Question 1

A company stores sensitive documents in Amazon S3 by using server-side encryption with an IAM Key Management Service (IAM KMS) CMK. A new requirement mandates that the CMK that is used for these documents can be used only for S3 actions. Which statement should the company add to the key policy to meet this requirement?

Options :

A :

"Effect": "Deny", "Principal": "*", "Action": "kmus:*" "Resource": "*", "Condition": { "StringNetEquals": { "kms: CallerAccount": "s3.amazonaws.com"

B :

"Effect": "Deny", "Principal":

"Action": "83:*", "Resource": Ham

"Condition": 1

"StringNotEquals": {

"kms: ViaService": "kms.amazonaws.com"

Answer: A

Question 2

A business requires a forensic logging solution for hundreds of Docker-based apps running on Amazon EC2. The solution must analyze logs in real time, provide message replay, and persist logs. Which Amazon Web Offerings (IAM) services should be employed to satisfy these requirements? (Select two.)

Options :

A : Amazon Athena

B : Amazon Kinesis

C : Amazon SQS

D : Amazon Elasticsearch

E : Amazon EMR

Answer: B,D

Question 3

A company's data scientists want to create artificial intelligence and machine learning (AI/ML) training models by using Amazon SageMaker. The training models will use large datasets in an Amazon S3 bucket. The datasets contain sensitive information. On average. the data scientists need 30 days to train models. The S3 bucket has been secured appropriately The companfs data retention policy states that all data that is older than 45 days must be removed from the S3 bucket. Which action should a security engineer take to enforce this data retention policy?

Options :

A : Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days.

B :

Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an S3 event notification to invoke the Lambda function for each PutObject operation.

C :

Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an Amazon EventBridge rule to invoke the Lambda function each month.

D :

Configure S3 Intelligent-Ttering on the S3 bucket to automatically transition objects to another storage class.

Answer: A

Question 4

An administrative user accidentally exposed an access key ID and secret access key to a public support forum. The user notified the security team about the incident after removing the exposed credentials from the forum.Which initial steps should a security engineer take to mitigate the exposure without interrupting operations? (Select TWO.)

Options :

A : Reset the password for the root user on the account.

B : Terminate or disable any resources the user has access to.

C : Implement a deny policy blocking access to resources.

D : Invalidate any temporary security credentials.

E : Delete the access key ID and secret access key.

Answer: C,E

Question 5

A company has an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Amazon EC2 Auto Scaling group and are attached to Amazon Elastic Blodfc Store (Amazon EBS) volumes. A security engineer needs to preserve all forensic evidence from one of the instances. Which order of steps should the security engineer use to meet this requirement?

Options :

A :

Take an EBS volume snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take a memory snapshot of the instance and store the snapshot in an S3 bucket. Detach the instance from the Auto Scaling group. Deregister the instance from the ALB. Stop the instance.

B :

Take a memory snapshot of the instance and store the snapshot in an Amazon S3 bucket. Stop the instance. Take an EBS volume snapshot of the instanceand store the snapshot in an S3 bucket. Detach the instance from the Auto Scaling group. Deregister the instance from the ALB.

C :

Detach the instance from the Auto Scaling group. Deregister the instance from the ALB. Take an EBS volume snapshot of the instance and store the snapshotin an Amazon S3 bucket. Take a memory snapshot of the instance and store the snapshot in an S3 bucket. Stop the instance

D :

Detach the instance from the Auto Scaling group Deregister the instance from the ALB. Stop the instance. Take a memory snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take an EBS volume snapshot of the instance and store the snapshot in an S3 bucket.

Answer: B

Free SCS-C02 Mock Exam – Practice Online Confidently

Buying Options: