27 October, 2023

How Many Questions Of SCS-C01 Simulations

Master the SCS-C01 AWS Certified Security- Specialty content and be ready for exam day success quickly with this Pass4sure SCS-C01 latest exam. We guarantee it!We make it a reality and give you real SCS-C01 questions in our Amazon-Web-Services SCS-C01 braindumps.Latest 100% VALID Amazon-Web-Services SCS-C01 Exam Questions Dumps at below page. You can use our Amazon-Web-Services SCS-C01 braindumps and pass your exam.

Amazon-Web-Services SCS-C01 Free Dumps Questions Online, Read and Test Now.

Page: 1 / 27

Total 330 questions Full Exam Access

Question 1

A company has a few dozen application servers in private subnets behind an Elastic Load Balancer (ELB) in an AWS Auto Scaling group. The application is accessed from the web over HTTPS. The data must always be encrypted in transit. The Security Engineer is worried about potential key exposure due to vulnerabilities in the application software.
Which approach will meet these requirements while protecting the external certificate during a breach?

Use a Network Load Balancer (NLB) to pass through traffic on port 443 from the internet to port 443 on the instances.

Purchase an external certificate, and upload it to the AWS Certificate Manager (for use with the ELB) and to the instance

Have the ELB decrypt traffic, and route and re-encrypt with the same certificate.

Generate an internal self-signed certificate and apply it to the instance

Use AWS Certificate Manager to generate a new external certificate for the EL

Have the ELB decrypt traffic, and route andre-encrypt with the internal certificate.

Upload a new external certificate to the load balance

Have the ELB decrypt the traffic and forward it on port 80 to the instances.

Question 2

A Security Engineer is working with a Product team building a web application on AWS. The application uses Amazon S3 to host the static content, Amazon API Gateway to provide RESTful services; and Amazon DynamoDB as the backend data store. The users already exist in a directory that is exposed through a SAML identity provider.
Which combination of the following actions should the Engineer take to enable users to be authenticated into the web application and call APIs? (Choose three.)

Create a custom authorization service using AWS Lambda.

Configure a SAML identity provider in Amazon Cognito to map attributes to the Amazon Cognito user pool attributes.

Configure the SAML identity provider to add the Amazon Cognito user pool as a relying party.

Configure an Amazon Cognito identity pool to integrate with social login providers.

Update DynamoDB to store the user email addresses and passwords.

Update API Gateway to use a COGNITO_USER_POOLS authorizer.

Question 3

You have just developed a new mobile application that handles analytics workloads on large scale datasets that are stored on Amazon Redshift. Consequently, the application needs to access Amazon Redshift tables. Which of the belov methods would be the best both practically and security-wise, to access the tables? Choose the correct answer from the options below
Please select:

Create an 1AM user and generate encryption keys for that use

Create a policy for Redshift read-only acces

Embed th keys in the application.

Create an HSM client certificate in Redshift and authenticate using this certificate.

Create a Redshift read-only access policy in 1AM and embed those credentials in the application.

Use roles that allow a web identity federated user to assume a role that allows access to the Redshift table by providing temporary credentials.

Question 4

A Security Engineer has been asked to troubleshoot inbound connectivity to a web server. This single web server is not receiving inbound connections from the internet, whereas all other web servers are functioning properly.
The architecture includes network ACLs, security groups, and a virtual security appliance. In addition, the Development team has implemented Application Load Balancers (ALBs) to distribute the load across all web servers. It is a requirement that traffic between the web servers and the internet flow through the virtual security appliance.
The Security Engineer has verified the following:
1. The rule set in the Security Groups is correct
2. The rule set in the network ACLs is correct
3. The rule set in the virtual appliance is correct
Which of the following are other valid items to troubleshoot in this scenario? (Choose two.)

Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to a NAT gateway.

Verify which Security Group is applied to the particular web server’s elastic network interface (ENI).

Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to the virtual security appliance.

Verify the registered targets in the ALB.

Verify that the 0.0.0.0/0 route in the public subnet points to a NAT gateway.

Question 5

Your company has just started using AWS and created an AWS account. They are aware of the potential issues when root access is enabled. How can they best safeguard the account when it comes to root access? Choose 2 answers fro the options given below
Please select:

Delete the root access account

Create an Admin 1AM user with the necessary permissions

Change the password for the root account.

Delete the root access keys

Question 6

A company hosts a popular web application that connects to an Amazon RDS MySQL DB instance running in a private VPC subnet that was created with default ACL settings. The IT Security department has a suspicion that a DDos attack is coming from a suspecting IP. How can you protect the subnets from this attack?
Please select:

Change the Inbound Security Groups to deny access from the suspecting IP

Change the Outbound Security Groups to deny access from the suspecting IP

Change the Inbound NACL to deny access from the suspecting IP

Change the Outbound NACL to deny access from the suspecting IP

Question 7

A windows machine in one VPC needs to join the AD domain in another VPC. VPC Peering has been
established. But the domain join is not working. What is the other step that needs to be followed to ensure that the AD domain join can work as intended
Please select:

Change the VPC peering connection to a VPN connection

Change the VPC peering connection to a Direct Connect connection

Ensure the security groups for the AD hosted subnet has the right rule for relevant subnets

Ensure that the AD is placed in a public subnet

Question 8

Your company has an EC2 Instance that is hosted in an AWS VPC. There is a requirement to ensure that logs files from the EC2 Instance are stored accordingly. The access should also be limited for the destination of the log files. How can this be accomplished? Choose 2 answers from the options given below. Each answer forms part of the solution
Please select:

Stream the log files to a separate Cloudtrail trail

Stream the log files to a separate Cloudwatch Log group

Create an 1AM policy that gives the desired level of access to the Cloudtrail trail

Create an 1AM policy that gives the desired level of access to the Cloudwatch Log group

Question 9

You have a bucket and a VPC defined in AWS. You need to ensure that the bucket can only be accessed by the VPC endpoint. How can you accomplish this?
Please select:

Modify the security groups for the VPC to allow access to the 53 bucket

Modify the route tables to allow access for the VPC endpoint

Modify the 1AM Policy for the bucket to allow access for the VPC endpoint

Modify the bucket Policy for the bucket to allow access for the VPC endpoint

My answer: -

Reference answer: D

Reference analysis:

This is mentioned in the AWS Documentation Restricting Access to a Specific VPC Endpoint
The following is an example of an S3 bucket policy that restricts access to a specific bucket, examplebucket only from the VPC endpoint with the ID vpce-la2b3c4d. The policy denies all access to the bucket if the specified endpoint is not being used. The aws:sourceVpce condition is used to the specify the endpoint. The aws:sourceVpce condition does not require an ARN for the VPC endpoint resource, only the VPC endpoint ID. For more information about using conditions in a policy, see Specifying Conditions in a Policy.
SCS-C01 dumps exhibit
C:\Users\wk\Desktop\mudassar\Untitled.jpg
Options A and B are incorrect because using Security Groups nor route tables will help to allow access specifically for that bucke via the VPC endpoint Here you specifically need to ensure the bucket policy is changed.
Option C is incorrect because it is the bucket policy that needs to be changed and not the 1AM policy. For more information on example bucket policies for VPC endpoints, please refer to below URL:
SCS-C01 dumps exhibit https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html
The correct answer is: Modify the bucket Policy for the bucket to allow access for the VPC endpoint Submit your Feedback/Queries to our Experts

Question 10

One of your company's EC2 Instances have been compromised. The company has strict po thorough investigation on finding the culprit for the security breach. What would you do in from the options given below.
Please select:

Take a snapshot of the EBS volume

Isolate the machine from the network

Make sure that logs are stored securely for auditing and troubleshooting purpose

Ensure all passwords for all 1AM users are changed

Ensure that all access kevs are rotated.

My answer: -

Reference answer: ABC

Reference analysis:

Some of the important aspects in such a situation are
1) First isolate the instance so that no further security harm can occur on other AWS resources
2) Take a snapshot of the EBS volume for further investigation. This is incase if you need to shutdown the initial instance and do a separate investigation on the data
3) Next is Option C. This indicates that we have already got logs and we need to make sure that it is stored securely so that n unauthorised person can access it and manipulate it.
Option D and E are invalid because they could have adverse effects for the other 1AM users. For more information on adopting a security framework, please refer to below URL https://d1 .awsstatic.com/whitepapers/compliance/NIST Cybersecurity Framework
Note:
In the question we have been asked to take actions to find the culprit and to help the investigation or to further reduce the damage that has happened due to the security breach. So by keeping logs secure is one way of helping the investigation.
The correct answers are: Take a snapshot of the EBS volume. Isolate the machine from the network. Make sure that logs are stored securely for auditing and troubleshooting purpose
Submit your Feedback/Queries to our Experts

Question 11

You currently operate a web application In the AWS US-East region. The application runs on an auto-scaled layer of EC2 instances and an RDS Multi-AZ database. Your IT security compliance officer has tasked you to
develop a reliable and durable logging solution to track changes made to your EC2.IAM and RDS resources. The solution must ensure the integrity and confidentiality of your log data. Which of these solutions would you recommend?
Please select:

Create a new CloudTrail trail with one new S3 bucket to store the logs and with the global services option selecte

Use 1AM roles S3 bucket policies and Mufti Factor Authentication (MFA) Delete on the S3 bucket that stores your logs.

Create a new CloudTrail with one new S3 bucket to store the log

Configure SNS to send log file delivery notifications to your management syste

Use 1AM roles and S3 bucket policies on the S3 bucket that stores your logs.

Create a new CloudTrail trail with an existing S3 bucket to store the logs and with the global services option selecte

Use S3 ACLsand Multi Factor Authentication (MFA) Delete on the S3 bucket that stores your logs.

Create three new CloudTrail trails with three new S3 buckets to store the logs one for the AWS Management console, one for AWS SDKs and one for command line tool

Use 1AM roles and S3 bucket policies on the S3 buckets that store your logs.

Question 12

Your company currently has a set of EC2 Instances hosted in a VPC. The IT Security department is suspecting a possible DDos attack on the instances. What can you do to zero in on the IP addresses which are receiving a flurry of requests.
Please select:

Use VPC Flow logs to get the IP addresses accessing the EC2 Instances

Use AWS Cloud trail to get the IP addresses accessing the EC2 Instances

Use AWS Config to get the IP addresses accessing the EC2 Instances

Use AWS Trusted Advisor to get the IP addresses accessing the EC2 Instances

Question 13

Your company hosts a large section of EC2 instances in AWS. There are strict security rules governing the EC2 Instances. During a potential security breach , you need to ensure quick investigation of the underlying EC2 Instance. Which of the following service can help you quickly provision a test environment to look into the breached instance.
Please select:

AWS Cloudwatch

AWS Cloudformation

AWS Cloudtrail

AWS Config

Question 14

You need to establish a secure backup and archiving solution for your company, using AWS. Documents should be immediately accessible for three months and available for five years for compliance reasons. Which AWS service fulfills these requirements in the most cost-effective way? Choose the correct
answer
Please select:

Upload data to S3 and use lifecycle policies to move the data into Glacier for long-term archiving.

Upload the data on EBS, use lifecycle policies to move EBS snapshots into S3 and later into Glacier for long-term archiving.

Use Direct Connect to upload data to S3 and use 1AM policies to move the data into Glacier for long-term archiving.

Use Storage Gateway to store data to S3 and use lifecycle policies to move the data into Redshift for long-term archiving.

Question 15

A Systems Administrator has written the following Amazon S3 bucket policy designed to allow access to an S3 bucket for only an authorized AWS IAM user from the IP address range 10.10.10.0/24:
SCS-C01 dumps exhibit

When trying to download an object from the S3 bucket from 10.10.10.40, the IAM user receives an access denied message.
What does the Administrator need to change to grant access to the user?

Change the “Resource” from “arn: aws:s3:::Bucket” to “arn:aws:s3:::Bucket/*”.

Change the “Principal” from “*” to {AWS:”arn:aws:iam: : account-number: user/username”}

Change the “Version” from “2012-10-17” to the last revised date of the policy

Change the “Action” from [“s3:*”] to [“s3:GetObject”, “s3:ListBucket”]

Question 16

The Security Engineer is given the following requirements for an application that is running on Amazon EC2 and managed by using AWS CloudFormation templates with EC2 Auto Scaling groups:
-Have the EC2 instances bootstrapped to connect to a backend database.
-Ensure that the database credentials are handled securely.
-Ensure that retrievals of database credentials are logged.
Which of the following is the MOST efficient way to meet these requirements?

Pass databases credentials to EC2 by using CloudFormation stack parameters with the property set to tru

Ensure that the instance is configured to log to Amazon CloudWatch Logs.

Store database passwords in AWS Systems Manager Parameter Store by using SecureString parameters.Set the IAM role for the EC2 instance profile to allow access to the parameters.

Create an AWS Lambda that ingests the database password and persists it to Amazon S3 with server-side encryptio

Have the EC2 instances retrieve the S3 object on startup, and log all script invocations to syslog.

Write a script that is passed in as UserData so that it is executed upon launch of the EC2 instance.Ensure that the instance is configured to log to Amazon CloudWatch Logs.

Question 17

A company has resources hosted in their AWS Account. There is a requirement to monitor all API activity for all regions. The audit needs to be applied for future regions as well. Which of the following can be used to fulfil this requirement.
Please select:

Ensure Cloudtrail for each regio

Then enable for each future region.

Ensure one Cloudtrail trail is enabled for all regions.

Create a Cloudtrail for each regio

Use Cloudformation to enable the trail for all future regions.

Create a Cloudtrail for each regio

Use AWS Config to enable the trail for all future regions.

Question 18

Your company has a set of EBS volumes defined in AWS. The security mandate is that all EBS volumes are encrypted. What can be done to notify the IT admin staff if there are any unencrypted volumes in the account.
Please select:

Use AWS Inspector to inspect all the EBS volumes

Use AWS Config to check for unencrypted EBS volumes

Use AWS Guard duty to check for the unencrypted EBS volumes

Use AWS Lambda to check for the unencrypted EBS volumes

Question 19

In response to the past DDoS attack experiences, a Security Engineer has set up an Amazon CloudFront distribution for an Amazon S3 bucket. There is concern that some users may bypass the CloudFront distribution and access the S3 bucket directly.
What must be done to prevent users from accessing the S3 objects directly by using URLs?

Change the S3 bucket/object permission so that only the bucket owner has access.

Set up a CloudFront origin access identity (OAI), and change the S3 bucket/object permission so that only the OAI has access.

Create IAM roles for CloudFront, and change the S3 bucket/object permission so that only the IAM role has access.

Redirect S3 bucket access to the corresponding CloudFront distribution.

Question 20

A Security Administrator is configuring an Amazon S3 bucket and must meet the following security requirements:
SCS-C01 dumps exhibit

Encryption at rest
SCS-C01 dumps exhibit

Logging of all object retrievals in AWS CloudTrail
Which of the following meet these security requirements? (Choose three.)

Specify “aws:SecureTransport”: “true” within a condition in the S3 bucket policy.

Enable a security group for the S3 bucket that allows port 443, but not port 80.

Set up default encryption for the S3 bucket.

Enable Amazon CloudWatch Logs for the AWS account.

Enable API logging of data events for all S3 objects.

Enable S3 object versioning for the S3 bucket.

Question 21

Your company is planning on developing an application in AWS. This is a web based application. The application user will use their facebook or google identities for authentication. You want to have the ability to manage user profiles without having to add extra coding to manage this. Which of the below would assist in this.
Please select:

Create an OlDC identity provider in AWS

Create a SAML provider in AWS

Use AWS Cognito to manage the user profiles

Use 1AM users to manage the user profiles

My answer: -

Reference answer: C

Reference analysis:

The AWS Documentation mentions the following
A user pool is a user directory in Amazon Cognito. With a user pool, your users can sign in to your web or mobile app through Amazon Cognito. Your users can also sign in through social identity providers like Facebook or Amazon, and through SAML identity providers. Whether your users sign in directly or through a third party, all members of the user pool have a directory profile that you can access through an SDK.
User pools provide:
Sign-up and sign-in services.
A built-in, customizable web Ul to sign in users.
Social sign-in with Facebook, Google, and Login with Amazon, as well as sign-in with SAML identity providers from your user pool.
User directory management and user profiles.
Security features such as multi-factor authentication (MFA), checks for compromised credentials, account takeover protection, and phone and email verification.
Customized workflows and user migration through AWS Lambda triggers. Options A and B are invalid because these are not used to manage users Option D is invalid because this would be a maintenance overhead
For more information on Cognito User Identity pools, please refer to the below Link: https://docs.aws.amazon.com/coenito/latest/developerguide/cognito-user-identity-pools.html
The correct answer is: Use AWS Cognito to manage the user profiles Submit your Feedback/Queries to our Experts

Question 22

You are trying to use the AWS Systems Manager run command on a set of Instances. The run command on a set of Instances. What can you do to diagnose the issue? Choose 2 answers from the options given
Please select:

Ensure that the SSM agent is running on the target machine

Check the /var/log/amazon/ssm/errors.log file

Ensure the right AMI is used for the Instance

Ensure the security groups allow outbound communication for the instance

My answer: -

Reference answer: AB

Reference analysis:

The AWS Documentation mentions the following
If you experience problems executing commands using Run Command, there might be a problem with the SSM Agent. Use the following information to help you troubleshoot the agent
View Agent Logs
The SSM Agent logs information in the following files. The information in these files can help you troubleshoot problems.
On Windows
%PROGRAMDATA%\Amazon\SSM\Logs\amazon-ssm-agent.log
%PROGRAMDATA%\Amazon\SSM\Logs\error.log
The default filename of the seelog is seelog-xml.template. If you modify a seelog, you must rename the file to seelog.xml.
On Linux
/var/log/amazon/ssm/amazon-ssm-agentlog /var/log/amazon/ssm/errors.log
Option C is invalid because the right AMI has nothing to do with the issues. The agent which is used to execute run commands can run on a variety of AMI'S
Option D is invalid because security groups does not come into the picture with the communication between the agent and the SSM service
For more information on troubleshooting AWS SSM, please visit the following URL:
https://docs.aws.amazon.com/systems-manaeer/latest/userguide/troubleshootine-remote-commands.htmll
The correct answers are: Ensure that the SSM agent is running on the target machine. Check the
/var/log/amazon/ssm/errors.log file
Submit your Feedback/Queries to our Experts

Question 23

A Security Engineer launches two Amazon EC2 instances in the same Amazon VPC but in separate Availability Zones. Each instance has a public IP address and is able to connect to external hosts on the internet. The two instances are able to communicate with each other by using their private IP addresses, but they are not able to communicate with each other when using their public IP addresses.
Which action should the Security Engineer take to allow communication over the public IP addresses?

Associate the instances to the same security groups.

Add 0.0.0.0/0 to the egress rules of the instance security groups.

Add the instance IDs to the ingress rules of the instance security groups.

Add the public IP addresses to the ingress rules of the instance security groups.

Question 24

When you enable automatic key rotation for an existing CMK key where the backing key is managed by AWS, after how long is the key rotated?
Please select:

After 30 days

After 128 days

After 365 days

After 3 years

My answer: -

Reference answer: D

Reference analysis:

The AWS Documentation states the following
• AWS managed CM Ks: You cannot manage key rotation for AWS managed CMKs. AWS KMS automatically rotates AWS managed keys every three years (1095 days).
Note: AWS-managed CMKs are rotated every 3yrs, Customer-Managed CMKs are rotated every 365-days from when rotation is enabled.
Option A, B, C are invalid because the dettings for automatic key rotation is not changeable. For more information on key rotation please visit the below URL https://docs.aws.amazon.com/kms/latest/developereuide/rotate-keys.html
AWS managed CMKs are CMKs in your account that are created, managed, and used on your behalf by an AWS service that is integrated with AWS KMS. This CMK is unique to your AWS account and region. Only the service that created the AWS managed CMK can use it
You can login to you 1AM dashbaord . Click on "Encryption Keys" You will find the list based on the services you are using as follows:
• aws/elasticfilesystem 1 aws/lightsail
• aws/s3
• aws/rds and many more Detailed Guide: KMS
You can recognize AWS managed CMKs because their aliases have the format aws/service-name, such as aws/redshift. Typically, a service creates its AWS managed CMK in your account when you set up the service or the first time you use the CMfC
The AWS services that integrate with AWS KMS can use it in many different ways. Some services create AWS managed CMKs in your account. Other services require that you specify a customer managed CMK that you have created. And, others support both types of CMKs to allow you the ease of an AWS managed CMK or the control of a customer-managed CMK
Rotation period for CMKs is as follows:
• AWS managed CMKs: 1095 days
• Customer managed CMKs: 365 days
Since question mentions about "CMK where backing keys is managed by AWS", its Amazon(AWS) managed and its rotation period turns out to be 1095 days{every 3 years)
For more details, please check below AWS Docs: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html The correct answer is: After 3 years
Submit your Feedback/Queries to our Experts

Question 25

A company wants to have a secure way of generating, storing and managing cryptographic exclusive access for the keys. Which of the following can be used for this purpose?
Please select:

Use KMS and the normal KMS encryption keys

Use KMS and use an external key material

Use S3 Server Side encryption

Use Cloud HSM

My answer: -

Reference answer: D

Reference analysis:

The AWS Documentation mentions the following
The AWS CloudHSM service helps you meet corporate, contractual and regulatory compliance requirements for data security by using dedicated Hardware Security Module (HSM) instances within the AWS cloud. AWS and AWS Marketplace partners offer a variety of solutions for protecting sensitive data within the AWS platform, but for some applications and data subject to contractual or regulatory mandates for managing cryptographic keys, additional protection may be necessary. CloudHSM complements existing data protection solutions and allows you to protect your encryption keys within HSMs that are desigr and validated to government standards for secure key management. CloudHSM allows you to securely generate, store and manage cryptographic keys used for data encryption in a way that keys are accessible only by you.
Option A.B and Care invalid because in all of these cases, the management of the key will be with AWS. Here the question specifically mentions that you want to have exclusive access over the keys. This can be achieved with Cloud HSM
For more information on CloudHSM, please visit the following URL: https://aws.amazon.com/cloudhsm/faq:
The correct answer is: Use Cloud HSM Submit your Feedback/Queries to our Experts

Page: 1 / 27

Total 330 questions Full Exam Access