SCS-C02 Exam Questions
470 real SCS-C02 exam questions with expert-verified answers and explanations. Page 8 of 10.
- Question #359Infrastructure Security
A company is deploying a new web application on AWS. Based on their other web applications, they anticipate being the target of frequent DDoS attacks. Which steps can the company u...
DDoS protectionWAFCloudFrontAuto Scaling - Question #360Infrastructure Security
A company is using AWS Secrets Manager to store secrets for its production Amazon RDS database. The Security Officer has asked that secrets be rotated every 3 months. Which solutio...
Secrets Manager rotationAWS Lambda VPCAmazon RDS securityPrivate subnets - Question #361Identity and Access Management
An employee keeps terminating EC2 instances on the production environment. You've determined the best way to ensure this doesn't happen is to add an extra layer of defense against...
IAM resource-level permissionsEC2 termination protectionMFA enforcementinstance tagging - Question #362Identity and Access Management
An organization has setup multiple IAM users. The organization wants that each IAM user accesses the IAM console only within the organization and not from outside. How can it achie...
IAM policy conditionsIP-based access controlconsole access restriction - Question #363Data Protection
A company has a set of EC2 Instances hosted in AWS. The EC2 Instances have EBS volumes which is used to store critical information. There is a business continuity requirement to en...
EBS snapshotshigh availabilitydata backupbusiness continuity - Question #364Data Protection
You need to have a cloud security device which would allow to generate encryption keys based on FIPS 140-2 Level 3. Which of the following can be used for this purpose?
Encryption KeysFIPS 140-2Key Management Service (KMS)Hardware Security Module (HSM) - Question #365Data Protection
Attach the following SCP to the OU that contains this account:
Data ProtectionEncryptionEC2 SnapshotsAWS Organizations - Question #366Infrastructure Security
Your company has a set of 1000 EC2 Instances defined in an AWS Account. They want to effectively automate several administrative tasks on these instances. Which of the following wo...
Systems Manager Run CommandEC2 automationadministrative tasks - Question #367Infrastructure Security
There is a set of Ec2 Instances in a private subnet. The application hosted on these EC2 Instances need to access a DynamoDB table. It needs to be ensured that traffic does not flo...
VPC endpointDynamoDBprivate subnetnetwork isolation - Question #368Incident Response
Your company hosts a large section of EC2 instances in AWS. There are strict security rules governing the EC2 Instances. During a potential security breach , you need to ensure qui...
CloudFormationforensic environmentincident responseEC2 - Question #369Data Protection
A company stores critical data in an S3 bucket. There is a requirement to ensure that an extra level of security is added to the S3 bucket. In addition , it should be ensured that...
S3 versioningcross-region replicationMFA deletebucket policy conditions - Question #370Data Protection
You need to have a requirement to store objects in an S3 bucket with a key that is automatically managed and rotated. Which of the following can be used for this purpose?
S3 SSE-S3encryption at restauto key rotationserver-side encryption - Question #371Incident Response
One of the EC2 Instances in your company has been compromised. What steps would you take to ensure that you could apply digital forensics on the Instance. Select 2 answers from the...
digital forensicsEC2 isolationforensic instanceincident containment - Question #372Security Logging and Monitoring
Your company has a set of EC2 Instances defined in AWS. These Ec2 Instances have strict security groups attached to them. You need to ensure that changes to the Security groups are...
CloudWatch Eventssecurity group monitoringchange detectionalerting - Question #373Infrastructure Security
Your company has a set of EC2 Instances defined in AWS. They need to ensure that all traffic packets are monitored and inspected for any security threats. How can this be achieved?...
host-based IDSintrusion detectiontraffic inspectionnetwork security - Question #374Management and Security Governance
A company had developed an incident response plan 18 months ago. Regular implementations of the response plan are carried out. No changes have been made to the response plan have b...
incident response planplan maintenancesecurity governancenew services coverage - Question #375Identity and Access Management
You are planning to use AWS Configto check the configuration of the resources in your AWS account. You are planning on using an existing IAM role and using it for the AWS Config re...
AWS ConfigIAM role trust policyservice rolecross-service permissions - Question #376Data Protection
You are planning on using the AWS KMS service for managing keys for your application. For which of the following can the KMS CMK keys be used for encrypting? Choose 2 answers from...
KMS CMKencryption scopekey managementsmall data encryption - Question #377Data Protection
A company is using a Redshift cluster to store their data warehouse. There is a requirement from the Internal IT Security team to ensure that data gets encrypted for the Redshift d...
Redshift encryptionKMS CMKencryption at restdata warehouse security - Question #378Identity and Access Management
Your company is planning on developing an application in AWS. This is a web based application. The application user will use their facebook or google identities for authentication....
Amazon Cognitosocial identity federationuser profile managementOAuth - Question #379Identity and Access Management
You have just developed a new mobile application that handles analytics workloads on large scale datasets that are stored on Amazon Redshift. Consequently, the application needs to...
web identity federationIAM rolesRedshift accessmobile application security - Question #380Security Logging and Monitoring
Your company makes use of S3 buckets for storing data. There is a company policy that all services should have logging enabled. How can you ensure that logging is always enabled fo...
AWS Config RulesS3 loggingcompliance enforcementgovernance automation - Question #381Infrastructure Security
A company is operating a website using Amazon CloudFornt. CloudFront servers some content from Amazon S3 and other from web servers running EC2 instances behind an Application. Loa...
End-to-end encryptionTLS/HTTPS configurationCloudFrontApplication Load Balancer - Question #382Identity and Access Management
Your company has many AWS accounts defined and all are managed via AWS Organizations. One AWS account has a S3 bucket that has critical data. How can we ensure that all the users i...
S3 bucket policyaws:PrincipalOrgIDAWS Organizationsresource-based policy - Question #383Infrastructure Security
A company is planning on extending their on-premise AWS Infrastructure to the AWS Cloud. They need to have a solution that would give core benefits of traffic encryption and ensure...
AWS Direct ConnectAWS VPNhybrid connectivitytraffic encryption - Question #384Identity and Access Management
You need to create a policy and apply it for just an individual user. How could you accomplish this in the right way?
inline policyIAM policy typesuser permissions - Question #385Data Protection
You have a set of Keys defined using the AWS KMS service. You want to stop using a couple of keys , but are not sure of which services are currently using the keys. Which of the fo...
AWS KMSCMK lifecyclekey disablekey deletion - Question #386Infrastructure Security
You have a set of application , database and web servers hosted in AWS. The web servers are placed behind an ELB. There are separate security groups for the application, database a...
security groupsinbound rulesoutbound rulesnetwork troubleshooting - Question #387Data Protection
Your company has confidential documents stored in the simple storage service. Due to compliance requirements, you have to ensure that the data in the S3 bucket is available in a di...
S3 cross-region replicationdata residencycomplianceS3 - Question #388Infrastructure Security
Your current setup in AWS consists of the following architecture. 2 public subnets, one subnet which has the web servers accessed by users across the internet and the other subnet...
private subnetVPC architecturenetwork segmentationdatabase security - Question #389Security Logging and Monitoring
An auditor needs access to logs that record all API events on AWS. The auditor only needs read- only access to the log files and does not need access to each AWS account. The compa...
CloudTrailmulti-account loggingcentralized loggingaudit logs - Question #390Data Protection
A company has a requirement to create a DynamoDB table. The company's software architect has provided the following CLI command for the DynamoDB table Which of the following has be...
DynamoDB encryption at restSSEAWS CLICMK - Question #391Security Logging and Monitoring
A company is planning to run a number of Admin related scripts using the AWS Lambda service. There is a need to understand if there are any errors encountered when the script run....
CloudWatch metricsCloudWatch logsLambda monitoringerror detection - Question #392Threat Detection and Incident Response
An IT department currently has a Java web application deployed on Apache Tomcat running on Amazon EC2 instances. All traffic to the EC2 instances is sent through an internet-facing...
DDoS MitigationApplication Layer AttackCloudFrontCaching - Question #393Infrastructure Security
A windows machine in one VPC needs to join the AD domain in another VPC. VPC Peering has been established. But the domain join is not working. What is the other step that needs to...
VPC peeringActive Directorysecurity groupsnetwork connectivity - Question #394Infrastructure Security
How can you ensure that instance in an VPC does not use AWS DNS for routing DNS requests. You want to use your own managed DNS instance. How can this be achieved?
DHCP options setVPC DNScustom DNS serverVPC networking - Question #395Data Protection
A company continually generates sensitive records that it stores in an S3 bucket. All objects in the bucket are encrypted using SSE-KMS using one of the company's CMKs. Company com...
KMS CMK rotationS3 SSE-KMSkey lifecycle managementcompliance automation - Question #396Identity and Access Management
An EC2 Instance hosts a Java based application that access a DynamoDB table. This EC2 Instance is currently serving production based users. Which of the following is a secure way o...
IAM rolesEC2 instance profileDynamoDB accessleast privilege - Question #397Infrastructure Security
Your company looks at the gaming domain and hosts several Ec2 Instances as game servers. The servers each experience user loads in the thousands. There is a concern of DDos attacks...
AWS Shield AdvancedDDoS protectionEC2 availabilityvolumetric attacks - Question #398Infrastructure Security
DDoS attacks that happen at the application layer commonly target web applications with lower volumes of traffic compared to infrastructure attacks. To mitigate these types of atta...
AWS WAFAuto Scalinglayer 7 DDoSapplication security - Question #399Data Protection
A company is hosting sensitive data in an AWS S3 bucket. It needs to be ensured that the bucket always remains private. How can this be ensured continually? Choose 2 answers from t...
S3 SecurityAWS ConfigAutomated RemediationAccess Control - Question #400Security Logging and Monitoring
You need to ensure that the cloudtrail logs which are being delivered in your AWS account is encrypted. How can this be achieved in the easiest way possible?
CloudTraillog encryptionSSE-S3default encryption - Question #401Infrastructure Security
Your company has a hybrid environment, with on-premise servers and servers hosted in the AWS cloud. They are planning to use the Systems Manager for patching servers. Which of the...
AWS Systems Managerhybrid patchingIAM service roleon-premises servers - Question #402Data Protection
A company is using Amazon Elastic Container Service (Amazon ECS) to deploy an application that deals with sensitive data During a recent security audit, the company identified a se...
AWS Secrets Managercredentials rotationECS securitydatabase credentials - Question #403Infrastructure Security
You are building a large-scale confidential documentation web server on AWSand all of the documentation for it will be stored on S3. One of the requirements is that it cannot be pu...
CloudFront OAIOrigin Access IdentityS3 bucket policycontent delivery security - Question #404Infrastructure Security
You have a bucket and a VPC defined in AWS. You need to ensure that the bucket can only be accessed by the VPC endpoint. How can you accomplish this?
S3 bucket policyVPC endpointresource-based policyaccess control - Question #405Threat Detection and Incident Response
An Incident Response team is investigating an AWS access key leak that resulted in Amazon EC2 instances being launched. The company did not discover the incident until many months...
Threat DetectionSecurity MonitoringAWS GuardDutyVPC Flow Logs - Question #406Infrastructure Security
You have an Amazon VPC that has a private subnet and a public subnet in which you have a NAT instance server. You have created a group of EC2 instances that configure themselves at...
VPC private subnetNAT instanceEC2 securitynetwork architecture - Question #407Identity and Access Management
Every application in a company's portfolio has a separate AWS account for development and production. The security team wants to prevent the root user and all IAM users in the prod...
Service Control PolicyAWS Organizationsroot user restrictionproduction account governance - Question #408Identity and Access Management
A company's AWS account consists of approximately 300 IAM users. Now there is a mandate that an access change is required for 100 IAM users to have unlimited privileges to S3.As a...
IAM groupsS3 permissionsuser managementpolicy assignment