Latest SCS-C01 Study Guides 2023 - With Test Engine PDF
Get New SCS-C01 Practice Test Questions Answers
The benefit of obtaining the Amazon SCS-C01: AWS Certified Security - Specialty Exam Certification
The IT practitioners accredited by Amazon are known amongst the competitors. At the time of appointment of applicants for a work interview employers, AWS accredited production partners will easily give them the advantage to inform anything that differentiates the employee from each other. Amazon Certified IT professionals have networks that are more useful and important to help them set themselves career goals. AWS Accredited Developer gives you the correct career advice that you normally can not receive without a degree. Amazon Accredited IT professionals are confident and distinct from other professionals since they have more expertise than uncertified professionals. Like most uncertified professionals do not know, AMAZON Certified IT professionals use the resources to do the job quickly and cost-effectively.
The qualification as AWS Certified Developer enables candidates to become experts in all facets of their expertise. Instead of waiting years and completing, AWS accredited development certifications provide a way to find a place in which you are involved without experience.
The AWS Certified Security - Specialty Exam is one of the most sought-after certifications in the IT industry. Offered by Amazon Web Services (AWS), SCS-C01 exam is designed to test the knowledge and skills of IT professionals in securing the AWS platform. The AWS Certified Security - Specialty certification demonstrates that the individual has a thorough understanding of AWS security best practices and can implement them effectively.
NEW QUESTION # 284
An application uses Amazon Cognito to manage end users' permissions when directly accessing IAM resources, including Amazon DynamoDB. A new feature request reads as follows:
Provide a mechanism to mark customers as suspended pending investigation or suspended permanently. Customers should still be able to log in when suspended, but should not be able to make changes.
The priorities are to reduce complexity and avoid potential for future security issues.
Which approach will meet these requirements and priorities?
- A. Use Amazon Cognito Sync to push out a "suspension_status" parameter and split the lAM policy into normal users and suspended users.
- B. Add suspended customers to second Cognito user pool and update the application login flow to check both user pools.
- C. Move suspended customers to a second Cognito group and define an appropriate IAM access policy for the group.
- D. Create a new database field "suspended_status" and modify the application logic to validate that field when processing requests.
Answer: C
Explanation:
https://IAM.amazon.com/blogs/IAM/new-amazon-cognito-groups-and-fine-grained-role-based-access-control-2/
NEW QUESTION # 285
A recent security audit identified that a company's application team injects database credentials into the environment variables of an IAM Fargate task. The company's security policy mandates that all sensitive data be encrypted at rest and in transit.
When combination of actions should the security team take to make the application compliant within the security policy? (Select THREE)
- A. Create an IAM Secrets Manager secret and specify the key/value pairs to be stored in this secret
- B. Store the credentials securely in a file in an Amazon S3 bucket with restricted access to the application team IAM role Ask the application team to read the credentials from the S3 object instead
- C. Add the following statement to the container instance IAM role policy
- D. Modify the application to pull credentials from the IAM Secrets Manager secret instead of the environment variables.
- E. Log in to the IAM Fargate instance, create a script to read the secret value from IAM Secret Manager, and inject the environment variables. Ask the application team to redeploy the application.
- F. Add the following statement to the execution role policy.
Answer: A,E,F
NEW QUESTION # 286
Your company is planning on using AWS EC2 and ELB for deployment for their web applications. The security policy mandates that all traffic should be encrypted. Which of the following options will ensure that this requirement is met. Choose 2 answers from the options below.
Please select:
- A. Ensure the HTTPS listener sends requests to the instances on port 80 The AWS Documentation mentions the following You can create a load balancer that listens on both the HTTP (80) and HTTPS (443) ports. If you specify that the HTTPS listener sends requests to the instances on port 80, the load balancer terminates the requests and communication from the load balancer to the instances is not encrypted, if the HTTPS listener sends requests to the instances on port 443, communication from the load balancer to the instances is encrypted.
- B. Ensure the load balancer listens on port 80
- C. Ensure the HTTPS listener sends requests to the instances on port 443
- D. Ensure the load balancer listens on port 443
Answer: C,D
Explanation:
Option A is invalid because there is a need for secure traffic, so port 80 should not be used Option D is invalid because for the HTTPS listener you need to use port 443 For more information on HTTPS with ELB, please refer to the below Link:
https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-create-https-ssl-load-balancer.htmll The correct answers are: Ensure the load balancer listens on port 443, Ensure the HTTPS listener sends requests to the instances on port 443 Submit your Feedback/Queries to our Experts
NEW QUESTION # 287
A Security Engineer received an IAM Abuse Notice listing EC2 instance IDs that are reportedly abusing other hosts.
Which action should the Engineer take based on this situation? (Choose three.)
- A. Create EBS Snapshots of each of the volumes attached to the compromised instances.
- B. Run Auto Recovery for Amazon EC2.
- C. Log in to each instance with administrative credentials to restart the instance.
- D. Revoke all network ingress and egress except for to/from a forensics workstation.
- E. Capture a memory dump.
- F. Use IAM Artifact to capture an exact image of the state of each instance.
Answer: A,B,D
NEW QUESTION # 288
A company wants to encrypt data locally while meeting regulatory requirements related to key exhaustion. The encryption key can be no more than 10 days old or encrypt more than 2" 16 objects Any encryption key must be generated on a FlPS-validated hardware security module (HSM). The company is cost-conscious, as plans to upload an average of 100 objects to Amazon S3 each second for sustained operations across 5 data producers When approach MOST efficiently meets the company's needs?
- A. Use AWS CloudHSM to generate the master key and data keys. Then use Boto 3 and Python to locally encrypt data before uploading the object Rotate the data key every 10 days or after 2" 16 objects have been Uploaded to Amazon 33
- B. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) and set the master key to automatically rotate.
- C. Use the AWS Encryption SDK and set the maximum age to 10 days and the minimum number of messages encrypted to 3" 16. Use AWS Key Management Service (AWS KMS) to generate the master key and data key Use data key caching with the Encryption SDk during the encryption process.
- D. Use AWS Key Management Service (AWS KMS) to generate an AWS managed CMK. Then use Amazon S3 client-side encryption configured to automatically rotate with every object
Answer: C
NEW QUESTION # 289
An application outputs logs to a text file. The logs must be continuously monitored for security incidents.
Which design will meet the requirements with MINIMUM effort?
- A. Create a file watcher that copies data to Amazon Kinesis when the application writes to the log file.
Have Kinesis trigger a Lambda function to update Amazon CloudWatch metrics with the log data. Set up CloudWatch alerts based on the metrics. - B. Install and configure the Amazon CloudWatch Logs agent on the application's EC2 instance. Create a CloudWatch metric filter to monitor the application logs. Set up CloudWatch alerts based on the metrics.
- C. Create a scheduled process to copy the component's logs into Amazon S3. Use S3 events to trigger a Lambda function that updates Amazon CloudWatch metrics with the log data. Set up CloudWatch alerts based on the metrics.
- D. Create a scheduled process to copy the application log files to IAM CloudTrail. Use S3 events to trigger Lambda functions that update CloudWatch metrics with the log data. Set up CloudWatch alerts based on the metrics.
Answer: B
Explanation:
Explanation
https://docs.IAM.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html
NEW QUESTION # 290
A Security Administrator is configuring an Amazon S3 bucket and must meet the following security
requirements:
Encryption in transit
Encryption at rest
Logging of all object retrievals in AWS CloudTrail
Which of the following meet these security requirements? (Choose three.)
- A. Set up default encryption for the S3 bucket.
- B. Enable API logging of data events for all S3 objects.
- C. Enable S3 object versioning for the S3 bucket.
- D. Enable a security group for the S3 bucket that allows port 443, but not port 80.
- E. Specify "aws:SecureTransport": "true"within a condition in the S3 bucket policy.
- F. Enable Amazon CloudWatch Logs for the AWS account.
Answer: A,C,F
NEW QUESTION # 291
A security engineer needs to configure monitonng and auditing for AWS Lambda.
Which combination of actions using AWS services should the security engineer take to accomplish this goal?
(Select TWO.)
- A. Use Amazon Macie to discover, classify, and protect sensitive data being executed inside the Lambda function.
- B. Use AWS CloudTrail to implement governance, compliance, operational, and risk auditing for Lambda.
- C. Use Amazon Inspector to automatically monitor for vulnerabilities and perform governance, compliance, operational, and risk auditing for Lambda.
- D. Use AWS Config to track configuration changes to Lambda functions, runtime environments, tags, handler names, code sizes, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations.
- E. Use AWS Resource Access Manager to track configuration changes to Lambda functions, runtime environments, tags, handler names, code sizes, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations.
Answer: B,D
NEW QUESTION # 292
Your company has been using AWS for the past 2 years. They have separate S3 buckets for logging the various AWS services that have been used. They have hired an external vendor for analyzing their log files. They have their own AWS account. What is the best way to ensure that the partner account can access the log files in the company account for analysis. Choose 2 answers from the options given below Please select:
- A. Create an IAM user in the company account
- B. Ensure the IAM Role has access for read-only to the S3 buckets
- C. Ensure the IAM user has access for read-only to the S3 buckets
- D. Create an IAM Role in the company account
Answer: B,D
Explanation:
The AWS Documentation mentions the following
To share log files between multiple AWS accounts, you must perform the following general steps. These steps are explained in detail later in this section.
Create an IAM role for each account that you want to share log files with.
For each of these IAM roles, create an access policy that grants read-only access to the account you want to share the log files with.
Have an IAM user in each account programmatically assume the appropriate role and retrieve the log files.
Options A and C are invalid because creating an IAM user and then sharing the IAM user credentials with the vendor is a direct 'NO' practise from a security perspective.
For more information on sharing cloudtrail logs files, please visit the following URL
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-sharine-loes.htmll The correct answers are: Create an IAM Role in the company account Ensure the IAM Role has access for read-only to the S3 buckets Submit your Feedback/Queries to our Experts
NEW QUESTION # 293
The Security Engineer implemented a new vault lock policy for 10TB of data and called initiate-vault-lock 12 hours ago. The Audit team identified a typo that is allowing incorrect access to the vault.
What is the MOST cost-effective way to correct this?
- A. Update the policy, keeping the vault lock in place.
- B. Copy the vault data to Amazon S3, delete the vault, and create a new vault with the data.
- C. Update the policy and call initiate-vault-lock again to apply the new policy.
- D. Call the abort-vault-lock operation, fix the typo, and call the initiate-vault-lock again.
Answer: D
NEW QUESTION # 294
You currently have an S3 bucket hosted in an IAM Account. It holds information that needs be accessed by a partner account. Which is the MOST secure way to allow the partner account to access the S3 bucket in your account? Select 3 options.
Please select:
- A. Provide the ARN for the role to the partner account
- B. Ensure an IAM role is created which can be assumed by the partner account.
- C. Ensure an IAM user is created which can be assumed by the partner account.
- D. Ensure the partner uses an external id when making the request
- E. Provide access keys for your account to the partner account
- F. Provide the Account Id to the partner account
Answer: A,B,D
Explanation:
Option B is invalid because Roles are assumed and not IAM users
Option E is invalid because you should not give the account ID to the partner Option F is invalid because you should not give the access keys to the partner The below diagram from the IAM documentation showcases an example on this wherein an IAM role and external ID is us> access an IAM account resources
For more information on creating roles for external ID'S please visit the following URL:
The correct answers are: Ensure an IAM role is created which can be assumed by the partner account. Ensure the partner uses an external id when making the request Provide the ARN for the role to the partner account Submit your Feedback/Queries to our Experts
NEW QUESTION # 295
Your company is planning on using AWS EC2 and ELB for deployment for their web applications. The security policy mandates that all traffic should be encrypted. Which of the following options will ensure that this requirement is met. Choose 2 answers from the options below.
Please select:
- A. Ensure the HTTPS listener sends requests to the instances on port 80
- B. Ensure the load balancer listens on port 80
- C. Ensure the HTTPS listener sends requests to the instances on port 443
- D. Ensure the load balancer listens on port 443
Answer: C,D
Explanation:
Explanation
The AWS Documentation mentions the following
You can create a load balancer that listens on both the HTTP (80) and HTTPS (443) ports. If you specify that the HTTPS listener sends requests to the instances on port 80, the load balancer terminates the requests and communication from the load balancer to the instances is not encrypted, if the HTTPS listener sends requests to the instances on port 443, communication from the load balancer to the instances is encrypted.
Option A is invalid because there is a need for secure traffic, so port 80 should not be used Option D is invalid because for the HTTPS listener you need to use port 443 For more information on HTTPS with ELB, please refer to the below Link:
https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-create-https-ssl-load-balancer.htmll The correct answers are: Ensure the load balancer listens on port 443, Ensure the HTTPS listener sends requests to the instances on port 443 Submit your Feedback/Queries to our Experts
NEW QUESTION # 296
There are currently multiple applications hosted in a VPC. During monitoring it has been noticed that multiple port scans are coming in from a specific IP Address block. The internal security team has requested that all offending IP Addresses be denied for the next 24 hours. Which of the following is the best method to quickly and temporarily deny access from the specified IP Address's.
Please select:
- A. Modify the Network ACLs associated with all public subnets in the VPC to deny access from the IP Address block.
- B. Modify the Windows Firewall settings on all AMI'S that your organization uses in that VPC to deny access from the IP address block.
- C. Add a rule to all of the VPC Security Groups to deny access from the IP Address block.
- D. Create an AD policy to modify the Windows Firewall settings on all hosts in the VPC to deny access from the IP Address block.
Answer: A
Explanation:
NACL acts as a firewall at the subnet level of the VPC and we can deny the offending IP address block at the subnet level using NACL rules to block the incoming traffic to the VPC instances. Since NACL rules are applied as per the Rule numbers make sure that this rule number should take precedence over other rule numbers if there are any such rules that will allow traffic from these IP ranges. The lowest rule number has more precedence over a rule that has a higher number.
The AWS Documentation mentions the following as a best practices for 1AM users For extra security, enable multi-factor authentication (MFA) for privileged 1AM users (users who are allowed access to sensitive resources or APIs). With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP). Users must provide both their normal credentials (like their user name and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device (for example, it can run in an app on a smartphone).
Options C is invalid because these options are not available
Option D is invalid because there is not root access for users
For more information on 1AM best practices, please visit the below URL:
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
The correct answer is: Modify the Network ACLs associated with all public subnets in the VPC to deny access from the IP Address block.
omit your Feedback/Queries to our Experts
NEW QUESTION # 297
An Amazon S3 bucket is encrypted using an AWS KMS CMK. An IAM user is unable to download objects from the S3 bucket using the AWS Management Console; however, other users can download objects from the S3 bucket.
Which policies should the Security Engineer review and modify to resolve this issue? (Select three.)
- A. The VPC endpoint policy
- B. The CMK policy
- C. The IAM policy
- D. The S3 bucket policy
- E. The S3 ACL
Answer: B,C,D
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/decrypt-kms-encrypted-objects-s3/
NEW QUESTION # 298
After multiple compromises of its Amazon EC2 instances, a company's Security Officer is mandating that memory dumps of compromised instances be captured for further analysis. A Security Engineer just received an EC2 abuse notification report from AWS stating that an EC2 instance running the most recent Windows Server 2019 Base AMI is compromised.
How should the Security Engineer collect a memory dump of the EC2 instance for forensic analysis?
- A. Reboot the EC2 Windows Server, enter safe mode, and select memory dump.
- B. Download and run the EC2Rescue for Windows Server utility from AWS.
- C. Give consent to the AWS Security team to dump the memory core on the compromised instance and provide it to AWS Support for analysis.
- D. Review memory dump data that the AWS Systems Manager Agent sent to Amazon CloudWatch Logs.
Answer: C
NEW QUESTION # 299
You have a set of application , database and web servers hosted in AWS. The web servers are placed behind an ELB. There are separate security groups for the application, database and web servers. The network security groups have been defined accordingly. There is an issue with the communication between the application and database servers. In order to troubleshoot the issue between just the application and database server, what is the ideal set of MINIMAL steps you would take?
Please select:
- A. Check the Inbound security rules for the database security group Check the Outbound security rules for the application security group
- B. Check the both the Inbound and Outbound security rules for the database security group Check the inbound security rules for the application security group
- C. Check the Outbound security rules for the database security group
Check the both the Inbound and Outbound security rules for the application security group - D. Check the Outbound security rules for the database security group I Check the inbound security rules for the application security group
Answer: A
Explanation:
Explanation
Here since the communication would be established inward to the database server and outward from the application server, you need to ensure that just the Outbound rules for application server security groups are checked. And then just the Inbound rules for database server security groups are checked.
Option B can't be the correct answer. It says that we need to check the outbound security group which is not needed.
We need to check the inbound for DB SG and outbound of Application SG. Because, this two group need to communicate with each other to function properly.
Option C is invalid because you don't need to check for Outbound security rules for the database security group Option D is invalid because you don't need to check for Inbound security rules for the application security group For more information on Security Groups, please refer to below URL:
The correct answer is: Check the Inbound security rules for the database security group Check the Outbound security rules for the application security group Submit your Feedback/Queries to our Experts
NEW QUESTION # 300
An application makes calls to AWS services using the AWS SDK. The application runs on Amazon EC2 instances with an associated IAM role. When the application attempts to access an object within an Amazon S3 bucket; the Administrator receives the following error message: HTTP 403: Access Denied.
Which combination of steps should the Administrator take to troubleshoot this issue? (Select three.)
- A. Confirm that the EC2 instance's security group authorizes S3 access.
- B. Confirm that the EC2 instance is using the correct key pair.
- C. Confirm that the instance and the S3 bucket are in the same Region.
- D. Confirm that the IAM role associated with the EC2 instance has the proper privileges.
- E. Verify that the KMS key policy allows decrypt access for the KMS key for this IAM principle.
- F. Check the S3 bucket policy for statements that deny access to objects.
Answer: D,E,F
NEW QUESTION # 301
An IAM account includes two S3 buckets: bucket1 and bucket2. The bucket2 does not have a policy defined, but bucket1 has the following bucket policy:
In addition, the same account has an IAM User named "alice", with the following IAM policy.
Which buckets can user "alice" access?
- A. Bucket2 only
- B. Neither bucket1 nor bucket2
- C. Both bucket1 and bucket2
- D. Bucket1 only
Answer: C
Explanation:
Explanation
Both S3 policies and IAM policies can be used to grant access to buckets. IAM policies specify what actions are allowed or denied on what IAM resources (e.g. allow ec2:TerminateInstance on the EC2 instance with instance_id=i-8b3620ec). You attach IAM policies to IAM users, groups, or roles, which are then subject to the permissions you've defined. In other words, IAM policies define what a principal can do in your IAM environment. S3 bucket policies, on the other hand, are attached only to S3 buckets. S3 bucket policies specify what actions are allowed or denied for which principals on the bucket that the bucket policy is attached to (e.g.
allow user Alice to PUT but not DELETE objects in the bucket).
https://IAM.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-
NEW QUESTION # 302
A company is deploying a new web application on AWS. Based on their other web applications, they anticipate being the target of frequent DDoS attacks. Which steps can the company use to protect their application? Select 2 answers from the options given below.
Please select:
- A. Use Amazon Inspector on the EC2 instances to examine incoming traffic and discard malicious traffic.
- B. Use CloudFront and AWS WAF to prevent malicious traffic from reaching the application
- C. Enable GuardDuty to block malicious traffic from reaching the application
- D. Associate the EC2 instances with a security group that blocks traffic from blacklisted IP addresses.
- E. Use an ELB Application Load Balancer and Auto Scaling group to scale to absorb application layer traffic.
Answer: B,E
Explanation:
The below diagram from AWS shows the best case scenario for avoiding DDos attacks using services such as AWS Cloudfro WAF, ELB and Autoscaling
Option A is invalid because by default security groups don't allow access
Option C is invalid because AWS Inspector cannot be used to examine traffic
Option E is invalid because this can be used for attacks on EC2 Instances but not against DDos attacks on the entire application For more information on DDos mitigation from AWS, please visit the below URL:
https://aws.amazon.com/answers/networking/aws-ddos-attack-mitieationi
The correct answers are: Use an ELB Application Load Balancer and Auto Scaling group to scale to absorb application layer traffic., Use CloudFront and AWS WAF to prevent malicious traffic from reaching the application
Submit your Feedback/Queries to our Experts
NEW QUESTION # 303
A distributed web application is installed across several EC2 instances in public subnets residing in two Availability Zones. Apache logs show several intermittent brute-force attacks from hundreds of IP addresses at the layer 7 level over the past six months.
What would be the BEST way to reduce the potential impact of these attacks in the future?
- A. Update security groups to deny traffic from the originating source IP addresses.
- B. Use network ACLs.
- C. Use custom route tables to prevent malicious traffic from routing to the instances.
- D. Install intrusion prevention software (IPS) on each instance.
Answer: D
Explanation:
Explanation
https://docs.IAM.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html NACL has limit 20 (can increase to maximum 40 rule), and more rule will make more low-latency
NEW QUESTION # 304
......
How to study the Amazon AWS-Security-Specialty: AWS Certified Security - Specialty Exam
A broad range of Solutions Architect-Professional exam dumps pdf for AWS certified security-specialty Certification have been recognized for certification issues. The reality that students need to prepare attentively does not make certificates easy. It also takes a long time to learn from AWS certified security-specialty. Every exam includes answers and questions that help students pass their final test. You will pass the test after you have taken and learned our modules. But it doesn't end there; thanks to our full guides, you will still be good in your career. You will produce your goods in the future. To plan any material for you, we have an advanced method. In the development of and commodity, we have used the latest details.
AWS certified security - specialty practice test are easy to use, so that anyone can appreciate them. In such dynamic areas, where qualification requires a lot of study, planning, and focus, no one likes loss. An effort is so hard that even the students' nerves can be shattered. Our waste management systems are so legitimate and best that you have no pain to pass your AWS accredited Developer Professional.
SCS-C01 Dumps and Exam Test Engine: https://www.passexamdumps.com/SCS-C01-valid-exam-dumps.html
Amazon SCS-C01 DUMPS WITH REAL EXAM QUESTIONS: https://drive.google.com/open?id=1GHJdp22deK1c65z1GIkrdFOpNf6clGCq
