Amazon SCS-C01 Practice Test - Questions Answers, Page 38

The AWS documentation mentions the following on the Application Load Balancer AWS WAF can be deployed on Amazon CloudFront and the Application Load Balancer (ALB). As part of Amazon CloudFront it car be part of your Content Distribution Network (CDN) protecting your resources and content at the Edge locations and as part of the Application Load Balancer it can protect your origin web servers running behind the ALBs. Options B and D are invalid because only Cloudfront and the Application Load Balancer services are supported by AWS WAF. For more information on the web application firewall please refer to the below URL:

https://aws.amazon.com/waf/faq;The correct answers are: AWS Cloudfront AWS Application Load BalancerSubmit your Feedback/Queries to our Experts

One of the AWS Security blogs mentions the followinj

Versioning keeps multiple versions of an object in the same bucket. When you enable it on a bucket Amazon S3 automatically adds a unique version ID to every object stored in the bucket. At that point, a simple DELETE action does not permanently delete an object version; it merely associates a delete marker with the object. If you want to permanently delete an object version, you must specify its version ID in your DELETE request. You can add another layer of protection by enabling MFA Delete on a versioned bucket. Once you do so, you must provide your AWS accounts access keys and a valid code from the account's MFA device in order to permanently delete an object version or suspend or reactivate versioning on the bucket.

Option B is invalid because enabling encryption does not guarantee risk of data deletion.

Option D is invalid because this option does not guarantee risk of data deletion.

For more information on AWS S3 versioning and MFA please refer to the below URL:

https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/The correct answers are: Enable versioning on the S3 bucket Enable MFA Delete in the bucket policySubmit your Feedback/Queries to our Experts

EBS encryption can also be enabled when the volume is created and not for existing volumes. One can use existing tools for OS level encryption. Option C is incorrect.

AWS Systems Manager is a management service that helps you automatically collect software inventory, apply OS patches, create system images, and configure Windows and Linux operating systems. Option D is incorrect

You cannot choose to encrypt a non-encrypted boot volume on instance launch. To have encrypted boot volumes during launch , your custom AMI must have it's boot volume encrypted before launch. For more information on the Security Best practices, please visit the following URL:

.com/whit Security Practices.

The correct answers are: Use Windows bit locker for EBS volumes on Windows instances. Use TrueEncrypt for EBS volumes on Linux instances Submit your Feedback/Queries to our Experts

IPSec is a widely adopted protocol that can be used to provide end to end protection for data

Since the Web server needs to talk to the database server on port 3306 that means that the database server should allow incoming traffic on port 3306. The below table from the aws documentation shows how the security groups should be set up.

Option B is invalid because you need to allow incoming access for the database server from the WebSecGrp security group. Options C and D are invalid because you need to allow Outbound traffic and not inbound traffic For more information on security groups please visit the below Link: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC Scenario2.html The correct answer is: Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp. Submit your Feedback/Queries to our Experts

.anaging your own encryption keys, y

You can encrypt the object and send it across to S3

Option A is invalid because ideally you should use different encryption keys

Option C is invalid because you can use you own encryption keys

Option D is invalid because encryption works even if versioning is enabled For more information on client side encryption please visit the below Link:

""Keys.html

https://docs.aws.ama2on.com/AmazonS3/latest/dev/UsingClientSideEncryption.htmlThe correct answer is: It is possible to have different encryption keys for different versions of thesame object Submit your Feedback/Queries to our Experts

Options B,C and D are invalid because you need to ensure a trust policy is in place and not a grant, user or group policy or more information on the IAM role permissions please visit the below Link:

https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.htmllThe correct answer is: Ensure that there is a trust policy in place for the AWS Config service withinthe roleSubmit your Feedback/Queries to our Experts

You need to ensure that UserB is given access via the Key

policy for the Key Option is invalid because you don't assign roles to IAM users For more information on Key policies please visit the below Link:

https://docs.aws.amazon.com/kms/latest/developerguide/key-poliThe correct answer is: Ensure that UserB is given the right permissions in the Key policy