Best Free Actual Exam Prep Sources

JOB Exam Prep
Menu

Amazon (AWS) : SCS-C02 AWS Certified Security – Specialty Questions and Answers

Get Full PDF

Question.51
A company’s AWS CloudTrail logs are all centrally stored in an Amazon S3 bucket. The security team controls the company’s AWS account. The security team must prevent unauthorized access and tampering of the CloudTrail logs.

Which combination of steps should the security team take? (Choose three.)
(A) Configure server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
(B) Compress log files with secure gzip.
(C) Create an Amazon EventBridge rule to notify the security team of any modifications on CloudTrail log files.
(D) Implement least privilege access to the S3 bucket by configuring a bucket policy.
(E) Configure CloudTrail log file integrity validation.
(F) Configure Access Analyzer for S3.
51. Click here to View Answer

Answer: ADE

Explanation:

The correct answer is ADE. Let’s break down why each choice is or isn’t the correct one.

A. Configure server-side encryption with AWS KMS managed encryption keys (SSE-KMS). This is crucial. SSE-KMS encrypts the CloudTrail logs at rest using keys managed by AWS KMS. This protects the logs from unauthorized access, even if someone gains access to the S3 bucket itself. Using KMS provides more granular control and auditing capabilities over key usage, compared to S3-managed keys. https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html

D. Implement least privilege access to the S3 bucket by configuring a bucket policy. This is vital for access control. A bucket policy should be configured to grant the CloudTrail service permission to write logs and restrict access to the bucket to only authorized IAM entities (e.g., the security team). This prevents unintended or malicious access to the sensitive log data. Least privilege means giving users and services only the permissions they absolutely need. https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html

E. Configure CloudTrail log file integrity validation. This is essential for tamper detection. CloudTrail’s log file integrity validation feature creates a digitally signed hash of the logs. This allows the security team to verify that the log files haven’t been altered or deleted since they were delivered to the S3 bucket. Any modification will invalidate the hash, alerting the team to potential tampering. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html

Now, let’s look at why the other options are not the best choices:

B. Compress log files with secure gzip. While compression is good for storage efficiency, it doesn’t directly address unauthorized access or tampering. Encryption is a more effective measure against unauthorized viewing, and file integrity validation detects tampering.

C. Create an Amazon EventBridge rule to notify the security team of any modifications on CloudTrail log files. While event notification is useful, it’s more of a reactive measure. The log integrity validation (option E) proactively ensures the integrity and can be coupled with a notification mechanism like EventBridge after validation detects tampering. It does not prevent modification in the first place.

F. Configure Access Analyzer for S3. Access Analyzer helps you identify buckets with permissions that grant access to entities outside of your account. While useful for identifying broader S3 security risks, it doesn’t directly address the specific requirements of preventing unauthorized access and tampering of CloudTrail logs, like encryption and integrity validation do.

Question.52
A company has several petabytes of data. The company must preserve this data for 7 years to comply with regulatory requirements. The company’s compliance team asks a security officer to develop a strategy that will prevent anyone from changing or deleting the data.

Which solution will meet this requirement MOST cost-effectively?
(A) Create an Amazon S3 bucket. Configure the bucket to use S3 Object Lock in compliance mode. Upload the data to the bucket. Create a resource-based bucket policy that meets all the regulatory requirements.
(B) Create an Amazon S3 bucket. Configure the bucket to use S3 Object Lock in governance mode. Upload the data to the bucket. Create a user-based IAM policy that meets all the regulatory requirements.
(C) Create a vault in Amazon S3 Glacier. Create a Vault Lock policy in S3 Glacier that meets all the regulatory requirements. Upload the data to the vault.
(D) Create an Amazon S3 bucket. Upload the data to the bucket. Use a lifecycle rule to transition the data to a vault in S3 Glacier. Create a Vault Lock policy that meets all the regulatory requirements.
52. Click here to View Answer

Answer: C

Explanation:

The correct answer is C because it leverages Amazon S3 Glacier’s Vault Lock feature, which is specifically designed for long-term data archival and compliance requirements where immutability is crucial. S3 Glacier is significantly cheaper than standard S3 for infrequently accessed data, making it a cost-effective option for data retention spanning 7 years. Vault Lock enables the enforcement of write-once-read-many (WORM) protection, preventing deletion or modification of data according to a defined policy.

Option A utilizes S3 Object Lock in compliance mode, which is also a WORM solution. However, standard S3 storage is more expensive than S3 Glacier for long-term archival. While S3 Object Lock is a valid solution for data immutability, it is not the most cost-effective for a 7-year retention period involving petabytes of data.

Option B uses S3 Object Lock in governance mode. Governance mode allows users with specific IAM permissions to bypass the WORM protection, making it unsuitable for strict regulatory compliance where immutability must be enforced without exceptions. The risk of privileged users altering or deleting data makes it less secure.

Option D involves using an S3 lifecycle rule to move data to S3 Glacier and then applying Vault Lock. While this is possible, it introduces an unnecessary step. Directly uploading the data to an S3 Glacier vault with Vault Lock configured from the beginning simplifies the process and potentially reduces complexity. Additionally, the lifecycle transition might introduce brief periods where the data is not yet fully protected.

In summary, S3 Glacier with Vault Lock offers the most cost-effective and compliant solution for long-term, immutable data archival due to its lower storage costs and robust WORM protection capabilities explicitly designed for regulatory compliance.

Supporting links:

Question.53
A-company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certificate, users saw the following message when trying to log in:
Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken)
A security engineer needs to provide a solution that corrects the error and minimizes operational overhead.

Which solution meets these requirements?
(A) Upload the third-party signing certificate’s new private key to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS Management Console.
(B) Sign the identity provider’s metadata file with the new public key. Upload the signature to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
(C) Download the updated SAML metadata file from the identity service provider. Update the file in the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
(D) Configure the AWS identity provider entity defined in AWS Identity and Access Management (IAM) to synchronously fetch the new public key by using the AWS Management Console.
53. Click here to View Answer

Answer: C

Explanation:

The error “Response Signature Invalid” during SAML-based SSO indicates that the signature on the SAML response from the identity provider (IdP) cannot be verified by AWS Security Token Service (STS). This usually happens when the signing certificate used by the IdP to sign the SAML responses is updated or renewed, and AWS doesn’t have the corresponding public key to validate the signature.

Option A is incorrect because you never upload a private key to AWS or any third-party service. Private keys should be kept secure and secret within the IdP. Exposing the private key creates a massive security risk.

Option B suggests signing the metadata file with the new public key and uploading the signature. This is not how SAML integration works. The metadata file itself contains information about the IdP, including its signing certificate. The SAML responses are what need to be signed by the private key corresponding to the public key/certificate in the metadata. The metadata file contains the certificate that AWS uses to verify the signature on the SAML response.

Option C is the correct solution. The SAML metadata file contains the IdP’s public key certificate. When the IdP updates its signing certificate, it’s crucial to update the corresponding metadata file and upload the updated metadata to AWS. This allows AWS to correctly verify the signatures on SAML responses from the IdP. Using the AWS CLI ensures automated update and minimizes overhead.

Option D is incorrect as IAM does not allow synchronous fetching of public keys. It relies on you uploading the SAML metadata document.

In essence, the solution involves updating the trust relationship between AWS and the IdP by providing AWS with the new public key certificate via the metadata file. This aligns with the principles of federated identity management and minimizes operational overhead by relying on metadata updates rather than manual key management.

Relevant documentation:

Create or Update an IAM SAML Identity Provider

Configuring SAML 2.0 federated users’ access to the AWS Management Console

Question.54
A company has several workloads running on AWS. Employees are required to authenticate using on-premises ADFS and SSO to access the AWS Management Console. Developers migrated an existing legacy web application to an Amazon EC2 instance. Employees need to access this application from anywhere on the internet, but currently, there is no authentication system built into the application.

How should the security engineer implement employee-only access to this system without changing the application?
(A) Place the application behind an Application Load Balancer (ALB). Use Amazon Cognito as authentication for the ALB. Define a SAML-based Amazon Cognito user pool and connect it to ADFS.
(B) Implement AWS IAM Identity Center (AWS Single Sign-On) in the management account and link it to ADFS as an identity provider. Define the EC2 instance as a managed resource, then apply an IAM policy on the resource.
(C) Define an Amazon Cognito identity pool, then install the connector on the Active Directory server. Use the Amazon Cognito SDK on the application instance to authenticate the employees using their Active Directory user names and passwords.
(D) Create an AWS Lambda custom authorizer as the authenticator for a reverse proxy on Amazon EC2. Ensure the security group on Amazon EC2 only allows access from the Lambda function.
54. Click here to View Answer

Answer: A

Explanation:

Here’s a detailed justification for why option A is the best solution, along with supporting concepts and links:

Justification:

Option A provides a robust and secure solution for adding authentication to a legacy web application without modifying its code, leveraging the power of AWS services. The core idea is to front the application with an Application Load Balancer (ALB) and use its built-in authentication capabilities. Amazon Cognito serves as the intermediary for authentication, interfacing with the company’s existing ADFS infrastructure.

  1. ALB’s Authentication Feature: ALBs offer native authentication support, allowing you to offload authentication responsibilities from the application to the load balancer. The ALB handles the authentication process before traffic reaches the EC2 instance, ensuring only authenticated users gain access.
  2. Amazon Cognito as an Authentication Provider: Amazon Cognito is a managed authentication service. In this case, it acts as a bridge between the ALB and the company’s on-premises ADFS.
  3. SAML Integration: Cognito user pools can be configured with SAML (Security Assertion Markup Language) federation. This enables Cognito to trust ADFS as an identity provider. When a user tries to access the application, the ALB redirects them to Cognito, which then redirects them to ADFS for authentication. Upon successful authentication by ADFS, ADFS provides a SAML assertion to Cognito, and Cognito then grants the user access to the application via the ALB.
  4. No Application Changes: This approach is ideal because it requires no modifications to the legacy web application itself. The authentication logic is entirely handled by the ALB and Cognito. The EC2 instance hosting the web application only receives traffic from already-authenticated users.
  5. Security Benefits: Centralizing authentication improves security. It simplifies the management of access control and reduces the risk of vulnerabilities within the application code.

Options B, C, and D have shortcomings:

  • Option B (IAM Identity Center): While IAM Identity Center (successor to AWS Single Sign-On) can link to ADFS, it is primarily designed for centralized access to AWS resources and not necessarily for authenticating users to arbitrary applications. It can be complex and less suitable for this specific purpose.
  • Option C (Cognito Identity Pool & SDK): This would require significant modifications to the existing legacy application. It forces the application to handle the authentication process, which violates the requirements. Identity pools also primarily grant access to AWS resources.
  • Option D (Lambda Authorizer & Reverse Proxy): This is a more complex solution compared to using the ALB’s built-in authentication. It would involve managing a custom Lambda function and setting up a reverse proxy on an EC2 instance. It would not be as efficient as Option A.

Authoritative Links:

In summary, Option A offers the most efficient, secure, and non-intrusive method for integrating ADFS authentication with the legacy web application, leveraging the ALB and Cognito’s SAML capabilities.

Question.55
A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are deployed in a private subnet of a VPC that does not have internet access. The EC2 instances and the S3 buckets are in the same AWS account.
The EC2 instances access the S3 buckets through an S3 gateway endpoint that has the default access policy. Each EC2 instance is associated with an instance profile role that has a policy that explicitly allows the s3:GetObject action and the s3:PutObject action for only the required S3 buckets.
The company learns that one or more of the EC2 instances are compromised and are exfiltrating data to an S3 bucket that is outside the company’s organization in AWS Organizations. A security engineer must implement a solution to stop this exfiltration of data and to keep the EC2 processing job functional.

Which solution will meet these requirements?
(A) Update the policy on the S3 gateway endpoint to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company’s values.
(B) Update the policy on the instance profile role to allow the S3 actions only if the value of the aws:ResourceOrgID condition key matches the company’s value.
(C) Add a network ACL rule to the subnet of the EC2 instances to block outgoing connections on port 443.
(D) Apply an SCP on the AWS account to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company’s values.
55. Click here to View Answer

Answer: A

Explanation:

The correct answer is A. Here’s why:

  • Problem: Compromised EC2 instances are exfiltrating data to an external S3 bucket. The existing instance profile only restricts access based on bucket name within the account.
  • S3 Gateway Endpoint Policies: S3 gateway endpoints offer a powerful way to control S3 access from within a VPC. You can apply a policy that restricts access based on various conditions.
  • aws:ResourceOrgID and aws:PrincipalOrgID: These condition keys are crucial.
    • aws:ResourceOrgID restricts access based on the organization ID of the S3 bucket being accessed.
    • aws:PrincipalOrgID restricts access based on the organization ID of the IAM principal (in this case, the instance profile role) making the request.
  • Why A Works: By updating the S3 gateway endpoint policy to require matching aws:ResourceOrgID and aws:PrincipalOrgID values, you ensure that the gateway only allows access to S3 buckets within your organization. Any attempt to access an S3 bucket outside your organization (i.e., with a different aws:ResourceOrgID) will be blocked at the gateway level, regardless of the permissions granted to the instance profile. This effectively prevents the exfiltration.
  • Why B is incorrect: Updating the instance profile policy to check aws:ResourceOrgID is insufficient. While it would prevent legitimate access attempts to external buckets using that role, compromised instances could still bypass the IAM layer (by using compromised credentials, for example) and directly interact with the gateway endpoint to access external S3 buckets. The gateway endpoint needs the restrictive policy.
  • Why C is incorrect: Blocking outgoing port 443 would prevent all HTTPS traffic, including legitimate S3 access required for the analysis process, thus breaking the primary functionality. The solution needs to selectively block the exfiltration attempts.
  • Why D is incorrect: SCPs (Service Control Policies) are applied at the AWS Organizations level to control permissions across all accounts within the organization. While SCPs could potentially be used, they are broader in scope and less precise than the gateway endpoint policy in this scenario. Also, SCPs can be complex to manage and debug. Furthermore, the problem is primarily about controlling access from within the VPC to S3; an SCP is a heavier solution. It’s better to restrict access closer to the source (VPC) using the gateway endpoint.

Authoritative Links:

aws:ResourceOrgID and aws:PrincipalOrgID Condition Keys: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#principal-orgid-and-resource-orgid

VPC Endpoints: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html

S3 Endpoint Policies: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html#vpc-endpoints-s3-policies

IAM Condition Keys: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html

Pages: 1 2 3 4 5 6 7 8 9 10 11 12 13 14
Scroll to Top