Free Amazon SCS-C02 Exam Questions

Question 1

A company has a critical web application running on a fleet of auto scaling Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is associated with an AWS WAF web ACL. The security team has identified suspicious port scans coming from a specific range of internet IP addresses. A security engineer needs to block access from the identified addresses.Which solution meets these requirements?

A : Modify the web ACL with an IP set match rule statement and a block action to deny incoming requests from the IP address range.

B : Modify the web ACL with a rate-based rule statement and a block action to deny incoming requests from the IP address range.

C : Add a rule to the ALB security group to deny incoming requests from the IP address range.

D : Create an Amazon CloudFront distribution in front of the ALB and use geo restrictions to block access from the IP address range.

Answer: A

Question 2

A security engineer is attempting to setup automatic notifications that alert administrators about any changes that are made to an Amazon S3 bucket. The engineer has configured AWS Config and created an SNS topic. Changes have been made to the S3 bucket, but the SNS notifications have not been sent.Which combination of steps should the security engineer take to resolve the issue? (Select THREE.)

A : Configure the trust policy on the IAM role AWS Config uses to allow “s3.amazonaws.com” to assume the role.

B : Configure the trust policy on the IAM role AWS Config uses to allow “config.amazonaws.com” to assume the role.

C : Configure the Amazon S3 bucket ACLs to allow AWS Config to record any changes made to the S3 bucket.

D : Configure the access policy for the Amazon SNS topic to allow “sns:publish” access to “config.amazonaws.com”.

E : Configure the role policy on the IAM role AWS Config uses to allow write access to the Amazon S3 bucket.

F : Configure the access policy for the Amazon SNS topic to allow “sns:write” access to “config.amazonaws.com”.

Answer: B,D,F

Question 3

A security engineer has been asked to review an Amazon S3 bucket policy to determine if the data is properly secured against public access. The policy statement is as follows:What should the response be from the security engineer?Is this bucket policy sufficient to ensure that the data is not publicly accessible?

A : The S3 bucket ACL and object ACLs will need to be checked to determine if public access is possible.

B : The bucket policy does not block access from public IP addresses regardless of the bucket ACL and object ACL settings.

C : The bucket policy will block all access from public IP addresses and will only allow connections from the specified private CIDR.

D : IAM user policies will need to be checked to determine if public access is granted through these policies.

Answer: A

Question 4

An administrative user accidentally exposed an access key ID and secret access key to a public support forum. The user notified the security team about the incident after removing the exposed credentials from the forum.Which initial steps should a security engineer take to mitigate the exposure without interrupting operations? (Select TWO.)

A : Reset the password for the root user on the account.

B : Terminate or disable any resources the user has access to.

C : Implement a deny policy blocking access to resources.

D : Invalidate any temporary security credentials.

E : Delete the access key ID and secret access key.

Answer: C,E

Question 5

A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager. Which solution will meet the requirements?

A : Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.

B : Use a parameter in the CloudFormation template to reference the database credentials. Encrypt the CloudFormation template by using AWS KMS.

C : Use a SecureString parameter in the CloudFormation template to reference the database credentials in Secrets Manager.

D : Use a SecureString parameter in the CloudFormation template to reference an encrypted value in AWS KMS

Answer: A