Free 2021 AWS Certified Security SCS-C01 dumps are available on Google Drive shared by Pass4suresVCE
Welcome to download the newest Pass4suresVCE SCS-C01 PDF dumps: https://www.pass4suresvce.com/SCS-C01-pass4sure-vce-dumps.html ( 530 Q&As)
Topics of Amazon SCS-C01: AWS Certified Security - Specialty Exam
Candidates must know the exam topics before they start preparation. Because it will help them in hitting the core. scs-c01 dumps will include the following topics:
Domain 1: Incident Response
- 1.1 Given an AWS abuse notice, evaluate the suspected compromised instance or exposed access keys.
- 1.3 Evaluate the configuration of automated alerting and execute possible remediation of security-related incidents and emerging issues.
- 1.2 Verify that the Incident Response plan includes relevant AWS services.
Domain 2: Logging and Monitoring
- 2.4 Troubleshoot logging solutions.
- 2.2 Troubleshoot security monitoring and alerting.
- 2.3 Design and implement a logging solution.
- 2.1 Design and implement security monitoring and alerting.
Domain 3: Infrastructure Security
- 3.3 Troubleshoot a secure network infrastructure.
- 3.1 Design edge security on AWS.
- 3.2 Design and implement a secure network infrastructure.
- 3.4 Design and implement host-based security.
Domain 4: Identity and Access Management
- 4.2 Troubleshoot an authorization and authentication system to access AWS resources.
- 4.1 Design and implement a scalable authorization and authentication system to access AWS resources.
Domain 5: Data Protection
- 5.2 Troubleshoot key management.
- 5.3 Design and implement a data encryption solution for data at rest and data in transit.
- 5.1 Design and implement key management and use.
How to study the Amazon SCS-C01: AWS Certified Security - Specialty Exam
A broad range of scs-c01 dumps pdf for AWS certified security-specialty Certification have been recognized for certification issues. The reality that students need to prepare attentively does not make certificates easy. It also takes a long time to learn from AWS certified security-specialty. Every exam includes answers and questions that help students pass their final test. You will pass the test after you have taken and learned our modules. But it doesn’t end there; thanks to our full guides, you will still be good in your career. You will produce your goods in the future. To plan any material for you, we have an advanced method. In the development of and commodity, we have used the latest details.
Scs-c01 practice test are easy to use, so that anyone can appreciate them. In such dynamic areas, where qualification requires a lot of studies, planning, and focus, no one likes loss. An effort is so hard that even the students' nerves can be shattered. Our waste management systems are so legitimate and best that you have no pain to pass your AWS accredited Developer Professional.
NEW QUESTION 268
A company has complex connectivity rules governing ingress, egress, and communications between
Amazon EC2 instances. The rules are so complex that they cannot be implemented within the limits of the
maximum number of security groups and network access control lists (network ACLs).
What mechanism will allow the company to implement all required network rules without incurring
additional cost?
- A. Use the operating system built-in, host-based firewall to implement the required rules.
- B. Launch an EC2-based firewall product from the AWS Marketplace, and implement the required rules in
that product. - C. Use a NAT gateway to control ingress and egress according to the requirements.
- D. Configure AWS WAF rules to implement the required rules.
Answer: A
NEW QUESTION 269
A company is planning to run a number of Admin related scripts using the AWS Lambda service. There is a need to understand if there are any errors encountered when the script run. How can this be accomplished in the most effective manner.
Please select:
- A. Use the AWS Config service to monitor for errors
- B. Use the AWS inspector service to monitor for errors
- C. Use Cloudtrail to monitor for errors
- D. Use Cloudwatch metrics and logs to watch for errors
Answer: D
NEW QUESTION 270
You have an Ec2 Instance in a private subnet which needs to access the KMS service. Which of the following methods can help fulfil this requirement, keeping security in perspective Please select:
- A. Attach a VPN connection to the VPC
- B. Use VPC Peering
- C. Attach an Internet gateway to the subnet
- D. Use a VPC endpoint
Answer: D
Explanation:
The AWS Documentation mentions the following
You can connect directly to AWS KMS through a private endpoint in your VPC instead of connecting over the internet. When you use a VPC endpoint communication between your VPC and AWS KMS is conducted entirely within the AWS network.
Option B is invalid because this could open threats from the internet
Option C is invalid because this is normally used for communication between on-premise environments and AWS.
Option D is invalid because this is normally used for communication between VPCs For more information on accessing KMS via an endpoint, please visit the following URL
https://docs.aws.amazon.com/kms/latest/developerguide/kms-vpc-endpoint.htmll The correct answer is: Use a VPC endpoint Submit your Feedback/Queries to our Experts
NEW QUESTION 271
A company has set up the following structure to ensure that their S3 buckets always have logging enabled
If there are any changes to the configuration to an S3 bucket, a config rule gets checked. If logging is disabled
, then Lambda function is invoked. This Lambda function will again enable logging on the S3 bucket. Now there is an issue being encoutered with the entire flow. You have verified that the Lambda function is being invoked. But when logging is disabled for the bucket, the lambda function does not enable it again. Which of the following could be an issue Please select:
- A. The AWS Config rule is not configured properly
- B. You need to also use the API gateway to invoke the lambda function
- C. The AWS Lambda function does not have appropriate permissions for the bucket
- D. The AWS Lambda function should use Node.js instead of python.
Answer: C
Explanation:
Explanation
The most probable cause is that you have not allowed the Lambda functions to have the appropriate permissions on the S3 bucket to make the relevant changes.
Option A is invalid because this is more of a permission instead of a configuration rule issue.
Option C is invalid because changing the language will not be the core solution.
Option D is invalid because you don't necessarily need to use the API gateway service For more information on accessing resources from a Lambda function, please refer to below URL
https://docs.aws.amazon.com/lambda/latest/ds/accessing-resources.htmll
The correct answer is: The AWS Lambda function does not have appropriate permissions for the bucket Submit your Feedback/Queries to our Experts
NEW QUESTION 272
A Devops team is currently looking at the security aspect of their CI/CD pipeline. They are making use of AWS resource? for their infrastructure. They want to ensure that the EC2 Instances don't have any high security vulnerabilities. They want to ensure a complete DevSecOps process. How can this be achieved?
Please select:
- A. Use AWS Security Groups to ensure no vulnerabilities are present
- B. Use AWS Config to check the state of the EC2 instance for any sort of security issues.
- C. Use AWS Inspector API's in the pipeline for the EC2 Instances
- D. Use AWS Trusted Advisor API's in the pipeline for the EC2 Instances
Answer: C
Explanation:
Amazon Inspector offers a programmatic way to find security defects or misconfigurations in your operating systems and applications. Because you can use API calls to access both the processing of assessments and the results of your assessments, integration of the findings into workflow and notification systems is simple. DevOps teams can integrate Amazon Inspector into their CI/CD pipelines and use it to identify any pre-existing issues or when new issues are introduced.
Option A.C and D are all incorrect since these services cannot check for Security Vulnerabilities. These can only be checked by the AWS Inspector service.
For more information on AWS Security best practices, please refer to below URL:
https://d1.awsstatic.com/whitepapers/Security/AWS Security Best Practices.pdl The correct answer is: Use AWS Inspector API's in the pipeline for the EC2 Instances Submit your Feedback/Queries to our Experts
NEW QUESTION 273
Your company has a requirement to work with a DynamoDB table. There is a security mandate that all data should be encrypted at rest. What is the easiest way to accomplish this for DynamoDB.
Please select:
- A. Use S3 buckets to encrypt the data before sending it to DynamoDB
- B. Encrypt the DynamoDB table using KMS during its creation
- C. Use the AWS SDK to encrypt the data before sending it to the DynamoDB table
- D. Encrypt the table using AWS KMS after it is created
Answer: B
Explanation:
Explanation
The most easiest option is to enable encryption when the DynamoDB table is created.
The AWS Documentation mentions the following
Amazon DynamoDB offers fully managed encryption at rest. DynamoDB encryption at rest provides enhanced security by encrypting your data at rest using an AWS Key Management Service (AWS KMS) managed encryption key for DynamoDB. This functionality eliminates the operational burden and complexity involved in protecting sensitive data.
Option A is partially correct, you can use the AWS SDK to encrypt the data, but the easier option would be to encrypt the table before hand.
Option C is invalid because you cannot encrypt the table after it is created Option D is invalid because encryption for S3 buckets is for the objects in S3 only.
For more information on securing data at rest for DynamoDB please refer to below URL:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.htmll The correct answer is: Encrypt the DynamoDB table using KMS during its creation Submit your Feedback/Queries to our Experts
NEW QUESTION 274
A company has hundreds of AWS accounts, and a centralized Amazon S3 bucket used to collect AWS CloudTrail logs for all of these accounts. A Security Engineer wants to create a solution that will enable the company to run ad hoc queries against its CloudTrail logs dating back 3 years from when the trails were first enabled in the company's AWS account.
How should the company accomplish this with the least amount of administrative overhead?
- A. Write an AWS Lambda function to query the CloudTrail trails. Configure the Lambda function to be executed whenever a new file is created in the CloudTrail S3 bucket.
- B. Use the events history feature of the CloudTrail console to query the CloudTrail trails.
- C. Create an Amazon Athena table that looks at the S3 bucket the CloudTrail trails are being written to. Use Athena to run queries against the trails.
- D. Run an Amazon EMR cluster that uses a MapReduce job to examine the CloudTrail trails.
Answer: B
NEW QUESTION 275
An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that one particular group of 1AM users should only access the test instances and not the production ones. How can the organization set that as a part of the policy?
Please select:
- A. Define the tags on the test and production servers and add a condition to the 1AM policy which allows access to specification tags
- B. Create an 1AM policy with a condition which allows access to only small instances
- C. Launch the test and production instances in separate regions and allow region wise access to the group
- D. Define the 1AM policy which allows access based on the instance ID
Answer: A
Explanation:
Explanation
Tags enable you to categorize your AWS resources in different ways, for example, by purpose, owner, or environment. This is useful when you have many resources of the same type - you can quickly identify a specific resource based on the tags you've assigned to it Option A is invalid because this is not a recommended practices Option B is invalid because this is an overhead to maintain this in policies Option C is invalid because the instance type will not resolve the requirement For information on resource tagging, please visit the below URL:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Usine_Tags.htmll
The correct answer is: Define the tags on the test and production servers and add a condition to the 1AM policy which allows access to specific tags Submit your Feedback/Queries to our Experts
NEW QUESTION 276
A Developer reported that AWS CloudTrail was disabled on their account. A Security Engineer investigated the account and discovered the event was undetected by the current security solution. The Security Engineer must recommend a solution that will detect future changes to the CloudTrail configuration and send alerts when changes occur.
What should the Security Engineer do to meet these requirements?
- A. Use AWS Resource Access Manager (AWS RAM) to monitor the AWS CloudTrail configuration. Send notifications using Amazon SNS.
- B. Update security contact details in AWS account settings for AWS Support to send alerts when suspicious activity is detected.
- C. Use Amazon Inspector to automatically detect security issues. Send alerts using Amazon SNS.
- D. Create an Amazon CloudWatch Events rule to monitor Amazon GuardDuty findings. Send email notifications using Amazon SNS.
Answer: D
NEW QUESTION 277
A company Is planning to use Amazon Elastic File System (Amazon EFS) with its on-premises servers. The company has an existing AWS Direct Connect connection established between its on-premises data center and an AWS Region Security policy states that the company's on-premises firewall should only have specific IP addresses added to the allow list and not a CIDR range. The company also wants to restrict access so that only certain data center-based servers have access to Amazon EFS How should a security engineer implement this solution''
- A. Add the EFS file system mount target IP addresses to the allow list for the data center firewall In the EFS security group, add the data center server IP addresses to the allow list Use the Linux terminal to mount the EFS file system using the IP address of one of the mount targets
- B. Assign a static range of IP addresses for the EFS file system by contacting AWS Support In the EFS security group add the data center server IP addresses to the allow list Use the Linux terminal to mount the EFS file system using one of the static IP addresses
- C. Add the file-system-id efs aws-region amazonaws com URL to the allow list for the data center firewall Install the AWS CLI on the data center-based servers to mount the EFS file system in the EFS security group add the data center IP range to the allow list Mount the EFS using the EFS file system name
- D. Assign an Elastic IP address to Amazon EFS and add the Elastic IP address to the allow list for the data center firewall Install the AWS CLI on the data center-based servers to mount the EFS file system In the EFS security group, add the IP addresses of the data center servers to the allow list Mount the EFS using the Elastic IP address
Answer: D
NEW QUESTION 278
A company recently experienced a DDoS attack that prevented its web server from serving content. The website is static and hosts only HTML, CSS, and PDF files that users download.
Based on the architecture shown in the image, what is the BEST way to protect the site against future attacks while minimizing the ongoing operational overhead?
- A. Move all the files to an Amazon S3 bucket. Have the web server serve the files from the S3 bucket.
- B. Move all the files to an S3 bucket. Create a CloudFront distribution in front of the bucket and terminate the web server.
- C. Launch an Application Load Balancer in front of the EC2 instance. Create an Amazon CloudFront distribution in front of the Application Load Balancer.
- D. Launch a second Amazon EC2 instance in a new subnet. Launch an Application Load Balancer in front of both instances.
Answer: A
NEW QUESTION 279
A Solutions Architect is designing a web application that uses Amazon CloudFront, an Elastic Load Balancing Application Load Balancer, and an Auto Scaling group of Amazon EC2 instances. The load balancer and EC2 instances are in the US West (Oregon) region. It has been decided that encryption in transit is necessary by using a customer-branded domain name from the client to CloudFront and from CloudFront to the load balancer.
Assuming that AWS Certificate Manager is used, how many certificates will need to be generated?
- A. One in the US West (Oregon) region and none in the US East (Virginia) region.
- B. Two in the US East (Virginia) region and none in the US West (Oregon) region.
- C. One in the US West (Oregon) region and one in the US East (Virginia) region.
- D. Two in the US West (Oregon) region and none in the US East (Virginia) region.
Answer: C
Explanation:
Explanation
AWS Region that You Request a Certificate In (for AWS Certificate Manager) If you want to require HTTPS between viewers and CloudFront, you must change the AWS region to US East (N. Virginia) in the AWS Certificate Manager console before you request or import a certificate. If you want to require HTTPS between CloudFront and your origin, and you're using an ELB load balancer as your origin, you can request or import a certificate in any region.
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html
NEW QUESTION 280
You have a bucket and a VPC defined in AWS. You need to ensure that the bucket can only be accessed by the VPC endpoint. How can you accomplish this?
Please select:
- A. Modify the bucket Policy for the bucket to allow access for the VPC endpoint This is mentioned in the AWS Documentation Restricting Access to a Specific VPC Endpoint The following is an example of an S3 bucket policy that restricts access to a specific bucket, examplebucket only from the VPC endpoint with the ID vpce-la2b3c4d. The policy denies all access to the bucket if the specified endpoint is not being used. The aws:sourceVpce condition is used to the specify the endpoint. The aws:sourceVpce condition does not require an ARN for the VPC endpoint resource, only the VPC endpoint ID. For more information about using conditions in a policy, see Specifying Conditions in a Policy.
- B. Modify the route tables to allow access for the VPC endpoint
- C. Modify the IAM Policy for the bucket to allow access for the VPC endpoint
- D. Modify the security groups for the VPC to allow access to the 53 bucket
Answer: A
Explanation:
Options A and B are incorrect because using Security Groups nor route tables will help to allow access specifically for that bucke via the VPC endpoint Here you specifically need to ensure the bucket policy is changed.
Option C is incorrect because it is the bucket policy that needs to be changed and not the IAM policy.
For more information on example bucket policies for VPC endpoints, please refer to below URL:
https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html The correct answer is: Modify the bucket Policy for the bucket to allow access for the VPC endpoint Submit your Feedback/Queries to our Experts
NEW QUESTION 281
You are planning on using the AWS KMS service for managing keys for your application. For which of the following can the KMS CMK keys be used for encrypting? Choose 2 answers from the options given below Please select:
- A. Image Objects
- B. Password
- C. Large files
- D. RSA Keys
Answer: B,D
Explanation:
Explanation
The CMK keys themselves can only be used for encrypting data that is maximum 4KB in size. Hence it can be used for encryptii information such as passwords and RSA keys.
Option A and B are invalid because the actual CMK key can only be used to encrypt small amounts of data and not large amoui of data. You have to generate the data key from the CMK key in order to encrypt high amounts of data For more information on the concepts for KMS, please visit the following URL:
https://docs.aws.amazon.com/kms/latest/developereuide/concepts.html
The correct answers are: Password, RSA Keys Submit your Feedback/Queries to our Experts
NEW QUESTION 282
Which of the following are valid configurations for using SSL certificates with Amazon CloudFront? (Select THREE )
- A. Default CloudFront certificate
- B. Custom SSL certificate stored in AWS Certificate Manager
- C. Custom SSL certificate stored in AWS IAM
- D. Custom SSL certificate stored in AWS KMS
- E. Default SSL certificate stored in AWS Secrets Manager
- F. Default AWS Certificate Manager certificate
Answer: A,B,F
NEW QUESTION 283
A company wants to deploy a distributed web application on a fleet of EC2 instances. The fleet will be fronted by a Classic Load Balancer that will be configured to terminate the TLS connection. The company wants to make sure that all past and current TLS traffic to the Classic Load Balancer stays secure, even if the certificate private key is leaked.
To ensure the company meets these requirements, a Security Engineer can configure a Classic Load Balancer with:
- A. An HTTPS listener that uses the latest AWS predefined ELBSecurityPolicy-TLS-1-2-2017-01 security policy.
- B. An HTTPS listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.
- C. An HTTPS listener that uses a certificate that is managed by Amazon Certification Manager.
- D. A TCP listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.
Answer: B
NEW QUESTION 284
An application uses Amazon Cognito to manage end users' permissions when directly accessing AWS resources, including Amazon DynamoDB. A new feature request reads as follows:
Provide a mechanism to mark customers as suspended pending investigation or suspended permanently.
Customers should still be able to log in when suspended, but should not be able to make changes.
The priorities are to reduce complexity and avoid potential for future security issues.
Which approach will meet these requirements and priorities?
- A. Create a new database field "suspended_status" and modify the application logic to validate that field when processing requests.
- B. Use Amazon Cognito Sync to push out a "suspension_status" parameter and split the lAM policy into normal users and suspended users.
- C. Move suspended customers to a second Cognito group and define an appropriate IAM access policy for the group.
- D. Add suspended customers to second Cognito user pool and update the application login flow to check both user pools.
Answer: C
NEW QUESTION 285
Your company is planning on developing an application in AWS. This is a web based application. The application users will use their facebook or google identities for authentication. You want to have the ability to manage user profiles without having to add extra coding to manage this. Which of the below would assist in this.
Please select:
- A. Create an OlDC identity provider in AWS
- B. Use AWS Cognito to manage the user profiles
- C. Create a SAML provider in AWS
- D. Use IAM users to manage the user profiles
Answer: C
Explanation:
Explanation
The AWS Documentation mentions the following
The AWS Documentation mentions the following
OIDC identity providers are entities in IAM that describe an identity provider (IdP) service that supports the OpenID Connect (OIDC) standard. You use an OIDC identity provider when you want to establish trust between an OlDC-compatible IdP-such as Google, Salesforce, and many others-and your AWS account This is useful if you are creating a mobile app or web application that requires access to AWS resources, but you don't want to create custom sign-in code or manage your own user identities Option A is invalid because in the security groups you would not mention this information/ Option C is invalid because SAML is used for federated authentication Option D is invalid because you need to use the OIDC identity provider in AWS For more information on ODIC identity providers, please refer to the below Link:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id roles providers create oidc.htmll The correct answer is: Create an OIDC identity provider in AWS
NEW QUESTION 286
A Security Engineer must implement mutually authenticated TLS connections between containers that communicate inside a VPC.
Which solution would be MOST secure and easy to maintain?
- A. Use AWS Certificate Manager Private Certificate Authority (ACM PCA) to create a subordinate certificate authority, then create the private keys in the containers and sign them using the ACM PCA API.
- B. Create a self-signed certificate in one container and use AWS Secrets Manager to distribute the certificate to the other containers to establish trust.
- C. Use AWS Certificate Manager to generate certificates from a public certificate authority and deploy them to all the containers.
- D. Use AWS Certificate Manager Private Certificate Authority (ACM PCA) to create a subordinate certificate authority, then use AWS Certificate Manager to generate the private certificates and deploy them to all the containers.
Answer: A
NEW QUESTION 287
......
Tested Material Used To SCS-C01: https://www.pass4suresvce.com/SCS-C01-pass4sure-vce-dumps.html
Following are some new SCS-C01 Real Exam Questions!: https://drive.google.com/open?id=1PftqxCa9Q386uNqes8EJVqv0gs4qqwM4