Amazon SCS-C02 Exam Dumps - Latest AWS Certified Security - Specialty Practice Test

Question # 1

A company's data scientists want to create artificial intelligence and machine learning(AI/ML) training models by using Amazon SageMaker. The training models will use largedatasets in an Amazon S3 bucket. The datasets contain sensitive information.On average. the data scientists need 30 days to train models. The S3 bucket has beensecured appropriately The companfs data retention policy states that all data that is olderthan 45 days must be removed from the S3 bucket.Which action should a security engineer take to enforce this data retention policy?

A. Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days.
B. Create an AWS Lambda function to check the last-modified date of the S3 objects anddelete objects that are older than 45 days. Create an S3 event notification to invoke theLambda function for each PutObject operation.
C. Create an AWS Lambda function to check the last-modified date of the S3 objects anddelete objects that are older than 45 days. Create an Amazon EventBridge rule to invoke the Lambda function each month.
D. Configure S3 Intelligent-Ttering on the S3 bucket to automatically transition objects toanother storage class.

Show Answer

Question # 2

A company uses Amazon EC2 instances to host frontend services behind an ApplicationLoad Balancer. Amazon Elastic Block Store (Amazon EBS) volumes are attached to theEC2 instances. The company uses Amazon S3 buckets to store large files for images andmusic.The company has implemented a security architecture oit>AWS to prevent, identify, andisolate potential ransomware attacks. The company now wants to further reduce risk.A security engineer must develop a disaster recovery solution that can recover to normaloperations if an attacker bypasses preventive and detective controls. The solution mustmeet an RPO of 1 hour.Which solution will meet these requirements?

A. Use AWS Backup to create backups of the EC2 instances and S3 buckets every hour.Create AWS CloudFormation templates that replicate existing architecture components.Use AWS CodeCommit to store the CloudFormation templates alongside applicationconfiguration code.
B. Use AWS Backup to create backups of the EBS volumes and S3 objects every day. UseAmazon Security Lake to create a centralized data lake for AWS CloudTrail logs and VPCflow logs. Use the logs for automated response.
C. Use Amazon Security Lake to create a centralized data lake for AWS CloudTrail logsand VPC flow logs. Use the logs for automated response Enable AWS Security Hub toestablish a single location for recovery procedures. Create AWS CloudFormation templatesthat replicate existing architecture components. Use AWS CodeCommit to store theCloudFormation templates alongside application configuration code.
D. Create EBS snapshots every 4 hours Enable Amazon GuardDuty Malware Protection.Create automation to immediately restore the most recent snapshot for any EC2 instancesthat produce an Execution:EC2/MaliciousFile finding in GuardDuty.

Show Answer

Question # 3

AWS CloudTrail is being used to monitor API calls in an organization. An audit revealedthat CloudTrail is failing to deliver events to Amazon S3 as expected.What initial actions should be taken to allow delivery of CloudTrail events to S3? (SelectTWO.)

A. Verify thattheS3 bucket policy allows CloudTrail to write objects.
B. Verify thatthe1AM role used by CloudTrail has access to write to Amazon CloudWatchLogs.
C. Remove any lifecycle policies on the S3 bucket that are archiving objects to S3 GlacierFlexible Retrieval.
D. Verify thattheS3 bucket defined in CloudTrail exists.
E. Verify that the log file prefix defined in CloudTrail exists in the S3 bucket.

Show Answer

Question # 4

A company deployed an Amazon EC2 instance to a VPC on AWS. A recent alert indicatesthat the EC2 instance is receiving a suspicious number of requests over an open TCP portfrom an external source. The TCP port remains open for long periods of time.The company's security team needs to stop all activity to this port from the external sourceto ensure that the EC2 instance is not being compromised. The application must remainavailable to other users.Which solution will mefet these requirements?

A. Update the network ACL that is attached to the subnet that is associated with the EC2instance. Add a Deny statement for the port and the source IP addresses.
B. Update the elastic network interface security group that is attached to the EC2 instanceto remove the port from theinbound rule list.
C. Update the elastic network interface security group that is attached to the EC2 instanceby adding a Deny entry in the inbound list for the port and the sourceIP addresses.
D. Create a new network ACL for the subnet. Deny all traffic from the EC2 instance toprevent data from being removed.

Show Answer

Question # 5

A company is running an application on Amazon EC2 instances in an Auto Scaling group.The application stores logs locally. A security engineer noticed that logs were lost after ascale-in event. The security engineer needs to recommend a solution to ensure thedurability and availability of log data All logs must be kept for a minimum of 1 year forauditing purposes. What should the security engineer recommend?

A. Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon ElasticBlock Store (Amazon EBS) log volume each time an EC2 instance is created. When theinstance is terminated, the EBS volume can be reattached to another instance for logreview.
B. Create an Amazon Elastic File System (Amazon EFS) file system and add a commandin the user data section of the Auto Scaling launch template to mount the EFS file systemduring EC2 instance creation. Configure a process on the instance to copy the logs once aday from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory inthe EFS file system.
C. Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group.Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review,
D. Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon SimpleNotification Service (Amazon SNS). Configure the hook to remain in the Terminating:Waitstate for 1 hour to allow manual review of the security logs prior to instance termination.

Show Answer

Question # 6

A company has AWS accounts in an organization in AWS Organizations. The companyneeds to install a corporate software package on all Amazon EC2 instances for all theaccounts in the organization.A central account provides base AMIs for the EC2 instances. The company uses AWSSystems Manager for software inventory and patching operations.A security engineer must implement a solution that detects EC2 instances ttjat do not havethe required software. The solution also must automatically install the software if thesoftware is not present.Which solution will meet these requirements?

A. Provide new AMIs that have the required software pre-installed. Apply a tag to the AMIsto indicate that the AMIs have the required software. Configure an SCP that allows newEC2 instances to be launched only if the instances have the tagged AMIs. Tag all existingEC2 instances.
B. Configure a custom patch baseline in Systems Manager Patch Manager. Add thepackage name for the required software to the approved packages list. Associate the newpatch baseline with all EC2 instances. Set up a maintenance window for softwaredeployment.
C. Centrally enable AWS Config. Set up the ec2-managedinstance-applications-requiredAWS Config rule for all accounts Create an Amazon EventBridge rule that reacts to AWSConfig events. Configure the EventBridge rule to invoke an AWS Lambda function thatuses Systems Manager Run Command to install the required software.
D. Create a new Systems Manager Distributor package for the required software. Specifythe download location. Select all EC2 instances in the different accounts. Install thesoftware by using Systems Manager Run Command.

Show Answer

Question # 7

A company uses HTTP Live Streaming (HL'S) to stream live video content to payingsubscribers by using Amazon CloudFront. HLS splits the video content into chunks so thatthe user can request the right chunk based on different conditions. Because the videoevents last for several hours, the total video is made up of thousands of chunks.The origin URL is not disclosed, and every user is forced to access the CloudFront URL.The company has a web application that authenticates the paying users against aninternal repository and a CloudFront key pair that is already issued.What is the simplest and MOST effective way to protect the content?

A. Develop the application to use the CloudFront key pair to set the signed cookies thatusers will use to access the content.
B. Develop the application to issue a security token that Lambda@Edge will receive toauthenticate and authorize access to the content
C. Keep the CloudFront URL encrypted inside the application, and use AWS KMS toresolve the URL on-the-fly after the user is authenticated.

Show Answer

Question # 8

A company hosts an application on Amazon EC2 instances. The application also usesAmazon S3 and Amazon Simple Queue Service (Amazon SQS). The application is behindan Application Load Balancer (ALB) and scales with AWS Auto Scaling.The company’s security policy requires the use of least privilege access, which has beenapplied to all existing AWS resources. A security engineer needs to implement privateconnectivity to AWS services.Which combination of steps should the security engineer take to meet this requirement?(Select THREE.)

A. A. Use an interface VPC endpoint for Amazon SQS
B. B. Configure a connection to Amazon S3 through AWS Transit Gateway.
C. C. Use a gateway VPC endpoint for Amazon S3.
D. D. Modify the 1AM role applied to the EC2 instances in the Auto Scaling group to allowoutbound traffic to the interface endpoints.
E. E. Modify the endpoint policies on all VPC endpoints. Specify the SQS and S3 resourcesthat the application uses
F. F. Configure a connection to Amazon S3 through AWS Firewall Manager

Show Answer

Question # 9

A company operates a web application that runs on Amazon EC2 instances. Theapplication listens on port 80 and port 443. The company uses an Application LoadBalancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the applicationinstances only on port 80.The ALB is in public subnets that are associated with a network ACL that is named NACL1.The application instances are in dedicated private subnets that are associated with a network ACL that is named NACL2. An Amazon RDS for PostgreSQL DB instance thatuses port 5432 is in a dedicated private subnet that is associated with a network ACL thatis named NACL3. All the network ACLs currently allow all inbound and outbound traffic.Which set of network ACL changes will increase the security of the application whileensuring functionality?

A. Make the following changes to NACL3:• Add a rule that allows inbound traffic on port 5432 from NACL2.• Add a rule that allows outbound traffic on ports 1024-65536 to NACL2.• Remove the default rules that allow all inbound and outbound traffic.
B. Make the following changes to NACL3:• Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the applicationinstance subnets.• Add a rule that allows outbound traffic on ports 1024-65536 to the application instancesubnets.• Remove the default rules that allow all inbound and outbound traffic.
C. Make the following changes to NACL2:• Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDSsubnets.• Remove the default rules that allow all inbound and outbound traffic.
D. Make the following changes to NACL2:• Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDSsubnets.• Add a rule that allows outbound traffic on port 5432 to the RDS subnets.

Show Answer

Question # 10

An AWS Lambda function was misused to alter data, and a security engineer must identifywho invoked the function and what output was produced. The engineer cannot find anylogs create^ by the Lambda function in Amazon CloudWatch Logs.Which of the following explains why the logs are not available?

A. The execution role for the Lambda function did not grant permissions to write log data toCloudWatch Logs.
B. The Lambda function was invoked by using Amazon API Gateway, so the logs are notstored in CloudWatch Logs.
C. The execution role for the Lambda function did not grant permissions to write to theAmazon S3 bucket where CloudWatch Logs stores the logs.
D. The version of the Lambda function that was invoked was not current.

Show Answer

Question # 11

A company that uses AWS Organizations is using AWS 1AM Identity Center (AWS SingleSign-On) to administer access to AWS accounts. A security engineer is creating a custompermission set in 1AM Identity Center. The company will use the permission set acrossmultiple accounts. An AWS managed policy and a customer managed policy are attachedto the permission set. The security engineer has full administrative permissions and isoperating in the management account.When the security engineer attempts to assign the permission set to an 1AM IdentityCenter user who has access to multiple accounts, the assignment fails.What should the security engineer do to resolve this failure?

A. Create the customer managed policy in every account where the permission set isassigned. Give the customer managed policy the same name and same permissions ineach account.
B. Remove either the AWS managed policy or the customer managed policy from thepermission set. Create a second permission set that includes the removed policy. Apply thepermission sets separately to the user.
C. Evaluate the logic of the AWS managed policy and the customer managed policy.Resolve any policy conflicts in the permission set before deployment.
D. Do not add the new permission set to the user. Instead, edit the user's existingpermission set to include the AWS managed policy and the customer managed policy.

Show Answer

Question # 12

A company suspects that an attacker has exploited an overly permissive role to exportcredentials from Amazon EC2 instance metadata. The company uses Amazon GuardDutyand AWS Audit Manager. The company has enabled AWS CloudTrail logging and AmazonCloudWatch logging for all of its AWS accounts. A security engineer must determine if the credentials were used to access the company'sresources from an external account.Which solution will provide this information?

A. Review GuardDuty findings to find InstanceCredentialExfiltration events.
B. Review assessment reports in the Audit Manager console to findInstanceCredentialExfiltration events.
C. Review CloudTrail logs for GetSessionToken API calls to AWS Security Token Service(AWS STS) that come from an acount ID from outside the company.
D. Review CloudWatch logs for GetSessionToken API calls to AWS Security TokenService (AWS STS) that come from an account ID from outside the company.

Show Answer

Question # 13

A security team is working on a solution that will use Amazon EventBridge (AmazonCloudWatch Events) to monitor new Amazon S3 objects. The solution will monitor forpublic access and for changes to any S3 bucket policy or setting that result in publicaccess. The security team configures EventBridge to watch for specific API calls that arelogged from AWS CloudTrail. EventBridge has an action to send an email notificationthrough Amazon Simple Notification Service (Amazon SNS) to the security team immediately with details of the API call.Specifically, the security team wants EventBridge to watch for the s3:PutObjectAcl,s3:DeleteBucketPolicy, and s3:PutBucketPolicy API invocation logs from CloudTrail. Whiledeveloping the solution in a single account, the security team discovers that thes3:PutObjectAcl API call does not invoke an EventBridge event. However, thes3:DeleteBucketPolicy API call and the s3:PutBucketPolicy API call do invoke an event.The security team has enabled CloudTrail for AWS management events with a basicconfiguration in the AWS Region in which EventBridge is being tested. Verification of theEventBridge event pattern indicates that the pattern is set up correctly. The security teammust implement a solution so that the s3:PutObjectAcl API call will invoke an EventBridgeevent. The solution must not generate false notifications.Which solution will meet these requirements?

A. Modify the EventBridge event pattern by selecting Amazon S3. Select All Events as theevent type.
B. Modify the EventBridge event pattern by selecting Amazon S3. Select Bucket LevelOperations as the event type.
C. Enable CloudTrail Insights to identify unusual API activity.
D. Enable CloudTrail to monitor data events for read and write operations to S3 buckets.

Show Answer

Question # 14

A company runs an online game on AWS. When players sign up for the game, theirusername and password credentials are stored in an Amazon Aurora database.The number of users has grown to hundreds of thousands of players. The number ofrequests for password resets and login assistance has become a burden for the company’scustomer service team.The company needs to implement a solution to give players another way to log in to thegame. The solution must remove the burden of password resets and login assistance whilesecurely protecting each player's credentials.Which solution will meet these requirements?

A. When a new player signs up, use an AWS Lambda function to automatically create an1AM access key and a secret access key. Program the Lambda function to store thecredentials on the player's device. Create 1AM keys for existing players. B Migrate the player credentials from the Aurora database to AWS Secrets Manager. Whena new player signs up. create a key-value pair in Secrets Manager for the player's user IDand password.
B. Configure Amazon Cognito user pools to federate access to the game with third-partyidentity providers (IdPs), such as social IdPs Migrate the game's authentication mechanismto Cognito.
C. Instead of using usernames and passwords for authentication, issue API keys to newand existing players. Create an Amazon API Gateway API to give the game client accessto the game's functionality.

Show Answer

Question # 15

A company wants to receive automated email notifications when AWS access keys fromdeveloper AWS accounts are detected on code repository sites.Which solution will provide the required email notifications?

A. Create an Amazon EventBridge rule to send Amazon Simple Notification Service(Amazon SNS) email notifications for Amazon GuardDutyUnauthorizedAccesslAMUser/lnstanceCredentialExfiltration OutsideAWS findings.
B. Change the AWS account contact information for the Operations type to a separateemail address. Periodically poll this email address for notifications.
C. Create an Amazon EventBridge rule that reacts to AWS Health events that have a valueof Risk for the service category Configure email notifications by using Amazon SimpleNotification Service (Amazon SNS).
D. D. Implement new anomaly detection software. Ingest AWS CloudTrail logs. Configuremonitoring for ConsoleLogin events in the AWS Management Console. Configure emailnotifications from the anomaly detection software.

Show Answer