Skip to main content

SCS-C02 Real Exam Questions

AWS Certified Security - Specialty (SCS-C02)

851 questions available · Page 1 of 86

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Multiple choice

A security administrator has enabled AWS Security Hub for all the AWS accounts in an organization in AWS Organizations. The security team wants near-real-time response and remediation for deployed AWS resources that do not meet security standards. All changes must be centrally logged for auditing purposes.

The organization has reached the quotas for the number of SCPs attached to an OU and SCP document size. The team wants to avoid making any changes to any of the SCPs. The solution must maximize scalability and cost-effectiveness.

Which combination of actions should the security administrator take to meet these requirements? (Choose three.)

  1. A

    Create an AWS Config custom rule to detect configuration changes to AWS resources. Create an AWS Lambda function to remediate the AWS resources in the delegated administrator AWS account.

  2. B

    Use AWS Systems Manager Change Manager to track configuration changes to AWS resources.
    Create a Systems Manager document to remediate the AWS resources in the delegated administrator
    AWS account.

  3. C

    Create a Security Hub custom action to reference in an Amazon EventBridge event rule in the
    delegated administrator AWS account.

  4. D

    Create an Amazon EventBridge event rule to Invoke an AWS Lambda function that will take action on
    AWS resources.

  5. E

    Create an Amazon EventBridge event rule to invoke an AWS Lambda function that will evaluate AWS resource configuration for a set of API requests and create a finding for noncompllant AWS resources.

  6. F

    Create an Amazon EventBridge event rule to invoke an AWS Lambda function on a schedule to assess
    specific AWS Config rules.

Show answer and explanation

Correct answers: A, C, D

Question 2 Multiple choice

You have just received an email from IAM Support stating that your IAM account might have been compromised.

Which of the following steps would you look to carry out immediately? Choose 3 answers from the options below.

  1. A

    Change the root account password.

  2. B

    Rotate all IAM access keys

  3. C

    Keep all resources running to avoid disruption

  4. D

    Change the password for all IAM users.

Show answer and explanation

Correct answers: A, B, D

Explanation

One of the articles from IAM mentions what should be done in such a scenario
If you suspect that your account has been compromised, or if you have received a notification from IAM that the account has been compromised, perform the following tasks: Change your IAM root account password and the passwords of any IAM users. Delete or rotate all root and IAM Identity and Access Management (IAM) access keys. Delete any resources on your account you didn't create, especially running EC2 instances, EC2 spot bids, or IAM users.
Respond to any notifications you received from IAM Support through the IAM Support Center.
Option C is invalid because there could be compromised instances or resources running on your environment. They should be shutdown or stopped immediately. For more information on the article, please visit the below URL:
https://IAM.amazon.com/premiumsupport/knowledee-center/potential-account-
compromise>Thecorrectanswersare:Changetherootaccountpassword.RotateallIAMaccesskeys.ChangethepasswordforallIAMusers.SubmityourFeedback/QueriestoourExperts

Question 3 Single choice

A company is building a data processing application mat uses AWS Lambda functions. The application's
Lambda functions need to communicate with an Amazon RDS OB instance that is deployed within a VPC in the same AWS account.

Which solution meets these requirements in the MOST secure way?

  1. A

    Configure the DB instance to allow public access Update the DB instance security group to allow access from the Lambda public address space for the AWS Region

  2. B

    Deploy the Lambda functions inside the VPC Attach a network ACL to the Lambda subnet Provide outbound rule access to the VPC CIDR range only Update the DB instance security group to allow traffic from 0.0.0.0/0

  3. C

    Deploy the Lambda functions inside the VPC Attach a security group to the Lambda functions Provide outbound rule access to the VPC CIDR range only Update the DB instance security group to allow traffic from the Lambda security group

  4. D

    Peer the Lambda default VPC with the VPC that hosts the DB instance to allow direct network access without the need for security groups

Show answer and explanation

Correct answer: C

Explanation

This solution ensures that the Lambda functions are deployed inside the VPC and can communicate with the Amazon RDS DB instance securely. The security group attached to the Lambda functions only allows outbound traffic to the VPC CIDR range, and the DB instance security group only allows traffic from the Lambda security group. This solution ensures that the Lambda functions can communicate with the DB instance securely and that the DB instance is not exposed to the public internet.

Question 4 Multiple choice

A company plans to move most of its IT infrastructure to IAM. They want to leverage their existing on-premises Active Directory as an identity provider for IAM.

Which combination of steps should a Security Engineer take to federate the company's on-premises Active Directory with IAM? (Choose two.)

  1. A

    Create IAM roles with permissions corresponding to each Active Directory group.

  2. B

    Create IAM groups with permissions corresponding to each Active Directory group.

  3. C

    Configure Amazon Cloud Directory to support a SAML provider.

  4. D

    Configure Active Directory to add relying party trust between Active Directory and IAM.

  5. E

    Configure Amazon Cognito to add relying party trust between Active Directory and IAM.

Show answer and explanation

Correct answers: A, D

Explanation

https://IAM.amazon.com/blogs/security/how-to-establish-federated-access-to-your-IAM-resources-by-using-active-directory-user-attributes/

Question 5 Single choice

You have private video content in S3 that you want to serve to subscribed users on the Internet. User IDs, credentials, and subscriptions are stored in an Amazon RDS database.

Which configuration will allow you to securely serve private content to your users?

  1. A

    Generate pre-signed URLs for each user as they request access to protected S3 content

  2. B

    Create an IAM user for each subscribed user and assign the GetObject permission to each IAM user

  3. C

    Create an S3 bucket policy that limits access to your private content to only your subscribed users'credentials

  4. D

    Crpafp a Cloud Front Clriein Identity user for vnur suhsrrihprl users and assign the GptOhiprt oprmissinn to this user

Show answer and explanation

Correct answer: A

Explanation

All objects and buckets by default are private. The pre-signed URLs are useful if you want your user/ customer to be able upload a specific object to your bucket but you don't require them to have IAM security credentials or permissions. When you create a pre-signed URL, you must provide your security credentials, specify a bucket name, an object key, an HTTP method (PUT for uploading objects), and an expiration date and time. The pre-signed URLs are valid only for the specified duration. Option B is invalid because this would be too difficult to implement at a user level.
Option C is invalid because this is not possible
Option D is invalid because this is used to serve private content via Cloudfront For more information on pre-signed urls, please refer to the Link:
http://docs.IAM.amazon.com/AmazonS3/latest/dev/PresienedUrlUploadObiect.htmll
The correct answer is:Generatepre-signedURLsforeachuserastheyrequestaccesstoprotectedS3contentSubmityourFeedback/QueriestoourExperts

Question 6 Single choice

Your company is planning on hosting an internal network in IAM. They want machines in the VPC to authenticate using private certificates. They want to minimize the work and maintenance in working with certificates. What is the ideal way to fulfil this requirement.

  1. A

    Consider using Windows Server 2016 Certificate Manager

  2. B

    Consider using IAM Certificate Manager

  3. C

    Consider using IAM Access keys to generate the certificates

  4. D

    Consider using IAM Trusted Advisor for managing the certificates

Show answer and explanation

Correct answer: B

Explanation

The IAM Documentation mentions the following ACM is tightly linked with IAM Certificate Manager Private Certificate Authority. You can use ACM PCA to create a private certificate authority (CA) and then use ACM to issue private certificates. These are SSL/TLS X.509 certificates that identify users, computers, applications, services, servers, and other devices internally. Private certificates cannot be publicly trusted

Option A is partially invalid. Windows Server 2016 Certificate Manager can be used but since there is a requirement to "minimize the work and maintenance", IAM Certificate Manager should be used
Option C and D are invalid because these cannot be used for managing certificates. For more information on ACM, please visit the below URL:
https://docs.IAM.amazon.com/acm/latest/userguide/acm-overview.html
The correct answer is: ConsiderusingIAMCertificateManagerSubmityourFeedback/QueriestoourExperts

Question 7 Multiple choice

A company accidentally deleted the private key for an Amazon Elastic Block Store (Amazon EBS)-backed Amazon EC2 instance. A security engineer needs to regain access to the instance.

Which combination of steps will meet this requirement? (Choose two.)

  1. A

    Stop the instance. Detach the root volume. Generate a new key pair.

  2. B

    Keep the instance running. Detach the root volume. Generate a new key pair.

  3. C

    When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance. Start the instance.

  4. D

    When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new private key. Move the volume back to the original instance. Start the instance.

  5. E

    When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance that is running.

Show answer and explanation

Correct answers: A, C

Explanation

If you lose the private key for an EBS-backed instance, you can regain access to your instance. You must stop the instance, detach its root volume and attach it to another instance as a data volume, modify the authorized_keys file with a new public key, move the volume back to the original instance, and restart the instance.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html#replacing-lost-key-pai

Question 8 Multiple choice

A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS account.

Which solutions will provide the Lambda function this access? (Select TWO.)

  1. A

    Create an IAM user that has only programmatic access. Create a new access key pair. Add environmental variables to the Lambda function with the ac-cess key ID and secret access key. Modify the Lambda function to use the environmental variables at run time during communication with Amazon
    S3.

  2. B

    Generate an Amazon EC2 key pair. Store the private key in AWS Secrets Man-ager. Modify the Lambda function to retrieve the private key from Secrets Manager and to use the private key during communication with Amazon S3.

  3. C

    Create an IAM role for the Lambda function. Attach an IAM policy that al-lows access to the S3 bucket.

  4. D

    Create an IAM role for the Lambda function. Attach a bucket policy to the S3 bucket to allow access.
    Specify the function's IAM role as the princi-pal.

  5. E

    Create a security group. Attach the security group to the Lambda function. Attach a bucket policy that allows access to the S3 bucket through the se-curity group ID.

Show answer and explanation

Correct answers: C, D

Question 9 Single choice

An EC2 Instance hosts a Java based application that access a DynamoDB table. This EC2 Instance is currently serving production based users.

Which of the following is a secure way of ensuring that the EC2 Instance access the Dynamo table?

  1. A

    Use IAM Roles with permissions to interact with DynamoDB and assign it to the EC2 Instance

  2. B

    Use KMS keys with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

  3. C

    Use IAM Access Keys with the right permissions to interact with DynamoDB and assign it to the EC2
    Instance

  4. D

    Use IAM Access Groups with the right permissions to interact with DynamoDB and assign it to the EC2
    Instance

Show answer and explanation

Correct answer: A

Explanation

To always ensure secure access to IAM resources from EC2 Instances, always ensure to assign a Role to the EC2 Instance Option B is invalid because KMS keys are not used as a mechanism for providing EC2
Instances access to IAM services.
Option C is invalid Access keys is not a safe mechanism for providing EC2 Instances access to IAM services.
Option D is invalid because there is no way access groups can be assigned to EC2 Instances. For more information on IAM Roles, please refer to the below URL:
https://docs.IAM.amazon.com/IAM/latest/UserGuide/id
roles.html The correct answer is: Use IAM RoleswithpermissionstointeractwithDynamoDBandassignittotheEC2InstanceSubmityourFeedback/
Queries to our Experts

Question 10 Single choice

A security engineer must develop an encryption tool for a company.

The company requires a cryptographic solution that supports the ability to perform cryptographic erasure on all resources protected by the key material in 15 minutes or less Which IAM Key Management Service (IAM KMS) key solution will allow the security engineer to meet these requirements?

  1. A

    Use Imported key material with CMK

  2. B

    Use an IAM KMS CMK

  3. C

    Use an IAM managed CMK.

  4. D

    Use an IAM KMS customer managed CMK

Show answer and explanation

Correct answer: C