ExamGecko
Home / Amazon / SCS-C01 / List of questions
Ask Question

Amazon SCS-C01 Practice Test - Questions Answers, Page 38

List of questions

Question 371

Report
Export
Collapse


An application is designed to run on an EC2 Instance. The applications needs to work with an S3 bucket. From a security perspective , what is the ideal way for the EC2 instance/ application to be configured? Please select:

Use the AWS access keys ensuring that they are frequently rotated.
Use the AWS access keys ensuring that they are frequently rotated.
Assign an IAM user to the application that has specific access to only that S3 bucket
Assign an IAM user to the application that has specific access to only that S3 bucket
Assign an IAM Role and assign it to the EC2 Instance
Assign an IAM Role and assign it to the EC2 Instance
Assign an IAM group and assign it to the EC2 Instance
Assign an IAM group and assign it to the EC2 Instance
Suggested answer: C

Explanation:

The below diagram from the AWS whitepaper shows the best security practicse of allocating a role that has access to the S3 bucket

Amazon SCS-C01 image Question 371 explanation 7489 09162024005924000000

Options A,B and D are invalid because using users, groups or access keys is an invalid security practise when giving access to resources from other AWS resources.

For more information on the Security Best practices, please visit the following URL:

https://d1.awsstatic.com/whitepapers/Security/AWS Security Best Practices.pdlThe correct answer is: Assign an IAM Role and assign it to the EC2 Instance Submit yourFeedback/Queries to our Experts

asked 16/09/2024
Federico Miliacca
33 questions

Question 372

Report
Export
Collapse

Your company has an EC2 Instance hosted in AWS. This EC2 Instance hosts an application. Currently this application is experiencing a number of issues. You need to inspect the network packets to see what the type of error that is occurring? Which one of the below steps can help address this issue?

Please select:

Use the VPC Flow Logs.
Use the VPC Flow Logs.
Use a network monitoring tool provided by an AWS partner.
Use a network monitoring tool provided by an AWS partner.
Use another instance. Setup a port to "promiscuous mode" and sniff the traffic to analyze the packets. -
Use another instance. Setup a port to "promiscuous mode" and sniff the traffic to analyze the packets. -
Use Cloudwatch metric
Use Cloudwatch metric
Suggested answer: B
asked 16/09/2024
DMITRY Yunov
33 questions

Question 373

Report
Export
Collapse

Which of the below services can be integrated with the AWS Web application firewall service.

Choose 2 answers from the options given below

Please select:

AWS Cloudfront
AWS Cloudfront
AWS Lambda
AWS Lambda
AWS Application Load Balancer
AWS Application Load Balancer
AWS Classic Load Balancer
AWS Classic Load Balancer
Suggested answer: A, C

Explanation:

The AWS documentation mentions the following on the Application Load Balancer AWS WAF can be deployed on Amazon CloudFront and the Application Load Balancer (ALB). As part of Amazon CloudFront it car be part of your Content Distribution Network (CDN) protecting your resources and content at the Edge locations and as part of the Application Load Balancer it can protect your origin web servers running behind the ALBs. Options B and D are invalid because only Cloudfront and the Application Load Balancer services are supported by AWS WAF. For more information on the web application firewall please refer to the below URL:

https://aws.amazon.com/waf/faq;The correct answers are: AWS Cloudfront AWS Application Load BalancerSubmit your Feedback/Queries to our Experts

asked 16/09/2024
Nikolay Yankov
35 questions

Question 374

Report
Export
Collapse

A company hosts critical data in an S3 bucket. Even though they have assigned the appropriate permissions to the bucket, they are still worried about data deletion. What measures can be taken to restrict the risk of data deletion on the bucket. Choose 2 answers from the options given below Please select:

Enable versioning on the S3 bucket
Enable versioning on the S3 bucket
Enable data at rest for the objects in the bucket
Enable data at rest for the objects in the bucket
Enable MFA Delete in the bucket policy
Enable MFA Delete in the bucket policy
Enable data in transit for the objects in the bucket
Enable data in transit for the objects in the bucket
Suggested answer: A, C

Explanation:

One of the AWS Security blogs mentions the followinj

Versioning keeps multiple versions of an object in the same bucket. When you enable it on a bucket Amazon S3 automatically adds a unique version ID to every object stored in the bucket. At that point, a simple DELETE action does not permanently delete an object version; it merely associates a delete marker with the object. If you want to permanently delete an object version, you must specify its version ID in your DELETE request. You can add another layer of protection by enabling MFA Delete on a versioned bucket. Once you do so, you must provide your AWS accounts access keys and a valid code from the account's MFA device in order to permanently delete an object version or suspend or reactivate versioning on the bucket.

Option B is invalid because enabling encryption does not guarantee risk of data deletion.

Option D is invalid because this option does not guarantee risk of data deletion.

For more information on AWS S3 versioning and MFA please refer to the below URL:

https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/The correct answers are: Enable versioning on the S3 bucket Enable MFA Delete in the bucket policySubmit your Feedback/Queries to our Experts

asked 16/09/2024
Nagaretnam, Ravin
38 questions

Question 375

Report
Export
Collapse

You company has mandated that all data in AWS be encrypted at rest. How can you achieve this for EBS volumes? Choose 2 answers from the options given below Please select:

Use Windows bit locker for EBS volumes on Windows instances
Use Windows bit locker for EBS volumes on Windows instances
Use TrueEncrypt for EBS volumes on Linux instances
Use TrueEncrypt for EBS volumes on Linux instances
Use AWS Systems Manager to encrypt the existing EBS volumes
Use AWS Systems Manager to encrypt the existing EBS volumes
Boot EBS volume can be encrypted during launch without using custom AMI
Boot EBS volume can be encrypted during launch without using custom AMI
Suggested answer: A, B

Explanation:

EBS encryption can also be enabled when the volume is created and not for existing volumes. One can use existing tools for OS level encryption. Option C is incorrect.

AWS Systems Manager is a management service that helps you automatically collect software inventory, apply OS patches, create system images, and configure Windows and Linux operating systems. Option D is incorrect

You cannot choose to encrypt a non-encrypted boot volume on instance launch. To have encrypted boot volumes during launch , your custom AMI must have it's boot volume encrypted before launch. For more information on the Security Best practices, please visit the following URL:

.com/whit Security Practices.

The correct answers are: Use Windows bit locker for EBS volumes on Windows instances. Use TrueEncrypt for EBS volumes on Linux instances Submit your Feedback/Queries to our Experts

asked 16/09/2024
Adrien Gallais
38 questions

Question 376

Report
Export
Collapse

You are designing a connectivity solution between on-premises infrastructure and Amazon VPC. Your server's on-premises will be communicating with your VPC instances. You will be establishing IPSec tunnels over the internet. Yo will be using VPN gateways and terminating the IPsec tunnels on AWSsupported customer gateways. Which of the following objectives would you achieve by implementing an IPSec tunnel as outlined above? Choose 4 answers form the options below Please select:

End-to-end protection of data in transit
End-to-end protection of data in transit
End-to-end Identity authentication
End-to-end Identity authentication
Data encryption across the internet
Data encryption across the internet
Protection of data in transit over the Internet
Protection of data in transit over the Internet
Peer identity authentication between VPN gateway and customer gateway
Peer identity authentication between VPN gateway and customer gateway
Data integrity protection across the Internet
Data integrity protection across the Internet
Suggested answer: C, D, E, F

Explanation:

IPSec is a widely adopted protocol that can be used to provide end to end protection for data

asked 16/09/2024
Jorrit Meijer
40 questions

Question 377

Report
Export
Collapse

A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet with port 80 and a Database server in the private subnet with port 3306. The user is configuring a security group for the public subnet (WebSecGrp) and the private subnet (DBSecGrp). which of the below mentioned entries is required in the private subnet database security group DBSecGrp?

Please select:

Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp.
Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp.
Allow Inbound on port 3306 from source 20.0.0.0/16
Allow Inbound on port 3306 from source 20.0.0.0/16
Allow Outbound on port 3306 for Destination Web Server Security Group WebSecGrp.
Allow Outbound on port 3306 for Destination Web Server Security Group WebSecGrp.
Allow Outbound on port 80 for Destination NAT Instance IP
Allow Outbound on port 80 for Destination NAT Instance IP
Suggested answer: A

Explanation:

Since the Web server needs to talk to the database server on port 3306 that means that the database server should allow incoming traffic on port 3306. The below table from the aws documentation shows how the security groups should be set up.

Amazon SCS-C01 image Question 377 explanation 7495 09162024005924000000

Option B is invalid because you need to allow incoming access for the database server from the WebSecGrp security group. Options C and D are invalid because you need to allow Outbound traffic and not inbound traffic For more information on security groups please visit the below Link: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC Scenario2.html The correct answer is: Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp. Submit your Feedback/Queries to our Experts

asked 16/09/2024
Djordje Novakovic
36 questions

Question 378

Report
Export
Collapse

A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at Rest. If the user is supplying his own keys for encryption SSE-C, which of the below mentioned statements is true? Please select:

The user should use the same encryption key for all versions of the same object
The user should use the same encryption key for all versions of the same object
It is possible to have different encryption keys for different versions of the same object
It is possible to have different encryption keys for different versions of the same object
AWS S3 does not allow the user to upload his own keys for server side encryption
AWS S3 does not allow the user to upload his own keys for server side encryption
The SSE-C does not work when versioning is enabled
The SSE-C does not work when versioning is enabled
Suggested answer: B

Explanation:

.anaging your own encryption keys, y

You can encrypt the object and send it across to S3

Option A is invalid because ideally you should use different encryption keys

Option C is invalid because you can use you own encryption keys

Option D is invalid because encryption works even if versioning is enabled For more information on client side encryption please visit the below Link:

""Keys.html

https://docs.aws.ama2on.com/AmazonS3/latest/dev/UsingClientSideEncryption.htmlThe correct answer is: It is possible to have different encryption keys for different versions of thesame object Submit your Feedback/Queries to our Experts

asked 16/09/2024
Simon Sawal
31 questions

Question 379

Report
Export
Collapse

You are planning to use AWS Configto check the configuration of the resources in your AWS account.

You are planning on using an existing IAM role and using it for the AWS Config resource. Which of the following is required to ensure the AWS config service can work as required? Please select:

Ensure that there is a trust policy in place for the AWS Config service within the role
Ensure that there is a trust policy in place for the AWS Config service within the role
Ensure that there is a grant policy in place for the AWS Config service within the role
Ensure that there is a grant policy in place for the AWS Config service within the role
Ensure that there is a user policy in place for the AWS Config service within the role
Ensure that there is a user policy in place for the AWS Config service within the role
Ensure that there is a group policy in place for the AWS Config service within the role
Ensure that there is a group policy in place for the AWS Config service within the role
Suggested answer: A

Explanation:

Amazon SCS-C01 image Question 379 explanation 7497 09162024005924000000

Options B,C and D are invalid because you need to ensure a trust policy is in place and not a grant, user or group policy or more information on the IAM role permissions please visit the below Link:

https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.htmllThe correct answer is: Ensure that there is a trust policy in place for the AWS Config service withinthe roleSubmit your Feedback/Queries to our Experts

asked 16/09/2024
Aaaa ddsdss
22 questions

Question 380

Report
Export
Collapse

Your developer is using the KMS service and an assigned key in their Java program. They get the below error when running the code arn:aws:iam::113745388712:user/UserB is not authorized to perform: kms:DescribeKey Which of the following could help resolve the issue?

Please select:

Ensure that UserB is given the right IAM role to access the key
Ensure that UserB is given the right IAM role to access the key
Ensure that UserB is given the right permissions in the IAM policy
Ensure that UserB is given the right permissions in the IAM policy
Ensure that UserB is given the right permissions in the Key policy
Ensure that UserB is given the right permissions in the Key policy
Ensure that UserB is given the right permissions in the Bucket policy
Ensure that UserB is given the right permissions in the Bucket policy
Suggested answer: C

Explanation:

You need to ensure that UserB is given access via the Key

Amazon SCS-C01 image Question 380 explanation 7498 09162024005924000000

policy for the Key Option is invalid because you don't assign roles to IAM users For more information on Key policies please visit the below Link:

https://docs.aws.amazon.com/kms/latest/developerguide/key-poliThe correct answer is: Ensure that UserB is given the right permissions in the Key policy

asked 16/09/2024
Anirban Ganguly
48 questions
Total 590 questions
Go to page: of 59
Search

Related questions