Limited-Time Summer Sale 25% Discount Offer - Apply Coupon Code: Save25
Certs Blitz
Sign in Create account
See all results for ""
Home Exams
CRISC ISACA CISSP ISC2 200-301 Cisco SY0-701 CompTIA AZ-104 Microsoft AI-900 Microsoft AIGP IAPP 1Z0-1067-26 Oracle View All Exams →
Sign in Create account
SCS-C02 EXAM PREPARATION

Prepare Smarter for the SCS-C02 Exam

Build your exam confidence with flexible preparation resources designed around the latest SCS-C02 exam objectives. Practice at your own pace using PDF questions, online exam simulations, or desktop practice software.

Download Exam View Entire Exam
Page: 1 / 1
Question #1 (Topic: Demo Questions)

A company is developing a highly resilient application to be hosted on multiple Amazon EC2 instances . The application will store highly sensitive user data in Amazon RDS tables

The application must

• Include migration to a different IAM Region in the application disaster recovery plan.

• Provide a full audit trail of encryption key administration events

• Allow only company administrators to administer keys.

• Protect data at rest using application layer encryption

A Security Engineer is evaluating options for encryption key management

Why should the Security Engineer choose IAM CloudHSM over IAM KMS for encryption key management in this situation?

A.

The key administration event logging generated by CloudHSM is significantly moreextensive than IAM KMS.
B.

CloudHSM ensures that only company support staff can administer encryption keys, whereas IAM KMS allows IAM staff to administer keys
C.

The ciphertext produced by CloudHSM provides more robust protection against brute force decryption attacks than the ciphertext produced by IAM KMS
D.

CloudHSM provides the ability to copy keys to a different Region, whereas IAM KMS does not
Correct Answer: B
Explanation:

CloudHSM allows full control of your keys such including Symmetric (AES), Asymmetric (RSA), Sha-256, SHA 512, Hash Based, Digital Signatures (RSA). On the other hand, AWS Key Management Service is a multi-tenant key storage that is owned and managed byAWS1.

Question #2 (Topic: Demo Questions)

A company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters to run its Kubernetes-based applications. The company uses Amazon GuardDuty to protect the applications. EKS Protection is enabled in GuardDuty. However, the corresponding GuardDuty feature is not monitoring the Kubernetes-based applications.

A.

Enable VPC flow logs for the VPC that hosts the EKS clusters.
B.

Assign the CloudWatchEventsFullAccess AWS managed policy to the EKS clusters.
C.

Ensure that the AmazonGuardDutyFullAccess AWS managed policy is attached to the GuardDuty service role.
D.

Enable the control plane logs in Amazon EKS. Ensure that the logs are ingested into Amazon CloudWatch.
Correct Answer: D
Explanation:

To enable GuardDuty to monitor Kubernetes-based applications:

Enable Control Plane Logs:

GuardDuty uses control plane logs to detect malicious or unauthorized activity in Amazon EKS.

Enable EKS control plane logs (API, audit, authenticator) and ingest them into CloudWatch.

Question #3 (Topic: Demo Questions)

Your company has a set of EC2 Instances defined in IAM. These Ec2 Instances have strict security

groups attached to them. You need to ensure that changes to the Security groups are noted and

acted on accordingly. How can you achieve this?

Please select:

A.

Use Cloudwatch logs to monitor the activity on the Security Groups. Use filters to search for the changes and use SNS forthe notification.
B.

 Use Cloudwatch metrics to monitor the activity on the Security Groups. Use filters to search for the changes and use SNS forthe notification.
C.

Use IAM inspector to monitor the activity on the Security Groups. Use filters to search for the changes and use SNS f the notification. 
D.

Use Cloudwatch events to be triggered for any changes to the Security Groups. Configure the Lambda function for email notification as well.
Correct Answer: D
Explanation:

The below diagram from an IAM blog shows how security groups can be monitored 

 Option A is invalid because you need to use Cloudwatch Events to check for chan,

Option B is invalid because you need to use Cloudwatch Events to check for chang

Option C is invalid because IAM inspector is not used to monitor the activity on Security Groups

he correct answer is: Use Cloudwatch events to be triggered for any changes to the Security Groups.

Configure the Lambda function for email notification as well.

Question #4 (Topic: Demo Questions)

A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DNSSEC signing and has created a key-signing key (KSK). When the security engineer tries to test the configuration, the security engineer receives an error for a broken trust chain.

What should the security engineer do to resolve this error?

A.

Replace the KSK with a zone-signing key (ZSK)
B.

Deactivate and then activate the KSK.
C.

Create a Delegation Signer (DS) record in the parent hosted zone.
D.

Create a Delegation Signer (DS) record in the subdomain.
Correct Answer: C
Explanation:

When implementing DNSSEC for a subdomain in Amazon Route 53 and encountering a broken trust chain error, creating a Delegation Signer (DS) record in the parent hosted zone is the correct approach. The DS record is essential for establishing the trust chain between the parent and child zones by linking the DNSSEC-signed subdomain to its parentdomain. This step is crucial for DNS resolvers to validate the authenticity of DNS responses, thereby resolving the broken trust chain issue and ensuring the integrity and authenticity of the DNS data for the secured subdomain.

Question #5 (Topic: Demo Questions)

ccA security engineer receives an IAM abuse email message. According to the message, an Amazon EC2 instance that is running in the security engineer's IAM account is sending phishing email messages.

The EC2 instance is part of an application that is deployed in production. The application runs on many EC2 instances behind an Application Load Balancer. The instances run in an AmazonEC2 Auto Scaling group across multiple subnets and multiple Availability Zones.

The instances normally communicate only over the HTTP. HTTPS, and MySQL protocols. Upon investigation, the security engineer discovers that email messages are being sent over port 587. All other traffic is normal.

The security engineer must create a solution that contains the compromised EC2 instance, preserves forensic evidence for analysis, and minimizes application downtime. Which combination of steps must the security engineer take to meet these requirements? (Select THREE.)

A.

Add an outbound rule to the security group that is attached to the compromised EC2 instance to deny traffic to 0.0.0.0/0 and port 587.
B.

Add an outbound rule to the network ACL for the subnet that contains the compromised EC2 instance to deny traffic to 0.0.0.0/0 and port 587.
C.

Gather volatile memory from the compromised EC2 instance. Suspend the compromised EC2 instance from the Auto Scaling group. Then take a snapshot of the compromised EC2 instance. 
D.

Take a snapshot of the compromised EC2 instance. Suspend the compromised EC2 instance from the Auto Scaling group. Then gather volatile memory from the compromised EC2 instance.
E.

Move the compromised EC2 instance to an isolated subnet that has a network ACL that has no inbound rules or outbound rules.
F.

Replace the existing security group that is attached to the compromised EC2 instance with a new security group that has no inbound rules or outbound rules.
Correct Answer: A, C, E
Download Exam
Page: 1 / 1
Next Page