Independence Day Deal! Unlock 25% OFF Today – Limited-Time Offer - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location PL
Mob_nav_barsMENU

Amazon Exam SCS-C02 Topic 8 Question 11 Discussion

Actual exam question for Amazon's SCS-C02 exam
Question #: 11
Topic #: 8
[All SCS-C02 Questions]

A company has multiple Amazon S3 buckets encrypted with customer-managed CMKs Due to regulatory requirements the keys must be rotated every year. The company's Security Engineer has enabled automatic key rotation for the CMKs; however the company wants to verity that the rotation has occurred.

What should the Security Engineer do to accomplish this?

Show Suggested Answer Hide Answer
Suggested Answer: C

The correct answer is C. Create rule sets in AWS CloudFormation Guard. Run validation checks for CloudFormation templates as a phase of the CI/CD process.

This answer is correct because AWS CloudFormation Guard is a tool that helps you implement policy-as-code for your CloudFormation templates. You can use Guard to write rules that define your security policies, such as requiring encryption for EBS volumes, and then validate your templates against those rules before deploying them. You can integrate Guard into your CI/CD pipeline as a step that runs the validation checks and prevents the deployment of any non-compliant templates12.

The other options are incorrect because:

A) Turning on AWS Trusted Advisor and configuring security notifications as webhooks in the preferences section of the CI/CD pipeline is not a solution, because AWS Trusted Advisor is not a policy-as-code tool, but a service that provides recommendations to help you follow AWS best practices. Trusted Advisor does not allow you to define your own security policies or validate your CloudFormation templates against them3.

B) Turning on AWS Config and using the prebuilt or customized rules is not a solution, because AWS Config is not a policy-as-code tool, but a service that monitors and records the configuration changes of your AWS resources. AWS Config does not allow you to validate your CloudFormation templates before deploying them, but only evaluates the compliance of your resources after they are created4.

D) Creating rule sets as SCPs and integrating them as a part of validation control in a phase of the CI/CD process is not a solution, because SCPs are not policy-as-code tools, but policies that you can use to manage permissions in your AWS Organizations. SCPs do not allow you to validate your CloudFormation templates, but only restrict the actions that users and roles can perform in your accounts5.


1: What is AWS CloudFormation Guard? 2: Introducing AWS CloudFormation Guard 2.0 3: AWS Trusted Advisor 4: What Is AWS Config? 5: Service control policies - AWS Organizations

by Ma at Jan 26, 2024, 01:46 PM

Limited Time Offer

25%

Off

Get Premium SCS-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Charlene
29 days ago
I hope the correct answer doesn't involve any 'black magic' or 'voodoo' ceremonies to verify the key rotation. That would be a bit too much for a security engineer, don't you think?
upvoted 0 times
...
Annamae
1 months ago
A) Filtering CloudTrail logs for KeyRotation events is a valid approach, but it might not be as efficient as monitoring CloudWatch Events.
upvoted 0 times
...
Zita
1 months ago
D) Querying CloudTrail logs with Athena is a good option, but it might be overkill for this use case. It could be a bit more complex to set up.
upvoted 0 times
Dorothea
3 days ago
Use AWS Config to monitor key rotation compliance
upvoted 0 times
...
Marg
15 days ago
Verify the key rotation status using AWS CloudTrail logs
upvoted 0 times
...
Cathern
16 days ago
Check the key rotation status in the AWS Key Management Service console
upvoted 0 times
...
...
Jutta
1 months ago
C) Using the IAM CLI to check the CMK rotation date seems like the most direct approach. I like that it gives you the specific details you need.
upvoted 0 times
Rachael
3 days ago
C) Using the IAM CLI, run the IAM kms get-key-rotation-status operation with the --key-id parameter to check the CMK rotation date
upvoted 0 times
...
Jenelle
12 days ago
B) Monitor Amazon CloudWatch Events for any IAM KMS CMK rotation events
upvoted 0 times
...
Lynelle
19 days ago
A) Filter IAM CloudTrail logs for KeyRotation events
upvoted 0 times
...
...
Rosio
2 months ago
B) Monitoring CloudWatch Events seems like the way to go. It's a nice way to get real-time notifications on key rotations.
upvoted 0 times
Ashanti
16 hours ago
B) Monitor Amazon CloudWatch Events for any IAM KMS CMK rotation events
upvoted 0 times
...
Dulce
4 days ago
A) Filter IAM CloudTrail logs for KeyRotation events
upvoted 0 times
...
Leoma
10 days ago
C) Using the IAM CLI, run the IAM kms get-key-rotation-status operation with the --key-id parameter to check the CMK rotation date
upvoted 0 times
...
Johnetta
12 days ago
B) Monitor Amazon CloudWatch Events for any IAM KMS CMK rotation events
upvoted 0 times
...
Cassie
1 months ago
A) Filter IAM CloudTrail logs for KeyRotation events
upvoted 0 times
...
...
Angelica
2 months ago
That's a good point, Chan. Checking the CloudTrail logs does provide a detailed history. It's important to have a solid audit trail for compliance purposes.
upvoted 0 times
...
Chan
2 months ago
I disagree, I believe option A is more reliable. Filtering IAM CloudTrail logs for KeyRotation events will give us a clear record of when the rotation occurred.
upvoted 0 times
...
Angelica
3 months ago
I think option B is the best choice. Monitoring CloudWatch Events seems like the most direct way to verify key rotation.
upvoted 0 times
...

Save Cancel
az-700  pass4success  az-104  200-301  200-201  cissp  350-401  350-201  350-501  350-601  350-801  350-901  az-720  az-305  pl-300  

Warning: Cannot modify header information - headers already sent by (output started at /pass.php:70) in /pass.php on line 77