🔍

SCS-C02 — questions

Page 12 of 16 · 307 total questions.

SCS-C02 Question 221

Single page →
Topic 1 · Question 221

A company is migrating its Amazon EC2 based applications to use Instance Metadata Service Version 2 (IMDSv2). A security engineer needs to determine whether any of the EC2 instances are still using Instance Metadata Service Version 1 (IMDSv1). What should the security engineer do to confirm that the IMDSv1 endpoint is no longer being used?

  • AConfigure logging on the Amazon CloudWatch agent for IMDSv1 as part of EC2 instance startup. Create a metric filter and a CloudWatch dashboard. Track the metric in the dashboard.
  • BCreate an Amazon CloudWatch dashboard. Verify that the EC2:MetadataNoToken metric is zero across all EC2 instances. Monitor the dashboard. (correct answer)
  • CCreate a security group that blocks access to HTTP for the IMDSv1 endpoint. Attach the security group to all EC2 instances.
  • DConfigure user data scripts for all EC2 instances to send logging information to AWS CloudTrail when IMDSV1 is used. Create a metric filter and an Amazon CloudWatch dashboard. Track the metric in the dashboard.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Amazon CloudWatch dashboard. Verify that the EC2:MetadataNoToken metric is zero across all EC2 instances. Monitor the dashboard.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SCS-C02 Question 222

Single page →
Topic 1 · Question 222

A company is planning to create an organization by using AWS Organizations. The company needs to integrate user management with the company’s external identity provider (IdP). The company also needs to centrally manage access to all of its AWS accounts and applications from the organization’s management account. Which solution will meet these requirements?

  • AConfigure AWS Directory Service with the external IdP. Create IAM policies and associate them with users from the external IdP.
  • BEnable AWS IAM Identity Center and use the external IdP as the identity source. Create permission sets and account assignments by using IAM Identity Center. (correct answer)
  • CConfigure AWS Identity and Access Management (IAM) to use the external IdP as an IdP. Create IAM policies and associate them with users from the external IdP.
  • DEnable Amazon Cognito in the organization’s management account. Create an identity pool and associate it with the external IdP. Create IAM roles and associate them with the identity pool.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable AWS IAM Identity Center and use the external IdP as the identity source. Create permission sets and account assignments by using IAM Identity Center.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

SCS-C02 Question 223

Single page →
Topic 1 · Question 223

A company uses Amazon Elastic Container Registry (Amazon ECR) as the repository for its production applications. A security engineer must implement an automated solution to report any vulnerabilities that ECR enhanced scanning detects. The solution must provide notification of vulnerability findings in an instant message to the company’s Slack account Which solution will meet these requirements with the MOST operational efficiency?

  • AActivate Amazon Inspector scans for the ECR repository. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure an AWS Chatbot client for Slack that consumes the SNS topic. Create an Amazon EventBridge rule for Amazon Inspector findings. Specify the SNS topic as the target for the rule. (correct answer)
  • BActivate Amazon Inspector scans for the ECR repository. Write a script to use AWS CLI commands to retrieve image scan findings from Amazon Inspector. Configure the script to send the findings to a Slack endpoint. Launch an Amazon EC2 instance to run the script.
  • CActivate Amazon Inspector scans for the ECR repository. Create an AWS Step Functions state machine. Set a first step in the state machine to call the Amazon Inspector ListFindings API operation. Create an Amazon Simple Notification Service (Amazon SNS) topic with Slack as the target. Add a second step in the state machine to call the Amazon SNS Publish API operation.
  • DActivate AWS Security Hub scans for the ECR repository. Create a custom action in Security Hub for findings. Define an Amazon EventBridge rule for the custom action. Configure the EventBridge rule to redirect the findings to a Slack channel.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Activate Amazon Inspector scans for the ECR repository. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure an AWS Chatbot client for Slack that consumes the SNS topic. Create an Amazon EventBri...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon Inspector automatically scans workloads for software vulnerabilities.

SCS-C02 Question 224

Single page →
Topic 1 · Question 224

A company uses AWS Config rules to identify Amazon S3 buckets that are not compliant with the company’s data protection policy. The S3 buckets are hosted in several AWS Regions and several AWS accounts. The accounts are in an organization in AWS Organizations. The company needs a solution to remediate the organization’s existing noncompliant S3 buckets and any noncompliant S3 buckets that are created in the future. Which solution will meet these requirements?

  • ADeploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets. (correct answer)
  • BDeploy an AWS Config aggregator with organization-wide resource data aggregation. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
  • CDeploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
  • DDeploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 225

Single page →
Topic 1 · Question 225

A company’s engineering team is developing a new application that creates AWS Key Management Service (AWS KMS) customer managed key grants for users. Immediately after a grant is created, users must be able to use the KMS key to encrypt a 512-byte payload. During load testing, AccessDeniedException errors occur occasionally when a user first attempts to use the key to encrypt. Which solution should the company’s security specialist recommend to eliminate these AccessDeniedException errors?

  • AInstruct users to implement a retry mechanism every 2 minutes until the call succeeds.
  • BInstruct the engineering team to consume a random grant token from users and to call the CreateGrant operation by passing the grant token to the operation. Instruct users to use that grant token in their call to encrypt.
  • CInstruct the engineering team to create a random name for the grant when calling the CreateGrant operation. Return the name to the users and instruct them to provide the name as the grant token in the call to encrypt.
  • DInstruct the engineering team to pass the grant token returned in the CreateGrant response to users. Instruct users to use that grant token in their call to encrypt. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. Instruct users to use that grant token in their call to encrypt.

SCS-C02 Question 226

Single page →
Topic 1 · Question 226

A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent. A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The security engineer must implement a rule statement as part of the web ACL to block the requests. The rule statement must mitigate the current attack and future attacks from these IoT devices without blocking requests from customers. Which rule statement will meet these requirements?

  • AUse an IP set match rule statement that includes the IP address for IoT devices from the user agent.
  • BUse a geographic match rule statement. Configure the statement to block countries that the IoT devices are located in.
  • CUse a rate-based rule statement. Set a rate limit that is equal to the number of requests that are coming from the IoT devices.
  • DUse a string match rule statement that includes details of the IoT device brand from the user agent. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use a string match rule statement that includes details of the IoT device brand from the user agent.

SCS-C02 Question 227

Single page →
Topic 1 · Question 227

A company has configured a gateway VPC endpoint in a VPC. Only Amazon EC2 instances that reside in a single subnet in the VPC can use the endpoint. The company has modified the route table for this single subnet to route traffic to Amazon S3 through the gateway VPC endpoint. The VPC provides internet access through an internet gateway. A security engineer attempts to use instance profile credentials from an EC2 instance to retrieve an object from the S3 bucket, but the attempt fails. The security engineer verifies that the EC2 instance has an IAM instance profile with the correct permissions to access the S3 bucket and to retrieve objects. The security engineer also verifies that the S3 bucket policy is allowing access properly. Additionally, the security engineer verifies that the EC2 instance’s security group and the subnet's network ACLs allow the communication. What else should the security engineer check to determine why the request from the EC2 instance is failing?

  • AVerify that the EC2 instance’s security group does not have an implicit inbound deny rule for Amazon S3.
  • BVerify that the VPC endpoint’s security group does not have an explicit inbound deny rule for the EC2 instance.
  • CVerify that the internet gateway is allowing traffic to Amazon S3.
  • DVerify that the VPC endpoint policy is allowing access to Amazon S3. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Verify that the VPC endpoint policy is allowing access to Amazon S3.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

SCS-C02 Question 228

Single page →
Topic 1 · Question 228

A security administrator is restricting the capabilities of company root user accounts. The company uses AWS Organizations and has all features enabled. The management account is used for billing and administrative purposes, but it is not used for operational AWS resource purposes. How can the security administrator restrict usage of member root user accounts across the organization?

  • ADisable the use of the root user account at the organizational root. Enable multi-factor authentication (MFA) of the root user account for each organization member account.
  • BConfigure IAM user policies to restrict root account capabilities for each organization member account.
  • CCreate an OU in Organizations, and attach an SCP that controls usage of the root user. Add all member accounts to the new OU. (correct answer)
  • DConfigure AWS CloudTrail to integrate with Amazon CloudWatch Logs. Create a metric filter for RootAccountUsage.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an OU in Organizations, and attach an SCP that controls usage of the root user. Add all member accounts to the new OU.

Explanation

AWS Organizations centrally governs and secures multiple AWS accounts. Service Control Policies set guardrails on what accounts in an organization can do.

SCS-C02 Question 229

Single page →
Topic 1 · Question 229

A company wants to start processing sensitive data on Amazon EC2 instances. The company will use Amazon CloudWatch Logs to monitor, store, and access log files from the EC2 instances. The company’s developers use CloudWatch Logs for troubleshooting. A security engineer must implement a solution that prevents the developers from viewing the sensitive data. The solution must automatically apply to any new log groups that are created in the account in the future. Which solution will meet these requirements?

  • ACreate a CloudWatch Logs account-wide data protection policy. Specify the appropriate data identifiers for the policy. Ensure that the developers do not have the logs:Unmask IAM permission. (correct answer)
  • BExport the CloudWatch Logs data to an Amazon S3 bucket. Set up automated discovery by using Amazon Macie on the S3 bucket. Create a custom data identifier for the sensitive data. Remove the developers’ access to CloudWatch Logs. Grant permissions for the developers to view the exported log data in Amazon S3.
  • CExport the CloudWatch Logs data to an Amazon S3 bucket. Set up automated discovery by using Amazon Macie on the S3 bucket. Specify the appropriate managed data identifiers. Remove the developers’ access to CloudWatch Logs. Grant permissions for the developers to view the exported log data in Amazon S3.
  • DCreate a CloudWatch Logs data protection policy for each log group. Specify the appropriate data identifiers for the policy. Ensure that the developers do not have the logs:Unmask IAM permission.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a CloudWatch Logs account-wide data protection policy. Specify the appropriate data identifiers for the policy. Ensure that the developers do not have the logs:Unmask IAM permission.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SCS-C02 Question 230

Single page →
Topic 1 · Question 230

A security engineer needs to implement a solution to identify any sensitive data that is stored in an Amazon S3 bucket. The solution must report on sensitive data in the S3 bucket by using an existing Amazon Simple Notification Service (Amazon SNS) topic. Which solution will meet these requirements with the LEAST implementation effort?

  • AEnable AWS Config. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.
  • BCreate an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern. Program the Lambda function to send notifications to the SNS topic.
  • CConfigure Amazon Macie to use managed data identifiers to identify and categorize sensitive data. Create an Amazon EventBridge rule to send notifications to the SNS topic. (correct answer)
  • DEnable Amazon GuardDuty. Configure AWS CloudTrail S3 data events. Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data. Create an Amazon EventBridge rule to send notifications to the SNS topic.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon Macie discovers and protects sensitive data such as PII in S3.

SCS-C02 Question 231

Single page →
Topic 1 · Question 231

A company has an application on Amazon EC2 instances that store confidential customer data. The company must restrict access to customer data. A security engineer requires secure access to the instances that host the application. According to company policy, users must not open any inbound ports, maintain bastion hosts, or manage SSH keys for the EC2 instances. The security engineer wants to monitor, store, and access all session activity logs. The logs must be encrypted. Which solution will meet these requirements?

  • AUse AWS Control Tower to connect to the EC2 instances. Configure Amazon CloudWatch logging for the sessions. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.
  • BUse AWS Security Hub to connect to the EC2 instances. Configure Amazon CloudWatch logging for the sessions. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.
  • CUse AWS Systems Manager Session Manager to connect to the EC2 instances. Configure Amazon CloudWatch monitoring to record the sessions. Select the store session logs option for the desired CloudWatch Logs log groups.
  • DUse AWS Systems Manager Session Manager to connect to the EC2 instances. Configure Amazon CloudWatch logging. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS Systems Manager Session Manager to connect to the EC2 instances. Configure Amazon CloudWatch logging. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 232

Single page →
Topic 1 · Question 232

A company uses an organization in AWS Organizations to help separate its Amazon EC2 instances and VPCs. The company has separate OUs for development workloads and production workloads. A security engineer must ensure that only AWS accounts in the production OU can write VPC flow logs to an Amazon S3 bucket. The security engineer is configuring the S3 bucket policy with a Condition element to allow the s3:PutObject action for VPC flow logs. How should the security engineer configure the Condition element to meet these requirements?

  • ASet the value of the aws:SourceOrgID condition key to be the organization ID.
  • BSet the value of the aws:SourceOrgPaths condition key to be the Organizations entity path of the production OU. (correct answer)
  • CSet the value of the aws:ResourceOrgID condition key to be the organization ID.
  • DSet the value of the aws:ResourceOrgPaths condition key to be the Organizations entity path of the production OU.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Set the value of the aws:SourceOrgPaths condition key to be the Organizations entity path of the production OU.

Explanation

AWS Organizations centrally governs and secures multiple AWS accounts.

SCS-C02 Question 233

Single page →
Topic 1 · Question 233 · Select all that apply

Amazon CloudWatch Logs agent is successfully delivering logs to the CloudWatch Logs service. However, logs stop being delivered after the associated log stream has been active for a specific number of hours. What steps are necessary to identify the cause of this phenomenon? (Choose two.)

  • AEnsure that file permissions for monitored files that allow the CloudWatch Logs agent to read the file have not been modified. (correct answer)
  • BVerify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming. (correct answer)
  • CConfigure an Amazon Kinesis producer to first put the logs into Amazon Kinesis Streams.
  • DCreate a CloudWatch Logs metric to isolate a value that changes at least once during the period before logging stops.
  • EUse AWS CloudFormation to dynamically create and maintain the configuration file for the CloudWatch Logs agent.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Ensure that file permissions for monitored files that allow the CloudWatch Logs agent to read the file have not been modified. Option B: Verify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming.

Explanation

Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 234

Single page →
Topic 1 · Question 234 · Select all that apply

A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. The security engineer has provisioned each Availability Zone with one private subnet and one public subnet. The security engineer has created three route tables for use with the environment. One route table is for the public subnets, and two route tables are for the private subnets (one route table for the private subnet in each Availability Zone). The security engineer discovers that all four subnets are attempting to route traffic out through the internet gateway that is attached to the VPC. Which combination of steps should the security engineer take to remediate this scenario? (Choose two.)

  • AVerify that a NAT gateway has been provisioned in the public subnet in each Availability Zone. (correct answer)
  • BVerify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.
  • CModify the route tables that are associated with each of the public subnets. Create a new route for local destinations to the VPC CIDR range.
  • DModify the route tables that are associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the NAT gateway in the public subnet of the same Availability Zone as the target of the route. (correct answer)
  • EModify the route tables that are associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the internet gateway in the public subnet of the same Availability Zone as the target of the route.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone. Option D: Modify the route tables that are associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the NAT gateway in the public subnet of the same Availability Zone as the target...

Explanation

A NAT gateway lets private subnet resources reach the internet for outbound traffic only.

SCS-C02 Question 235

Single page →
Topic 1 · Question 235

A company hired an external consultant who needs to use a laptop to access the company’s VPCs. Specifically, the consultant needs access to two VPCs that are peered together in the same AWS Region. The company wants to provide the consultant with access to these VPCs without also providing any unnecessary access to other network resources. Which solution will meet these requirements?

  • ACreate an AWS Site-to-Site VPN endpoint in the same Region as the VPCs. Configure access through an appropriate subnet and authorization rule.
  • BCreate an AWS account. Use the VPC sharing feature through AWS Resource Access Manager to allow the consultant to access the VPCs.
  • CCreate an AWS Client VPN endpoint in the same Region as the VPCs. Configure access through an appropriate subnet and authorization rule. (correct answer)
  • DCreate a gateway VPC endpoint in the same Region as the VPCs. Configure access through an appropriate subnet and authorization rule.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an AWS Client VPN endpoint in the same Region as the VPCs. Configure access through an appropriate subnet and authorization rule.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 236

Single page →
Topic 1 · Question 236

A company uses AWS Organizations to manage a small number of AWS accounts. However, the company plans to add 1,000 more accounts soon. The company allows only a centralized security team to create IAM roles for all AWS accounts and teams. Application teams submit requests for IAM roles to the security team. The security team has a backlog of IAM role requests and cannot review and provision the IAM roles quickly. The security team must create a process that will allow application teams to provision their own IAM roles. The process must also limit the scope of IAM roles and prevent privilege escalation. Which solution will meet these requirements with the LEAST operational overhead?

  • ACreate an IAM group for each application team. Associate policies with each IAM group. Provision IAM users for each application team member. Add the new IAM users to the appropriate IAM group by using role-based access control (RBAC).
  • BDelegate application team leads to provision IAM roles for each team. Conduct a quarterly review of the IAM roles the team leads have provisioned. Ensure that the application team leads have the appropriate training to review IAM roles.
  • CPut each AWS account in its own OU. Add an SCP to each OU to grant access to only the AWS services that the teams plan to use. Include conditions in the AWS account of each team.
  • DCreate an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that only roles that have the permissions boundary attached can create any new IAM roles. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that only roles that have the permissions boundary attached can create any new IAM roles.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Service Control Policies set guardrails on what accounts in an organization can do.

SCS-C02 Question 237

Single page →
Topic 1 · Question 237

A developer is receiving AccessDenied errors when the developer invokes API calls to AWS services from a workstation. The developer previously configured environment variables and configuration files on the workstation to use multiple roles with other AWS accounts. A security engineer needs to help the developer configure authentication. The current credentials must be evaluated without conflicting with other credentials that were previously configured on the workstation. Where these credentials should be configured to meet this requirement?

  • AIn the local AWS CLI configuration file
  • BAs environment variables on the local workstation
  • CAs variables in the AWS CLI command line options (correct answer)
  • DIn the AWS shared configuration file
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: As variables in the AWS CLI command line options.

SCS-C02 Question 238

Single page →
Topic 1 · Question 238 · Select all that apply

A medical company recently completed an acquisition and inherited an existing AWS environment. The company has an upcoming audit and is concerned about the compliance posture of its acquisition. The company must identify personal health information inside Amazon S3 buckets and must identify S3 buckets that are publicly accessible. The company needs to prepare for the audit by collecting evidence in the environment. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

  • AEnable Amazon Macie. Run an on-demand sensitive data discovery job that uses the PERSONAL_INFORMATION managed data identifier. (correct answer)
  • BUse AWS Glue with the Detect PII transform to identify sensitive data and to mask the sensitive data.
  • CEnable AWS Audit Manager. Create an assessment by using a supported framework. (correct answer)
  • DEnable Amazon GuardDuty S3 Protection. Document any findings that are related to suspicious access of S3 buckets.
  • EEnable AWS Security Hub. Use the AWS Foundational Security Best Practices standard. Review the controls dashboard for evidence of failed S3 Block Public Access controls. (correct answer)
  • FEnable AWS Config. Set up the s3-bucket-public-write-prohibited AWS Config managed rule.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Enable Amazon Macie. Run an on-demand sensitive data discovery job that uses the PERSONAL_INFORMATION managed data identifier. Option C: Enable AWS Audit Manager. Create an assessment by using a supported framework. Option E: Enable AWS Security Hub. Use the AWS Foundational Security Best Practices standard. Review the controls dashboard for evidence of failed S3 Block Public Access controls.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Macie discovers and protects sensitive data such as PII in S3. AWS Security Hub centralizes security findings and compliance checks.

SCS-C02 Question 239

Single page →
Topic 1 · Question 239 · Select all that apply

A company finds that one of its Amazon EC2 instances suddenly has a high CPU usage. The company does not know whether the EC2 instance is compromised or whether the operating system is performing background cleanup. Which combination of steps should a security engineer take before investigating the issue? (Choose three.)

  • ADisable termination protection for the EC2 instance if termination protection has not been disabled.
  • BEnable termination protection for the EC2 instance if termination protection has not been enabled. (correct answer)
  • CTake snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance. (correct answer)
  • DRemove all snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
  • ECapture the EC2 instance metadata, and then tag the EC2 instance as under quarantine. (correct answer)
  • FImmediately remove any entries in the EC2 instance metadata that contain sensitive information.
Reveal answer & explanation
Correct answer: B, C, E

The correct answer is B, C, E. Option B: Enable termination protection for the EC2 instance if termination protection has not been enabled. Option C: Take snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance. Option E: Capture the EC2 instance metadata, and then tag the EC2 instance as under quarantine.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon EBS provides block storage attached to a single EC2 instance.

SCS-C02 Question 240

Single page →
Topic 1 · Question 240

A company is implementing a customized notification solution to detect repeated unauthorized authentication attempts to bastion hosts. The company’s security engineer needs to implement a solution that will provide notification when 5 failed attempts occur within a 5-minute period. The solution must use native AWS services and must notify only the designated system administrator who is assigned to the specific bastion host. Which solution will meet these requirements?

  • AUse the Amazon CloudWatch agent to collect operating system logs. Use Amazon EventBridge to configure an alarm based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Service (Amazon SNS) when the defined threshold for the alarm is exceeded. Use Amazon EC2 instance tags to determine which SNS topics receive notifications.
  • BUse AWS Systems Manager Agent to collect operating system logs. Use the Systems Manager Run Command AWS-ConfigureCloudWatch document to configure an Amazon EventBridge event based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Service (Amazon SNS) when the defined threshold for the alarm is exceeded. Use SNS messaging filters to control who receives notifications.
  • CUse the Amazon CloudWatch agent to collect operating system logs. Create a CloudWatch alarm based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Servige (Amazon SNS) when the defined threshold for the alarm is exceeded. Use SNS messaging filters to control who receives notifications. (correct answer)
  • DUse AWS Systems Manager Agent to collect operating system logs. Use the Systems Manager Run Command AWS-ConfigureCloudWatch document to configure an Amazon CloudWatch alarm based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Service (Amazon SNS) when the defined threshold for the alarm is exceeded. Use EC2 instance tags to determine which SNS topics receive notifications.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the Amazon CloudWatch agent to collect operating system logs. Create a CloudWatch alarm based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Servige (Amazon SNS) when the...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

Showing questions 221–240 of 307 · Page 12 of 16