Free Amazon Web Services SCS-C02 Practice Exam with Questions & Answers | Set: 3

To ensure that the EC2 instances are logged, the security engineer should do the following:

Use AWS DNS resolvers for all EC2 instances. This allows the security engineer to use Amazon-provided DNS servers that resolve public DNS hostnames to private IP addresses within their VPC, and that log DNS queries in Amazon CloudWatch Logs.

The AWS documentation states that you can deploy the Lambda functions inside the VPC and attach a security group to the Lambda functions. You can then provide outbound rule access to the VPC CIDR range only and update the DB instance security group to allow traffic from the Lambda security group. This method is the most secure way to meet the requirements.

Action for Amazon Cognito User Pools:

Update the password policy in the Cognito user pool configuration.

Set the required minimum password length and other password complexity settings as needed.

Navigate toAmazon Cognito>User Pools>Policies, and configure the password requirements.

Action for On-Premises Active Directory:

Update the password policy in the on-premises Active Directory.

Use Group Policy Management to configure the minimum password length.

Apply the updated policy to all relevant organizational units (OUs).

IAM Password Policy:

Note that IAM does not manage Active Directory or Cognito password policies. Instead, focus on federated configurations and user pool settings.

Amazon Cognito User Pool Policies

Active Directory Password Policy

what the Security Engineer should do to block the malicious bot. SFTP is a protocol that allows secure file transfer over SSH. EC2 is a service that provides virtual servers in the cloud. A public subnet is a subnet that has a route to an internet gateway, which allows it to communicate with the internet. A brute force attack is a type of attack that tries to guess passwords or keys by trying many possible combinations. A malicious bot is a software program that performs automated tasks for malicious purposes. Route 53 is a service that provides DNS resolution and domain name registration. A DNS sinkhole is a technique that redirects malicious or unwanted traffic to a different destination, such as a black hole server or a honeypot. By modifying the hosted zone in Route 53 and creating a DNS sinkhole for the malicious IP, the Security Engineer can block the malicious bot from reaching the EC2 instance on the public subnet. The other options are either ineffective or inappropriate for blocking the malicious bot.

To prevent developers from configuring unauthenticated Lambda function URLs, the most effective approach is to use Service Control Policies (SCPs) at the organizational level. By explicitly denying actions such as lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig when the lambda:FunctionUrlAuthType is set to NONE, the organization ensures that only authenticated function URLs are deployed in production.

This method imposes no additional workload on developers and leverages AWS Organizations' SCPs to enforce centralized security policy — a recommended practice in the Identity and Access Management domain.

The correct answer is D. Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role.

According to the AWS documentation1, the CloudWatch agent is a software agent that you can install on your EC2 instances to collect system-level metrics and logs. To use the CloudWatch agent, you need to attach an IAM role or user to the EC2 instance thatgrants permissions for the agent to perform actions on your behalf.The CloudWatchAgentServerPolicy is an AWS managed policy that provides the necessary permissions for the agent to write metrics and logs to CloudWatch2. By attaching this policy to the EC2 instance role, the security engineer can resolve the issue of CloudWatch not receiving the custom application-security logs.

The other options are incorrect for the following reasons:

A.Adding AWS CloudTrail to the trust policy of the EC2 instance is not relevant, because CloudTrail is a service that records API activity in your AWS account, not custom application logs3. Sending the custom logs to CloudTrail instead of CloudWatch would not meet the requirement of forwarding them to CloudWatch.

B.Adding Amazon S3 to the trust policy of the EC2 instance is not necessary, because S3 is a storage service that does not require any trust relationship with EC2 instances4. Configuring the application to write the custom logs to an S3 bucket that CloudWatch can use to ingest the logs would be an alternative solution, but it would be more complex and costly than using the CloudWatch agent directly.

C.Adding Amazon Inspector to the trust policy of theEC2 instance is not helpful, because Inspector is a service that scans EC2 instances for software vulnerabilities and unintended network exposure, not custom application logs5. Using Amazon Inspector instead of the CloudWatch agent would not meet the requirement of forwarding them to CloudWatch.

Enable Amazon GuardDuty:

GuardDuty is a threat detection service that natively supports detecting cryptocurrency mining activity on Amazon EC2 instances.

Enable GuardDuty for the account and all AWS Regions to ensure comprehensive coverage.

Monitor GuardDuty Findings:

GuardDuty generates findings for activities associated with cryptocurrency mining (e.g., unauthorized mining, DNS queries to known mining domains).

Create an EventBridge Rule:

Define an EventBridge rule that triggers on specific GuardDuty findings related to cryptocurrency activity.

Configure the rule to send notifications to an Amazon SNS topic.

Example Rule:

{

"Source": ["aws.guardduty"],

"DetailType": ["GuardDuty Finding"],

"Detail": {

"type": ["CryptoCurrency:EC2/BitcoinTool.B"]

}

}

Advantages of GuardDuty:

Automated Threat Detection: Requires no additional setup or custom rules.

Near-Real-Time Alerts: Delivers findings and notifications with minimal delay.

Amazon GuardDuty Documentation

Creating EventBridge Rules for GuardDuty Findings