SCS-C02 Exam Questions
470 real SCS-C02 exam questions with expert-verified answers and explanations. Page 10 of 10.
- Question #459Security Logging and Monitoring
A company's security policy requires all Amazon EC2 instances to use the Amazon Time Sync Service. AWS CloudTrail trails are enabled in all of the company's AWS accounts. VPC flow...
VPC flow logsNTPnetwork monitoringAmazon Time Sync - Question #460Management and Security Governance
A company has a multi-account strategy that uses an organization in AWS Organizations with all features enabled. The company has enabled trusted access for AWS Account Management....
AWS Security HubAWS OrganizationsDelegated AdministratorMulti-account Security - Question #463Infrastructure Security
A company has a new web-based account management system for an online game. Players create a unique username and password to log in to the system. The company has implemented an AW...
AWS WAFcredential stuffingaccount takeover preventionATP rule group - Question #464Infrastructure Security
A company is operating an open-source software platform that is internet facing. The legacy software platform no longer receives security updates. The software platform operates us...
AWS WAFSQL injectionApplication Load Balancerweb ACL - Question #465Data Protection
A company runs an application that sends logs to a log group in Amazon CloudWatch Logs. The email addresses of the application users are in the logs. The company's developers need...
CloudWatch Logsdata protection policyPII maskingmanaged data identifiers - Question #466Data Protection
A security engineer is implementing a logging solution for a company's AWS environment. The security engineer has configured an AWS CloudTrail trail in the company's AWS account. T...
KMS key policyCloudTrail encryptionkms:Decryptcross-account access - Question #467Data Protection
A company must retain backup copies of Amazon RDS DB instances and Amazon Elastic Block Store (Amazon EBS) volumes. The company must retain the backup copies in data centers that a...
AWS Backupcross-region replicationRDSEBS - Question #468Threat Detection and Incident Response
A company runs workloads that are spread across hundreds of Amazon EC2 instances. During a recent security incident, an EC2 instance was compromised and ran malware code until the...
GuardDutyAutomated Incident ResponseLambdaEC2 Security - Question #469Infrastructure Security
A public subnet contains two Amazon EC2 instances. The subnet has a custom network ACL. A security engineer is designing a solution to improve the subnet security. The solution mus...
network ACLstateless rulesephemeral portsport 3306 - Question #470Identity and Access Management
A company is investigating actions that an IAM role performed. The company must find out when the role last accessed AWS Security Hub and when the role last used the DeleteInsight...
IAM Access Advisorlast accessed serviceSecurity Hubrole activity - Question #471Threat Detection and Incident Response
A company is migrating container workloads from a data center to Amazon Elastic Container Service (Amazon ECS) clusters. The company must implement a solution to detect potential t...
GuardDutyRuntime MonitoringECScontainer threat detection - Question #472Threat Detection and Incident Response
A security engineer needs to implement a solution to determine whether a company's Amazon EC2 instances are being used to mine cryptocurrency. The solution must provide notificatio...
GuardDutycryptocurrency miningEventBridgeSNS notifications - Question #473Data Protection
A company must create annual snapshots of Amazon Elastic Block Store (Amazon EBS) volumes. The company must retain the snapshots for 10 years. The company will use AWS Key Manageme...
KMS key rotationsymmetric keysEBS encryptioncustomer managed keys - Question #474Identity and Access Management
A company has hundreds of AWS accounts and uses AWS Organizations. The company plans to create many different IAM roles and policies for its product team, security team, and platfo...
IAM pathSCPsIAM delegationOrganizations - Question #475Identity and Access Management
A company's developers are using AWS Lambda function URLs to invoke functions directly. The company must ensure that developers cannot configure or deploy unauthenticated functions...
Lambda function URLsSCPsunauthenticated accessOrganizations - Question #476Security Logging and Monitoring
A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards. However, the security engineer is con...
AWS Configcomplianceconfiguration historyresource tracking - Question #477Management and Security Governance
A company uses AWS Organizations to manage an organization that consists of three workload OUs: Production, Development, and Testing. The company uses AWS CloudFormation templates...
CloudTrailSCP troubleshootingCloudFormationAPI call analysis - Question #478Data Protection
A company hosts a web-based application that captures and stores sensitive data in an Amazon DynamoDB table. The company needs to implement a solution that provides end-to-end data...
DynamoDB Encryption Clientclient-side encryptionitem signingend-to-end protection - Question #479Infrastructure Security
A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running in Amazon Elastic Container Service (Amazon ECS)....
NLB TLS pass-throughECS encryptionload balancer selectionend-to-end encryption - Question #480Infrastructure Security
A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application. The application processes sensitive data and has the following compliance requirements:...
Systems Manager Session ManagerIAM Identity CenterEC2 access controlaudit logging