Free AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C02 Amazon AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C02 Practice Test Question - Page 8

Question 22 (Topic 1)

A company uses AWS Organizations and has many AWS accounts. The company has a new requirement to use server-side encryption with customer-provided keys (SSE-C) on all new object uploads to Amazon S3 buckets. A security engineer is creating an SCP that includes a Deny effect for the s3:PutObject action. Which condition must the security engineer add to the SCP to enforce the new SSE-C requirement?

Select an option, then click Submit answer.

○
○
○
○

Reference / correct answer:

Most accepted answer: A.

Community votes: A=4, C=1

Selected Answer: A The "Null" condition key with "true" ensures that the s3:x-amz-server-side-encryption-customer-algorithm header must be present in the s3:PutObject request. This header specifies the use of SSE-C. upvoted 2 times

Selected Answer: C Deny: This Deny statement ensures that the action is blocked unless the specified condition is met. s3:PutObject: This is the action that allows uploading objects to S3. Condition: The condition enforces that the upload must include the SSE-C encryption header. The key s3:x-amz-server-side-encryption-customer-algorithm must be set to a valid encryption algorithm (such as AES256) to use SSE-C. StringNotEqualsIfExists: This condition ensures that if the header is not present in the request, it is denied. This SCP effectively enforces the requirement that all object uploads to the specified S3 bucket(s) must use SSE-C with the specified encryption algorithm. upvoted 1 times HappyG 1 year, 8 months ago It's A. upvoted 1 times ...

It's A. upvoted 1 times

Selected Answer: A Condition: The condition specifies that the s3:x-amz-server-side-encryption-customer-algorithm key must not be null (Null: "true"). If this key is absent, the condition evaluates to true, and the Deny effect is applied. upvoted 2 times

Selected Answer: A https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html upvoted 4 times

Question 23 (Topic 1)

A security engineer is designing a cloud architecture to support an application. The application runs on Amazon EC2 instances and processes sensitive information, including credit card numbers. The application will send the credit card numbers to a component that is running in an isolated environment. The component will encrypt, store, and decrypt the numbers. The component then will issue tokens to replace the numbers in other parts of the application. The component of the application that manages the tokenization process will be deployed on a separate set of EC2 instances. Other components of the application must not be able to store or access the credit card numbers. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Use EC2 Dedicated Instances for the tokenization component of the application.
○ Place the EC2 instances that manage the tokenization process into a partition placement group.
○ Create a separate VPDeploy new EC2 instances into the separate VPC to support the data tokenization.
○ Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances.

Reference / correct answer:

Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances.

Most accepted answer: D. Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances.

Community votes: D=2

Selected Answer: D Agree with D upvoted 1 times

Selected Answer: D The best solution to meet these requirements is: D. Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances. AWS Nitro Enclaves provide an isolated environment that is ideal for processing sensitive data, such as credit card numbers. They offer strong security guarantees by isolating the tokenization process from other components of the application, ensuring that sensitive data is protected and inaccessible to unauthorized components upvoted 2 times

D. Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances. Explanation: AWS Nitro Enclaves provide isolated compute environments to process highly sensitive data, ensuring that other components cannot access the credit card numbers. Nitro Enclaves are specifically designed for secure processing of confidential information, making them ideal for tokenization tasks. https://aws.amazon.com/ec2/nitro/nitro-enclaves/ upvoted 1 times

Option D, deploying the tokenization component onto AWS Nitro Enclaves, is the best solution. Nitro Enclaves provide a highly secure, isolated environment that can handle the encryption, storage, and tokenization of sensitive information without exposing it to other parts of the application, meeting the requirements for both isolation and data security. upvoted 1 times

Question 24 (Topic 1)

A company runs workloads in the us-east-1 Region. The company has never deployed resources to other AWS Regions and does not have any multi-Region resources. The company needs to replicate its workloads and infrastructure to the us-west-1 Region. A security engineer must implement a solution that uses AWS Secrets Manager to store secrets in both Regions. The solution must use AWS Key Management Service (AWS KMS) to encrypt the secrets. The solution must minimize latency and must be able to work if only one Region is available. The security engineer uses Secrets Manager to create the secrets in us-east-1. What should the security engineer do next to meet the requirements?

Select an option, then click Submit answer.

○ Encrypt the secrets in us-east-1 by using an AWS managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using a new AWS managed KMS key in us-west-1.
○ Encrypt the secrets in us-east-1 by using an AWS managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
○ Encrypt the secrets in us-east-1 by using a customer managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
○ Encrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1.

Reference / correct answer:

Encrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1.

Most accepted answer: D. Encrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1.

Community votes: A=6, D=6

Selected Answer: D the key answer is to use KMS replication. But AWS Managed key & customer imported key is not supported for replication. Only customer managed key upvoted 1 times

Selected Answer: A A. Replicate the secrets to us-west-1 and have each Region encrypt with its own regional AWS managed KMS key (the default aws/secretsmanager in each Region). Why: • You need secrets in both Regions to minimize latency and remain operable if one Region is down → replication is required. • KMS keys are regional. Using the AWS-managed key for Secrets Manager in each Region is the simplest, least-overhead way to meet the encryption requirement. • Options B/C make cross-Region calls (higher latency, single-Region dependency). • D suggests using the same key from us-east-1 in us-west-1, which isn’t possible unless you configure multi-Region customer-managed keys (not stated), and is more work than needed. upvoted 1 times

Selected Answer: A The links to documentation to justify the answer : KMS regional replication https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html Secrets manager regional replication https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html upvoted 2 times

Selected Answer: D This question appears twice 137 upvoted 1 times

Selected Answer: A Option A does the job and is simpler than using customer managed key upvoted 2 times

Free AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C02 – Amazon AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C02 Practice Test Question