ExamGecko
Login
Home / Amazon / SCS-C01 / List of questions
Ask Question

Amazon SCS-C01 Practice Test - Questions Answers, Page 38

List of questions

Question 371

Report
Export
Collapse


An application is designed to run on an EC2 Instance. The applications needs to work with an S3 bucket. From a security perspective , what is the ideal way for the EC2 instance/ application to be configured? Please select:

Use the AWS access keys ensuring that they are frequently rotated.
Use the AWS access keys ensuring that they are frequently rotated.
Assign an IAM user to the application that has specific access to only that S3 bucket
Assign an IAM user to the application that has specific access to only that S3 bucket
Assign an IAM Role and assign it to the EC2 Instance
Assign an IAM Role and assign it to the EC2 Instance
Assign an IAM group and assign it to the EC2 Instance
Assign an IAM group and assign it to the EC2 Instance
Suggested answer: C

Explanation:

The below diagram from the AWS whitepaper shows the best security practicse of allocating a role that has access to the S3 bucket

Amazon SCS-C01 image Question 371 explanation 7489 09162024005924000000

Options A,B and D are invalid because using users, groups or access keys is an invalid security practise when giving access to resources from other AWS resources.

For more information on the Security Best practices, please visit the following URL:

https://d1.awsstatic.com/whitepapers/Security/AWS Security Best Practices.pdlThe correct answer is: Assign an IAM Role and assign it to the EC2 Instance Submit yourFeedback/Queries to our Experts

asked 16/09/2024
Federico Miliacca
33 questions

Question 372

Report
Export
Collapse

Your company has an EC2 Instance hosted in AWS. This EC2 Instance hosts an application. Currently this application is experiencing a number of issues. You need to inspect the network packets to see what the type of error that is occurring? Which one of the below steps can help address this issue?

Please select:

Use the VPC Flow Logs.
Use the VPC Flow Logs.
Use a network monitoring tool provided by an AWS partner.
Use a network monitoring tool provided by an AWS partner.
Use another instance. Setup a port to "promiscuous mode" and sniff the traffic to analyze the packets. -
Use another instance. Setup a port to "promiscuous mode" and sniff the traffic to analyze the packets. -
Use Cloudwatch metric
Use Cloudwatch metric
Suggested answer: B
asked 16/09/2024
DMITRY Yunov
33 questions

Question 373

Report
Export
Collapse

Which of the below services can be integrated with the AWS Web application firewall service.

Choose 2 answers from the options given below

Please select:

AWS Cloudfront
AWS Cloudfront
AWS Lambda
AWS Lambda
AWS Application Load Balancer
AWS Application Load Balancer
AWS Classic Load Balancer
AWS Classic Load Balancer
Suggested answer: A, C

Explanation:

The AWS documentation mentions the following on the Application Load Balancer AWS WAF can be deployed on Amazon CloudFront and the Application Load Balancer (ALB). As part of Amazon CloudFront it car be part of your Content Distribution Network (CDN) protecting your resources and content at the Edge locations and as part of the Application Load Balancer it can protect your origin web servers running behind the ALBs. Options B and D are invalid because only Cloudfront and the Application Load Balancer services are supported by AWS WAF. For more information on the web application firewall please refer to the below URL:

https://aws.amazon.com/waf/faq;The correct answers are: AWS Cloudfront AWS Application Load BalancerSubmit your Feedback/Queries to our Experts

asked 16/09/2024
Nikolay Yankov
35 questions

Question 374

Report
Export
Collapse

A company hosts critical data in an S3 bucket. Even though they have assigned the appropriate permissions to the bucket, they are still worried about data deletion. What measures can be taken to restrict the risk of data deletion on the bucket. Choose 2 answers from the options given below Please select:

Enable versioning on the S3 bucket
Enable versioning on the S3 bucket
Enable data at rest for the objects in the bucket
Enable data at rest for the objects in the bucket
Enable MFA Delete in the bucket policy
Enable MFA Delete in the bucket policy
Enable data in transit for the objects in the bucket
Enable data in transit for the objects in the bucket
Suggested answer: A, C

Explanation:

One of the AWS Security blogs mentions the followinj

Versioning keeps multiple versions of an object in the same bucket. When you enable it on a bucket Amazon S3 automatically adds a unique version ID to every object stored in the bucket. At that point, a simple DELETE action does not permanently delete an object version; it merely associates a delete marker with the object. If you want to permanently delete an object version, you must specify its version ID in your DELETE request. You can add another layer of protection by enabling MFA Delete on a versioned bucket. Once you do so, you must provide your AWS accounts access keys and a valid code from the account's MFA device in order to permanently delete an object version or suspend or reactivate versioning on the bucket.

Option B is invalid because enabling encryption does not guarantee risk of data deletion.

Option D is invalid because this option does not guarantee risk of data deletion.

For more information on AWS S3 versioning and MFA please refer to the below URL:

https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/The correct answers are: Enable versioning on the S3 bucket Enable MFA Delete in the bucket policySubmit your Feedback/Queries to our Experts

asked 16/09/2024
Nagaretnam, Ravin
38 questions

Question 375

Report
Export
Collapse

You company has mandated that all data in AWS be encrypted at rest. How can you achieve this for EBS volumes? Choose 2 answers from the options given below Please select:

Use Windows bit locker for EBS volumes on Windows instances
Use Windows bit locker for EBS volumes on Windows instances
Use TrueEncrypt for EBS volumes on Linux instances
Use TrueEncrypt for EBS volumes on Linux instances
Use AWS Systems Manager to encrypt the existing EBS volumes
Use AWS Systems Manager to encrypt the existing EBS volumes
Boot EBS volume can be encrypted during launch without using custom AMI
Boot EBS volume can be encrypted during launch without using custom AMI
Suggested answer: A, B

Explanation:

EBS encryption can also be enabled when the volume is created and not for existing volumes. One can use existing tools for OS level encryption. Option C is incorrect.

AWS Systems Manager is a management service that helps you automatically collect software inventory, apply OS patches, create system images, and configure Windows and Linux operating systems. Option D is incorrect

You cannot choose to encrypt a non-encrypted boot volume on instance launch. To have encrypted boot volumes during launch , your custom AMI must have it's boot volume encrypted before launch. For more information on the Security Best practices, please visit the following URL:

.com/whit Security Practices.

The correct answers are: Use Windows bit locker for EBS volumes on Windows instances. Use TrueEncrypt for EBS volumes on Linux instances Submit your Feedback/Queries to our Experts

asked 16/09/2024
Adrien Gallais
38 questions

Question 376

Report
Export
Collapse

You are designing a connectivity solution between on-premises infrastructure and Amazon VPC. Your server's on-premises will be communicating with your VPC instances. You will be establishing IPSec tunnels over the internet. Yo will be using VPN gateways and terminating the IPsec tunnels on AWSsupported customer gateways. Which of the following objectives would you achieve by implementing an IPSec tunnel as outlined above? Choose 4 answers form the options below Please select:

End-to-end protection of data in transit
End-to-end protection of data in transit
End-to-end Identity authentication
End-to-end Identity authentication
Data encryption across the internet
Data encryption across the internet
Protection of data in transit over the Internet
Protection of data in transit over the Internet
Peer identity authentication between VPN gateway and customer gateway
Peer identity authentication between VPN gateway and customer gateway
Data integrity protection across the Internet
Data integrity protection across the Internet
Suggested answer: C, D, E, F

Explanation:

IPSec is a widely adopted protocol that can be used to provide end to end protection for data

asked 16/09/2024
Jorrit Meijer
40 questions

Question 377

Report
Export
Collapse

A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet with port 80 and a Database server in the private subnet with port 3306. The user is configuring a security group for the public subnet (WebSecGrp) and the private subnet (DBSecGrp). which of the below mentioned entries is required in the private subnet database security group DBSecGrp?

Please select:

Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp.
Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp.
Allow Inbound on port 3306 from source 20.0.0.0/16
Allow Inbound on port 3306 from source 20.0.0.0/16
Allow Outbound on port 3306 for Destination Web Server Security Group WebSecGrp.
Allow Outbound on port 3306 for Destination Web Server Security Group WebSecGrp.
Allow Outbound on port 80 for Destination NAT Instance IP
Allow Outbound on port 80 for Destination NAT Instance IP
Suggested answer: A

Explanation:

Since the Web server needs to talk to the database server on port 3306 that means that the database server should allow incoming traffic on port 3306. The below table from the aws documentation shows how the security groups should be set up.

Amazon SCS-C01 image Question 377 explanation 7495 09162024005924000000

Option B is invalid because you need to allow incoming access for the database server from the WebSecGrp security group. Options C and D are invalid because you need to allow Outbound traffic and not inbound traffic For more information on security groups please visit the below Link: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC Scenario2.html The correct answer is: Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp. Submit your Feedback/Queries to our Experts

asked 16/09/2024
Djordje Novakovic
36 questions

Question 378

Report
Export
Collapse

A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at Rest. If the user is supplying his own keys for encryption SSE-C, which of the below mentioned statements is true? Please select:

The user should use the same encryption key for all versions of the same object
The user should use the same encryption key for all versions of the same object
It is possible to have different encryption keys for different versions of the same object
It is possible to have different encryption keys for different versions of the same object
AWS S3 does not allow the user to upload his own keys for server side encryption
AWS S3 does not allow the user to upload his own keys for server side encryption
The SSE-C does not work when versioning is enabled
The SSE-C does not work when versioning is enabled
Suggested answer: B

Explanation:

.anaging your own encryption keys, y

You can encrypt the object and send it across to S3

Option A is invalid because ideally you should use different encryption keys

Option C is invalid because you can use you own encryption keys

Option D is invalid because encryption works even if versioning is enabled For more information on client side encryption please visit the below Link:

""Keys.html

https://docs.aws.ama2on.com/AmazonS3/latest/dev/UsingClientSideEncryption.htmlThe correct answer is: It is possible to have different encryption keys for different versions of thesame object Submit your Feedback/Queries to our Experts

asked 16/09/2024
Simon Sawal
31 questions

Question 379

Report
Export
Collapse

You are planning to use AWS Configto check the configuration of the resources in your AWS account.

You are planning on using an existing IAM role and using it for the AWS Config resource. Which of the following is required to ensure the AWS config service can work as required? Please select:

Ensure that there is a trust policy in place for the AWS Config service within the role
Ensure that there is a trust policy in place for the AWS Config service within the role
Ensure that there is a grant policy in place for the AWS Config service within the role
Ensure that there is a grant policy in place for the AWS Config service within the role
Ensure that there is a user policy in place for the AWS Config service within the role
Ensure that there is a user policy in place for the AWS Config service within the role
Ensure that there is a group policy in place for the AWS Config service within the role
Ensure that there is a group policy in place for the AWS Config service within the role
Suggested answer: A

Explanation:

Amazon SCS-C01 image Question 379 explanation 7497 09162024005924000000

Options B,C and D are invalid because you need to ensure a trust policy is in place and not a grant, user or group policy or more information on the IAM role permissions please visit the below Link:

https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.htmllThe correct answer is: Ensure that there is a trust policy in place for the AWS Config service withinthe roleSubmit your Feedback/Queries to our Experts

asked 16/09/2024
Aaaa ddsdss
22 questions

Question 380

Report
Export
Collapse

Your developer is using the KMS service and an assigned key in their Java program. They get the below error when running the code arn:aws:iam::113745388712:user/UserB is not authorized to perform: kms:DescribeKey Which of the following could help resolve the issue?

Please select:

Ensure that UserB is given the right IAM role to access the key
Ensure that UserB is given the right IAM role to access the key
Ensure that UserB is given the right permissions in the IAM policy
Ensure that UserB is given the right permissions in the IAM policy
Ensure that UserB is given the right permissions in the Key policy
Ensure that UserB is given the right permissions in the Key policy
Ensure that UserB is given the right permissions in the Bucket policy
Ensure that UserB is given the right permissions in the Bucket policy
Suggested answer: C

Explanation:

You need to ensure that UserB is given access via the Key

Amazon SCS-C01 image Question 380 explanation 7498 09162024005924000000

policy for the Key Option is invalid because you don't assign roles to IAM users For more information on Key policies please visit the below Link:

https://docs.aws.amazon.com/kms/latest/developerguide/key-poliThe correct answer is: Ensure that UserB is given the right permissions in the Key policy

asked 16/09/2024
Anirban Ganguly
48 questions
Total 590 questions
Go to page: of 59
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

A Security Administrator is configuring an Amazon S3 bucket and must meet the following security requirements: Encryption in transit Encryption at rest Logging of all object retrievals in AWS CloudTrail Which of the following meet these security requirements? (Choose three.)
A company is implementing new compliance requirements to meet customer needs. According to the new requirements the company must not use any Amazon RDS DB instances or DB clusters that lack encryption of the underlying storage. The company needs a solution that will generate an email alert when an unencrypted DB instance or DB cluster is created. The solution also must terminate the unencrypted DB instance or DB cluster. Which solution will meet these requirements in the MOST operationally efficient manner?
A company's cloud operations team is responsible for building effective security for AWS crossaccount access. The team asks a security engineer to help troubleshoot why some developers in the developer account (123456789012) in the developers group are not able to assume a cross-account role (ReadS3) into a production account (999999999999) to read the contents of an Amazon S3 bucket (productionapp). The two account policies are as follows: Which recommendations should the security engineer make to resolve this issue? (Select TWO.)
A Security Architect has been asked to review an existing security architecture and identify why the application servers cannot successfully initiate a connection to the database servers. The following summary describes the architecture: 1 An Application Load Balancer, an internet gateway, and a NAT gateway are configured in the public subnet 2. Database, application, and web servers are configured on three different private subnets. 3 The VPC has two route tables: one for the public subnet and one for all other subnets The route table for the public subnet has a 0 0 0 0/0 route to the internet gateway The route table for all other subnets has a 0 0.0.0/0 route to the NAT gateway. All private subnets can route to each other 4 Each subnet has a network ACL implemented that limits all inbound and outbound connectivity to only the required ports and protocols 5 There are 3 Security Groups (SGs) database application and web Each group limits all inbound and outbound connectivity to the minimum required Which of the following accurately reflects the access control mechanisms the Architect should verify1?
A company hosts an end user application on AWS Currently the company deploys the application on Amazon EC2 instances behind an Elastic Load Balancer The company wants to configure end-to-end encryption between the Elastic Load Balancer and the EC2 instances. Which solution will meet this requirement with the LEAST operational effort?
A company usesAWS Organizations to run workloads in multiple AWS accounts Currently the individual team members at the company access all Amazon EC2 instances remotely by using SSH or Remote Desktop Protocol (RDP) The company does not have any audit trails and security groups are occasionally open The company must secure access management and implement a centralized togging solution. Which solution will meet these requirements MOST securely?
A company has hired a third-party security auditor, and the auditor needs read-only access to all AWS resources and logs of all VPC records and events that have occurred on AWS. How can the company meet the auditor's requirements without comprising security in the AWS environment? Choose the correct answer from the options below Please select:
A company has several production AWS accounts and a central security AWS account. The security account is used for centralized monitoring and has IAM privileges to all resources in every corporate account. All of the company's Amazon S3 buckets are tagged with a value denoting the data classification of their contents. A Security Engineer is deploying a monitoring solution in the security account that will enforce bucket policy compliance. The system must monitor S3 buckets in all production accounts and confirm that any policy change is in accordance with the bucket's data classification. If any change is out of compliance; the Security team must be notified quickly. Which combination of actions would build the required solution? (Choose three.)
After multiple compromises of its Amazon EC2 instances, a company's Security Officer is mandating that memory dumps of compromised instances be captured for further analysis. A Security Engineer just received an EC2 abuse notification report from AWS stating that an EC2 instance running the most recent Windows Server 2019 Base AMI is compromised. How should the Security Engineer collect a memory dump of the EC2 instance for forensic analysis?
A company will store sensitive documents in three Amazon S3 buckets based on a data classification scheme of “Sensitive,” “Confidential,” and “Restricted.” The security solution must meet all of the following requirements: Each object must be encrypted using a unique key. Items that are stored in the “Restricted” bucket require two-factor authentication for decryption. AWS KMS must automatically rotate encryption keys annually. Which of the following meets these requirements?