18 October, 2023

Far Out SCS-C01 Dumps Questions For AWS Certified Security- Specialty Certification

It is more faster and easier to pass the Amazon-Web-Services SCS-C01 exam by using Exact Amazon-Web-Services AWS Certified Security- Specialty questuins and answers. Immediate access to the Renovate SCS-C01 Exam and find the same core area SCS-C01 questions with professionally verified answers, then PASS your exam with a high score now.

Amazon-Web-Services SCS-C01 Free Dumps Questions Online, Read and Test Now.

Page: 1 / 27

Total 330 questions Full Exam Access

Question 1

You have a set of application , database and web servers hosted in AWS. The web servers are placed behind an ELB. There are separate security groups for the application, database and web servers. The network security groups have been defined accordingly. There is an issue with the communication between the application and database servers. In order to troubleshoot the issue between just the application and database server, what is the ideal set of MINIMAL steps you would take?
Please select:

Check the Inbound security rules for the database security group Check the Outbound security rules for the application security group

Check the Outbound security rules for the database security group I Check the inbound security rules for the application security group

Check the both the Inbound and Outbound security rules for the database security group Check the inbound security rules for the application security group

Check the Outbound security rules for the database security groupCheck the both the Inbound and Outbound security rules for the application security group

Question 2

A Security Engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled.
While testing the solution, the Security Engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?

The log files fail integrity validation and automatically are marked as unavailable.

The KMS key policy does not grant the Security Engineer's IAM user or role permissions to decrypt with it.

The bucket is set up to use server-side encryption with Amazon S3-managed keys (SSE-S3) as the default and does not allow SSE-KMS-encrypted files.

An IAM policy applicable to the Security Engineer’s IAM user or role denies access to the "CloudTrail/" prefix in the Amazon S3 bucket

Question 3

You have a set of 100 EC2 Instances in an AWS account. You need to ensure that all of these instances are patched and kept to date. All of the instances are in a private subnet. How can you achieve this. Choose 2 answers from the options given below
Please select:

Ensure a NAT gateway is present to download the updates

Use the Systems Manager to patch the instances

Ensure an internet gateway is present to download the updates

Use the AWS inspector to patch the updates

Question 4

A Security Administrator at a university is configuring a fleet of Amazon EC2 instances. The EC2 instances are shared among students, and non-root SSH access is allowed. The Administrator is concerned about students attacking other AWS account resources by using the EC2 instance metadata service.
What can the Administrator do to protect against this potential attack?

Disable the EC2 instance metadata service.

Log all student SSH interactive session activity.

Implement ip tables-based restrictions on the instances.

Install the Amazon Inspector agent on the instances.

Question 5

A company has been using the AW5 KMS service for managing its keys. They are planning on carrying out housekeeping activities and deleting keys which are no longer in use. What are the ways that can be incorporated to see which keys are in use? Choose 2 answers from the options given below
Please select:

Determine the age of the master key

See who is assigned permissions to the master key

See Cloudtrail for usage of the key

Use AWS cloudwatch events for events generated for the key

My answer: -

Reference answer: BC

Reference analysis:

The direct ways that can be used to see how the key is being used is to see the current access permissions and cloudtrail logs
Option A is invalid because seeing how long ago the key was created would not determine the usage of the key
Option D is invalid because Cloudtrail Event is better for seeing for events generated by the key This is also mentioned in the AWS Documentation
Examining CMK Permissions to Determine the Scope of Potential Usage
Determining who or what currently has access to a customer master key (CMK) might help you determine how widely the CM was used and whether it is still needed. To learn how to determine who or what currently has access to a CMK, go to Determining Access to an AWS KMS Customer Master Key.
Examining AWS CloudTrail Logs to Determine Actual Usage
AWS KMS is integrated with AWS CloudTrail, so all AWS KMS API activity is recorded in CloudTrail log files. If you have CloudTrail turned on in the region where your customer master key (CMK) is located, you can examine your CloudTrail log files to view a history of all AWS KMS API activity for a particular CMK, and thus its usage history. You might be able to use a CMK's usage history to help you determine whether or not you still need it
For more information on determining the usage of CMK keys, please visit the following URL:
SCS-C01 dumps exhibit https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-determining-usage.html
The correct answers are: See who is assigned permissions to the master key. See Cloudtrail for usage of the key Submit your Feedback/Queries to our Experts

Question 6

A company is planning on extending their on-premise AWS Infrastructure to the AWS Cloud. They need to have a solution that would give core benefits of traffic encryption and ensure latency is kept to a minimum. Which of the following would help fulfil this requirement? Choose 2 answers from the options given below
Please select:

AWS VPN

AWS VPC Peering

AWS NAT gateways

AWS Direct Connect

Question 7

A company had developed an incident response plan 18 months ago. Regular implementations of the response plan are carried out. No changes have been made to the response plan have been made since its creation. Which of the following is a right statement with regards to the plan?
Please select:

It places too much emphasis on already implemented security controls.

The response plan is not implemented on a regular basis

The response plan does not cater to new services

The response plan is complete in its entirety

Question 8

A Security Engineer received an AWS Abuse Notice listing EC2 instance IDs that are reportedly abusing other hosts.
Which action should the Engineer take based on this situation? (Choose three.)

Use AWS Artifact to capture an exact image of the state of each instance.

Create EBS Snapshots of each of the volumes attached to the compromised instances.

Capture a memory dump.

Revoke all network ingress and egress except for to/from a forensics workstation.

Run Auto Recovery for Amazon EC2.

Question 9

You are trying to use the Systems Manager to patch a set of EC2 systems. Some of the systems are not getting covered in the patching process. Which of the following can be used to troubleshoot the issue? Choose 3 answers from the options given below.
Please select:

Check to see if the right role has been assigned to the EC2 instances

Check to see if the 1AM user has the right permissions for EC2

Ensure that agent is running on the instances.

Check the Instance status by using the Health API.

Question 10

An Amazon S3 bucket is encrypted using an AWS KMS CMK. An IAM user is unable to download objects from the S3 bucket using the AWS Management Console; however, other users can download objects from the S3 bucket.
Which policies should the Security Engineer review and modify to resolve this issue? (Select three.)

The CMK policy

The VPC endpoint policy

The S3 bucket policy

The S3 ACL

The IAM policy

Question 11

A company’s security policy requires that VPC Flow Logs are enabled on all VPCs. A Security Engineer is looking to automate the process of auditing the VPC resources for compliance.
What combination of actions should the Engineer take? (Choose two.)

Create an AWS Lambda function that determines whether Flow Logs are enabled for a given VPC.

Create an AWS Config configuration item for each VPC in the company AWS account.

Create an AWS Config managed rule with a resource type of AWS:: Lambda:: Function.

Create an Amazon CloudWatch Event rule that triggers on events emitted by AWS Config.

Create an AWS Config custom rule, and associate it with an AWS Lambda function that contains the evaluating logic.

Question 12

You are designing a custom 1AM policy that would allow uses to list buckets in S3 only if they are MFA authenticated. Which of the following would best match this requirement?
A.
SCS-C01 dumps exhibit

Question 13

The Security Engineer implemented a new vault lock policy for 10TB of data and called initiate-vault-lock 12 hours ago. The Audit team identified a typo that is allowing incorrect access to the vault.
What is the MOST cost-effective way to correct this?

Call the abort-vault-lock operation, fix the typo, and call the initiate-vault-lock again.

Copy the vault data to Amazon S3, delete the vault, and create a new vault with the data.

Update the policy, keeping the vault lock in place.

Update the policy and call initiate-vault-lock again to apply the new policy.

Question 14

A company has a large set of keys defined in AWS KMS. Their developers frequently use the keys for the applications being developed. What is one of the ways that can be used to reduce the cost of accessing the keys in the AWS KMS service.
Please select:

Enable rotation of the keys

Use Data key caching

Create an alias of the key

Use the right key policy

Question 15

A Lambda function reads metadata from an S3 object and stores the metadata in a DynamoDB table. The function is triggered whenever an object is stored within the S3 bucket.
How should the Lambda function be given access to the DynamoDB table?
Please select:

Create a VPC endpoint for DynamoDB within a VP

Configure the Lambda function to access resources in the VPC.

Create a resource policy that grants the Lambda function permissions to write to the DynamoDB table.Attach the poll to the DynamoDB table.

Create an 1AM user with permissions to write to the DynamoDB tabl

Store an access key for that user in the Lambda environment variables.

Create an 1AM service role with permissions to write to the DynamoDB tabl

Associate that role with the Lambda function.

My answer: -

Reference answer: D

Reference analysis:

The ideal way is to create an 1AM role which has the required permissions and then associate it with the Lambda function
The AWS Documentation additionally mentions the following
Each Lambda function has an 1AM role (execution role) associated with it. You specify the 1AM role when you create your Lambda function. Permissions you grant to this role determine what AWS Lambda can do when it assumes the role. There are two types of permissions that you grant to the 1AM role:
If your Lambda function code accesses other AWS resources, such as to read an object from an S3 bucket or write logs to CloudWatch Logs, you need to grant permissions for relevant Amazon S3 and CloudWatch actions to the role.
If the event source is stream-based (Amazon Kinesis Data Streams and DynamoDB streams), AWS Lambda polls these streams on your behalf. AWS Lambda needs permissions to poll the stream and read new records on the stream so you need to grant the relevant permissions to this role.
Option A is invalid because the VPC endpoint allows access instances in a private subnet to access DynamoDB
Option B is invalid because resources policies are present for resources such as S3 and KMS, but not AWS Lambda
Option C is invalid because AWS Roles should be used and not 1AM Users
For more information on the Lambda permission model, please visit the below URL: https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html
The correct answer is: Create an 1AM service role with permissions to write to the DynamoDB table. Associate that role with the Lambda function.
Submit your Feedback/Queries to our Exp

Question 16

You have been given a new brief from your supervisor for a client who needs a web application set up on AWS. The a most important requirement is that MySQL must be used as the database, and this database must not be hosted in t« public cloud, but rather at the client's data center due to security risks. Which of the following solutions would be the ^ best to assure that the client's requirements are met? Choose the correct answer from the options below
Please select:

Build the application server on a public subnet and the database at the client's data cente

Connect them with a VPN connection which uses IPsec.

Use the public subnet for the application server and use RDS with a storage gateway to access and synchronize the data securely from the local data center.

Build the application server on a public subnet and the database on a private subnet with a NAT instance between them.

Build the application server on a public subnet and build the database in a private subnet with a secure ssh connection to the private subnet from the client's data center.

Question 17

You are creating a Lambda function which will be triggered by a Cloudwatch Event. The data from these events needs to be stored in a DynamoDB table. How should the Lambda function be given access to the DynamoDB table?
Please select:

Put the AWS Access keys in the Lambda function since the Lambda function by default is secure

Use an 1AM role which has permissions to the DynamoDB table and attach it to the Lambda function.

Use the AWS Access keys which has access to DynamoDB and then place it in an S3 bucket.

Create a VPC endpoint for the DynamoDB tabl

Access the VPC endpoint from the Lambda function.

Question 18

Your IT Security team has identified a number of vulnerabilities across critical EC2 Instances in the company's AWS Account. Which would be the easiest way to ensure these vulnerabilities are remediated?
Please select:

Create AWS Lambda functions to download the updates and patch the servers.

Use AWS CLI commands to download the updates and patch the servers.

Use AWS inspector to patch the servers

Use AWS Systems Manager to patch the servers

Question 19

A Security Engineer has been asked to create an automated process to disable IAM user access keys that are more than three months old.
Which of the following options should the Security Engineer use?

In the AWS Console, choose the IAM service and select “Users”. Review the “Access Key Age” column.

Define an IAM policy that denies access if the key age is more than three months and apply to all users.

Write a script that uses the GenerateCredentialReport, GetCredentialReport, and UpdateAccessKey APIs.

Create an Amazon CloudWatch alarm to detect aged access keys and use an AWS Lambda function to disable the keys older than 90 days.

Question 20

Your company is planning on AWS on hosting its AWS resources. There is a company policy which mandates that all security keys are completely managed within the company itself. Which of the following is the correct measure of following this policy?
Please select:

Using the AWS KMS service for creation of the keys and the company managing the key lifecycle thereafter.

Generating the key pairs for the EC2 Instances using puttygen

Use the EC2 Key pairs that come with AWS

Use S3 server-side encryption

Question 21

A company has a customer master key (CMK) with imported key materials. Company policy requires that all encryption keys must be rotated every year.
What can be done to implement the above policy?

Enable automatic key rotation annually for the CMK.

Use AWS Command Line Interface to create an AWS Lambda function to rotate the existing CMK annually.

Import new key material to the existing CMK and manually rotate the CMK.

Create a new CMK, import new key material to it, and point the key alias to the new CMK.

Question 22

In order to encrypt data in transit for a connection to an AWS RDS instance, which of the following would you implement
Please select:

Transparent data encryption

SSL from your application

Data keys from AWS KMS

Data Keys from CloudHSM

Question 23

An organization receives an alert that indicates that an EC2 instance behind an ELB Classic Load Balancer has been compromised.
What techniques will limit lateral movement and allow evidence gathering?

Remove the instance from the load balancer and terminate it.

Remove the instance from the load balancer, and shut down access to the instance by tightening the security group.

Reboot the instance and check for any Amazon CloudWatch alarms.

Stop the instance and make a snapshot of the root EBS volume.

Question 24

Your company has a set of EC2 Instances that are placed behind an ELB. Some of the applications hosted on these instances communicate via a legacy protocol. There is a security mandate that all traffic between the client and the EC2 Instances need to be secure. How would you accomplish this?
Please select:

Use an Application Load balancer and terminate the SSL connection at the ELB

Use a Classic Load balancer and terminate the SSL connection at the ELB

Use an Application Load balancer and terminate the SSL connection at the EC2 Instances

Use a Classic Load balancer and terminate the SSL connection at the EC2 Instances

Question 25

A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at Rest. If the user is supplying his own keys for encryption SSE-C, which of the below mentioned statements is true?
Please select:

The user should use the same encryption key for all versions of the same object

It is possible to have different encryption keys for different versions of the same object

AWS S3 does not allow the user to upload his own keys for server side encryption

The SSE-C does not work when versioning is enabled

Page: 1 / 27

Total 330 questions Full Exam Access