🔍

SCS-C02 — questions

Page 15 of 16 · 307 total questions.

SCS-C02 Question 281

Single page →
Topic 1 · Question 281

A public subnet contains two Amazon EC2 instances. The subnet has a custom network ACL. A security engineer is designing a solution to improve the subnet security. The solution must allow outbound traffic to an internet service that uses TLS through port 443. The solution also must deny inbound traffic that is destined for MySQL port 3306. Which network ACL rule set meets these requirements?

  • AUse inbound rule 100 to allow traffic on TCP port 443. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
  • BUse inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port 443.
  • CUse inbound rule 100 to allow traffic on TCP port range 1024-65535. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
  • DUse inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port 443. Use outbound rule 100 to allow traffic on TCP port 443. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port 443. Use outbound rule 100 to allow traffic on TCP port 443.

SCS-C02 Question 282

Single page →
Topic 1 · Question 282

A company is migrating container workloads from a data center to Amazon Elastic Container Service (Amazon ECS) clusters. The company must implement a solution to detect potential threats in the workloads and to improve the security posture of the container clusters. Which solution will meet these requirements?

  • AConfigure Amazon Inspector on the VPC that is running the ECS clusters.
  • BEnable Amazon GuardDuty Runtime Monitoring on the ECS clusters. (correct answer)
  • CAudit Amazon ECS API access by using Amazon CloudWatch logs to identify unauthorized access.
  • DCreate container clusters in the same VPC. Use VPC flow logs to centrally monitor network traffic.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable Amazon GuardDuty Runtime Monitoring on the ECS clusters.

Explanation

Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. Amazon GuardDuty continuously monitors for threats and malicious activity.

SCS-C02 Question 283

Single page →
Topic 1 · Question 283

A security engineer needs to implement a solution to determine whether a company’s Amazon EC2 instances are being used to mine cryptocurrency. The solution must provide notifications of cryptocurrency-related activity to an Amazon Simple Notification Service (Amazon SNS) topic. Which solution will meet these requirements?

  • ACreate AWS Config custom rules by using Guard custom policy. Configure the AWS Config rules to detect when an EC2 instance queries a DNS domain name that is associated with cryptocurrency-related activity. Configure AWS Config to initiate alerts to the SNS topic.
  • BEnable Amazon GuardDuty. Create an Amazon EventBridge rule to send alerts to the SNS topic when GuardDuty creates a finding that is associated with cryptocurrency-related activity. (correct answer)
  • CEnable Amazon Inspector. Create an Amazon EventBridge rule to send alerts to the SNS topic when Amazon Inspector creates a finding that is associated with cryRtocurrency-related activity.
  • DEnable VPC flow logs. Send the flow logs to an Amazon S3 bucket. Set up a query in Amazon Athena to detect when an EC2 instance queries a DNS domain name that is associated with cryptocurrency-related activity. Configure the Athena query to initiate alerts to the SNS topic.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable Amazon GuardDuty. Create an Amazon EventBridge rule to send alerts to the SNS topic when GuardDuty creates a finding that is associated with cryptocurrency-related activity.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon GuardDuty continuously monitors for threats and malicious activity.

SCS-C02 Question 284

Single page →
Topic 1 · Question 284

A company controls user access by using IAM users and groups in AWS accounts across an organization in AWS Organizations. The company uses an external identity provider (IdP) for workforce single sign-on (SSO). The company needs to implement a solution to provide a single management portal to access accounts within the organization. The solution must support the external IdP as a federation source. Which solution will meet these requirements?

  • AEnable AWS IAM Identity Center. Specify the external IdP as the identity source. (correct answer)
  • BEnable federation with AWS Identity and Access Management (IAM). Specify the external IdP as the identity source.
  • CMigrate to Amazon Verified Permissions. Implement fine-grained access to AWS by using policy-based access control (PBAC).
  • DMigrate users to AWS Directory Service. Use AWS Control Tower to centralize security across the organization.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable AWS IAM Identity Center. Specify the external IdP as the identity source.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

SCS-C02 Question 285

Single page →
Topic 1 · Question 285

A company is implementing new compliance requirements to meet customer needs. According to the new requirements, the company must not use any Amazon RDS DB instances or DB clusters that lack encryption of the underlying storage. The company needs a solution that will generate an email alert when an unencrypted DB instance or DB cluster is created. The solution also must terminate the unencrypted DB instance or DB cluster. Which solution will meet these requirements in the MOST operationally efficient manner?

  • ACreate an AWS Config managed rule to detect unencrypted RDS storage. Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.
  • BCreate an AWS Config managed rule to detect unencrypted RDS storage. Configure a manual remediation action to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.
  • CCreate an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource. (correct answer)
  • DCreate an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to publish messages to an Amazon Simple Notification Service (Ama...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers.

SCS-C02 Question 286

Single page →
Topic 1 · Question 286

A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards. However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes. Which solution will meet this requirement in the MOST operationally efficient way?

  • AUse AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
  • BUse AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes. (correct answer)
  • CUse Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
  • DUse AWS Cloud Map to detect the configuration changes. Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 287

Single page →
Topic 1 · Question 287

A company uses AWS Organizations to manage an organization that consists of three workload OUs. Production, Development, and Testing. The company uses AWS CloudFormation templates to define and deploy workload infrastructure in AWS accounts that are associated with the OUs. Different SCPs are attached to each workload OU. The company successfully deployed a CloudFormation stack update to workloads in the Development OU and the Testing OU. When the company uses the same CloudFormation template to deploy the stack update in.an account in the Production OU, the update fails. The error message reports insufficient IAM permissions. What is the FIRST step that a security engineer should take to troubleshoot this issue?

  • AReview the AWS CloudTrail logs in the account in the Production OU. Search for any failed API calls from CloudFormation during the deployment attempt. (correct answer)
  • BRemove all the SCPs that are attached to the Production OU. Rerun the CloudFormation stack update to determine if the SCPs were preventing the CloudFormation API calls.
  • CConfirm that the role used by CloudFormation has sufficient permissions to create, update, and delete the resources that are referenced in the CloudFormation template.
  • DMake all the SCPs that are attached to the Production OU the same as the SCPs that are attached to the Testing OU.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Review the AWS CloudTrail logs in the account in the Production OU. Search for any failed API calls from CloudFormation during the deployment attempt.

Explanation

AWS CloudTrail records API activity for auditing and governance. AWS CloudFormation provisions infrastructure as code repeatably.

SCS-C02 Question 288

Single page →
Topic 1 · Question 288

A company hosts a web-based application that captures and stores sensitive data in an Amazon DynamoDB table. The company needs to implement a solution that provides end-to-end data protection and the ability to detect unauthorized data changes. Which solution will meet these requirements?

  • AUse an AWS Key Management Service (AWS KMS) customer managed key. Encrypt the data at rest.
  • BUse AWS Private Certificate Authority. Encrypt the data in transit.
  • CUse the DynamoDB Encryption Client. Use client-side encryption. Sign the table items. (correct answer)
  • DUse the AWS Encryption SDK. Use client-side encryption. Sign the table items.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the DynamoDB Encryption Client. Use client-side encryption. Sign the table items.

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling.

SCS-C02 Question 289

Single page →
Topic 1 · Question 289

A security engineer needs to implement a solution to determine whether a company’s Amazon EC2 instances are being used to mine cryptocurrency. The solution must provide notifications of cryptocurrency-related activity to an Amazon Simple Notification Service (Amazon SNS) topic. Which solution will meet these requirements?

  • ACreate AWS Config custom rules by using Guard custom policy. Configure the AWS Config rules to detect when an EC2 instance queries a DNS domain name that is associated with cryptocurrency-related activity. Configure AWS Config to initiate alerts to the SNS topic.
  • BEnable Amazon GuardDuty. Create an Amazon EventBridge rule to send alerts to the SNS topic when GuardDuty creates a finding that is associated with cryptocurrency-related activity. (correct answer)
  • CEnable Amazon Inspector. Create an Amazon EventBridge rule to send alerts to the SNS topic when Amazon Inspector creates a finding that is associated with cryRtocurrency-related activity.
  • DEnable VPC flow logs. Send the flow logs to an Amazon S3 bucket. Set up a query in Amazon Athena to detect when an EC2 instance queries a DNS domain name that is associated with cryptocurrency-related activity. Configure the Athena query to initiate alerts to the SNS topic.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable Amazon GuardDuty. Create an Amazon EventBridge rule to send alerts to the SNS topic when GuardDuty creates a finding that is associated with cryptocurrency-related activity.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon GuardDuty continuously monitors for threats and malicious activity.

SCS-C02 Question 290

Single page →
Topic 1 · Question 290

A company controls user access by using IAM users and groups in AWS accounts across an organization in AWS Organizations. The company uses an external identity provider (IdP) for workforce single sign-on (SSO). The company needs to implement a solution to provide a single management portal to access accounts within the organization. The solution must support the external IdP as a federation source. Which solution will meet these requirements?

  • AEnable AWS IAM Identity Center. Specify the external IdP as the identity source. (correct answer)
  • BEnable federation with AWS Identity and Access Management (IAM). Specify the external IdP as the identity source.
  • CMigrate to Amazon Verified Permissions. Implement fine-grained access to AWS by using policy-based access control (PBAC).
  • DMigrate users to AWS Directory Service. Use AWS Control Tower to centralize security across the organization.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable AWS IAM Identity Center. Specify the external IdP as the identity source.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

SCS-C02 Question 291

Single page →
Topic 1 · Question 291

A company must create annual snapshots of Amazon Elastic Block Store (Amazon EBS) volumes. The company must retain the snapshots for 10 years. The company will use AWS Key Management Service (AWS KMS) to encrypt the EBS volumes and snapshots. The encryption keys must be rotated automatically every year. Snapshots that were created in previous years must be readable after rotation of the encryption keys. Which type of KMS keys should the company use for encryption to meet these requirements?

  • AAsymmetric AWS managed KMS keys with key material created by AWS KMS
  • BSymmetric customer managed KMS keys with key material created by AWS KMS (correct answer)
  • CSymmetric customer managed KMS keys with custom imported key material
  • DAsymmetric AWS managed KMS keys with custom imported key material
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Symmetric customer managed KMS keys with key material created by AWS KMS

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SCS-C02 Question 292

Single page →
Topic 1 · Question 292

A company has hundreds of AWS accounts and uses AWS Organizations. The company plans to create many different IAM roles and policies for its product team, security team, and platform team. Some IAM policies will be shared across teams. A security engineer needs to implement a solution to logically group together the IAM roles of each team. The solution must allow only the platform team to delegate IAM permissions to AWS services. Which solution will meet these requirements?

  • ASet up an IAM path with the IAM roles for each team. Deploy an SCP that denies the iam:PassRole permission to all entities except the IAM path of the platform team. (correct answer)
  • BApply different tags for each team to the IAM roles. Deploy an SCP that denies the sts:AssumeRole permission to all entities except the roles of the platform team.
  • CApply different tags for each team to the IAM policies. Deploy an SCP that denies the iam:PassRole permission to all entities except the policies of the platform team.
  • DSet up an IAM path with the IAM roles for each team. Use IAM permissions boundaries to deny the sts:AssumeRole permission to the IAM roles for the product team and the security team.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set up an IAM path with the IAM roles for each team. Deploy an SCP that denies the iam:PassRole permission to all entities except the IAM path of the platform team.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Service Control Policies set guardrails on what accounts in an organization can do.

SCS-C02 Question 293

Single page →
Topic 1 · Question 293

A company’s developers are using AWS Lambda function URLs to invoke functions directly. The company must ensure that developers cannot configure or deploy unauthenticated functions in production accounts. The company wants to meet this requirement by using AWS Organizations. The solution must not require additional work for the developers. Which solution will meet these requirements?

  • ARequire the developers to configure all function URL to support cross-origin resource sharing (CORS) when the functions are called from a different domain.
  • BUse an AWS WAF delegated administrator account to view and block unauthenticated access to function URLs in production accounts, based on the OU of accounts that are using the functions.
  • CUse SCPs to allow all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions that have a lambda:FunctionUrlAuthType condition key value of AWS_IAM.
  • DUse SCPs to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions that have a lambda:FunctionUrlAuthType condition key value of NONE. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use SCPs to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions that have a lambda:FunctionUrlAuthType condition key value of NONE.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Service Control Policies set guardrails on what accounts in an organization can do. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 294

Single page →
Topic 1 · Question 294

A company is implementing new compliance requirements to meet customer needs. According to the new requirements, the company must not use any Amazon RDS DB instances or DB clusters that lack encryption of the underlying storage. The company needs a solution that will generate an email alert when an unencrypted DB instance or DB cluster is created. The solution also must terminate the unencrypted DB instance or DB cluster. Which solution will meet these requirements in the MOST operationally efficient manner?

  • ACreate an AWS Config managed rule to detect unencrypted RDS storage. Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.
  • BCreate an AWS Config managed rule to detect unencrypted RDS storage. Configure a manual remediation action to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.
  • CCreate an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource. (correct answer)
  • DCreate an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to publish messages to an Amazon Simple Notification Service (Ama...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers.

SCS-C02 Question 295

Single page →
Topic 1 · Question 295

A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards. However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes. Which solution will meet this requirement in the MOST operationally efficient way?

  • AUse AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
  • BUse AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes. (correct answer)
  • CUse Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
  • DUse AWS Cloud Map to detect the configuration changes. Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 296

Single page →
Topic 1 · Question 296

A company uses AWS Organizations to manage an organization that consists of three workload OUs. Production, Development, and Testing. The company uses AWS CloudFormation templates to define and deploy workload infrastructure in AWS accounts that are associated with the OUs. Different SCPs are attached to each workload OU. The company successfully deployed a CloudFormation stack update to workloads in the Development OU and the Testing OU. When the company uses the same CloudFormation template to deploy the stack update in.an account in the Production OU, the update fails. The error message reports insufficient IAM permissions. What is the FIRST step that a security engineer should take to troubleshoot this issue?

  • AReview the AWS CloudTrail logs in the account in the Production OU. Search for any failed API calls from CloudFormation during the deployment attempt. (correct answer)
  • BRemove all the SCPs that are attached to the Production OU. Rerun the CloudFormation stack update to determine if the SCPs were preventing the CloudFormation API calls.
  • CConfirm that the role used by CloudFormation has sufficient permissions to create, update, and delete the resources that are referenced in the CloudFormation template.
  • DMake all the SCPs that are attached to the Production OU the same as the SCPs that are attached to the Testing OU.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Review the AWS CloudTrail logs in the account in the Production OU. Search for any failed API calls from CloudFormation during the deployment attempt.

Explanation

AWS CloudTrail records API activity for auditing and governance. AWS CloudFormation provisions infrastructure as code repeatably.

SCS-C02 Question 297

Single page →
Topic 1 · Question 297

A company hosts a web-based application that captures and stores sensitive data in an Amazon DynamoDB table. The company needs to implement a solution that provides end-to-end data protection and the ability to detect unauthorized data changes. Which solution will meet these requirements?

  • AUse an AWS Key Management Service (AWS KMS) customer managed key. Encrypt the data at rest.
  • BUse AWS Private Certificate Authority. Encrypt the data in transit.
  • CUse the DynamoDB Encryption Client. Use client-side encryption. Sign the table items. (correct answer)
  • DUse the AWS Encryption SDK. Use client-side encryption. Sign the table items.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the DynamoDB Encryption Client. Use client-side encryption. Sign the table items.

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling.

SCS-C02 Question 298

Single page →
Topic 1 · Question 298

A security engineer has created an Amazon GuardDuty detector in several AWS accounts. The accounts are in an organization in AWS Organizations. The security engineer needs centralized visibility of the security findings from the detectors. Which solution will meet this requirement?

  • AConfigure Amazon CloudWatch Logs Insights.
  • BCreate an Amazon CloudWatch dashboard.
  • CConfigure AWS Security Hub integrations. (correct answer)
  • DQuery the findings by using Amazon Athena.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure AWS Security Hub integrations.

Explanation

AWS Security Hub centralizes security findings and compliance checks. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 299

Single page →
Topic 1 · Question 299

A company runs workloads on Amazon EC2 instances in VPCs. The EC2 instances make requests to Amazon S3 buckets through VPC endpoints. The company uses AWS Organizations to manage its AWS accounts. The company needs the requests from the EC2 instances to originate from the same VPC that the EC2 instance credentials were issued to. Which solution will meet this requirement?

  • ADeploy an SCP that includes the S3:* action with the “aws:SourceVpc”: “${aws:Ec2InstanceSourceVpc}” condition.
  • BEdit the VPC endpoints to include the S3:* action with the “aws:Ec2InstanceSourcePrivateIPv4”: “${aws:VpcSourceIp}” condition.
  • CLimit all actions in the S3 bucket policies by using the aws:SourceVpce condition key with the value of the allowed VPC endpoint.
  • DLimit all actions in the S3 bucket policies by using the aws:SourceVpc condition key with the value of the allowed VPC ID. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Limit all actions in the S3 bucket policies by using the aws:SourceVpc condition key with the value of the allowed VPC ID.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SCS-C02 Question 300

Single page →
Topic 1 · Question 300

A company uses Amazon Cognito for external user authentication for a web application. External users report that they can no longer log in to the application. What is the FIRST step that a security engineer should take to troubleshoot the problem?

  • AReview AWS CloudTrail logs to identify authentication errors that relate to Cognito users.
  • BUse AWS Identity and Access Management Access Analyzer to delete all unused IAM roles and users.
  • CReview any recent changes in Cognito configuration, IAM policies, and role trust policies to identify issues. (correct answer)
  • DWrite a script that uses CLI commands to reset all user passwords in the Cognito user pool.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Review any recent changes in Cognito configuration, IAM policies, and role trust policies to identify issues.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Amazon Cognito manages user sign-up, sign-in and federated identity for applications. AWS Config tracks resource configuration changes and evaluates compliance.

Showing questions 281–300 of 307 · Page 15 of 16