SCS-C02 Online Practice Questions and Answers

Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic.

Which of the following troubleshooting steps should be performed?

A. Check inbound and outbound security groups, looking for DENY rules.

B. Check inbound and outbound Network ACL rules, looking for DENY rules.

C. Review the rejected packet reason codes in the VPC Flow Logs.

D. Use IAM X-Ray to trace the end-to-end application flow

An organization policy states that all encryption keys must be automatically rotated every 12 months.

Which IAM Key Management Service (KMS) key type should be used to meet this requirement?

A. IAM managed Customer Master Key (CMK)

B. Customer managed CMK with IAM generated key material

C. Customer managed CMK with imported key material

D. IAM managed data key

An Amazon EC2 instance is part of an EC2 Auto Scaling group that is behind an Application Load Balancer (ALB). It is suspected that the EC2 instance has been compromised. Which steps should be taken to investigate the suspected compromise? (Choose three.)

A. Detach the elastic network interface from the EC2 instance.

B. Initiate an Amazon Elastic Block Store volume snapshot of all volumes on the EC2 instance.

C. Disable any Amazon Route 53 health checks associated with the EC2 instance.

D. De-register the EC2 instance from the ALB and detach it from the Auto Scaling group.

E. Attach a security group that has restrictive ingress and egress rules to the EC2 instance.

F. Add a rule to an IAM WAF to block access to the EC2 instance.

A Security Engineer is building a Java application that is running on Amazon EC2. The application communicates with an Amazon RDS instance and authenticates with a user name and password. Which combination of steps can the Engineer take to protect the credentials and minimize downtime when the credentials are rotated? (Choose two.)

A. Have a Database Administrator encrypt the credentials and store the ciphertext in Amazon S3. Grant permission to the instance role associated with the EC2 instance to read the object and decrypt the ciphertext.

B. Configure a scheduled job that updates the credential in IAM Systems Manager Parameter Store and notifies the Engineer that the application needs to be restarted.

C. Configure automatic rotation of credentials in IAM Secrets Manager.

D. Store the credential in an encrypted string parameter in IAM Systems Manager Parameter Store. Grant permission to the instance role associated with the EC2 instance to access the parameter and the IAM KMS key that is used to encrypt it.

E. Configure the Java application to catch a connection failure and make a call to IAM Secrets Manager to retrieve updated credentials when the password is rotated. Grant permission to the instance role associated with the EC2 instance to access Secrets Manager.

A company has a forensic logging use case whereby several hundred applications running on Docker on EC2 need to send logs to a central location. The Security Engineer must create a logging solution that is able to perform real-time analytics on the log files, grants the ability to replay events, and persists data.

Which IAM Services, together, can satisfy this use case? (Select two.)

A. Amazon Elasticsearch

B. Amazon Kinesis

C. Amazon SQS

D. Amazon CloudWatch

E. Amazon Athena

Amazon CloudWatch Logs agent is successfully delivering logs to the CloudWatch Logs service. However, logs stop being delivered after the associated log stream has been active for a specific number of hours.

What steps are necessary to identify the cause of this phenomenon? (Choose two.)

A. Ensure that file permissions for monitored files that allow the CloudWatch Logs agent to read the file have not been modified.

B. Verify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming.

C. Configure an Amazon Kinesis producer to first put the logs into Amazon Kinesis Streams.

D. Create a CloudWatch Logs metric to isolate a value that changes at least once during the period before logging stops.

E. Use IAM CloudFormation to dynamically create and maintain the configuration file for the CloudWatch Logs agent.

A company hosts critical data in an S3 bucket. Even though they have assigned the appropriate permissions to the bucket, they are still worried about data deletion. What measures can be taken to restrict the risk of data deletion on the bucket? Choose 2 answers from the options given below

A. Enable versioning on the S3 bucket

B. Enable data at rest for the objects in the bucket

C. Enable MFA Delete in the bucket policy

D. Enable data in transit for the objects in the bucket

A System Administrator is unable to start an Amazon EC2 instance in the eu-west-1 Region using an IAM role The same System Administrator is able to start an EC2 instance in the eu-west-2 and eu-west-3 Regions. The IAMSystemAdministrator access policy attached to the System Administrator IAM role allows unconditional access to all IAM services and resources within the account

Which configuration caused this issue?

A. Option A

B. Option B

C. Option C

D. Option D

A company discovers a billing anomaly in its AWS account. A security consultant investigates the anomaly and discovers that an employee who left the company 30 days ago still has access to the account.

The company has not monitored account activity in the past.

The security consultant needs to determine which resources have been deployed or reconfigured by the employee as quickly as possible.

Which solution will meet these requirements?

A. In AWS Cost Explorer, filter chart data to display results from the past 30 days. Export the results to a data table. Group the data table by re-source.

B. Use AWS Cost Anomaly Detection to create a cost monitor. Access the detec-tion history. Set the time frame to Last 30 days. In the search area, choose the service category.

C. In AWS CloudTrail, filter the event history to display results from the past 30 days. Create an Amazon Athena table that contains the data. Parti-tion the table by event source.

D. Use AWS Audit Manager to create an assessment for the past 30 days. Apply a usage- based framework to the assessment. Configure the assessment to as-sess by resource.

A company has many member accounts in an organization in AWS Organizations. The company is concerned about the potential for misuse of the AWS account root user credentials for member accounts in the organization. To address this potential misuse, the company wants to ensure that even if the account root user credentials are compromised the account is still protected.

Which solution will meet this requirement?

A. Block service access by using SCPs for the root user

B. Remove the password for the root user

C. Delete access keys for the root user

D. Create an Amazon EventBridge rule to detect any AWS account root user API events