AWS Certified Security - Specialty SCS-C03 Practice Test

AWS Certified Security - Specialty SCS-C03 Practice Test practice questions, page 6 of 6, with answer review and explanations.

Question 26

A company is using Amazon Elastic Container Service (Amazon ECS) to deploy an application that deals with sensitive data. During a recent security audit, the company identified a security issue in which Amazon RDS credentials wore stored with the application code in the company's source code repository. A security engineer needs to develop a solution to ensure that database credentials are stored securely and rotated periodically. The credentials should be accessible to the application only. The engineer also needs to prevent database administrators from sharing database credentials as plaintext with other teammates. The solution must also minimize administrative overhead. Which solution meets these requirements?

  1. Use the AWS Systems Manager Parameter Store to generate database credentials. Use an IAM profile for ECS tasks to restrict access to database credentials to specific containers only.
  2. Use AWS Secrets Manager to store database credentials. Use an IAM inline policy for ECS tasks to restrict access to database credentials to specific containers only.
  3. Use the AWS Systems Manager Parameter Store to store database credentials. Use IAM roles for ECS tasks to restrict access to database credentials to specific containers only.
  4. Use AWS Secrets Manager to store database credentials. Use IAM roles for ECS tasks to restrict access to database credentials to specific containers only.

Question 27

A corporate cloud security policy slates that communications between the company's VPC and KMS must travel entirely within the AWS network and not use public service endpoints. Which combination of the following actions MOST satisfies this requirement? (Choose two.)

  1. Add the aws:sourceVpce condition to the AWS KMS key policy referencing the company’s VPC endpoint ID.
  2. Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.
  3. Create a VPC endpoint for AWS KMS with private DNS enabled.
  4. Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.
  5. Add the following condition to the AWS KMS key policy: "aws:SourceIp": "10.0.0.0/16".

Question 28

A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company’s primary website. The GuardDuty finding received read: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor. What is the first step the security engineer should take?

  1. Open the EC2 console and remove any security groups that allow inbound traffic from 0.0.0.0/0.
  2. Install the AWS Systems Manager Agent on the EC2 instance and run an inventory report.
  3. Install the Amazon Inspector agent on the host and run an assessment with the CVE rules package.
  4. Open the IAM console and revoke all IAM sessions that are associated with the instance profile.