Amazon Web Services SCS-C02 Exam With Confidence Using Practice Dumps

Source/destination checking "You must disable source/destination checks if the instance runs services such as network address translation, routing, or firewalls."

The correct answer is C. Disable the Network Source/Destination check on the security appliance’s elastic network interface.

This answer is correct because disabling the Network Source/Destination check allows the virtual security appliance to route traffic that is not addressed to or from itself. By default, this check is enabled on all EC2 instances, and it prevents them from forwarding traffic that does not match their own IP or MAC addresses.However, for a virtual security appliance that acts as a router or a firewall, this check needs to be disabled, otherwise it will drop the traffic that it is supposed to route12.

The other options are incorrect because:

A. Disabling network ACLs is not a solution, because network ACLs are optional layers of security for the subnets in a VPC.They can be used to allow or deny traffic based on IP addresses and ports, but they donot affect the routing behavior of the virtual security appliance3.

B. Configuring the security appliance’s elastic network interface for promiscuous mode is not a solution, because promiscuous mode is a mode for a network interface that causes it to pass all traffic it receives to the CPU, rather than passing only the frames that it is programmed to receive.Promiscuous mode is normally used for packet sniffing or monitoring, but it does not enable the network interface to route traffic4.

D. Placing the security appliance in the public subnet with the internet gateway is not a solution, because it does not address the routing issue of the virtual security appliance.Thesecurity appliance can be placed in either a public or a private subnet, depending on the network design and security requirements, but it still needs to have the Network Source/Destination check disabled to route traffic properly5.

Comprehensive Detailed Explanation with all AWS References

To resolve AccessDenied errors:

IAM Policy Validation:

Use IAM Access Analyzer to ensure that the policy attached to the role allows the necessary S3 actions (e.g., s3:GetObject).

Validate that the role is correctly assumed by the application.

Use AWS Systems Manager Session Manager:

AWS Systems Manager Session Manager provides a secure way to access Amazon EC2 instances without requiring SSH keys, opening inbound ports, or maintaining bastion hosts.

This complies with the company's requirement of not managing SSH keys or maintaining bastion hosts.

Configure Session Manager Logging to CloudWatch:

In the Systems Manager Console, configure Session Manager to upload session logs to Amazon CloudWatch Logs.

This ensures all session activity logs are recorded and stored securely.

Encrypt Logs in CloudWatch:

Use an AWS Key Management Service (AWS KMS) key to encrypt the logs in CloudWatch Logs. Ensure that the CloudWatch log group is configured to use an encrypted KMS key.

This meets the requirement to encrypt logs.

Monitor Logs for Compliance and Security:

Monitor the CloudWatch Logs to ensure proper access and record all activity for compliance purposes.

AWS Systems Manager Session Manager Documentation

Encrypting CloudWatch Logs with KMS

AWS Best Practices for Accessing EC2 Instances