SCS-C01 Sample Questions & Answers

Create a new CMK. Download a new wrapping key and a new import token to import the original key material.

Create a new CMK. Use the original wrapping key and import token to import the original key material.

Download a new wrapping key and a new import token. Import the original key material into the existing CMK.

Use the original wrapping key and import token. Import the original key material into the existing CMK.

Delete the internet gateway associated with the VPC.

Use network access control lists to block source IP addresses matching 0.0.0.0/0.

Use a host-based firewall to prevent access from all but the organization’s firewall IP.

Use AWS Config rules to detect 0.0.0.0/0 and invoke an AWS Lambda function to update the security group with the organization's firewall IP.

On a recurring basis, update all 1AM user policies to require that EC2 instances are created with an encrypted volume.

Configure an AWS Config rule to run on a recurring basis for volume encryption.

set up Amazon Inspector rules for volume encryption to run on a recurring schedule.

Use CloudWatch Logs to determine whether instances were created with an encrypted volume.

A Create 1AM roles with permissions corresponding to each Active Directory group.

Create 1AM groups with permissions corresponding to each Active Directory group

Create a SAML provider with 1A

Create a SAML provider with Amazon Cloud Directory

Configure AWS as a trusted relying party for the Active Directory

Configure 1AM as a trusted relying party for Amazon Cloud Directory.

An HTTPS listener that uses a certificate that is managed by Amazon Certification Manager.

An HTTPS listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.

An HTTPS listener that uses the latest AWS predefined ELBSecurityPolicy-TLS-1-2-2017-01 security policy.

A TCP listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.

Create dedicated 1AM users within each AWS account that employees can assume though federation based upon group membership in their existing identity provider.

Use a centralized account with 1AM roles that employees can assume through federation with their existing identity provider. Use cross-account roles to allow the federated users to assume their target role in the resource accounts.

Configure the AWS Security Token Service to use Kerberos tokens so that users can use their existing corporate user names and passwords to access AWS resources directly.

Configure the 1AM trust policies within each account’s role to set up a trust back to the corporation’s existing identity provider, allowing users to assume the role based off their SAML token.

Offload SSL termination onto an SSL listener on a Classic Load Balancer, and use a TCP connection between the load balancer and the EC2 instances.

Route all traffic through a TCP listener on a Classic Load Balancer, and terminate the TLS connection on the EC2 instances.

Create an HTTPS listener using an Application Load Balancer, and route all of the communication through that load balancer.

Offload SSL termination onto an SSL listener using an Application Load Balancer, and re-spawn and SSL connection between the load balancer and the EC2 instances.

Create a new database field “suspended_status” and modify the application logic to validate that field when processing requests.

Add suspended customers to second Cognito user pool and update the application login flow to check both user pools.

Use Amazon Cognito Sync to push out a “suspension_status” parameter and split the 1AM policy into normal users and suspended users.

Move suspended customers to a second Cognito group and define an appropriate 1AM access policy for the group.

Application Load Balancers do not support older web browsers.

The Perfect Forward Secrecy settings are not configured correctly.

The intermediate certificate is installed within the Application Load Balancer.

The cipher suites on the Application Load Balancers are blocking connections.

Create a new trail and configure it to send CloudTrail logs to Amazon S3. Use Amazon EventBridge (Amazon CloudWatch Events) to send notification if a trail is deleted or stopped.

Deploy an AWS Lambda function in every account to check if there is an existing trail and create a new trail, if needed.

Edit the existing trail in the Organizations master account and apply it to the organization.

Create an SCP to deny the cloudtraikDelete* and cloudtraikStop* actions. Apply the SCP to all accounts.