SCS-C01 sample questions

Question 1

A company wants to deploy an application in a private VPC that will not be connected to the internet. The company’s security team will not allow bastion hosts or methods using SSH to log in to Amazon EC2 instances. The application team plans to use AWS Systems Manager Session Manager to connect to and manage the EC2 instances.

Which combination of steps should the security team take? (Choose three.)

Accepted Answer

Make sure the Systems Manager Agent is installed and running on all EC2 instances inside the VPC.

Accepted Answer

Ensure the 1AM role attached to the EC2 instances in the VPC allows access to Systems Manager.

Accepted Answer

Ensure proper VPC endpoints are in place for Systems Manager and Amazon EC2.

Answer

Create an SCP that prevents the creation of SSH key pairs.

Answer

Launch a NAT gateway in the VPC. Update the routing policies to forward traffic to this NAT gateway.

Answer

Ensure the VPC has a transit gateway attachment. Update the routing policies to forward traffic to this transit gateway.

Question 2

A company is using AWS Organizations to manage multiple AWS accounts. The company has an application that allows users to assume the AppUser 1AM role to download files from an Amazon S3 bucket that is encrypted with an AWS KMS CMK. However, when users try to access the files in the S3 bucket, they get an access denied error.

What should a security engineer do to troubleshoot this error? (Choose three.)

Accepted Answer

Ensure the S3 bucket policy allows the AppUser role to have permission to get objects for the S3 bucket.

Accepted Answer

Ensure the S3 block public access feature is enabled for the S3 bucket.

Accepted Answer

Ensure that automatic key rotation is disabled for the CMK.

Answer

A Ensure the KMS policy allows the AppUser role to have permission to decrypt for the CMK.

Answer

Ensure the CMK was created before the S3 bucket.

Answer

Ensure the SCPs within Organizations allow access to the S3 bucket.

Question 3

A company has hundreds of AWS accounts, and a centralized Amazon S3 bucket used to collect AWS CloudTrail logs for all of these accounts. A Security Engineer wants to create a solution that will enable the company to run ad hoc queries against its CloudTrail logs dating back 3 years from when the trails were first enabled in the company’s AWS account.

How should the company accomplish this with the least amount of administrative overhead?

Accepted Answer

Use the events history feature of the CloudTrail console to query the CloudTrail trails.

Answer

Run an Amazon EMR cluster that uses a MapReduce job to examine the CloudTrail trails.

Answer

Write an AWS Lambda function to query the CloudTrail trails. Configure the Lambda function to be executed whenever a new file is created in the CloudTrail S3 bucket.

Answer

Create an Amazon Athena table that looks at the S3 bucket the CloudTrail trails are being written to. Use Athena to run queries against the trails.

Question 4

An organization wants to log all AWS API calls made within all of its AWS accounts, and must have a central place to analyze these logs.

What steps should be taken to meet these requirements in the MOST secure manner? (Choose two.)

Accepted Answer

Turn on CloudTrail in only the account that will be storing the logs.

Accepted Answer

Update the bucket policy of the bucket in the account that will be storing the logs so that other accounts can log to it.

Answer

Turn on AWS CloudTrail in each AWS account.

Answer

Update the bucket ACL of the bucket in the account that will be storing the logs so that other accounts can log to it.

Answer

Create a service-based role for CloudTrail and associate it with CloudTrail in each account.

Question 5

What is the function of the following AWS Key Management Service (KMS) key policy attached to a customer master key (CMK)?

Accepted Answer

The CMK is to be used for encrypting and decrypting only when the principal is ExampleUser and the request comes from WorkMail or SES in the specified region.

Answer

The Amazon WorkMail and Amazon SES services have delegated KMS encrypt and decrypt permissions to the Examplellser principal in the 111122223333 account.

Answer

The Examplellser principal can transparently encrypt and decrypt email exchanges specifically between ExampleUser and AWS.

Answer

The key policy allows WorkMail or SES to encrypt or decrypt on behalf of the user for any CMK in the account.

Question 6

Developers in an organization have moved from a standard application deployment to containers. The Security Engineer is tasked with ensuring that containers are secure.

Which strategies will reduce the attack surface and enhance the security of the containers? (Choose two.)

Accepted Answer

Limit resource consumption (CPU, memory), networking connections, ports, and unnecessary container libraries

Accepted Answer

Use Docker Notary framework to sign task definitions.

Answer

Use the containers to automate security deployment

Answer

Segregate container by host, function, and data classification.

Answer

Enable container breakout at the host kerne

Question 7

During a recent internal investigation, it was discovered that all API logging was disabled in a production account, and the root user had created new API keys that appear to have been used several times.
What could have been done to detect and automatically remediate the incident?

Accepted Answer

Using Amazon CloudWatch, create a CloudWatch event that detects AWS CloudTrail deactivation and a separate Amazon Trusted Advisor check to automatically detect the creation of root API keys. Then use a Lambda function to enable AWS CloudTrail and deactivate the root API keys.

Answer

Using Amazon Inspector, review all of the API calls and configure the inspector agent to leverage SNS topics to notify security of the change to AWS CloudTrail, and revoke the new API keys for the root user.

Answer

Using AWS Config, create a config rule that detects when AWS CloudTrail is disabled, as well as any calls to the root user create-api-key. Then use a Lambda function to re-enable CloudTrail logs and deactivate the root API keys.

Answer

Using Amazon CloudTrail, create a new CloudTrail event that detects the deactivation of CloudTrail logs, and a separate CloudTrail event that detects the creation of root API keys. Then use a Lambda function to enable CloudTrail and deactivate the root API keys.

Question 8

A Security Administrator has a website hosted in Amazon S3. The Administrator has been given the following requirements:

. Users may access the website by using an Amazon CloudFront distribution.
. Users may not access the website directly by using an Amazon S3 URL.

Which configurations will support these requirements? (Choose two.)

Accepted Answer

Associate an origin access identity with the CloudFront distribution

Accepted Answer

Modify the S3 bucket permissions so that only the origin access identity can access the bucket contents.

Answer

Implement a “Principal”: “cloudfront.amazonaws.com” condition in the S3 bucket policy.

Answer

Implement security groups so that the S3 bucket can be accessed only by using the intended CloudFront distribution.

Answer

Configure the S3 bucket policy so that it is accessible only through VPC endpoints, and place the CloudFront distribution into the specified VPC

Question 9

A company has a forensic logging use case whereby several hundred applications running on Docker on EC2 need to send logs to a central location. The Security Engineer must create a logging solution that is able to perform real-time analytics on the log files, grants the ability to replay events, and persists data.

Which AWS Services, together, can satisfy this use case? (Choose two.)

Accepted Answer

Amazon Kines

Accepted Answer

Amazon Cloud Watch

Answer

Amazon Elasticsear

Answer

Amazon SQS

Answer

Amazon Athena

Question 10

A Security Engineer is implementing a solution to allow users to seamlessly encrypt Amazon S3 objects without having to touch the keys directly. The solution must be highly scalable without requiring continual management. Additionally, the organization must be able to immediately delete the encryption keys.

Which solution meets these requirements?

Accepted Answer

Use KMS with AWS imported key material and then use the DeletelmportedKeyMaterial API to remove the key material if necessary.

Answer

Use AWS KMS with AWS managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.

Answer

Use AWS CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.

Answer

Use the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the key if necessary.

AWS Certified Security - Specialty Practice Questions

Unlock the full exam and previous versions

Create an account to continue.

Create an account to continue.

Related exams