SCS-C02 Free Practice Test

A security engineer is defining the controls required to protect the IAM account root user credentials in an IAM Organizations hierarchy. The controls should also limit the impact in case these credentials have been compromised.
Which combination of controls should the security engineer propose? (Select THREE.)
A)

B)

C) Enable multi-factor authentication (MFA) for the root user.
D) Set a strong randomized password and store it in a secure location.
E) Create an access key ID and secret access key, and store them in a secure location.
F) Apply the following permissions boundary to the toot user:

1. A. Option A
2. B. Option B
3. C. Option C
4. D. Option D
5. E. Option E
6. F. Option F

Correct Answer: ACE

A developer at a company uses an SSH key to access multiple Amazon EC2 instances. The company discovers that the SSH key has been posted on a public GitHub repository. A security engineer verifies that the key has not been used recently.
How should the security engineer prevent unauthorized access to the EC2 instances?

1. A. Delete the key pair from the EC2 consol
2. B. Create a new key pair.
3. C. Use the ModifylnstanceAttribute API operation to change the key on any EC2 instance that is using the key.
4. D. Restrict SSH access in the security group to only known corporate IP addresses.
5. E. Update the key pair in any AMI that is used to launch the EC2 instance
6. F. Restart the EC2 instances.

Correct Answer: C
To prevent unauthorized access to the EC2 instances, the security engineer should do the following:
Restrict SSH access in the security group to only known corporate IP addresses. This allows the security engineer to use a virtual firewall that controls inbound and outbound traffic for their EC2 instances, and limit SSH access to only trusted sources.

A security engineer receives an IAM abuse email message. According to the message, an Amazon EC2 instance that is running in the security engineer's IAM account is sending phishing email messages.
The EC2 instance is part of an application that is deployed in production. The application runs on many EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple subnets and multiple Availability Zones.
The instances normally communicate only over the HTTP. HTTPS, and MySQL protocols. Upon investigation, the security engineer discovers that email messages are being sent over port 587. All other traffic is normal.
The security engineer must create a solution that contains the compromised EC2 instance, preserves forensic evidence for analysis, and minimizes application downtime. Which combination of steps must the security engineer take to meet these requirements? (Select THREE.)

1. A. Add an outbound rule to the security group that is attached to the compromised EC2 instance to deny traffic to 0.0.0.0/0 and port 587.
2. B. Add an outbound rule to the network ACL for the subnet that contains the compromised EC2 instance to deny traffic to 0.0.0.0/0 and port 587.
3. C. Gather volatile memory from the compromised EC2 instanc
4. D. Suspend the compromised EC2 instance from the Auto Scaling grou
5. E. Then take a snapshot of the compromised EC2 instanc
6. F. v
7. G. Take a snapshot of the compromised EC2 instanc
8. H. Suspend the compromised EC2 instance from the Auto Scaling grou
9. I. Then gather volatile memory from the compromised EC2 instance.
10. J. Move the compromised EC2 instance to an isolated subnet that has a network ACL that has no inbound rules or outbound rules.
11. K. Replace the existing security group that is attached to the compromised EC2 instance with a new security group that has no inbound rules or outbound rules.

Correct Answer: ACE

Your development team is using access keys to develop an application that has access to S3 and DynamoDB. A new security policy has outlined that the credentials should not be older than 2 months, and should be rotated. How can you achieve this?
Please select:

1. A. Use the application to rotate the keys in every 2 months via the SDK
2. B. Use a script to query the creation date of the key
3. C. If older than 2 months, create new access key and update all applications to use it inactivate the old key and delete it.
4. D. Delete the user associated with the keys after every 2 month
5. E. Then recreate the user again.
6. F. Delete the IAM Role associated with the keys after every 2 month
7. G. Then recreate the IAM Role again.

Correct Answer: B
One can use the CLI command list-access-keys to get the access keys. This command also returns the "CreateDate" of the keys. If the CreateDate is older than 2 months, then the keys can be deleted.
The Returns list-access-keys CLI command returns information about the access key IDs associated with the specified IAM user. If there are none, the action returns an empty list
Option A is incorrect because you might as use a script for such maintenance activities Option C is incorrect because you would not rotate the users themselves
Option D is incorrect because you don't use IAM roles for such a purpose For more information on the CLI command, please refer to the below Link: http://docs.IAM.amazon.com/cli/latest/reference/iam/list-access-keys.htmll
The correct answer is: Use a script to query the creation date of the keys. If older than 2 months, create new access key and update all applications to use it inactivate the old key and delete it.
Submit your Feedback/Queries to our Experts

A development team is attempting to encrypt and decode a secure string parameter from the IAM Systems Manager Parameter Store using an IAM Key Management Service (IAM KMS) CMK. However, each attempt results in an error message being sent to the development team.
Which CMK-related problems possibly account for the error? (Select two.)

1. A. The CMK is used in the attempt does not exist.
2. B. The CMK is used in the attempt needs to be rotated.
3. C. The CMK is used in the attempt is using the CMK€™s key ID instead of the CMK ARN.
4. D. The CMK is used in the attempt is not enabled.
5. E. The CMK is used in the attempt is using an alias.

Correct Answer: AD
https://docs.IAM.amazon.com/kms/latest/developerguide/services-parameter-store.html#parameter-store-cmk-fa