Amazon SCS-C02 Exam Dumps

AWS Certified Security - Specialty

Recent SCS-C02 Exam Results

Our Amazon SCS-C02 dumps are key to get success. More than 80000+ success stories.

24

Clients Passed Amazon SCS-C02 Exam Today

94%

Passing score in Real Amazon SCS-C02 Exam

91%

Questions were from our given SCS-C02 dumps

Amazon SCS-C02 Sample Questions

Question # 1

A company is building an application on IAM that will store sensitive Information. Thecompany has a support team with access to the IT infrastructure, including databases. Thecompany's security engineer must introduce measures to protect the sensitive data againstany data breach while minimizing management overhead. The credentials must beregularly rotated.What should the security engineer recommend?

A. Enable Amazon RDS encryption to encrypt the database and snapshots. EnableAmazon Elastic Block Store (Amazon EBS) encryption on Amazon EC2 instances. Includethe database credential in the EC2 user data field. Use an IAM Lambda function to rotatedatabase credentials. Set up TLS for the connection to the database.
B. Install a database on an Amazon EC2 Instance. Enable third-party disk encryption toencrypt the Amazon Elastic Block Store (Amazon EBS) volume. Store the databasecredentials in IAM CloudHSM with automatic rotation. Set up TLS for the connection to thedatabase.
C. Enable Amazon RDS encryption to encrypt the database and snapshots. EnableAmazon Elastic Block Store (Amazon EBS) encryption on Amazon EC2 instances. Storethe database credentials in IAM Secrets Manager with automatic rotation. Set up TLS forthe connection to the RDS hosted database.
D. Set up an IAM CloudHSM cluster with IAM Key Management Service (IAM KMS) tostore KMS keys. Set up Amazon RDS encryption using IAM KMS to encrypt the database.Store database credentials in the IAM Systems Manager Parameter Store with automaticrotation. Set up TLS for the connection to the RDS hosted database.

Answer: C

Show Answer

Question # 2

A company's security engineer is developing an incident response plan to detectsuspicious activity in an AWS account for VPC hosted resources. The security engineerneeds to provide visibility for as many AWS Regions as possible.Which combination of steps will meet these requirements MOST cost-effectively? (SelectTWO.)

A. Turn on VPC Flow Logs for all VPCs in the account.
B. Activate Amazon GuardDuty across all AWS Regions.
C. Activate Amazon Detective across all AWS Regions.
D. Create an Amazon Simple Notification Service (Amazon SNS) topic. Create an AmazonEventBridge rule that responds to findings and publishes the find-ings to the SNS topic.
E. Create an AWS Lambda function. Create an Amazon EventBridge rule that in-vokes theLambda function to publish findings to Amazon Simple Email Ser-vice (Amazon SES).

Answer: B,D

Show Answer

Question # 3

A company is developing a highly resilient application to be hosted on multiple AmazonEC2 instances . The application will store highly sensitive user data in Amazon RDS tablesThe application must• Include migration to a different IAM Region in the application disaster recovery plan.• Provide a full audit trail of encryption key administration events• Allow only company administrators to administer keys.• Protect data at rest using application layer encryptionA Security Engineer is evaluating options for encryption key managementWhy should the Security Engineer choose IAM CloudHSM over IAM KMS for encryptionkey management in this situation?

A. The key administration event logging generated by CloudHSM is significantly moreextensive than IAM KMS.
B. CloudHSM ensures that only company support staff can administer encryption keys,whereas IAM KMS allows IAM staff to administer keys
C. The ciphertext produced by CloudHSM provides more robust protection against bruteforce decryption attacks than the ciphertext produced by IAM KMS
D. CloudHSM provides the ability to copy keys to a different Region, whereas IAM KMSdoes not

Answer: B

Show Answer

Question # 4

A company wants to protect its website from man in-the-middle attacks by using AmazonCloudFront. Which solution will meet these requirements with the LEAST operationaloverhead?

A. Use the SimpleCORS managed response headers policy.
B. Use a Lambda@Edge function to add the Strict-Transport-Security response header.
C. Use the SecurityHeadersPolicy managed response headers policy.
D. Include the X-XSS-Protection header in a custom response headers policy.

Answer: C

Show Answer

Question # 5

A company's security engineer wants to receive an email alert whenever AmazonGuardDuty, AWS Identity and Access Management Access Analyzer, or Amazon Madegenerate a high-severity security finding. The company uses AWS Control Tower to governall of its accounts. The company also uses AWS Security Hub with all of the AWS serviceintegrations turned on.Which solution will meet these requirements with the LEAST operational overhead?

A. Set up separate AWS Lambda functions for GuardDuty, 1AM Access Analyzer, andMacie to call each service's public API to retrieve high-severity findings. Use AmazonSimple Notification Service (Amazon SNS) to send the email alerts. Create an AmazonEventBridge rule to invoke the functions on a schedule.
B. Create an Amazon EventBridge rule with a pattern that matches Security Hub findingsevents with high severity. Configure the rule to send the findings to a target Amazon SimpleNotification Service (Amazon SNS) topic. Subscribe the desired email addresses to theSNS topic.
C. Create an Amazon EventBridge rule with a pattern that matches AWS Control Towerevents with high severity. Configure the rule to send the findings to a target Amazon SimpleNotification Service (Amazon SNS) topic. Subscribe the desired email addresses to theSNS topic.
D. Host an application on Amazon EC2 to call the GuardDuty, 1AM Access Analyzer, and Macie APIs. Within the application, use the Amazon Simple Notification Service (AmazonSNS) API to retrieve high-severity findings and to send the findings to an SNS topic.Subscribe the desired email addresses to the SNS topic.

Answer: B

Show Answer

Question # 6

A company uses a third-party identity provider and SAML-based SSO for its AWSaccounts. After the third-party identity provider renewed an expired signing certificate,users saw the following message when trying to log in:Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400;Error Code: InvalidldentityToken)A security engineer needs to provide a solution that corrects the error and min-imizesoperational overhead.Which solution meets these requirements?

A. Upload the third-party signing certificate's new private key to the AWS identity providerentity defined in AWS Identity and Access Management (IAM) by using the AWSManagement Console.
B. Sign the identity provider's metadata file with the new public key. Upload the signatureto the AWS identity provider entity defined in AWS Identity and Access Management (IAM)by using the AWS CU.
C. Download the updated SAML metadata file from the identity service provid-er. Updatethe file in the AWS identity provider entity defined in AWS Identity and AccessManagement (IAM) by using the AWS CLI.
D. Configure the AWS identity provider entity defined in AWS Identity and Ac-cess Management (IAM) to synchronously fetch the new public key by using the AWSManagement Console.

Answer: C

Show Answer

Question # 7

A company is running its workloads in a single AWS Region and uses AWS Organizations.A security engineer must implement a solution to prevent users from launching resourcesin other Regions.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an IAM policy that has an aws RequestedRegion condition that allows actionsonly in the designated Region Attach the policy to all users.
B. Create an I AM policy that has an aws RequestedRegion condition that denies actionsthat are not in the designated Region Attach the policy to the AWS account in AWSOrganizations.
C. Create an IAM policy that has an aws RequestedRegion condition that allows thedesired actions Attach the policy only to the users who are in the designated Region.
D. Create an SCP that has an aws RequestedRegion condition that denies actions that arenot in the designated Region. Attach the SCP to the AWS account in AWS Organizations.

Answer: D

Show Answer

Question # 8

A security engineer wants to use Amazon Simple Notification Service (Amazon SNS) tosend email alerts to a company's security team for Amazon GuardDuty findingsthat have a High severity level. The security engineer also wants to deliver these findings toa visualization tool for further examination.Which solution will meet these requirements?

A. Set up GuardDuty to send notifications to an Amazon CloudWatch alarm with twotargets in CloudWatch. From CloudWatch, stream the findings through Amazon KinesisData Streams into an Amazon OpenSearch Service domain as the first target for delivery.Use Amazon QuickSight to visualize the findings. Use OpenSearch queries for furtheranalysis. Deliver email alerts to the security team by configuring an SNS topic as a secondtarget for the CloudWatch alarm. Use event pattern matching with an Amazon EventBridgeevent rule to send only High severity findings in the alerts.
B. Set up GuardDuty to send notifications to AWS CloudTrail with two targets in CloudTrail.From CloudTrail, stream the findings through Amazon Kinesis Data Firehose into anAmazon OpenSearch Service domain as the first target for delivery. Use OpenSearchDashboards to visualize the findings. Use OpenSearch queries for further analysis. Deliveremail alerts to the security team by configuring an SNS topic as a second target forCloudTraiI. Use event pattern matching with a CloudTrail event rule to send only Highseverity findings in the alerts.
C. Set up GuardDuty to send notifications to Amazon EventBridge with two targets. FromEventBridge, stream the findings through Amazon Kinesis Data Firehose into an AmazonOpenSearch Service domain as the first target for delivery. Use OpenSearch Dashboardsto visualize the findings. Use OpenSearch queries for further analysis. Deliver email alertsto the security team by configuring an SNS topic as a second target for EventBridge. Useevent pattern matching with an EventBridge event rule to send only High severity findingsin the alerts.
D. Set up GuardDuty to send notifications to Amazon EventBridge with two targets. FromEventBridge, stream the findings through Amazon Kinesis Data Streams into an AmazonOpenSearch Service domain as the first target for delivery. Use Amazon QuickSight tovisualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts tothe security team by configuring an SNS topic as a second target for EventBridge. Useevent pattern matching with an EventBridge event rule to send only High severity findingsin the alerts.

Answer: C

Show Answer

Question # 9

A company wants to prevent SSH access through the use of SSH key pairs for anyAmazon Linux 2 Amazon EC2 instances in its AWS account. However, a systemadministrator occasionally will need to access these EC2 instances through SSH in anemergency. For auditing purposes, the company needs to record any commands that auser runs in an EC2 instance.What should a security engineer do to configure access to these EC2 instances to meetthese requirements?

A. Use the EC2 serial console Configure the EC2 serial console to save all commands thatare entered to an Amazon S3 bucket. Provide the EC2 instances with an IAM role thatallows the EC2 serial console to access Amazon S3. Configure an IAM account for thesystem administrator. Provide an IAM policy that allows the IAM account to use the EC2serial console.
B. Use EC2 Instance Connect Configure EC2 Instance Connect to save all commands thatare entered to Amazon CloudWatch Logs. Provide the EC2 instances with an IAM role thatallows the EC2 instances to access CloudWatch Logs Configure an IAM account for thesystem administrator. Provide an IAM policy that allows the IAM account to use EC2Instance Connect.
C. Use an EC2 key pair with an EC2 instance that needs SSH access Access the EC2instance with this key pair by using SSH. Configure the EC2 instance to save allcommands that are entered to Amazon CloudWatch Logs. Provide the EC2 instance withan IAM role that allows the EC2 instance to access Amazon S3 and CloudWatch Logs.
D. Use AWS Systems Manager Session Manager Configure Session Manager to save allcommands that are entered in a session to an Amazon S3 bucket. Provide the EC2instances with an IAM role that allows Systems Manager to manage the EC2 instances.Configure an IAM account for the system administrator Provide an IAM policy that allowsthe IAM account to use Session Manager.

Answer: D

Show Answer

Question # 10

An organization must establish the ability to delete an IAM KMS Customer Master Key(CMK) within a 24-hour timeframe to keep it from being used for encrypt or decryptoperations Which of tne following actions will address this requirement?

A. Manually rotate a key within KMS to create a new CMK immediately
B. Use the KMS import key functionality to execute a delete key operation
C. Use the schedule key deletion function within KMS to specify the minimum wait periodfor deletion
D. Change the KMS CMK alias to immediately prevent any services from using the CMK.

Answer: C

Show Answer

Question # 11

A company is designing a multi-account structure for its development teams. The companyis using AWS Organizations and AWS Single Sign-On (AWS SSO). The company mustimplement a solution so that the development teams can use only specific AWS Regionsand so that each AWS account allows access to only specific AWS services.Which solution will meet these requirements with the LEAST operational overhead?

A. Use AWS SSO to set up service-linked roles with IAM policy statements that include theCondition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
B. Deactivate AWS Security Token Service (AWS STS) in Regions that the developers arenot allowed to use.
C. Create SCPs that include the Condition, Resource, and NotAction elements to allowaccess to only the Regions and services that are needed.
D. For each AWS account, create tailored identity-based policies for AWS SSO. Usestatements that include the Condition, Resource, and NotAction elements to allow accessto only the Regions and services that are needed.

Answer: C

Show Answer

Question # 12

A company's Chief Security Officer has requested that a Security Analyst review andimprove the security posture of each company IAM account The Security Analyst decidesto do this by Improving IAM account root user security.Which actions should the Security Analyst take to meet these requirements? (SelectTHREE.)

A. Delete the access keys for the account root user in every account.
B. Create an admin IAM user with administrative privileges and delete the account rootuser in every account.
C. Implement a strong password to help protect account-level access to the IAMManagement Console by the account root user.
D. Enable multi-factor authentication (MFA) on every account root user in all accounts.
E. Create a custom IAM policy to limit permissions to required actions for the account rootuser and attach the policy to the account root user.
F. Attach an IAM role to the account root user to make use of the automated credentialrotation in IAM STS.

Answer: A,D,E

Show Answer

Question # 13

A company has a relational database workload that runs on Amazon Aurora MySQL.According to new compliance standards the company must rotate all database credentialsevery 30 days. The company needs a solution that maximizes security and minimizesdevelopment effort.Which solution will meet these requirements?

A. Store the database credentials in AWS Secrets Manager. Configure automaticcredential rotation tor every 30 days.
B. Store the database credentials in AWS Systems Manager Parameter Store. Create anAWS Lambda function to rotate the credentials every 30 days.
C. Store the database credentials in an environment file or in a configuration file. Modify thecredentials every 30 days.
D. Store the database credentials in an environment file or in a configuration file. Create anAWS Lambda function to rotate the credentials every 30 days.

Answer: A

Show Answer