SCS-C02 — questions

Page 6 of 16 · 307 total questions.

SCS-C02 Question 101

Topic 1 · Question 101

A security engineer wants to use Amazon Simple Notification Service (Amazon SNS) to send email alerts to a company's security team for Amazon GuardDuty findings that have a High severity level. The security engineer also wants to deliver these findings to a visualization tool for further examination. Which solution will meet these requirements?

ASet up GuardDuty to send notifications to an Amazon CloudWatch alarm with two targets in CloudWatch. From CloudWatch, stream the findings through Amazon Kinesis Data Streams into an Amazon Open Search Service domain as the first target for delivery. Use Amazon QuickSight to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for the CloudWatch alarm. Use event pattern matching with an Amazon EventBridge event rule to send only High severity findings in the alerts.
BSet up GuardDuty to send notifications to AWS CloudTrail with two targets in CloudTrail. From CloudTrail, stream the findings through Amazon Kinesis Data Firehose into an Amazon OpenSearch Service domain as the first target for delivery. Use OpenSearch Dashboards to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for CloudTrail. Use event pattern matching with a CloudTrail event rule to send only High severity findings in the alerts.
CSet up GuardDuty to send notifications to Amazon EventBridge with two targets. From EventBridge, stream the findings through Amazon Kinesis Data Firehose into an Amazon OpenSearch Service domain as the first target for delivery. Use OpenSearch Dashboards to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for EventBridge. Use event pattern matching with an EventBridge event rule to send only High severity findings in the alerts. (correct answer)
DSet up GuardDuty to send notifications to Amazon EventBridge with two targets. From EventBridge, stream the findings through Amazon Kinesis Data Streams into an Amazon OpenSearch Service domain as the first target for delivery. Use Amazon QuickSight to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for EventBridge. Use event pattern matching with an EventBridge event rule to send only High severity findings in the alerts.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Set up GuardDuty to send notifications to Amazon EventBridge with two targets. From EventBridge, stream the findings through Amazon Kinesis Data Firehose into an Amazon OpenSearch Service domain as the first target fo...

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SCS-C02 Question 102

Single page →

Topic 1 · Question 102

A security engineer needs to implement a write-once-read-many (WORM) model for data that a company will store in Amazon S3 buckets. The company uses the S3 Standard storage class for all of its S3 buckets. The security engineer must ensure that objects cannot be overwritten or deleted by any user, including the AWS account root user. Which solution will meet these requirements?

ACreate new S3 buckets with S3 Object Lock enabled in compliance mode. Place objects in the S3 buckets. (correct answer)
BUse S3 Glacier Vault Lock to attach a Vault Lock policy to new S3 buckets. Wait 24 hours to complete the Vault Lock process. Place objects in the S3 buckets.
CCreate new S3 buckets with S3 Object Lock enabled in governance mode. Place objects in the S3 buckets.
DCreate new S3 buckets with S3 Object Lock enabled in governance mode. Add a legal hold to the S3 buckets. Place objects in the S3 buckets.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Create new S3 buckets with S3 Object Lock enabled in compliance mode. Place objects in the S3 buckets.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SCS-C02 Question 103

Single page →

Topic 1 · Question 103

A company needs complete encryption of the traffic between external users and an application. The company hosts the application on a fleet of Amazon EC2 instances that run in an Auto Scaling group behind an Application Load Balancer (ALB). How can a security engineer meet these requirements?

ACreate a new Amazon-issued certificate in AWS Secrets Manager. Export the certificate from Secrets Manager. Import the certificate into the ALB and the EC2 instances.
BCreate a new Amazon-issued certificate in AWS Certificate Manager (ACM). Associate the certificate with the ALExport the certificate from ACM. Install the certificate on the EC2 instances.
CImport a new third-party certificate into AWS Identity and Access Management (IAM). Export the certificate from IAM. Associate the certificate with the ALB and the EC2 instances.
DImport a new third-party certificate into AWS Certificate Manager (ACM). Associate the certificate with the ALB. Install the certificate on the EC2 instances. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Import a new third-party certificate into AWS Certificate Manager (ACM). Associate the certificate with the ALB. Install the certificate on the EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Certificate Manager provisions and renews TLS certificates automatically.

SCS-C02 Question 104

Single page →

Topic 1 · Question 104

A company has an organization with SCPs in AWS Organizations. The root SCP for the organization is as follows: The company's developers are members of a group that has an IAM policy that allows access to Amazon Simple Email Service (Amazon SES) by allowing ses:* actions. The account is a child to an OU that has an SCP that allows Amazon SES. The developers are receiving a not-authorized error when they try to access Amazon SES through the AWS Management Console. Which change must a security engineer implement so that the developers can access Amazon SES?

AAdd a resource policy that allows each member of the group to access Amazon SES.
BAdd a resource policy that allows "Principal": {"AWS": "arn:aws:iam::account-number:group/Dev"}.
CRemove the AWS Control Tower control (guardrail) that restricts access to Amazon SES.
DRemove Amazon SES from the root SCP. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Remove Amazon SES from the root SCP.

Explanation

Service Control Policies set guardrails on what accounts in an organization can do.

SCS-C02 Question 105

Single page →

Topic 1 · Question 105 · Select all that apply

A company hosts a public website on an Amazon EC2 instance. HTTPS traffic must be able to access the website. The company uses SSH for management of the web server. The website is on the subnet 10.0.1.0/24. The management subnet is 192.168.100.0/24. A security engineer must create a security group for the EC2 instance. Which combination of steps should the security engineer take to meet these requirements in the MOST secure manner? (Choose two.)

AAllow port 22 from source 0.0.0.0/0.
BAllow port 443 from source 0.0 0 0/0. (correct answer)
CAllow port 22 from 192.168.100.0/24. (correct answer)
DAllow port 22 from 10.0.1.0/24.
EAllow port 443 from 10.0.1.0/24.

Reveal answer & explanation

Correct answer: B, C

The correct answer is B, C. Option B: Allow port 443 from source 0.0 0 0/0. Option C: Allow port 22 from 192.168.100.0/24.

SCS-C02 Question 106

Single page →

Topic 1 · Question 106

A security engineer wants to forward custom application-security logs from an Amazon EC2 instance to Amazon CloudWatch. The security engineer installs the CloudWatch agent on the EC2 instance and adds the path of the logs to the CloudWatch configuration file. However, CloudWatch does not receive the logs. The security engineer verifies that the awslogs service is running on the EC2 instance. What should the security engineer do next to resolve the issue?

AAdd AWS CloudTrail to the trust policy of the EC2 in stance. Send the custom logs to CloudTrail instead of CloudWatch.
BAdd Amazon S3 to the trust policy of the EC2 instance. Configure the application to write the custom logs to an S3 bucket that CloudWatch can use to ingest the logs.
CAdd Amazon Inspector to the trust policy of the EC2 instance. Use Amazon Inspector instead of the CloudWatch agent to collect the custom logs.
DAttach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SCS-C02 Question 107

Single page →

Topic 1 · Question 107

A systems engineer is troubleshooting the connectivity of a test environment that includes a virtual security appliance deployed inline. In addition to using the virtual security appliance, the development team wants to use security groups and network ACLs to accomplish various security requirements in the environment. What configuration is necessary to allow the virtual security appliance to route the traffic?

ADisable network ACLs.
BConfigure the security appliance's elastic network interface for promiscuous mode.
CDisable the Network Source/Destination check on the security appliance's elastic network interface. (correct answer)
DPlace the security appliance in the public subnet with the internet gateway.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Disable the Network Source/Destination check on the security appliance's elastic network interface.

SCS-C02 Question 108

Single page →

Topic 1 · Question 108

A security engineer needs to create an Amazon S3 bucket policy to grant least privilege read access to IAM user accounts that are named User1, User2, and User3. These IAM user accounts are members of the AuthorizedPeople IAM group. The security engineer drafts the following S3 bucket policy:

When the security engineer tries to add the policy to the S3 bucket, the following error message appears: "Missing required field Principal."

The security engineer is adding a Principal element to the policy. The addition must provide read access to only User1, User2, and User3.

Which solution meets these requirements?

A (correct answer)
B
C
D

Reveal answer & explanation

Correct answer: A

The correct answer is A. Compare the policy/code shown in each option image.

SCS-C02 Question 109

Single page →

Topic 1 · Question 109

A security engineer recently rotated all IAM access keys in an AWS account. The security engineer then configured AWS Config and enabled the following AWS Config managed rules: mfa-enabled-for-iam-console-access, iam-user-mfa-enabled, access-keys-rotated, and iam-user-unused-credentials-check. The security engineer notices that all resources are displaying as noncompliant after the IAM GenerateCredentialReport API operation is invoked. What could be the reason for the noncompliant status?

AThe IAM credential report was generated within the past 4 hours. (correct answer)
BThe security engineer does not have the GenerateCredentialReport permission.
CThe security engineer does not have the GetCredenlialReport permission.
DThe AWS Config rules have a MaximumExecutionFrequency value of 24 hours.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: The IAM credential report was generated within the past 4 hours.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SCS-C02 Question 110

Single page →

Topic 1 · Question 110

A company is using AWS WAF to protect a customized public API service that is based on Amazon EC instances. The API uses an Application Load Balancer. The AWS WAF web ACL is configured with an AWS Managed Rules rule group. After a software upgrade to the API and the client application, some types of requests are no longer working and are causing application stability issues. A security engineer discovers that AWS WAF logging is not turned on for the web ACL. The security engineer needs to immediately return the application to service, resolve the issue, and ensure that logging is not turned off in the future. The security engineer turns on logging for the web ACL and specifies Amazon CloudWatch Logs as the destination. Which additional set of steps should the security engineer take to meet the requirements?

AEdit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs. (correct answer)
BEdit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs.
CEdit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs.
DEdit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the lo...

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS WAF protects web applications from common exploits and malicious requests. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 111

Single page →

Topic 1 · Question 111 · Select all that apply

A security engineer is creating an AWS Lambda function. The Lambda function needs to use a role that is named LambdaAuditRole to assume a role that is named AcmeAuditFactoryRole in a different AWS account. When the code is processed, the following error message appears: "An error occurred (AccessDenied) when calling the AssumeRole operation." Which combination of steps should the security engineer take to resolve this error? (Choose two.)

AEnsure that LambdaAuditRole has the sts:AssumeRole permission for AcmeAuditFactoryRole. (correct answer)
BEnsure that LambdaAuditRole has the AWSLambdaBasicExecutionRole managed policy attached.
CEnsure that the trust policy for AcmeAuditFactoryRole allows the sts:AssumeRole action from LambdaAuditRole. (correct answer)
DEnsure that the trust policy for LambdaAuditRole allows the sts:AssumeRole action from the lambda.amazonaws.com service.
EEnsure that the sts:AssumeRole API call is being issued to the us-east-1 Region endpoint.

Reveal answer & explanation

Correct answer: A, C

The correct answer is A, C. Option A: Ensure that LambdaAuditRole has the sts:AssumeRole permission for AcmeAuditFactoryRole. Option C: Ensure that the trust policy for AcmeAuditFactoryRole allows the sts:AssumeRole action from LambdaAuditRole.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Certificate Manager provisions and renews TLS certificates automatically.

SCS-C02 Question 112

Single page →

Topic 1 · Question 112 · Select all that apply

A company has AWS accounts in an organization in AWS Organizations. The organization includes a dedicated security account. All AWS account activity across all member accounts must be logged and reported to the dedicated security account. The company must retain all the activity logs in a secure storage location within the dedicated security account for 2 years. No changes or deletions of the logs are allowed. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)

AIn the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock in compliance mode and a retention period of 2 years on the S3 bucket. Set the bucket policy to allow the organization's management account to write to the S3 bucket.
BIn the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock in compliance mode and a retention period of 2 years on the S3 bucket. Set the bucket policy to allow the organization's member accounts to write to the S3 bucket. (correct answer)
CIn the dedicated security account, create an Amazon S3 bucket that has an S3 Lifecycle configuration that expires objects after 2 years. Set the bucket policy to allow the organization's member accounts to write to the S3 bucket.
DCreate an AWS CloudTrail trail for the organization. Configure logs to be delivered to the logging Amazon S3 bucket in the dedicated security account. (correct answer)
ETurn on AWS CloudTrail in each account. Configure logs to be delivered to an Amazon S3 bucket that is created in the organization's management account. Forward the logs to the S3 bucket in the dedicated security account by using AWS Lambda and Amazon Kinesis Data Firehose.

Reveal answer & explanation

Correct answer: B, D

The correct answer is B, D. Option B: In the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock in compliance mode and a retention period of 2 years on the S3 bucket. Set the bucket policy to allow the organization's member a... Option D: Create an AWS CloudTrail trail for the organization. Configure logs to be delivered to the logging Amazon S3 bucket in the dedicated security account.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS CloudTrail records API activity for auditing and governance. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 113

Single page →

Topic 1 · Question 113

A company is testing its incident response plan for compromised credentials. The company runs a database on an Amazon EC2 instance and stores the sensitive database credentials as a secret in AWS Secrets Manager. The secret has rotation configured with an AWS Lambda function that uses the generic rotation function template. The EC2 instance and the Lambda function are deployed in the same private subnet. The VPC has a Secrets Manager VPC endpoint. A security engineer discovers that the secret cannot rotate. The security engineer determines that the VPC endpoint is working as intended. The Amazon CloudWatch logs contain the following error: "setSecret: Unable to log into database". Which solution will resolve this error?

AUse the AWS Management Console to edit the JSON structure of the secret in Secrets Manager so that the secret automatically conforms with the structure that the database requires.
BEnsure that the security group that is attached to the Lambda function allows outbound connections to the EC2 instance. Ensure that the security group that is attached to the EC2 instance allows inbound connections from the security group that is attached to the Lambda function. (correct answer)
CUse the Secrets Manager list-secrets command in the AWS CLI to list the secret. Identify the database credentials. Use the Secrets Manager rotate-secret command in the AWS CLI to force the immediate rotation of the secret.
DAdd an internet gateway to the VPC. Create a NAT gateway in a public subnet. Update the VPC route tables so that traffic from the Lambda function and traffic from the EC2 instance can reach the Secrets Manager public endpoint.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Ensure that the security group that is attached to the Lambda function allows outbound connections to the EC2 instance. Ensure that the security group that is attached to the EC2 instance allows inbound connections fr...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SCS-C02 Question 114

Single page →

Topic 1 · Question 114

A company deploys a set of standard IAM roles in AWS accounts. The IAM roles are based on job functions within the company. To balance operational efficiency and security, a security engineer implemented AWS Organizations SCPs to restrict access to critical security services in all company accounts.

All of the company's accounts and OUs within AWS Organizations have a default FullAWSAccess SCP that is attached. The security engineer needs to ensure that no one can disable Amazon GuardDuty and AWS Security Hub. The security engineer also must not override other permissions that are granted by IAM policies that are defined in the accounts.

Which SCP should the security engineer attach to the root of the organization to meet these requirements?

A (correct answer)
B
C
D

Reveal answer & explanation

Correct answer: A

The correct answer is A. Compare the policy/code shown in each option image.

SCS-C02 Question 115

Single page →

Topic 1 · Question 115

A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager. Which solution will meet the requirements?

AUse a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager. (correct answer)
BUse a parameter in the CloudFormation template to reference the database credentials. Encrypt the CloudFormation template by using AWS KMS.
CUse a SecureString parameter in the CloudFormation template to reference the database credentials in Secrets Manager.
DUse a SecureString parameter in the CloudFormation template to reference an encrypted value in AWS KMS.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.

Explanation

AWS Secrets Manager stores and automatically rotates secrets such as database credentials. AWS CloudFormation provisions infrastructure as code repeatably.

SCS-C02 Question 116

Single page →

Topic 1 · Question 116 · Select all that apply

An international company wants to combine AWS Security Hub findings across all the company's AWS Regions and from multiple accounts. In addition, the company wants to create a centralized custom dashboard to correlate these findings with operational data for deeper analysis and insights. The company needs an analytics tool to search and visualize Security Hub findings. Which combination of steps will meet these requirements? (Chose three.)

ADesignate an AWS account as a delegated administrator for Security Hub. Publish events to Amazon CloudWatch from the delegated administrator account, all member accounts, and required Regions that are enabled for Security Hub findings.
BDesignate an AWS account in an organization in AWS Organizations as a delegated administrator for Security Hub. Publish events to Amazon EventBridge from the delegated administrator account, all member accounts, and required Regions that are enabled for Security Hub findings. (correct answer)
CIn each Region, create an Amazon EventBridge rule to deliver findings to an Amazon Kinesis data stream. Configure the Kinesis data streams to output the logs to a single Amazon S3 bucket.
DIn each Region, create an Amazon EventBridge rule to deliver findings to an Amazon Kinesis Data Firehose delivery stream. Configure the Kinesis Data Firehose delivery streams to deliver the logs to a single Amazon S3 bucket. (correct answer)
EUse AWS Glue DataBrew to crawl the Amazon S3 bucket and build the schema. Use AWS Glue Data Catalog to query the data and create views to flatten nested attributes. Build Amazon QuickSight dashboards by using Amazon Athena.
FPartition the Amazon S3 data. Use AWS Glue to crawl the S3 bucket and build the schema. Use Amazon Athena to query the data and create views to flatten nested attributes. Build Amazon QuickSight dashboards that use the Athena views. (correct answer)

Reveal answer & explanation

Correct answer: B, D, F

The correct answer is B, D, F. Option B: Designate an AWS account in an organization in AWS Organizations as a delegated administrator for Security Hub. Publish events to Amazon EventBridge from the delegated administrator account, all member accounts, and r... Option D: In each Region, create an Amazon EventBridge rule to deliver findings to an Amazon Kinesis Data Firehose delivery stream. Configure the Kinesis Data Firehose delivery streams to deliver the logs to a single Amazon S3... Option F: Partition the Amazon S3 data. Use AWS Glue to crawl the S3 bucket and build the schema. Use Amazon Athena to query the data and create views to flatten nested attributes. Build Amazon QuickSight dashboards that use th...

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SCS-C02 Question 117

Single page →

Topic 1 · Question 117

An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication: After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication?

AChange the value of aws:MultiFactorAuthPresent to true.
BInstruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls. (correct answer)
CImplement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
DCreate a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.

SCS-C02 Question 118

Single page →

Topic 1 · Question 118

A company is developing a mechanism that will help data scientists use Amazon SageMaker to read, process, and output data to an Amazon S3 bucket. Data scientists will have access to a dedicated S3 prefix for each of their projects. The company will implement bucket policies that use the dedicated S3 prefixes to restrict access to the S3 objects. The projects can last up to 60 days. The company's security team mandates that data cannot remain in the S3 bucket after the end of the projects that use the data. Which solution will meet these requirements MOST cost-effectively?

ACreate an AWS Lambda function to identify and delete objects in the S3 bucket that have not been accessed for 60 days. Create an Amazon EventBridge scheduled rule that runs every day to invoke the Lambda function.
BCreate a new S3 bucket. Configure the new S3 bucket to use S3 Intelligent-Tiering. Copy the objects to the new S3 bucket.
CCreate an S3 Lifecycle configuration for each S3 bucket prefix for each project. Set the S3 Lifecycle configurations to expire objects after 60 days. (correct answer)
DCreate an AWS Lambda function to delete objects that have not been accessed for 60 days. Create an S3 event notification for S3 Intelligent-Tiering automatic archival events to invoke the Lambda function.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create an S3 Lifecycle configuration for each S3 bucket prefix for each project. Set the S3 Lifecycle configurations to expire objects after 60 days.

Explanation

S3 Lifecycle policies automatically transition or expire objects to control storage cost. Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SCS-C02 Question 119

Single page →

Topic 1 · Question 119

A company has AWS accounts that are in an organization in AWS Organizations. An Amazon S3 bucket in one of the accounts is publicly accessible. A security engineer must change the configuration so that the S3 bucket is no longer publicly accessible. The security engineer also must ensure that the S3 bucket cannot be made publicly accessible in the future. Which solution will meet these requirements?

AConfigure the S3 bucket to use an AWS Key Management Service (AWS KMS) key. Encrypt all objects in the S3 bucket by creating a bucket policy that enforces encryption. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account.
BEnable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account.
CEnable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account. (correct answer)
DConfigure the S3 bucket to use S3 Object Lock in governance mode. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Enable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Service Control Policies set guardrails on what accounts in an organization can do. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 120

Single page →

Topic 1 · Question 120 · Select all that apply

A company is designing a new application stack. The design includes web servers and backend servers that are hosted on Amazon EC2 instances. The design also includes an Amazon Aurora MySQL DB cluster. The EC2 instances are in an Auto Scaling group that uses launch templates. The EC2 instances for the web layer and the backend layer are backed by Amazon Elastic Block Store (Amazon EBS) volumes. No layers are encrypted at rest A security engineer needs to implement encryption at rest. Which combination of steps will meet these requirements? (Choose two.)

AModify EBS default encryption settings in the target AWS Region to enable encryption. Use an Auto Scaling group instance refresh. (correct answer)
BModify the launch templates for the web layer and the backend layer to add AWS Certificate Manager (ACM) encryption for the attached EBS volumes. Use an Auto Scaling group instance refresh.
CCreate a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster. (correct answer)
DApply AWS Key Management Service (AWS KMS) encryption to the existing DB cluster.
EApply AWS Certificate Manager (ACM) encryption to the existing DB cluster.

Reveal answer & explanation

Correct answer: A, C

The correct answer is A, C. Option A: Modify EBS default encryption settings in the target AWS Region to enable encryption. Use an Auto Scaling group instance refresh. Option C: Create a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EBS provides block storage attached to a single EC2 instance. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

Showing questions 101–120 of 307 · Page 6 of 16