Amazon SCS-C02 Exam Questions Instant Access

Question 1

[Incident Response]

A company has a new web-based account management system for an online game Players create a unique username and password to log in to the system.

The company has implemented an AWS WAF web ACL for the system. The web ACL includes the core rule set (CRS) AWS managed rule group on the Application Load Balancer that serves the system.

The company's security team finds that the system was the target of a credential stuffing attack Credentials that were exposed in other breaches were used to try to log in to the system

The security team must implement a solution to reduce the chance of a successful credential stuffing attack in the future The solution also must minimize impact on legitimate users of the system

Which combination of actions will meet these requirements? (Select TWO.)

ACreate an Amazon CloudWatch custom metric to analyze the number of successful login responses from a single IP address

BAdd the account takeover prevention (ATP) AWS managed rule group to the web ACL Configure the rule group to inspect login requests to the system Block any requests that have the awswaf managed awsatp signal credential_compromised label

CConfigure a default web ACL action that requires all users to solve a CAPTCHA puzzle when they log in

DImplement IP-based match rules in the web ACL for any IP addresses that generate many successful login responses Block any IP addresses that generate many successful logins

ECreate a custom block response that redirects users to a secure workflow to reset their password inside the system

Answer : B, E

Question 2

[Identity and Access Management]

A company has an AWS Key Management Service (AWS KMS) customer managed key with imported key material Company policy requires all encryption keys to be rotated every year

What should a security engineer do to meet this requirement for this customer managed key?

AEnable automatic key rotation annually for the existing customer managed key

BUse the AWS CLI to create an AWS Lambda function to rotate the existing customer managed key annually

CImport new key material to the existing customer managed key Manually rotate the key

DCreate a new customer managed key Import new key material to the new key Point the key alias to the new key

Answer : A

To meet the requirement of rotating the AWS KMS customer managed key every year, the most appropriate solution would be to enable automatic key rotation annually for the existing customer managed key. This will ensure that AWS KMS generates new cryptographic material for the CMK every year. AWS KMS also saves the CMK's older cryptographic material in perpetuity so it can be used to decrypt data that it encrypted. AWS KMS does not delete any rotated key material until you delete the CMK.

References: :Key Rotation Enabled | Trend Micro:Rotating AWS KMS keys - AWS Key Management Service

Question 3

[Identity and Access Management]

A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS account.

Which solutions will provide the Lambda function this access? (Select TWO.)

ACreate an IAM user that has only programmatic access. Create a new access key pair. Add environmental variables to the Lambda function with the ac-cess key ID and secret access key. Modify the Lambda function to use the environmental variables at run time during communication with Amazon S3.

BGenerate an Amazon EC2 key pair. Store the private key in AWS Secrets Man-ager. Modify the Lambda function to retrieve the private key from Secrets Manager and to use the private key during communication with Amazon S3.

CCreate an IAM role for the Lambda function. Attach an IAM policy that al-lows access to the S3 bucket.

DCreate an IAM role for the Lambda function. Attach a bucket policy to the S3 bucket to allow access. Specify the function's IAM role as the princi-pal.

ECreate a security group. Attach the security group to the Lambda function. Attach a bucket policy that allows access to the S3 bucket through the se-curity group ID.

Answer : C, D

Question 4

[Infrastructure Security]

A company plans to use AWS Key Management Service (AWS KMS) to implement an encryption strategy to protect data at rest. The company requires client-side encryption for company projects. The company is currently conducting multiple projects to test the company's use of AWS KMS. These tests have led to a sudden increase in the company's AWS resource consumption. The test projects include applications that issue multiple requests each second to KMS endpoints for encryption activities.

The company needs to develop a solution that does not throttle the company's ability to use AWS KMS. The solution must improve key usage for client-side

encryption and must be cost optimized.

Which solution will meet these requirements?

AUse keyrings with the AWS Encryption SDK. Use each keyring individually or combine keyrings into a multi-keyring. Decrypt the data by using a keyring that has the primary key in the multi-keyring.

BUse data key caching. Use the local cache that the AWS Encryption SDK provides with a caching cryptographic materials manager.

CUse KMS key rotation. Use a local cache in the AWS Encryption SDK with a caching cryptographic materials manager.

DUse keyrings with the AWS Encryption SDK. Use each keyring individually or combine keyrings into a multi-keyring. Use any of the wrapping keys in the multi-keyring to decrypt the data.

Answer : B

The correct answer is B. Use data key caching. Use the local cache that the AWS Encryption SDK provides with a caching cryptographic materials manager.

This answer is correct because data key caching can improve performance, reduce cost, and help the company stay within the service limits of AWS KMS. Data key caching stores data keys and related cryptographic material in a cache, and reuses them for encryption and decryption operations. This reduces the number of requests to AWS KMSendpoints and avoids throttling.The AWS Encryption SDK provides a local cache and a caching cryptographic materials manager (caching CMM) that interacts with the cache and enforces security thresholds that the company can set1.

The other options are incorrect because:

A . Using keyrings with the AWS Encryption SDK does not address the problem of throttling or cost optimization. Keyrings are used to generate, encrypt, and decrypt data keys, but they do not cache or reuse them.Using each keyring individually or combining them into a multi-keyring does not reduce the number of requests to AWS KMS endpoints2.

C . Using KMS key rotation does not address the problem of throttling or cost optimization. Key rotation is a security practice that creates new cryptographic material for a KMS key every year, but it does not affect the data that the KMS key protects.Key rotation does not reduce the number of requests to AWS KMS endpoints, and it might incur additional costs for storing multiple versions of key material3.

D . Using keyrings with the AWS Encryption SDK does not address the problem of throttling or cost optimization, as explained in option A. Moreover, using any of the wrapping keys in the multi-keyring to decrypt the data is not a valid option, because only one of the wrapping keys can decrypt a given data key.The wrapping key that encrypts a data key is stored in the encrypted data key structure, andonly that wrapping key can decrypt it4.

References:

1:Data key caching - AWS Encryption SDK2:Using keyrings - AWS Encryption SDK3:Rotating AWS KMS keys - AWS Key Management Service4:How keyrings work - AWS Encryption SDK

Question 5

[Identity and Access Management]

An IT department currently has a Java web application deployed on Apache Tomcat running on Amazon EC2 instances. All traffic to the EC2 instances is sent through an internet-facing Application Load Balancer (ALB) The Security team has noticed during the past two days thousands of unusual read requests coming from hundreds of IP addresses. This is causing the Tomcat server to run out of threads and reject new connections

Which the SIMPLEST change that would address this server issue?

ACreate an Amazon CloudFront distribution and configure the ALB as the origin

BBlock the malicious IPs with a network access list (NACL).

CCreate an IAM Web Application Firewall (WAF). and attach it to the ALB

DMap the application domain name to use Route 53

Answer : A

this is the simplest change that can address the server issue. CloudFront is a service that provides a global network of edge locations that cache and deliver web content. Creating a CloudFront distribution and configuring the ALB as the origin can help reduce the load on the Tomcat server by serving cached content to the end users. CloudFront can also provide protection against distributed denial-of-service (DDoS) attacks by filtering malicious traffic at the edge locations. The other options are either ineffective or complex for solving the server issue.

Question 6

[Logging and Monitoring]

A company has a legacy application that runs on a single Amazon EC2 instance. A security audit shows that the application has been using an IAM access key within its code to access an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET1 in the same AWS account. This access key pair has the s3:GetObject permission to all objects in only this S3 bucket. The company takes the application offline because the application is not compliant with the company's security policies for accessing other AWS resources from Amazon EC2.

A security engineer validates that AWS CloudTrail is turned on in all AWS Regions. CloudTrail is sending logs to an S3 bucket that is named DOC-EXAMPLE-BUCKET2. This S3 bucket is in the same AWS account as DOC-EXAMPLE-BUCKET1. However, CloudTrail has not been configured to send logs to Amazon CloudWatch Logs.

The company wants to know if any objects in DOC-EXAMPLE-BUCKET1 were accessed with the IAM access key in the past 60 days. If any objects were accessed, the company wants to know if any of the objects that are text files (.txt extension) contained personally identifiable information (PII).

Which combination of steps should the security engineer take to gather this information? (Choose two.)

AConfigure Amazon Macie to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII and that were available to the access key.

BUse Amazon CloudWatch Logs Insights to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII and that were available to the access key.

CUse Amazon OpenSearch Service (Amazon Elasticsearch Service) to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for API calls that used the access key to access an object that contained PII.

DUse Amazon Athena to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for any API calls that used the access key to access an object that contained PII.

EUse AWS Identity and Access Management Access Analyzer to identify any API calls that used the access key to access objects that contained PII in DOC-EXAMPLE-BUCKET1.

Answer : A, D

Question 7

[Logging and Monitoring]

A company runs workloads on Amazon EC2 instances. The company needs to continually monitor the EC2 instances for software vulnerabilities and must display the findings in AWS Security Hub. The company must not install agents on the EC2 instances.

AEnable Amazon Inspector. Set the scan mode to hybrid scanning. Enable the integration for Amazon Inspector in Security Hub.

BUse Security Hub to enable the AWS Foundational Security Best Practices standard.Wait for Security Hub to generate the findings.

CEnable Amazon GuardDuty. Initiate on-demand malware scans by using GuardDuty Malware Protection. Enable the integration for GuardDuty in Security Hub.

DUse AWS Config managed rules to detect EC2 software vulnerabilities. Ensure that Security Hub has the AWS Config integration enabled.

Answer : A

Comprehensive Detailed Explanation with all AWS References

To monitor EC2 instances for software vulnerabilities without installing agents and to display findings in AWS Security Hub,Amazon Inspectoris the most appropriate solution.

Amazon Inspector Overview:

Amazon Inspector is a vulnerability management service that automatically scans Amazon EC2 instances and container images in Amazon Elastic Container Registry (ECR) for known vulnerabilities.

It does not require agent installation as it integrates directly with EC2 metadata and uses network-based scanning.

Integration with AWS Security Hub:

Enable the integration of Amazon Inspector with Security Hub to ingest and display findings in a centralized dashboard.

Security Hub will show Inspector's findings as part of its comprehensive security overview.

Why Not Other Options?

Option B:Security Hub's AWS Foundational Security Best Practices standard provides a broad set of checks but does not include detailed vulnerability scanning for EC2 instances.

Option C:GuardDuty is focused on detecting security threats and anomalies, not software vulnerabilities.

Option D:AWS Config managed rules provide compliance checks but lack detailed vulnerability scanning.

Amazon AWS Certified Security - Specialty (old) SCS-C02 Exam Questions