SCS-C02 — questions

Page 4 of 16 · 307 total questions.

SCS-C02 Question 61

Single page →

Topic 1 · Question 61 · Select all that apply

A company accidentally deleted the private key for an Amazon Elastic Block Store (Amazon EBS)-backed Amazon EC2 instance. A security engineer needs to regain access to the instance. Which combination of steps will meet this requirement? (Choose two.)

AStop the instance. Detach the root volume. Generate a new key pair. (correct answer)
BKeep the instance running. Detach the root volume. Generate a new key pair.
CWhen the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance. Start the instance. (correct answer)
DWhen the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new private key. Move the volume back to the original instance. Start the instance.
EWhen the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance that is running.

Reveal answer & explanation

Correct answer: A, C

The correct answer is A, C. Option A: Stop the instance. Detach the root volume. Generate a new key pair. Option C: When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance. Sta...

SCS-C02 Question 62

Single page →

Topic 1 · Question 62

A company purchased a subscription to a third-party cloud security scanning solution that integrates with AWS Security Hub. A security engineer needs to implement a solution that will remediate the findings from the third-party scanning solution automatically. Which solution will meet this requirement?

ASet up an Amazon EventBridge rule that reacts to new Security Hub findings. Configure an AWS Lambda function as the target for the rule to remediate the findings. (correct answer)
BSet up a custom action in Security Hub. Configure the custom action to call AWS Systems Manager Automation runbooks to remediate the findings.
CSet up a custom action in Security Hub. Configure an AWS Lambda function as the target for the custom action to remediate the findings.
DSet up AWS Config rules to use AWS Systems Manager Automation runbooks to remediate the findings.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Set up an Amazon EventBridge rule that reacts to new Security Hub findings. Configure an AWS Lambda function as the target for the rule to remediate the findings.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Security Hub centralizes security findings and compliance checks.

SCS-C02 Question 63

Single page →

Topic 1 · Question 63

An application is running on an Amazon EC2 instance that has an IAM role attached. The IAM role provides access to an AWS Key Management Service (AWS KMS) customer managed key and an Amazon S3 bucket. The key is used to access 2 TB of sensitive data that is stored in the S3 bucket. A security engineer discovers a potential vulnerability on the EC2 instance that could result in the compromise of the sensitive data. Due to other critical operations, the security engineer cannot immediately shut down the EC2 instance for vulnerability patching. What is the FASTEST way to prevent the sensitive data from being exposed?

ADownload the data from the existing S3 bucket to a new EC2 instance. Then delete the data from the S3 bucket. Re-encrypt the data with a client-based key. Upload the data to a new S3 bucket.
BBlock access to the public range of S3 endpoint IP addresses by using a host-based firewall. Ensure that internet-bound traffic from the affected EC2 instance is routed through the host-based firewall.
CRevoke the IAM role's active session permissions. Update the S3 bucket policy to deny access to the IAM role. Remove the IAM role from the EC2 instance profile. (correct answer)
DDisable the current key. Create a new KMS key that the IAM role does not have access to, and re-encrypt all the data with the new key. Schedule the compromised key for deletion.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Revoke the IAM role's active session permissions. Update the S3 bucket policy to deny access to the IAM role. Remove the IAM role from the EC2 instance profile.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials.

SCS-C02 Question 64

Single page →

Topic 1 · Question 64

A company is building an application on AWS that will store sensitive information. The company has a support team with access to the IT infrastructure, including databases. The company’s security engineer must introduce measures to protect the sensitive data against any data breach while minimizing management overhead. The credentials must be regularly rotated. What should the security engineer recommend?

AEnable Amazon RDS encryption to encrypt the database and snapshots. Enable Amazon Elastic Block Store (Amazon EBS) encryption on Amazon EC2 instances. Include the database credential in the EC2 user data field. Use an AWS Lambda function to rotate database credentials. Set up TLS for the connection to the database.
BInstall a database on an Amazon EC2 instance. Enable third-party disk encryption to encrypt the Amazon Elastic Block Store (Amazon EBS) volume. Store the database credentials in AWS CloudHSM with automatic rotation. Set up TLS for the connection to the database.
CEnable Amazon RDS encryption to encrypt the database and snapshots. Enable Amazon Elastic Black Store (Amazon EBS) encryption on Amazon EC2 instances. Store the database credentials in AWS Secrets Manager with automatic rotation. Set up TLS for the connection to the RDS hosted database. (correct answer)
DSet up an AWS CloudHSM cluster with AWS Key Management Service (AWS KMS) to store KMS keys. Set up Amazon RDS encryption using AWS KMS to encrypt the database. Store database credentials in the AWS Systems Manager Parameter Store with automatic rotation. Set up TLS for the connection to the RDS hosted database.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Enable Amazon RDS encryption to encrypt the database and snapshots. Enable Amazon Elastic Black Store (Amazon EBS) encryption on Amazon EC2 instances. Store the database credentials in AWS Secrets Manager with automat...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon EBS provides block storage attached to a single EC2 instance. Amazon RDS is a managed relational database that handles patching, backups and failover.

SCS-C02 Question 65

Single page →

Topic 1 · Question 65

A company is using Amazon Route 53 Resolver for its hybrid DNS infrastructure. The company has set up Route 53 Resolver forwarding rules for authoritative domains that are hosted on on-premises DNS servers. A new security mandate requires the company to implement a solution to log and query DNS traffic that goes to the on-premises DNS servers. The logs must show details of the source IP address of the instance from which the query originated. The logs also must show the DNS name that was requested in Route 53 Resolver. Which solution will meet these requirements?

AUse VPC Traffic Mirroring. Configure all relevant elastic network interfaces as the traffic source, include amazon-dns in the mirror filter, and set Amazon CloudWatch Logs as the mirror target. Use CloudWatch Insights on the mirror session logs to run queries on the source IP address and DNS name.
BConfigure VPC flow logs on all relevant VPCs. Send the logs to an Amazon S3 bucket. Use Amazon Athena to run SQL queries on the source IP address and DNS name.
CConfigure Route 53 Resolver query logging on all relevant VPCs. Send the logs to Amazon CloudWatch Logs. Use CloudWatch Insights to run queries on the source IP address and DNS name. (correct answer)
DModify the Route 53 Resolver rules on the authoritative domains that forward to the on-premises DNS servers. Send the logs to an Amazon S3 bucket. Use Amazon Athena to run SQL queries on the source IP address and DNS name.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Configure Route 53 Resolver query logging on all relevant VPCs. Send the logs to Amazon CloudWatch Logs. Use CloudWatch Insights to run queries on the source IP address and DNS name.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 66

Single page →

Topic 1 · Question 66 · Select all that apply

A security engineer is configuring account-based access control (ABAC) to allow only specific principals to put objects into an Amazon S3 bucket. The principals already have access to Amazon S3. The security engineer needs to configure a bucket policy that allows principals to put objects into the S3 bucket only if the value of the Team tag on the object matches the value of the Team tag that is associated with the principal. During testing, the security engineer notices that a principal can still put objects into the S3 bucket when the tag values do not match. Which combination of factors are causing the PutObject operation to succeed when the tag values are different? (Choose two.)

AThe principal's identity-based policy grants access to put objects into the S3 bucket with no conditions. (correct answer)
BThe principal's identity-based policy overrides the condition because the identity-based policy contains an explicit allow.
CThe S3 bucket's resource policy does not deny access to put objects. (correct answer)
DThe S3 bucket's resource policy cannot allow actions to the principal.
EThe bucket policy does not apply to principals in the same zone of trust.

Reveal answer & explanation

Correct answer: A, C

The correct answer is A, C. Option A: The principal's identity-based policy grants access to put objects into the S3 bucket with no conditions. Option C: The S3 bucket's resource policy does not deny access to put objects.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SCS-C02 Question 67

Single page →

Topic 1 · Question 67

A company is hosting multiple applications within a single VPC in its AWS account. The applications are running behind an Application Load Balancer that is associated with an AWS WAF web ACL. The company's security team has identified that multiple port scans are originating from a specific range of IP addresses on the internet. A security engineer needs to deny access from the offending IP addresses. Which solution will meet these requirements?

AModify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range. (correct answer)
BAdd a rule to all security groups to deny the incoming requests from the IP address range.
CModify the AWS WAF web ACL with a rate-based rule statement to deny the incoming requests from the IP address range.
DConfigure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny the incoming requests based on the match condition.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Modify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.

Explanation

AWS WAF protects web applications from common exploits and malicious requests.

SCS-C02 Question 68

Single page →

Topic 1 · Question 68 · Select all that apply

A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The auditor is having trouble accessing some of the accounts. Which of the following may be causing this problem? (Choose three.)

AThe external ID used by the auditor is missing or incorrect. (correct answer)
BThe auditor is using the incorrect password.
CThe auditor has not been granted sts:AssumeRole for the role in the destination account. (correct answer)
DThe Amazon EC2 role used by the auditor must be set to the destination account role.
EThe secret key used by the auditor is missing or incorrect.
FThe role ARN used by the auditor is missing or incorrect. (correct answer)

Reveal answer & explanation

Correct answer: A, C, F

The correct answer is A, C, F. Option A: The external ID used by the auditor is missing or incorrect. Option C: The auditor has not been granted sts:AssumeRole for the role in the destination account. Option F: The role ARN used by the auditor is missing or incorrect.

SCS-C02 Question 69

Single page →

Topic 1 · Question 69

A security engineer needs to configure an Amazon S3 bucket policy to restrict access to an S3 bucket that is named DOC-EXAMPLE-BUCKET. The policy must allow access to only DOC-EXAMPLE-BUCKET from only the following endpoint: vpce-1a2b3c4d. The policy must deny all access to DOC-EXAMPLE-BUCKET if the specified endpoint is not used.

Which bucket policy statement meets these requirements?

A
B (correct answer)
C
D

Reveal answer & explanation

Correct answer: B

The correct answer is B. Compare the policy/code shown in each option image.

SCS-C02 Question 70

Single page →

Topic 1 · Question 70 · Select all that apply

A company has a group of Amazon EC2 instances in a single private subnet of a VPC with no internet gateway attached. A security engineer has installed the Amazon CloudWatch agent on all instances in that subnet to capture logs from a specific application. To ensure that the logs flow securely, the company's networking team has created VPC endpoints for CloudWatch monitoring and CloudWatch logs. The networking team has attached the endpoints to the VPC. The application is generating logs However, when the security engineer queries CloudWatch, the logs do not appear. Which combination of steps should the security engineer take to troubleshoot this issue? (Choose three.)

AEnsure that the EC2 instance profile that is attached to the EC2 instances has permissions to create log streams and write logs. (correct answer)
BCreate a metric filter on the logs so that they can be viewed in the AWS Management Console.
CCheck the CloudWatch agent configuration file on each EC2 instance to make sure that the CloudWatch agent is collecting the proper log files. (correct answer)
DCheck the VPC endpoint policies of both VPC endpoints to ensure that the EC2 instances have permissions to use them. (correct answer)
ECreate a NAT gateway in the subnet so that the EC2 instances can communicate with CloudWatch.
FEnsure that the security groups allow all the EC2 instances to communicate with each other to aggregate logs before sending.

Reveal answer & explanation

Correct answer: A, C, D

The correct answer is A, C, D. Option A: Ensure that the EC2 instance profile that is attached to the EC2 instances has permissions to create log streams and write logs. Option C: Check the CloudWatch agent configuration file on each EC2 instance to make sure that the CloudWatch agent is collecting the proper log files. Option D: Check the VPC endpoint policies of both VPC endpoints to ensure that the EC2 instances have permissions to use them.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. A VPC endpoint provides private connectivity to AWS services without traversing the public internet. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SCS-C02 Question 71

Single page →

Topic 1 · Question 71

A company uses AWS Signer with all of the company's AWS Lambda functions. A developer recently stopped working for the company. The company wants to ensure that all the code that the developer wrote can no longer be deployed to the Lambda functions. Which solution will meet this requirement?

ARevoke all versions of the signing profile assigned to the developer. (correct answer)
BExamine the developer's IAM roles. Remove all permissions that grant access to Signer.
CRe-encrypt all source code with a new AWS Key Management Service (AWS KMS) key.
DUse Amazon CodeGuru to profile all the code that the Lambda functions use.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Revoke all versions of the signing profile assigned to the developer.

SCS-C02 Question 72

Single page →

Topic 1 · Question 72

A company plans to use AWS Key Management Service (AWS KMS) to implement an encryption strategy to protect data at rest. The company requires client-side encryption for company projects. The company is currently conducting multiple projects to test the company's use of AWS KMS. These tests have led to a sudden increase in the company's AWS resource consumption. The test projects include applications that issue multiple requests each second to KMS endpoints for encryption activities. The company needs to develop a solution that does not throttle the company's ability to use AWS KMS. The solution must improve key usage for client-side encryption and must be cost optimized. Which solution will meet these requirements?

AUse keyrings with the AWS Encryption SDK. Use each keyring individually or combine keyrings into a multi-keyring. Decrypt the data by using a keyring that has the primary key in the multi-keyring.
BUse data key caching. Use the local cache that the AWS Encryption SDK provides with a caching cryptographic materials manager. (correct answer)
CUse KMS key rotation. Use a local cache in the AWS Encryption SDK with a caching cryptographic materials manager.
DUse keyrings with the AWS Encryption SDK. Use each keyring individually or combine keyrings into a multi-keyring. Use any of the wrapping keys in the multi-keyring to decrypt the data.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Use data key caching. Use the local cache that the AWS Encryption SDK provides with a caching cryptographic materials manager.

SCS-C02 Question 73

Single page →

Topic 1 · Question 73

A security team is working on a solution that will use Amazon EventBridge to monitor new Amazon S3 objects. The solution will monitor for public access and for changes to any S3 bucket policy or setting that result in public access. The security team configures EventBridge to watch for specific API calls that are logged from AWS CloudTrail. EventBridge has an action to send an email notification through Amazon Simple Notification Service (Amazon SNS) to the security team immediately with details of the API call. Specifically, the security team wants EventBridge to watch for the s3:PutObjectAcl, s3:DeleteBucketPolicy, and s3:PutBucketPolicy API invocation logs from CloudTrail. While developing the solution in a single account, the security team discovers that the s3:PutObjectAcl API call does not invoke an EventBridge event However, the s3:DeleteBucketPolicy API call and the s3:PutBucketPolicy API call do invoke an event. The security team has enabled CloudTrail for AWS management events with a basic configuration in the AWS Region in which EventBridge is being tested. Verification of the EventBridge event pattern indicates that the pattern is set up correctly. The security team must implement a solution so that the s3:PutObjectAcl API call will invoke an EventBridge event. The solution must not generate false notifications. Which solution will meet these requirements?

AModify the EventBridge event pattern by selecting Amazon S3. Select All Events as the event type.
BModify the EventBridge event pattern by selecting Amazon S3. Select Bucket Level Operations as the event type.
CEnable CloudTrail Insights to identify unusual API activity.
DEnable CloudTrail to monitor data events for read and write operations to S3 buckets. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Enable CloudTrail to monitor data events for read and write operations to S3 buckets.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS CloudTrail records API activity for auditing and governance.

SCS-C02 Question 74

Single page →

Topic 1 · Question 74

A company uses Amazon GuardDuty. The company's security team wants all High severity findings to automatically generate a ticket in a third-party ticketing system through email integration. Which solution will meet this requirement?

ACreate a verified identity for the third-party ticketing email system in Amazon Simple Email Service (Amazon SES). Create an Amazon EventBridge rule that includes an event pattern that matches High severity GuardDuty findings. Specify the SES identity as the target for the EventBridge rule.
BCreate an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the third-party ticketing email system to the SNS topic. Create an Amazon EventBridge rule that includes an event pattern that matches High severity GuardDuty findings. Specify the SNS topic as the target for the EventBridge rule. (correct answer)
CUse the GuardDuty CreateFilter API operation to build a filter in GuardDuty to monitor for High severity findings. Export the results of the filter to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the third-party ticketing email system to the SNS topic.
DUse the GuardDuty CreateFilter API operation to build a filter in GuardDuty to monitor for High severity findings. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the third-party ticketing email system to the SNS topic. Create an Amazon EventBridge rule that includes an event pattern that matches GuardDuty findings that are selected by the filter. Specify the SNS topic as the target for the EventBridge rule.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the third-party ticketing email system to the SNS topic. Create an Amazon EventBridge rule that includes an event pattern that matches High se...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon GuardDuty continuously monitors for threats and malicious activity.

SCS-C02 Question 75

Single page →

Topic 1 · Question 75

A company is using AWS Organizations to implement a multi-account strategy. The company does not have on-premises infrastructure. All workloads run on AWS. The company currently has eight member accounts. The company anticipates that it will have no more than 20 AWS accounts total at any time. The company issues a new security policy that contains the following requirements: • No AWS account should use a VPC within the AWS account for workloads. • The company should use a centrally managed VPC that all AWS accounts can access to launch workloads in subnets. • No AWS account should be able to modify another AWS account's application resources within the centrally managed VPC. • The centrally managed VPC should reside in an existing AWS account that is named Ac-count-A within an organization. The company uses an AWS CloudFormation template to create a VPC that contains multiple subnets in Account-A. This template exports the subnet IDs through the CloudFormation Outputs section. Which solution will complete the security setup to meet these requirements?

AUse a CloudFormation template in the member accounts to launch workloads. Configure the template to use the Fn::ImportValue function to obtain the subnet ID values.
BUse a transit gateway in the VPC within Account-A. Configure the member accounts to use the transit gateway to access the subnets in Account-A to launch workloads.
CUse AWS Resource Access Manager (AWS RAM) to share Account-A's VPC subnets with the remaining member accounts. Configure the member accounts to use the shared subnets to launch workloads. (correct answer)
DCreate a peering connection between Account-A and the remaining member accounts. Configure the member accounts to use the subnets in Account-A through the VPC peering connection to launch workloads.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Use AWS Resource Access Manager (AWS RAM) to share Account-A's VPC subnets with the remaining member accounts. Configure the member accounts to use the shared subnets to launch workloads.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 76

Single page →

Topic 1 · Question 76

A company's security team needs to receive a notification whenever an AWS access key has not been rotated in 90 or more days. A security engineer must develop a solution that provides these notifications automatically. Which solution will meet these requirements with the LEAST amount of effort?

ADeploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days. Create an Amazon EventBridge rule with an event pattern that matches the compliance type of NON_ COMPLIANT from AWS Config for the managed rule. Configure EventBridge to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team. (correct answer)
BCreate a script to export a .csv file from the AWS Trusted Advisor check for IAM access key rotation. Load the script into an AWS Lambda function that will upload the .csv file to an Amazon S3 bucket. Create an Amazon Athena table query that runs when the .csv file is uploaded to the S3 bucket. Publish the results for any keys older than 90 days by using an invocation of an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
CCreate a script to download the IAM credentials report on a periodic basis. Load the script into an AWS Lambda function that will run on a schedule through Amazon EventBridge. Configure the Lambda script to load the report into memory and to filter the report for records in which the key was last rotated at least 90 days ago. If any records are detected, send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
DCreate an AWS Lambda function that queries the IAM API to list all the users. Iterate through the users by using the ListAccessKeys operation. Verify that the value in the CreateDate field is not at least 90 days old. Send an Amazon Simple Notification Service (Amazon SNS) notification to the security team if the value is at least 90 days old. Create an Amazon EventBridge rule to schedule the Lambda function to run each day.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Deploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days. Create an Amazon EventBridge rule with an event...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 77

Single page →

Topic 1 · Question 77

A company maintains an open-source application that is hosted on a public GitHub repository. While creating a new commit to the repository, an engineer uploaded their AWS access key and secret access key. The engineer reported the mistake to a manager, and the manager immediately disabled the access key. The company needs to assess the impact of the exposed access key. A security engineer must recommend a solution that requires the least possible managerial overhead. Which solution meets these requirements?

AAnalyze an AWS Identity and Access Management (IAM) use report from AWS Trusted Advisor to see when the access key was last used.
BAnalyze Amazon CloudWatch Logs for activity by searching for the access key.
CAnalyze VPC flow logs for activity by searching for the access key.
DAnalyze a credential report in AWS Identity and Access Management (IAM) to see when the access key was last used. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Analyze a credential report in AWS Identity and Access Management (IAM) to see when the access key was last used.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SCS-C02 Question 78

Single page →

Topic 1 · Question 78

A company plans to create individual child accounts within an existing organization in AWS Organizations for each of its DevOps teams. AWS CloudTrail has been enabled and configured on all accounts to write audit logs to an Amazon S3 bucket in a centralized AWS account. A security engineer needs to ensure that DevOps team members are unable to modify or disable this configuration. How can the security engineer meet these requirements?

ACreate an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to the AWS account root user.
BCreate an S3 bucket policy in the specified destination account for the CloudTrail trail that prohibits configuration changes from the AWS account root user in the source account.
CCreate an SCP that prohibits changes to the specific CloudTrail trail and apply the SCP to the appropriate organizational unit or account in Organizations. (correct answer)
DCreate an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to a new IAM group. Have team members use individual IAM accounts that are members of the new IAM group.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create an SCP that prohibits changes to the specific CloudTrail trail and apply the SCP to the appropriate organizational unit or account in Organizations.

Explanation

AWS Organizations centrally governs and secures multiple AWS accounts. Service Control Policies set guardrails on what accounts in an organization can do. AWS CloudTrail records API activity for auditing and governance.

SCS-C02 Question 79

Single page →

Topic 1 · Question 79

A company's policy requires that all API keys be encrypted and stored separately from source code in a centralized security account. This security account is managed by the company's security team. However, an audit revealed that an API key is stored with the source code of an AWS Lambda function in an AWS CodeCommit repository in the DevOps account. How should the security team securely store the API key?

ACreate a CodeCommit repository in the security account using AWS Key Management Service (AWS KMS) for encryption. Require the development team to migrate the Lambda source code to this repository.
BStore the API key in an Amazon S3 bucket in the security account using server-side encryption with Amazon S3 managed encryption keys (SSE-S3) to encrypt the key. Create a presigned URL for the S3 key, and specify the URL in a Lambda environmental variable in the AWS CloudFormation template. Update the Lambda function code to retrieve the key using the URL and call the API.
CCreate a secret in AWS Secrets Manager in the security account to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the function can retrieve the key from Secrets Manager and call the API. (correct answer)
DCreate an encrypted environment variable for the Lambda function to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the function can decrypt the key at runtime.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create a secret in AWS Secrets Manager in the security account to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the funct...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SCS-C02 Question 80

Single page →

Topic 1 · Question 80

A security engineer is asked to update an AWS CloudTrail log file prefix for an existing trail. When attempting to save the change in the CloudTrail console, the security engineer receives the following error message: "There is a problem with the bucket policy." What will enable the security engineer to save the change?

ACreate a new trail with the updated log file prefix, and then delete the original trail. Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail console.
BUpdate the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform PutBucketPolicy, and then update the log file prefix in the CloudTrail console.
CUpdate the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail console. (correct answer)
DUpdate the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform GetBucketPolicy, and then update the log file prefix in the CloudTrail console.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail console.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS CloudTrail records API activity for auditing and governance.

Showing questions 61–80 of 307 · Page 4 of 16