25 October, 2023

How Many Questions Of SCS-C01 Actual Exam

It is more faster and easier to pass the Amazon-Web-Services SCS-C01 exam by using Download Amazon-Web-Services AWS Certified Security- Specialty questuins and answers. Immediate access to the Renewal SCS-C01 Exam and find the same core area SCS-C01 questions with professionally verified answers, then PASS your exam with a high score now.

Online Amazon-Web-Services SCS-C01 free dumps demo Below:

Page: 1 / 27

Total 330 questions Full Exam Access

Question 1

You are building a large-scale confidential documentation web server on AWSand all of the documentation for it will be stored on S3. One of the requirements is that it cannot be publicly accessible from S3 directly, and you will need to use Cloud Front to accomplish this. Which of the methods listed below would satisfy the requirements as outlined? Choose an answer from the options below
Please select:

Create an Identity and Access Management (1AM) user for CloudFront and grant access to the objects in your S3 bucket to that 1AM User.

Create an Origin Access Identity (OAI) for CloudFront and grant access to the objects in your S3 bucket to that OAl.

Create individual policies for each bucket the documents are stored in and in that policy grant access to only CloudFront.

Create an S3 bucket policy that lists the CloudFront distribution ID as the Principal and the target bucket as the Amazon Resource Name (ARN).

My answer: -

Reference answer: B

Reference analysis:

If you want to use CloudFront signed URLs or signed cookies to provide access to objects in your Amazon S3 bucket you probably also want to prevent users from accessing your Amazon S3 objects using Amazon S3 URLs. If users access your objects directly in Amazon S3, they bypass the controls provided by CloudFront signed URLs or signed cookies, for example, control over the date and time that a user can no longer access your content and control over which IP addresses can be used to access content. In addition, if user's access objects both through CloudFront and directly by using Amazon S3 URLs, CloudFront ace logs are less useful because they're incomplete.
Option A is invalid because you need to create a Origin Access Identity for Cloudfront and not an 1AM user Option C and D are invalid because using policies will not help fulfil the requirement
For more information on Origin Access Identity please see the below Link:
http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restrictine-access-to-s3.
The correct answer is: Create an Origin Access Identity (OAI) for CloudFront and grant access to the objects in your S3 bucket to that OAI.
(
Submit your Feedback/Queries to our Experts

Question 2

A company wants to have an Intrusion detection system available for their VPC in AWS. They want to have complete control over the system. Which of the following would be ideal to implement?
Please select:

Use AWS WAF to catch all intrusions occurring on the systems in the VPC

Use a custom solution available in the AWS Marketplace

Use VPC Flow logs to detect the issues and flag them accordingly.

Use AWS Cloudwatch to monitor all traffic

Question 3

A Security Administrator has a website hosted in Amazon S3. The Administrator has been given the following requirements:
SCS-C01 dumps exhibit

Users may not access the website directly by using an Amazon S3 URL.
Which configurations will support these requirements? (Choose two.)

Associate an origin access identity with the CloudFront distribution.

Implement a “Principal”: “cloudfront.amazonaws.com” condition in the S3 bucket policy.

Modify the S3 bucket permissions so that only the origin access identity can access the bucket contents.

Implement security groups so that the S3 bucket can be accessed only by using the intended CloudFront distribution.

Configure the S3 bucket policy so that it is accessible only through VPC endpoints, and place the CloudFront distribution into the specified VPC.

Question 4

Development teams in your organization use S3 buckets to store the log files for various applications hosted ir development environments in AWS. The developers want to keep the logs for one month for troubleshooting purposes, and then purge the logs. What feature will enable this requirement?
Please select:

Adding a bucket policy on the S3 bucket.

Configuring lifecycle configuration rules on the S3 bucket.

Creating an 1AM policy for the S3 bucket.

Enabling CORS on the S3 bucket.

Question 5

While securing the connection between a company's VPC and its on-premises data center, a Security Engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). The ping command did not return a response. The flow log in the VPC showed the following:
2 123456789010 eni-1235b8ca 203.0.113.12 172.31.16.139 0 0 1 4 336 1432917027 1432917142 ACCEPT OK
2 123456789010 eni-1235b8ca 172.31.16.139 203.0.113.12 0 0 1 4 336 1432917094 1432917142 REJECT OK
What action should be performed to allow the ping to work?

In the security group of the EC2 instance, allow inbound ICMP traffic.

In the security group of the EC2 instance, allow outbound ICMP traffic.

In the VPC's NACL, allow inbound ICMP traffic.

In the VPC's NACL, allow outbound ICMP traffic.

Question 6

You currently have an S3 bucket hosted in an AWS Account. It holds information that needs be accessed by a partner account. Which is the MOST secure way to allow the partner account to access the S3 bucket in your account? Select 3 options.
Please select:

Ensure an 1AM role is created which can be assumed by the partner account.

Ensure an 1AM user is created which can be assumed by the partner account.

Ensure the partner uses an external id when making the request

Provide the ARN for the role to the partner account

Provide the Account Id to the partner account

Provide access keys for your account to the partner account

Question 7

Amazon CloudWatch Logs agent is successfully delivering logs to the CloudWatch Logs service. However, logs stop being delivered after the associated log stream has been active for a specific number of hours.
What steps are necessary to identify the cause of this phenomenon? (Choose two.)

Ensure that file permissions for monitored files that allow the CloudWatch Logs agent to read the file have not been modified.

Verify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming.

Configure an Amazon Kinesis producer to first put the logs into Amazon Kinesis Streams.

Create a CloudWatch Logs metric to isolate a value that changes at least once during the period before logging stops.

Use AWS CloudFormation to dynamically create and maintain the configuration file for the CloudWatch Logs agent.

Question 8

A Security Engineer is working with the development team to design a supply chain application that stores sensitive inventory data in an Amazon S3 bucket. The application will use an AWS KMS customer master key (CMK) to encrypt the data on Amazon S3. The inventory data on Amazon S3 will be shared of vendors. All vendors will use AWS principals from their own AWS accounts to access the data on Amazon S3. The vendor list may change weekly, and the solution must support cross-account access.
What is the MOST efficient way to manage access control for the KMS CMK7?

Use KMS grants to manage key acces

Programmatically create and revoke grants to manage vendor access.

Use an IAM role to manage key acces

Programmatically update the IAM role policies to manage vendor access.

Use KMS key policies to manage key acces

Programmatically update the KMS key policies to manage vendor access.

Use delegated access across AWS accounts by using IAM roles to manage key access.Programmatically update the IAM trust policy to manage cross-account vendor access.

Question 10

The Security Engineer has discovered that a new application that deals with highly sensitive data is storing Amazon S3 objects with the following key pattern, which itself contains highly sensitive data.
Pattern: "randomID_datestamp_PII.csv" Example:
"1234567_12302017_000-00-0000 csv"
The bucket where these objects are being stored is using server-side encryption (SSE). Which solution is the most secure and cost-effective option to protect the sensitive data?

Remove the sensitive data from the object name, and store the sensitive data using S3 user-defined metadata.

Add an S3 bucket policy that denies the action s3:GetObject

Use a random and unique S3 object key, and create an S3 metadata index in Amazon DynamoDB using client-side encrypted attributes.

Store all sensitive objects in Binary Large Objects (BLOBS) in an encrypted Amazon RDS instance.

Question 11

A Security Engineer must design a solution that enables the Incident Response team to audit for changes to a user’s IAM permissions in the case of a security incident.
How can this be accomplished?

Use AWS Config to review the IAM policy assigned to users before and after the incident.

Run the GenerateCredentialReport via the AWS CLI, and copy the output to Amazon S3 daily for auditing purposes.

Copy AWS CloudFormation templates to S3, and audit for changes from the template.

Use Amazon EC2 Systems Manager to deploy images, and review AWS CloudTrail logs for changes.

Question 12

You have several S3 buckets defined in your AWS account. You need to give access to external AWS accounts to these S3 buckets. Which of the following can allow you to define the permissions for the external accounts? Choose 2 answers from the options given below
Please select:

1AM policies

Buckets ACL's

1AM users

Bucket policies

Question 13

An organization policy states that all encryption keys must be automatically rotated every 12 months. Which AWS Key Management Service (KMS) key type should be used to meet this requirement?

AWS managed Customer Master Key (CMK)

Customer managed CMK with AWS generated key material

Customer managed CMK with imported key material

AWS managed data key

Question 14

An EC2 Instance hosts a Java based application that access a DynamoDB table. This EC2 Instance is currently serving production based users. Which of the following is a secure way of ensuring that the EC2 Instance access the Dynamo table
Please select:

Use 1AM Roles with permissions to interact with DynamoDB and assign it to the EC2 Instance

Use KMS keys with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

Use 1AM Access Keys with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

Use 1AM Access Groups with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

Question 15

What is the result of the following bucket policy?
SCS-C01 dumps exhibit

Choose the correct answer
Please select:

It will allow all access to the bucket mybucket

It will allow the user mark from AWS account number 111111111 all access to the bucket but deny everyone else all access to the bucket

It will deny all access to the bucket mybucket

None of these

Question 16

A new application will be deployed on EC2 instances in private subnets. The application will transfer sensitive data to and from an S3 bucket. Compliance requirements state that the data must not traverse the public internet. Which solution meets the compliance requirement?
Please select:

Access the S3 bucket through a proxy server

Access the S3 bucket through a NAT gateway.

Access the S3 bucket through a VPC endpoint for S3

Access the S3 bucket through the SSL protected S3 endpoint

Question 17

You need to ensure that the cloudtrail logs which are being delivered in your AWS account is encrypted. How can this be achieved in the easiest way possible?
Please select:

Don't do anything since CloudTrail logs are automatically encrypted.

Enable S3-SSE for the underlying bucket which receives the log files

Enable S3-KMS for the underlying bucket which receives the log files

Enable KMS encryption for the logs which are sent to Cloudwatch

Question 18

A company hosts a critical web application on the AWS Cloud. This is a key revenue generating application for the company. The IT Security team is worried about potential DDos attacks against the web site. The senior management has also specified that immediate action needs to be taken in case of a potential DDos attack. What should be done in this regard?
Please select:

Consider using the AWS Shield Service

Consider using VPC Flow logs to monitor traffic for DDos attack and quickly take actions on a trigger of a potential attack.

Consider using the AWS Shield Advanced Service

Consider using Cloudwatch logs to monitor traffic for DDos attack and quickly take actions on a trigger of a potential attack.

My answer: -

Reference answer: C

Reference analysis:

Option A is invalid because the normal AWS Shield Service will not help in immediate action against a DDos attack. This can be done via the AWS Shield Advanced Service
Option B is invalid because this is a logging service for VPCs traffic flow but cannot specifically protect against DDos attacks.
Option D is invalid because this is a logging service for AWS Services but cannot specifically protect against DDos attacks.
The AWS Documentation mentions the following
AWS Shield Advanced provides enhanced protections for your applications running on Amazon EC2. Elastic Load Balancing (ELB), Amazon CloudFront and Route 53 against larger and more sophisticated attacks. AWS Shield Advanced is available to AWS Business Support and AWS Enterprise Support customers. AWS Shield Advanced protection provides always-on, flow-based monitoring of network traffic and active application monitoring to provide near real-time notifications of DDoS attacks. AWS Shield Advanced also gives customers highly flexible controls over attack mitigations to take actions instantly. Customers can also engage the DDoS Response Team (DRT) 24X7 to manage and mitigate their application layer DDoS attacks.
For more information on AWS Shield, please visit the below URL:
https://aws.amazon.com/shield/faqs;
The correct answer is: Consider using the AWS Shield Advanced Service Submit your Feedback/Queries to our Experts

Question 19

Your company use AWS KMS for management of its customer keys. From time to time, there is a requirement to delete existing keys as part of housekeeping activities. What can be done during the deletion process to verify that the key is no longer being used.
Please select:

Use CloudTrail to see if any KMS API request has been issued against existing keys

Use Key policies to see the access level for the keys

Rotate the keys once before deletion to see if other services are using the keys

Change the 1AM policy for the keys to see if other services are using the keys

Question 20

You need to inspect the running processes on an EC2 Instance that may have a security issue. How can you achieve this in the easiest way possible. Also you need to ensure that the process does not interfere with the continuous running of the instance.
Please select:

Use AWS Cloudtrail to record the processes running on the server to an S3 bucket.

Use AWS Cloudwatch to record the processes running on the server

Use the SSM Run command to send the list of running processes information to an S3 bucket.

Use AWS Config to see the changed process information on the server

Question 21

Your company is planning on using bastion hosts for administering the servers in AWS. Which of the
following is the best description of a bastion host from a security perspective? Please select:

A Bastion host should be on a private subnet and never a public subnet due to security concerns

A Bastion host sits on the outside of an internal network and is used as a gateway into the private network and is considered the critical strong point of the network

Bastion hosts allow users to log in using RDP or SSH and use that session to S5H into internal network to access private subnet resources.

A Bastion host should maintain extremely tight security and monitoring as it is available to the public

Question 22

A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS.
Which steps should be taken to authenticate to AWS services using the company's on-premises Active Directory? (Choose three).

Create IAM roles with permissions corresponding to each Active Directory group.

Create IAM groups with permissions corresponding to each Active Directory group.

Create a SAML provider with IAM.

Create a SAML provider with Amazon Cloud Directory.

Configure AWS as a trusted relying party for the Active Directory

Configure IAM as a trusted relying party for Amazon Cloud Directory.

Question 24

A company has Windows Amazon EC2 instances in a VPC that are joined to on-premises Active Directory servers for domain services. The security team has enabled Amazon GuardDuty on the AWS account to alert on issues with the instances.
During a weekly audit of network traffic, the Security Engineer notices that one of the EC2 instances is attempting to communicate with a known command-and-control server but failing. This alert does not show up in GuardDuty.
Why did GuardDuty fail to alert to this behavior?

GuardDuty did not have the appropriate alerts activated.

GuardDuty does not see these DNS requests.

GuardDuty only monitors active network traffic flow for command-and-control activity.

GuardDuty does not report on command-and-control activity.

Question 25

An application has been built with Amazon EC2 instances that retrieve messages from Amazon SQS. Recently, IAM changes were made and the instances can no longer retrieve messages.
What actions should be taken to troubleshoot the issue while maintaining least privilege. (Select two.)

Configure and assign an MFA device to the role used by the instances.

Verify that the SQS resource policy does not explicitly deny access to the role used by the instances.

Verify that the access key attached to the role used by the instances is active.

Attach the AmazonSQSFullAccess managed policy to the role used by the instances.

Verify that the role attached to the instances contains policies that allow access to the queue.

Page: 1 / 27

Total 330 questions Full Exam Access