Amazon SCS-C01 dumps

Amazon SCS-C01 Exam Dumps

AWS Certified Security - Specialty
975 Reviews

Exam Code SCS-C01
Exam Name AWS Certified Security - Specialty
Questions 589 Questions Answers With Explanation
Update Date March 06,2024
Price Was : $81 Today : $45 Was : $99 Today : $55 Was : $117 Today : $65

Genuine Exam Dumps For SCS-C01:

Prepare Yourself Expertly for SCS-C01 Exam:

Our most skilled and experienced professionals are providing updated and accurate study material in PDF form to our customers. The material accumulators make sure that our students successfully secure at least more than 90% marks in the Amazon SCS-C01 exam. Our team of professionals is always working very keenly to keep the material updated. Hence, they communicate to the students quickly if there is change in the SCS-C01 dumps file. You and your money both are very valuable for us so we never take it lightly and have made the attempt to provide you the best work in your hands. In fact, there is not a 1% chance to ruin it.

24/7 Friendly Approach:

You can access our agents anytime for your guidance 24/7. Our agent will provide you information you need, you can ask them any questions you have. We are here to provide you with a complete study material file you need to pass your SCS-C01 exam with remarkable marks.

Recognized Dumps for Amazon SCS-C01 Exam:

Our experts are working hard to provide our customers with accurate material for their Amazon SCS-C01 exam. If you want to meet a sweeping success in your exam you must sign up for the complete preparation at Pass4surexams and we will provide you with such genuine material that will help you succeed with distinction. Our provided material is as real as you are studying the real exam questions and answers. Our experts are working hard for our customers. So that they can easily pass their exam in their first attempt without any trouble.

Our team updates the Amazon SCS-C01 questions answers frequently and if there is a change, we instantly contact our customers and provide them updated study material for the exam preparation.

Amazon SCS-C01 Real Exam Questions:

We offer our students real exam questions with 100% passing guarantee, so that they can easily pass their Amazon SCS-C01 exam in the first attempt. Our SCS-C01 dumps PDF have been carved by the experienced experts exactly on the model of real exam question answers in which you are going to appear to get your certification.


Amazon SCS-C01 Sample Questions

Question # 1

A company wants to monitor the deletion of customer managed CMKs A security engineermust create an alarm that will notify the company before a CMK is deleted The securityengineer has configured the integration of AWS CloudTrail with Amazon CloudWatchWhat should the security engineer do next to meet this requirement?Within AWS Key Management Service (AWS KMS} specify the deletion time of the keymaterial during CMK creation AWS KMS will automatically create a CloudWatch.Create an amazon Eventbridge (Amazon CloudWatch Events) rule to look for API calls ofDeleteAlias Create an AWS Lamabda function to send an Amazon Simple NotificationService (Amazon SNS) messages to the company Add the Lambda functions as the targetof the Eventbridge (CloudWatch Events) rule.Create an Amazon EventBridge (Amazon CloudWath Events) rule to look for API calls ofDisableKey and ScheduleKeyDelection. Create an AWS Lambda function to generate thealarm and send the notification to the company. Add the lambda function as the target ofthe SNS policy.

A. Use inbound rule 100 to allow traffic on TCP port 443 Use inbound rule 200 to denytraffic on TCP port 3306 Use outbound rule 100 to allow traffic on TCP port 443
B. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allowtraffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port443
C. Use inbound rule 100 to allow traffic on TCP port range 1024-65535 Use inbound rule200 to deny traffic on TCP port 3306 Use outbound rule 100 to allow traffic on TCP port443
D. Use inbound rule 100 to deny traffic on TCP port 3306 Use inbound rule 200 to allowtraffic on TCP port 443 Use outbound rule 100 to allow traffic on TCP port 443



Question # 2

A company's on-premises networks are connected to VPCs using an AWS Direct Connectgateway. The company's on-premises application needs to stream data using an existingAmazon Kinesis Data Firehose delivery stream. The company's security policy requiresthat data be encrypted in transit using a private network.How should the company meet these requirements?

A. Create a VPC endpoint tor Kinesis Data Firehose. Configure the application to connectto the VPC endpoint.
B. Configure an 1AM policy to restrict access to Kinesis Data Firehose using a source IPcondition. Configure the application to connect to the existing Firehose delivery stream.
C. Create a new TLS certificate in AWS Certificate Manager (ACM). Create a public-facingNetwork Load Balancer (NLB) and select the newly created TLS certificate. Configure theNLB to forward all traffic to Kinesis Data Firehose. Configure the application to connect tothe NLB.
D. Peer the on-premises network with the Kinesis Data Firehose VPC using DirectConnect. Configure the application to connect to the existing Firehose delivery stream.



Question # 3

A developer signed in to a new account within an AWS Organization organizational unit(OU) containing multiple accounts. Access to the Amazon $3 service is restricted with thefollowing SCP. How can the security engineer provide the developer with Amazon $3 access withoutaffecting other account?

A. Move the SCP to the root OU of organization to remove the restriction to access Amazon $3.
B. Add an IAM policy for the developer, which grants $3 access.
C. Create a new OU without applying the SCP restricting $3 access. Move the developeraccount to this new OU.
D. Add an allow list for the developer account for the $3 service.



Question # 4

A Network Load Balancer (NLB) target instance is not entering the InService state. Asecurity engineer determines that health checks are failing.Which factors could cause the health check failures? (Select THREE.)

A. The target instance's security group does not allow traffic from the NLB.
B. The target instance's security group is not attached to the NLB.
C. The NLB's security group is not attached to the target instance.
D. The target instance's subnet network ACL does not allow traffic from the NLB.
E. The target instance's security group is not using IP addresses to allow traffic from the NLB.
F. The target network ACL is not attached to the NLB.



Question # 5

A company's security engineer has been tasked with restricting a contractor's 1AM accountaccess to the company's Amazon EC2 console without providing access to any other AWSservices The contractors 1AM account must not be able to gain access to any other AWSservice, even it the 1AM account rs assigned additional permissions based on 1AM groupmembershipWhat should the security engineer do to meet these requirements''

A. Create an mime 1AM user policy that allows for Amazon EC2 access for the contractor's1AM user
B. Create an 1AM permissions boundary policy that allows Amazon EC2 access Associatethe contractor's 1AM account with the 1AM permissions boundary policy
C. Create an 1AM group with an attached policy that allows for Amazon EC2 accessAssociate the contractor's 1AM account with the 1AM group
D. Create a 1AM role that allows for EC2 and explicitly denies all other services Instruct thecontractor to always assume this role



Question # 6

A security engineer receives an AWS abuse email message. According to the message, anAmazon EC2 instance that is running in the security engineer's AWS account is sendingphishing email messages.The EC2 instance is part of an application that is deployed in production. The applicationruns on many EC2 instances behind an Application Load Balancer. The instances run in anAmazon EC2 Auto Scaling group across multiple subnets and multiple Availability Zones.The instances normally communicate only over the HTTP. HTTPS, and MySQL protocols.Upon investigation, the security engineer discovers that email messages are being sentover port 587. All other traffic is normal.The security engineer must create a solution that contains the compromised EC2 instance,preserves forensic evidence for analysis, and minimizes application downtime. Whichcombination of steps must the security engineer take to meet these requirements? (SelectTHREE.)

A. Add an outbound rule to the security group that is attached to the compromised EC2instance to deny traffic to 0.0.0.0/0 and port 587.
B. Add an outbound rule to the network ACL for the subnet that contains the compromisedEC2 instance to deny traffic to 0.0.0.0/0 and port 587.
C. Gather volatile memory from the compromised EC2 instance. Suspend thecompromised EC2 instance from the Auto Scaling group. Then take a snapshot of thecompromised EC2 instance. v
D. Take a snapshot of the compromised EC2 instance. Suspend the compromised EC2instance from the Auto Scaling group. Then gather volatile memory from the compromisedEC2 instance.
E. Move the compromised EC2 instance to an isolated subnet that has a network ACL thathas no inbound rules or outbound rules.
F. Replace the existing security group that is attached to the compromised EC2 instancewith a new security group that has no inbound rules or outbound rules.



Question # 7

A company is implementing a new application in a new AWS account. A VPC and subnetshave been created for the application. The application has been peered to an existing VPCin another account in the same AWS Region for database access. Amazon EC2 instanceswill regularly be created and terminated in the application VPC, but only some of them willneed access to the databases in the peered VPC over TCP port 1521. A security engineermust ensure that only the EC2 instances that need access to the databases can accessthem through the network.How can the security engineer implement this solution?

A. Create a new security group in the database VPC and create an inbound rule that allowsall traffic from the IP address range of the application VPC. Add a new network ACL rule onthe database subnets. Configure the rule to TCP port 1521 from the IP address range ofthe application VPC. Attach the new security group to the database instances that theapplication instances need to access.
B. Create a new security group in the application VPC with an inbound rule that allows theIP address range of the database VPC over TCP port 1521. Create a new security group inthe database VPC with an inbound rule that allows the IP address range of the applicationVPC over port 1521. Attach the new security group to the database instances and theapplication instances that need database access.
C. Create a new security group in the application VPC with no inbound rules. Create a newsecurity group in the database VPC with an inbound rule that allows TCP port 1521 fromthe new application security group in the application VPC. Attach the application securitygroup to the application instances that need database access, and attach the databasesecurity group to the database instances.
D. Create a new security group in the application VPC with an inbound rule that allows theIP address range of the database VPC over TCP port 1521. Add a new network ACL ruleon the database subnets. Configure the rule to allow all traffic from the IP address range ofthe application VPC. Attach the new security group to the application instances that needdatabase access.



Question # 8

What is the result of the following bucket policy? Choose the correct answer:Please select:

A. It will allow all access to the bucket mybucket
B. It will allow the user mark from AWS account number 111111111 all access to thebucket but deny everyone else all access to the bucket
C. It will deny all access to the bucket mybucket
D. None of these



Question # 9

A company wants to establish separate AWS Key Management Service (AWS KMS) keysto use for different AWS services. The company's security engineer created the followingkey policy lo allow the infrastructure deployment team to create encrypted Amazon ElasticBlock Store (Amazon EBS) volumes by assuming the InfrastructureDeployment 1AM role: The security engineer recently discovered that 1AM roles other than theInfrastructureDeployment role used this key (or other services. Which change to the policyshould the security engineer make to resolve these issues?

A. In the statement block that contains the Sid "Allow use of the key", under the "Condition"block, change StringEquals to StringLike.
B. In the policy document, remove the statement Dlock that contains the Sid "Enable 1AMUser Permissions". Add key management policies to the KMS polic
C. In the statement block that contains the Sid "Allow use of the Key", under the"Condition" block, change the Kms:ViaService value to ec2.us-east-1 .amazonaws com.
D. In the policy document, add a new statement block that grants the kms:Disable'permission to the security engineer's IAM role.



Question # 10

A company deployed AWS Organizations to help manage its increasing number of AWSaccounts. A security engineer wants to ensure only principals in the Organization structurecan access a specic Amazon S3 bucket. The solution must also minimize operationaloverheadWhich solution will meet these requirements?

A. 1 Put all users into an IAM group with an access policy granting access to the J bucket.
B. Have the account creation trigger an AWS Lambda function that manages the bucketpolicy, allowing access to accounts listed in the policy only.
C. Add an SCP to the Organizations master account, allowing all principals access to thebucket.
D. Specify the organization ID in the global key condition element of a bucket policy, allowing all principals access.



Question # 11

A company has implemented AWS WAF and Amazon CloudFront for an application. Theapplication runs on Amazon EC2 instances that are part of an Auto Scaling group. TheAuto Scaling group is behind an Application Load Balancer (ALB).The AWS WAF web ACL uses an AWS Managed Rules rule group and is associated withthe CloudFront distribution. CloudFront receives the request from AWS WAF and then usesthe ALB as the distribution's origin.During a security review, a security engineer discovers that the infrastructure is susceptibleto a large, layer 7 DDoS attack.How can the security engineer improve the security at the edge of the solution to defendagainst this type of attack?

A. Configure the CloudFront distribution to use the Lambda@Edge feature. Create anAWS Lambda function that imposes a rate limit on CloudFront viewer requests. Block therequest if the rate limit is exceeded.
B. Configure the AWS WAF web ACL so that the web ACL has more capacity units toprocess all AWS WAF rules faster.
C. Configure AWS WAF with a rate-based rule that imposes a rate limit that automaticallyblocks requests when the rate limit is exceeded. 
D. Configure the CloudFront distribution to use AWS WAF as its origin instead of the ALB.



Question # 12

A security engineer needs to create an Amazon S3 bucket policy to grant least privilegeread access to 1AM user accounts that are named User=1, User2. and User3. These IAMuser accounts are members of the AuthorizedPeople IAM group. The security engineerdrafts the following S3 bucket policy: When the security engineer tries to add the policy to the S3 bucket, the following errormessage appears: "Missing required field Principal." The security engineer is adding aPrincipal element to the policy. The addition must provide read access to only User1.User2, and User3. Which solution meets these requirements?



C)



Question # 13

A company Is planning to use Amazon Elastic File System (Amazon EFS) with its onpremises servers. The company has an existing AWS Direct Connect connectionestablished between its on-premises data center and an AWS Region Security policystates that the company's on-premises firewall should only have specific IP addressesadded to the allow list and not a CIDR range. The company also wants to restrict access sothat only certain data center-based servers have access to Amazon EFSHow should a security engineer implement this solution''

A. Add the file-system-id efs aws-region amazonaws com URL to the allow list for the datacenter firewall Install the AWS CLI on the data center-based servers to mount the EFS filesystem in the EFS security group add the data center IP range to the allow list Mount theEFS using the EFS file system name
B. Assign an Elastic IP address to Amazon EFS and add the Elastic IP address to the allowlist for the data center firewall Install the AWS CLI on the data center-based servers tomount the EFS file system In the EFS security group, add the IP addresses of the datacenter servers to the allow list Mount the EFS using the Elastic IP address
C. Add the EFS file system mount target IP addresses to the allow list for the data centerfirewall In the EFS security group, add the data center server IP addresses to the allow listUse the Linux terminal to mount the EFS file system using the IP address of one of the mount targets
D. Assign a static range of IP addresses for the EFS file system by contacting AWSSupport In the EFS security group add the data center server IP addresses to the allow listUse the Linux terminal to mount the EFS file system using one of the static IP addresses



Amazon SCS-C01 Exam Reviews

Leave Your Review