You currently have an S3 bucket hosted in an AWS Account. It holds information that needs be accessed by a partner account. Which is the MOST secure way to allow the partner account to access the S3 bucket in your account? Select 3 options.Please select:

Ensure an IAM role is created which can be assumed by the partner account.

Ensure the partner uses an external id when making the request

Provide the ARN for the role to the partner account

Ensure an IAM role is created which can be assumed by the partner account.

Ensure an IAM user is created which can be assumed by the partner account.

Ensure the partner uses an external id when making the request

Provide the ARN for the role to the partner account

Provide the Account Id to the partner account

Provide access keys for your account to the partner account

Your company has created a set of keys using the AWS KMS service. They need to ensure that each key is only used for certain services. For example , they want one key to be used only for the S3 service. How can this be achieved? Please select:

Use the kms:ViaService condition in the Key policy

Create an IAM policy that allows the key to be accessed by only the S3 service.

Create a bucket policy that allows the key to be accessed by only the S3 service.

Use the kms:ViaService condition in the Key policy

Define an IAM user, allocate the key and then assign the permissions to the required service

You have a set of Customer keys created using the AWS KMS service. These keys have been used for around 6 months. You are now trying to use the new KMS features for the existing set of key's but are not able to do so. What could be the reason for this.Please select:

You have not explicitly given access via the key policy

You have not explicitly given access via the IAM policy

You have not given access via the IAM roles

You have not explicitly given access via IAM users

You are planning on hosting a web application on AWS. You create an EC2 Instance in a public subnet. This instance needs to connect to an EC2 Instance that will host an Oracle database. Which of the following steps should be followed to ensure a secure setup is in place? Select 2 answers. Please select:

Place the EC2 Instance with the Oracle database in a separate private subnet

Create a database security group and ensure the web security group to allowed incoming access

Place the EC2 Instance with the Oracle database in the same public subnet as the Web server for faster communication

Place the EC2 Instance with the Oracle database in a separate private subnet

Create a database security group and ensure the web security group to allowed incoming access

Ensure the database security group allows incoming traffic from 0.0.0.0/0

An EC2 Instance hosts a Java based application that access a DynamoDB table. This EC2 Instance is currently serving production based users. Which of the following is a secure way of ensuring that the EC2 Instance access the Dynamo table Please select:

Use IAM Roles with permissions to interact with DynamoDB and assign it to the EC2 Instance

Use KMS keys with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

Use IAM Access Keys with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

Use IAM Access Groups with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

An application running on EC2 instances processes sensitive information stored on Amazon S3. The information is accessed over the Internet. The security team is concerned that the Internet connectivity to Amazon S3 is a security risk. Which solution will resolve the security concern?Please select:

Access the data through a VPC endpoint for Amazon S3

Access the data through an Internet Gateway.

Access the data through a VPN connection.

Access the data through a NAT Gateway.

Access the data through a VPC endpoint for Amazon S3

Development teams in your organization use S3 buckets to store the log files for various applications hosted ir development environments in AWS. The developers want to keep the logs for one month for troubleshooting purposes, and then purge the logs. What feature will enable this requirement?Please select:

Configuring lifecycle configuration rules on the S3 bucket.

Adding a bucket policy on the S3 bucket.

Configuring lifecycle configuration rules on the S3 bucket.

Creating an IAM policy for the S3 bucket.

Enabling CORS on the S3 bucket.

A company is using a Redshift cluster to store their data warehouse. There is a requirement from the Internal IT Security team to ensure that data gets encrypted for the Redshift database. How can this be achieved? Please select:

Use AWS KMS Customer Default master key

Encrypt the EBS volumes of the underlying EC2 Instances

Use AWS KMS Customer Default master key

Use SSL/TLS for encrypting the data

A company has resources hosted in their AWS Account. There is a requirement to monitor all API activity for all regions. The audit needs to be applied for future regions as well. Which of the following can be used to fulfil this requirement. Please select:

Ensure one Cloudtrail trail is enabled for all regions.

Ensure Cloudtrail for each region. Then enable for each future region.

Ensure one Cloudtrail trail is enabled for all regions.

Create a Cloudtrail for each region. Use Cloudformation to enable the trail for all future regions.

Create a Cloudtrail for each region. Use AWS Config to enable the trail for all future regions.

A customer has an instance hosted in the AWS Public Cloud. The VPC and subnet used to host the Instance have been created with the default settings for the Network Access Control Lists. They need to provide an IT Administrator secure access to the underlying instance. How can this be accomplished.Please select:

Ensure that the security group allows Inbound SSH traffic from the IT Administrator's Workstation

Ensure the Network Access Control Lists allow Inbound SSH traffic from the IT Administrator's Workstation

Ensure the Network Access Control Lists allow Outbound SSH traffic from the IT Administrator's Workstation

Ensure that the security group allows Inbound SSH traffic from the IT Administrator's Workstation

Ensure that the security group allows Outbound SSH traffic from the IT Administrator's Workstation

A company is planning to run a number of Admin related scripts using the AWS Lambda service.There is a need to understand if there are any errors encountered when the script run. How can this be accomplished in the most effective manner. Please select:

Use Cloudwatch metrics and logs to watch for errors

Use Cloudtrail to monitor for errors

Use the AWS Config service to monitor for errors

Use the AWS inspector service to monitor for errors

A company hosts data in S3. There is now a mandate that going forward all data in the S3 bucket needs to encrypt at rest. How can this be achieved? Please select:

Enable server side encryption on the S3 bucket

Use AWS Access keys to encrypt the data

Use SSL certificates to encrypt the data

Enable server side encryption on the S3 bucket

You have a set of application , database and web servers hosted in AWS. The web servers are placed behind an ELB. There are separate security groups for the application, database and web servers. The network security groups have been defined accordingly. There is an issue with the communication between the application and database servers. In order to troubleshoot the issue between just the application and database server, what is the ideal set of MINIMAL steps you would take?Please select:

Check the Inbound security rules for the database security group Check the Outbound security rules for the application security group

Check the Outbound security rules for the database security groupI Check the inbound security rules for the application security group

Check the both the Inbound and Outbound security rules for the database security group Check the inbound security rules for the application security group

Check the Outbound security rules for the database security groupCheck the both the Inbound and Outbound security rules for the application security group

Your company has a requirement to work with a DynamoDB table. There is a security mandate that all data should be encrypted at rest. What is the easiest way to accomplish this for DynamoDB. Please select:

Encrypt the DynamoDB table using KMS during its creation

Use the AWS SDK to encrypt the data before sending it to the DynamoDB table

Encrypt the DynamoDB table using KMS during its creation

Encrypt the table using AWS KMS after it is created

Use S3 buckets to encrypt the data before sending it to DynamoDB

Your company hosts critical data in an S3 bucket. There is a requirement to ensure that all data is encrypted. There is also metadata about the information stored in the bucket that needs to be encrypted as well. Which of the below measures would you take to ensure that the metadata is encrypted?Please select:

Put the metadata in a DynamoDB table and ensure the table is encrypted during creation time.

Put the metadata as metadata for each object in the S3 bucket and then enable S3 Server side encryption.

Put the metadata as metadata for each object in the S3 bucket and then enable S3 Server KMS encryption.

Put the metadata in a DynamoDB table and ensure the table is encrypted during creation time.

Put thp metadata in thp S3 hurkpf itself.

One of the EC2 Instances in your company has been compromised. What steps would you take to ensure that you could apply digital forensics on the Instance. Select 2 answers from the options given below Please select:

Create a separate forensic instance

Ensure that the security groups only allow communication to this forensic instance

Remove the role applied to the Ec2 Instance

Create a separate forensic instance

Ensure that the security groups only allow communication to this forensic instance

One of your company's EC2 Instances have been compromised. The company has strict po thorough investigation on finding the culprit for the security breach. What would you do in from the options given below. Please select:

Take a snapshot of the EBS volume

Isolate the machine from the network

Make sure that logs are stored securely for auditing and troubleshooting purpose

Take a snapshot of the EBS volume

Isolate the machine from the network

Make sure that logs are stored securely for auditing and troubleshooting purpose

Ensure all passwords for all IAM users are changed

Ensure that all access kevs are rotated.

Your company has a set of EC2 Instances that are placed behind an ELB. Some of the applications hosted on these instances communicate via a legacy protocol. There is a security mandate that all traffic between the client and the EC2 Instances need to be secure. How would you accomplish this?Please select:

Use a Classic Load balancer and terminate the SSL connection at the EC2 Instances

Use an Application Load balancer and terminate the SSL connection at the ELB

Use a Classic Load balancer and terminate the SSL connection at the ELB

Use an Application Load balancer and terminate the SSL connection at the EC2 Instances

Use a Classic Load balancer and terminate the SSL connection at the EC2 Instances

A company has set up the following structure to ensure that their S3 buckets always have logging enabled If there are any changes to the configuration to an S3 bucket, a config rule gets checked. If logging is disabled , then Lambda function is invoked. This Lambda function will again enable logging on the S3 bucket. Now there is an issue being encoutered with the entire flow. You have verified that the Lambda function is being invoked. But when logging is disabled for the bucket, the lambda function does not enable it again. Which of the following could be an issue Please select:

The AWS Lambda function does not have appropriate permissions for the bucket

The AWS Config rule is not configured properly

The AWS Lambda function does not have appropriate permissions for the bucket

The AWS Lambda function should use Node.js instead of python.

You need to also use the API gateway to invoke the lambda function

Your company has a set of EC2 Instances defined in AWS. They need to ensure that all traffic packets are monitored and inspected for any security threats. How can this be achieved? Choose 2 answers from the options given below Please select:

Use a host based intrusion detection system

Use a third party firewall installed on a central EC2 instance

Use a host based intrusion detection system

Use a third party firewall installed on a central EC2 instance

Use Network Access control lists logging

Your company has a set of EBS volumes defined in AWS. The security mandate is that all EBS volumes are encrypted. What can be done to notify the IT admin staff if there are any unencrypted volumes in the account. Please select:

Use AWS Config to check for unencrypted EBS volumes

Use AWS Inspector to inspect all the EBS volumes

Use AWS Config to check for unencrypted EBS volumes

Use AWS Guard duty to check for the unencrypted EBS volumes

Use AWS Lambda to check for the unencrypted EBS volumes

Your company use AWS KMS for management of its customer keys. From time to time, there is a requirement to delete existing keys as part of housekeeping activities. What can be done during the deletion process to verify that the key is no longer being used.Please select:

Use CloudTrail to see if any KMS API request has been issued against existing keys

Use Key policies to see the access level for the keys

Rotate the keys once before deletion to see if other services are using the keys

Change the IAM policy for the keys to see if other services are using the keys

You have a bucket and a VPC defined in AWS. You need to ensure that the bucket can only be accessed by the VPC endpoint. How can you accomplish this? Please select:

Modify the bucket Policy for the bucket to allow access for the VPC endpoint

Modify the security groups for the VPC to allow access to the 53 bucket

Modify the route tables to allow access for the VPC endpoint

Modify the IAM Policy for the bucket to allow access for the VPC endpoint

Modify the bucket Policy for the bucket to allow access for the VPC endpoint

Which of the following is the responsibility of the customer? Choose 2 answers from the options given below. Please select:

Management of the Edge locations

Decommissioning of old storage devices

A Devops team is currently looking at the security aspect of their CI/CD pipeline. They are making use of AWS resource? for their infrastructure. They want to ensure that the EC2 Instances don't have any high security vulnerabilities. They want to ensure a complete DevSecOps process. How can this be achieved?Please select:

Use AWS Inspector API's in the pipeline for the EC2 Instances

Use AWS Config to check the state of the EC2 instance for any sort of security issues.

Use AWS Inspector API's in the pipeline for the EC2 Instances

Use AWS Trusted Advisor API's in the pipeline for the EC2 Instances

Use AWS Security Groups to ensure no vulnerabilities are present

You want to track access requests for a particular S3 bucket. How can you achieve this in the easiest possible way? Please select:

Enable server access logging for the bucket

Enable Cloudwatch metrics for the bucket

Enable Cloudwatch logs for the bucket

Enable AWS Config for the S3 bucket

Your company has just started using AWS and created an AWS account. They are aware of the potential issues when root access is enabled. How can they best safeguard the account when it comes to root access? Choose 2 answers fro the options given below Please select:

Create an Admin IAM user with the necessary permissions

Change the password for the root account.

You need to create a Linux EC2 instance in AWS. Which of the following steps is used to ensure secure authentication the EC2 instance from a windows machine. Choose 2 answers from the options given below. Please select:

Use the private key to log into the instance

Ensure to create a strong password for logging into the EC2 Instance

Use the private key to log into the instance

Ensure the password is passed securely using SSL

You have just developed a new mobile application that handles analytics workloads on large scale datasets that are stored on Amazon Redshift. Consequently, the application needs to access Amazon Redshift tables. Which of the belov methods would be the best both practically and security-wise, to access the tables? Choose the correct answer from the options below Please select:

Use roles that allow a web identity federated user to assume a role that allows access to the Redshift table by providing temporary credentials.

Create an IAM user and generate encryption keys for that user. Create a policy for Redshift readonly access. Embed th keys in the application.

Create an HSM client certificate in Redshift and authenticate using this certificate.

Create a Redshift read-only access policy in IAM and embed those credentials in the application.

Use roles that allow a web identity federated user to assume a role that allows access to the Redshift table by providing temporary credentials.

Your application currently use AWS Cognito for authenticating users. Your application consists of different types of users. Some users are only allowed read access to the application and others are given contributor access. How wou you manage the access effectively?Please select:

Create different cognito groups, one for the readers and the other for the contributors.

Create different cognito endpoints, one for the readers and the other for the contributors.

Create different cognito groups, one for the readers and the other for the contributors.

You need to manage this within the application itself

This needs to be managed via Web security tokens

DDoS attacks that happen at the application layer commonly target web applications with lower volumes of traffic compared to infrastructure attacks. To mitigate these types of attacks, you should probably want to include a WAF (Web Application Firewall) as part of your infrastructure. To inspect all HTTP requests, WAFs sit in-line with your application traffic. Unfortunately, this creates a scenario where WAFs can become a point of failure or bottleneck. To mitigate this problem, you need the ability to run multiple WAFs on demand during traffic spikes. This type of scaling for WAF is done via a "WAF sandwich." Which of the following statements best describes what a "WAF sandwich" is? Choose the correct answer from the options belowPlease select:

The EC2 instance running your WAF software is included in an Auto Scaling group and placed in between two Elastic load balancers.

The EC2 instance running your WAF software is placed between your private subnets and any NATed connections to the internet.

The EC2 instance running your WAF software is placed between your public subnets and your Internet Gateway.

The EC2 instance running your WAF software is placed between your public subnets and your private subnets.

The EC2 instance running your WAF software is included in an Auto Scaling group and placed in between two Elastic load balancers.

A company has hired a third-party security auditor, and the auditor needs read-only access to all AWS resources and logs of all VPC records and events that have occurred on AWS. How can the company meet the auditor's requirements without comprising security in the AWS environment? Choose the correct answer from the options below Please select:

Enable CloudTrail logging and create an IAM user who has read-only permissions to the required AWS resources, including the bucket containing the CloudTrail logs.

Create a role that has the required permissions for the auditor.

Create an SNS notification that sends the CloudTrail log files to the auditor's email when CIoudTrail delivers the logs to S3, but do not allow the auditor access to the AWS environment.

The company should contact AWS as part of the shared responsibility model, and AWS will grant required access to th^ third-party auditor.

Enable CloudTrail logging and create an IAM user who has read-only permissions to the required AWS resources, including the bucket containing the CloudTrail logs.

An auditor needs access to logs that record all API events on AWS. The auditor only needs read-only access to the log files and does not need access to each AWS account. The company has multiple AWS accounts, and the auditor needs access to all the logs for all the accounts. What is the best way to configure access for the auditor to view event logs from all accounts? Choose the correct answer from the options below Please select:

Configure the CloudTrail service in each AWS account and have the logs delivered to a single AWS bucket in the primary account and erant the auditor access to that single bucket in the orimarv account.

Configure the CloudTrail service in each AWS account, and have the logs delivered to an AWS bucket on each account, while granting the auditor permissions to the bucket via roles in the secondary accounts and a single primary IAM account that can assume a read-only role in the secondary AWS accounts.

Configure the CloudTrail service in the primary AWS account and configure consolidated billing for all the secondary accounts. Then grant the auditor access to the S3 bucket that receives the CloudTrail log files.

Configure the CloudTrail service in each AWS account and enable consolidated logging inside of CloudTrail.

Configure the CloudTrail service in each AWS account and have the logs delivered to a single AWS bucket in the primary account and erant the auditor access to that single bucket in the orimarv account.

Your company has a hybrid environment, with on-premise servers and servers hosted in the AWS cloud. They are planning to use the Systems Manager for patching servers. Which of the following is a pre-requisite for this to work; Please select:

Ensure that an IAM service role is created

Ensure that the on-premise servers are running on Hyper-V.

Ensure that an IAM service role is created

Ensure that an IAM User is created

Ensure that an IAM Group is created for the on-premise servers

Amazon SCS-C01 Practice Test 9 - Free Online Exam Prep & Questions

You have a requirement to conduct penetration testing on the AWS Cloud for a couple of EC2 Instances. How could you go about doing this? Choose 2 right answers from the options given below. Please select:

Become a Premium Member for full access

Unlock Premium Member

Amazon SCS-C01 Practice Test 9

Question

Amazon SCS-C01 Practice Tests

Practice Tests