Vce SCS-C01 Questions Latest

Page: 21 / 43

Question 84

An application has been written that publishes custom metrics to Amazon CloudWatch. Recently, IAM changes have been made on the account and the metrics are no longer being reported.

Which of the following is the LEAST permissive solution that will allow the metrics to be delivered?

Options:

Add a statement to the IAM policy used by the application to allow logs:putLogEvents and logs:createLogStream

Modify the IAM role used by the application by adding the CloudWatchFullAccess managed policy.

Add a statement to the IAM policy used by the application to allow cloudwatch:putMetricData.

Add a trust relationship to the IAM role used by the application for cloudwatch.amazonIAM.com.

Question 85

A Security Engineer has created an Amazon CloudWatch event that invokes an IAM Lambda function daily. The Lambda function runs an Amazon Athena query that checks IAM CloudTrail logs in Amazon S3 to detect whether any IAM user accounts or credentials have been created in the past 30 days. The results of the Athena query are created in the same S3 bucket. The Engineer runs a test execution of the Lambda function via the IAM Console, and the function runs successfully.

After several minutes, the Engineer finds that his Athena query has failed with the error message: “Insufficient Permissions”. The IAM permissions of the Security Engineer and the Lambda function are shown below:

Security Engineer

Lambda function execution role

What is causing the error?

Options:

The Lambda function does not have permissions to start the Athena query execution.

The Security Engineer does not have permissions to start the Athena query execution.

The Athena service does not support invocation through Lambda.

The Lambda function does not have permissions to access the CloudTrail S3 bucket.

Question 86

A company has complex connectivity rules governing ingress, egress, and communications between Amazon EC2 instances. The rules are so complex that they cannot be implemented within the limits of the maximum number of security groups and network access control lists (network ACLs).

What mechanism will allow the company to implement all required network rules without incurring additional cost?

Options:

Configure IAM WAF rules to implement the required rules.

Use the operating system built-in, host-based firewall to implement the required rules.

Use a NAT gateway to control ingress and egress according to the requirements.

Launch an EC2-based firewall product from the IAM Marketplace, and implement the required rules in that product.

Question 87

The IAM Systems Manager Parameter Store is being used to store database passwords used by an IAM Lambda function. Because this is sensitive data, the parameters are stored as type SecureString and protected by an IAM KMS key that allows access through IAM. When the function executes, this parameter cannot be retrieved as the result of an access denied error.

Which of the following actions will resolve the access denied error?