🔍

SCS-C02 — questions

Page 16 of 16 · 307 total questions.

SCS-C02 Question 301

Single page →
Topic 1 · Question 301 · Select all that apply

A company is running its application on AWS. Malicious users exploited a recent promotion event and created many fake accounts. The application currently uses Amazon CloudFront in front of an Amazon API Gateway API. AWS Lambda functions serve the different API endpoints. The GET registration endpoint is behind the path of /store/registration. The URI for submission of the new account details is at /store/newaccount. A security engineer needs to design a solution that prevents similar exploitations for future promotion events. Which combination of steps will meet these requirements? (Choose two.)

  • ACreate an AWS WAF web ACL. Add the AWSManagedRulesACFPRuleSet rule group to the web ACL. Associate the web ACL with the CloudFront distribution. (correct answer)
  • BCreate an AWS WAF web ACL. Add a rate limit rule to the web ACL. Include a RateBasedStatement entry that has a SearchString value that points to /store/registration. (correct answer)
  • CSpecify /store/registration as the registration page path. Specify /store/newaccount as the account creation path.
  • DEnable AWS Shield Advanced for the account that hosts the CloudFront distribution. Configure a DNS-specific custom mitigation that uses the Shield Response Team (SRT) for /store/newaccount.
  • EEnable Amazon GuardDuty for the account that hosts the CloudFront distribution. Enable Lambda Protection for the Lambda functions that answer calls to /store/registration and /store/newaccount.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Create an AWS WAF web ACL. Add the AWSManagedRulesACFPRuleSet rule group to the web ACL. Associate the web ACL with the CloudFront distribution. Option B: Create an AWS WAF web ACL. Add a rate limit rule to the web ACL. Include a RateBasedStatement entry that has a SearchString value that points to /store/registration.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS WAF protects web applications from common exploits and malicious requests.

SCS-C02 Question 302

Single page →
Topic 1 · Question 302

A company is investigating an increase in its AWS monthly bill. The company discovers that bad actors compromised some Amazon EC2 instances and served webpages for a large email phishing campaign. A security engineer must implement a solution to monitor for cost increases in the future to help detect malicious activity. Which solution will offer the company the EARLIEST detection of cost increases?

  • ACreate an Amazon EventBridge rule that invokes an AWS Lambda function hourly. Program the Lambda function to download an AWS usage report from AWS Data Exports about usage of all services. Program the Lambda function to analyze the report and to send a notification when anomalies are detected.
  • BCreate a cost monitor in AWS Cost Anomaly Detection. Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage above the expected cost exceeds a threshold. (correct answer)
  • CReview AWS Cost Explorer daily to detect anomalies in cost from prior months. Review the usage of any services that experience a significant cost increase from prior months.
  • DCapture VPC flow logs from the VPC where the EC2 instances run. Use a third-party network analysis tool to analyze the flow logs and to detect anomalies in network traffic that might increase cost.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a cost monitor in AWS Cost Anomaly Detection. Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage above the expected cost exceeds a threshold.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 303

Single page →
Topic 1 · Question 303

A company’s network security policy requires encryption for all data in transit. The company must encrypt data that is sent between Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes. Which solution will meet this requirement?

  • AConfigure Amazon EC2 to enable encryption in the EC2 network interface properties.
  • BConfigure Amazon EBS to enable volume encryption with AWS Key Management Service (AWS KMS) for data at rest. (correct answer)
  • CConfigure Amazon EBS to enable TLS encryption in the volume configuration properties.
  • DConfigure Amazon EC2 to enable TLS encryption with certificates that are stored in AWS Certificate Manager (ACM).
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure Amazon EBS to enable volume encryption with AWS Key Management Service (AWS KMS) for data at rest.

Explanation

Amazon EBS provides block storage attached to a single EC2 instance. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 304

Single page →
Topic 1 · Question 304

A company runs a web application on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are in the same VPC subnet as other workloads. A security engineer deploys an Amazon GuardDuty detector in the same AWS Region as the EC2 instances. The security engineer also sets up an AWS Security Hub integration with GuardDuty. The security engineer needs to implement an automated solution to detect and appropriately respond to anomalous traffic patterns for the web application. The solution must comply with AWS best practices for initial response to security incidents and must minimize disruption to the web application. Which solution will meet these requirements?

  • ACreate an Amazon EventBridge rule that detects the Behavior:EC2/TrafficVolumeUnusual GuardDuty finding. Configure the rule to invoke an AWS Lambda function to disable the EC2 instance profile access keys.
  • BCreate an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic. Program the Lambda function to disassociate the identified instance from the Auto Scaling group and to isolate the instance by using a new restricted security group. (correct answer)
  • CCreate a Security Hub automated response that updates the network ACL that is associated with the subnet of the EC2 instances. Configure the response to update the network ACL to deny traffic from the source of detected anomalous traffic.
  • DCreate an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security engineer’s email address to the SNS topic. Configure GuardDuty to send all findings to the SNS topic.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic. Program the Lambda function to disassociate the identified instance from the Auto Scaling group and to is...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SCS-C02 Question 305

Single page →
Topic 1 · Question 305

A company has an application that needs to read objects from an Amazon S3 bucket. The company configures an IAM policy and attaches the policy to an IAM role that the application uses. When the application tries to read objects from the S3 bucket, the application receives AccessDenied errors. A security engineer must resolve this problem without decreasing the security of the S3 bucket or the application. Which solution will meet these requirements?

  • AAttach a resource policy to the S3 bucket to grant read access to the role.
  • BLaunch a new deployment of the application in a different AWS Region. Attach the role to the application.
  • CReview the IAM policy by using AWS Identity and Access Management Access Analyzer to ensure that the policy grants the right permissions. Validate that the application is assuming the role correctly. (correct answer)
  • DEnsure that the S3 Block Public Access feature is disabled on the S3 bucket. Review AWS CloudTrail logs to validate that the application is assuming the role correctly.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Review the IAM policy by using AWS Identity and Access Management Access Analyzer to ensure that the policy grants the right permissions. Validate that the application is assuming the role correctly.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SCS-C02 Question 306

Single page →
Topic 1 · Question 306

A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running in Amazon Elastic Container Service (Amazon ECS). This solution will also handle volatile traffic patterns. Which solution would have the MOST scalability and LOWEST latency?

  • AConfigure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
  • BConfigure an Application Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
  • CConfigure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers. (correct answer)
  • DConfigure Amazon Route 53 to use multivalue answer routing to send traffic to the containers.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers.

Explanation

A Network Load Balancer handles very high throughput TCP/UDP traffic with ultra-low latency and static IPs. A load balancer distributes traffic across targets in multiple AZs for availability and scale. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 307

Single page →
Topic 1 · Question 307

A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application. The application processes sensitive data and has the following compliance requirements: • No remote access management ports to the EC2 instances can be exposed internally or externally. • All remote session activity must be recorded in an audit log. • All remote access to the EC2 instances must be authenticated and authorized by AWS IAM Identity Center. The company’s DevOps team occasionally needs to connect to one of the EC2 instances to troubleshoot issues. Which solution will provide remote access to the EC2 instances while meeting the compliance requirements?

  • AGrant access to the EC2 serial console at the account level. Create an IAM policy that allows an IAM role of the DevOps team to access the EC2 serial console.
  • BEnable EC2 instance Connect on the AMI of the EC2 instances. Configure the appropriate security group rules. Grant EC2 console access to the DevOps team for access to EC2 instance Connect.
  • CAssign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy that grants access to Systems Manager Session Manager. Assign the policy to an IAM role of the DevOps team. (correct answer)
  • DUse AWS Systems Manager Automation runbooks to open remote access ports to the EC2 instances. Attach a role to the EC2 instances to allow the runbooks to run.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Assign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy that grants access to Systems Manager Session Manager. Assign the policy to an IAM role of the DevOps team.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

Showing questions 301–307 of 307 · Page 16 of 16