SCS-C02 Exam Dumps - Amazon Web Services AWS Certified Specialty Questions and Answers

Collect Operating System Logs:

Install the Amazon CloudWatch agent on the bastion hosts to collect logs, including failed login attempts from/var/log/auth.logor equivalent files.

Create a Metric Filter:

Use CloudWatch Logs to create a metric filter for failed login attempts by identifying log patterns (e.g.,Failed password).

Set Up a CloudWatch Alarm:

Define an alarm in CloudWatch to trigger when the metric exceeds a threshold of 5 failed attempts within a 5-minute period.

Configure SNS for Notifications:

Use Amazon SNS to send alerts to system administrators.

Use SNS message filtering to ensure only the designated administrator for the specific bastion host receives the notification.

Monitoring CloudWatch Logs

SNS Message Filtering

This SCP prevents users or roles in any affected account from disabling a CloudTrail log, either directly as a command or through the console.https://asecure.cloud/a/scp_cloudtrail/

because these are the actions that can improve IAM account root user security. IAM account root user is a user that has complete access to all AWS resources and services in an account. IAM account root user security is a set of best practices that help protect the account root user from unauthorized oraccidental use. Deleting the access keys for the account root user in every account can help prevent programmatic access by the account root user, which reduces the risk of compromise or misuse. Enabling MFA on every account root user in all accounts can help add an extra layer of security for console access by requiring a verification code in addition to a password. Creating a custom IAM policy to limit permissions to required actions for the account root user and attaching the policy to the account root user can help enforce the principle of least privilege and restrict the account root user from performing unnecessary or dangerous actions. The other options are either invalid or ineffective for improving IAM account root user security.

The correct answer is A. Create an AWS Service Catalog portfolio in the organization’s management account. Upload the CloudFormation template. Add the template to the portfolio’s product list. Share the portfolio with the OU.

According to the AWS documentation, AWS Service Catalog is a service that allows you to create and manage catalogs of IT services that are approved for use on AWS. You can use Service Catalog to centrally manage commonly deployed IT services and help achieve consistent governance and compliance requirements, while enabling users to quickly deploy only the approved IT services they need.

To use Service Catalog with multiple AWS accounts, you need to enable AWS Organizations with all features enabled. This allows you to centrally manage your accounts and apply policies across your organization. You can also use Service Catalog as a service principal for AWS Organizations, which lets you share your portfolios with organizational units (OUs) or accounts in your organization.

To create a Service Catalog portfolio, you need to use an administrator account, such as the organization’s management account. You can upload your CloudFormation template as a product in your portfolio, and define constraints and tags for it. You can then share your portfolio with the OU that contains the accounts for the web applications. This will allow the developers in those accounts to launch products from the shared portfolio using the Service Catalog end user console.

Option B is incorrect because CloudFormation modules are reusable components that encapsulate one or more resources and their configurations. They are not meant to be used as templates for deploying entire stacks of resources. Moreover, sharing a module with an OU does not grant access to launch stacks from it.

Option C is incorrect because creating an IAM role that has a trust policy that allows cross-account access to the portfolio is not secure. It would allow any user in the OU accounts to assume the role and access the portfolio, regardless of their job function or access requirements.

Option D is incorrect because sharing a module with an OU does not grant access to launch stacks from it. It also does not limit access to the deployment plan to only the developers who need access.

The correct answer is D. The AWS Config rules have a MaximumExecutionFrequency value of 24 hours.

According to the AWS documentation1, the MaximumExecutionFrequency parameter specifies the maximum frequency with which AWS Config runs evaluations for a rule. For AWS Config managed rules, this value can be one of the following:

One_Hour

Three_Hours

Six_Hours

Twelve_Hours

TwentyFour_Hours

If the rule is triggered by configuration changes, it will still run evaluations when AWS Config delivers the configuration snapshot. However, if the rule is triggered periodically, it will not run evaluations more often than the specified frequency.

In this case, the security engineer enabled four AWS Config managed rules that are triggered periodically. Therefore, these rules will only run evaluations every 24 hours, regardless of when the IAM credential report is generated. This means that the resources will display as noncompliant until the next evaluation cycle, which could take up to 24 hours after the IAM access keys are rotated.

The other options are incorrect because:

A. The IAM credential report can be generated at any time, but it will not affect the compliance status of the resources until the next evaluation cycle of the AWS Config rules.

B. The security engineer was able to invoke the IAM GenerateCredentialReport API operation, which means they have the GenerateCredentialReport permission.This permission is required to generate a credential report that lists all IAM users in an AWS account and their credential status2.

C. The security engineer does not need the GetCredentialReport permission to enable or evaluate AWS Config rules.This permission is required to retrieve a credential report that was previously generated by using the GenerateCredentialReport operation2.

https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/

Comprehensive and Detailed Explanation From Exact Extract:

Using SSE-KMS with customer-managed keys enables separation of duties:

The operations team can configure the bucket policy to enforce encryption.

The security team manages access to the encryption keys via KMS key policies.

This ensures that neither team alone can access plaintext data, aligning with data protection and least privilege principles.

Comprehensive and Detailed Explanation From Exact Extract:

Amazon OpenSearch Service provides near real-time log ingestion and indexing, full-text search, and analytics capabilities. Using the Security Analytics feature, you can define detection rules and configure alerts based on log patterns or threat indicators. These alerts can be routed to Amazon SNS topics for notification and automation workflows.

This meets the requirements for:

Near real-time log ingestion and search

Rule-based detection and alerting

Integration with SNS for notifications

This solution aligns with best practices under the Logging and Monitoring domain in the AWS Certified Security – Specialty curriculum.