Dumps4free
Home / Amazon Web Services / AWS Certified Specialty / SCS-C02 - AWS Certified Security - Specialty

Latest SCS-C02 Exam Questions


Question # 1



A company has a guideline that mandates the encryption of all Amazon S3 bucket data in transit. A security engineer must implement an S3 bucket policy that denies any S3 operations if data is not encrypted.
Which S3 bucket policy will meet this requirement?

A.

B.

C.

D.




B.   






Question # 2



A company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certificate, users saw the following message when trying to log in: 
Error: Response Signature Invalid (Service: AWSSecurityTokenService; 
Status Code: 400; 
Error Code: InvalidldentityToken)
A security engineer needs to provide a solution that corrects the error and min-imizes operational overhead. Which solution meets these requirements?

A.

Upload the third-party signing certificate's new private key to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS Management Console.

B.

Sign the identity provider's metadata file with the new public key. Upload the signature to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CU.

C.

Download the updated SAML metadata file from the identity service provid-er. Update the file in the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.

D.

Configure the AWS identity provider entity defined in AWS Identity and Ac-cess Management (IAM) to synchronously fetch the new public key by using the AWS Management Console.




C.   

Download the updated SAML metadata file from the identity service provid-er. Update the file in the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.






Question # 3



A development team is attempting to encrypt and decode a secure string parameter from the IAM Systems Manager Parameter Store using an IAM Key Management Service (IAM KMS) CMK. However, each attempt results in an error message being sent to the development team.
Which CMK-related problems possibly account for the error? (Select two.)

A.

The CMK is used in the attempt does not exist.

B.

The CMK is used in the attempt needs to be rotated.

C.

The CMK is used in the attempt is using the CMK€™s key ID instead of the CMK ARN.

D.

The CMK is used in the attempt is not enabled.

E.

The CMK is used in the attempt is using an alias.




A.   

The CMK is used in the attempt does not exist.




D.   

The CMK is used in the attempt is not enabled.






Question # 4



A company’s security team needs to receive a notification whenever an AWS access key has not been rotated in 90 or more days. A security engineer must develop a solution that provides these notifications automatically. Which solution will meet these requirements with the LEAST amount of effort?

A.

Deploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern hat matches the compliance type of NON_COMPLIANT from AWS Config for the managed rule. Configure EventBridge (CloudWatch Events) to send an Amazon Simple
Notification Service (Amazon SNS) notification to the security team.

B.

Create a script to export a .csv file from the AWS Trusted Advisor check for IAM access key rotation. Load the script into an AWS Lambda function that will upload the .csv file to an Amazon S3 bucket. Create an Amazon Athena table query that runs when the .csv file is uploaded to the S3 bucket. Publish the results for any keys older than 90 days by using an invocation of an Amazon Simple Notification Service (Amazon SNS) notification to the security team.

C.

Create a script to download the IAM credentials report on a periodic basis. Load the script into an AWS Lambda function that will run on a schedule through Amazon EventBridge (Amazon CloudWatch Events). Configure the Lambda script to load the report into memory and to filter the report for records in which the key was last rotated at least 90 days ago. If any records are detected, send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.

D.

Create an AWS Lambda function that queries the IAM API to list all the users. Iterate through the users by using the ListAccessKeys operation. Verify that the value in the CreateDate field is not at least 90 days old. Send an Amazon Simple Notification Service (Amazon SNS) notification to the security team if the value is at least 90 days old. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to schedule the Lambda function to run each day.




A.   

Deploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern hat matches the compliance type of NON_COMPLIANT from AWS Config for the managed rule. Configure EventBridge (CloudWatch Events) to send an Amazon Simple
Notification Service (Amazon SNS) notification to the security team.






Question # 5



A security team is working on a solution that will use Amazon EventBridge (Amazon CloudWatch Events) to monitor new Amazon S3 objects. The solution will monitor for public access and for changes to any S3 bucket policy or setting that result in public access. The security team configures EventBridge to watch for specific API calls that are logged from AWS CloudTrail. EventBridge has an action to send an email notification through Amazon Simple Notification Service (Amazon SNS) to the security team immediately with details of the API call. Specifically, the security team wants EventBridge to watch for the s3:PutObjectAcl, s3:DeleteBucketPolicy, and s3:PutBucketPolicy API invocation logs from CloudTrail. While developing the solution in a single account, the security team discovers that the s3:PutObjectAcl API call does not invoke an EventBridge event. However, the s3:DeleteBucketPolicy API call and the s3:PutBucketPolicy API call do invoke an event. The security team has enabled CloudTrail for AWS management events with a basic configuration in the AWS Region in which EventBridge is being tested. Verification of the EventBridge event pattern indicates that the pattern is set up correctly. The security team must implement a solution so that the s3:PutObjectAcl API call will invoke an EventBridge event. The solution must not generate false notifications. Which solution will meet these requirements?

A.

Modify the EventBridge event pattern by selecting Amazon S3. Select All Events as the event type.

B.

Modify the EventBridge event pattern by selecting Amazon S3. Select Bucket Level Operations as the event type.

C.

Enable CloudTrail Insights to identify unusual API activity.

D.

Enable CloudTrail to monitor data events for read and write operations to S3 buckets.




D.   

Enable CloudTrail to monitor data events for read and write operations to S3 buckets.






Question # 6



To meet regulatory requirements, a Security Engineer needs to implement an IAM policy that restricts the use of AWS services to the us-east-1 Region. What policy should the Engineer implement?

A.

B.

C.

D.




C.   






Question # 7



A company's security engineer has been tasked with restricting a contractor's IAM account access to the company's Amazon EC2 console without providing access to any other IAM services The contractors IAM account must not be able to gain access to any other IAM service, even it the IAM account rs assigned additional permissions based on IAM group membership 
What should the security engineer do to meet these requirements''

A.

Create an mime IAM user policy that allows for Amazon EC2 access for the contractor's IAM user

B.

Create an IAM permissions boundary policy that allows Amazon EC2 access Associate the contractor's IAM account with the IAM permissions boundary policy

C.

Create an IAM group with an attached policy that allows for Amazon EC2 access Associate the contractor's IAM account with the IAM group

D.

Create a IAM role that allows for EC2 and explicitly denies all other services Instruct the contractor to always assume this role




B.   

Create an IAM permissions boundary policy that allows Amazon EC2 access Associate the contractor's IAM account with the IAM permissions boundary policy






Question # 8



The Security Engineer is managing a traditional three-tier web application that is running on Amazon EC2 instances. The application has become the target of increasing numbers of malicious attacks from the Internet. What steps should the Security Engineer take to check for known vulnerabilities and limit the attack surface? (Choose two.)

A.

Use AWS Certificate Manager to encrypt all traffic between the client and application servers.

B.

Review the application security groups to ensure that only the necessary ports are open.

C.

Use Elastic Load Balancing to offload Secure Sockets Layer encryption.

D.

Use Amazon Inspector to periodically scan the backend instances.

E.

Use AWS Key Management Services to encrypt all the traffic between the client and application servers.




B.   

Review the application security groups to ensure that only the necessary ports are open.




D.   

Use Amazon Inspector to periodically scan the backend instances.






Question # 9



A company in France uses Amazon Cognito with the Cognito Hosted Ul as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application's users will come from France. When the company launches the application the company's security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France. The security team needs a solution to perform custom validation at sign-up Based on the results of the validation the solution must accept or deny the registration request. Which combination of steps will meet these requirements? (Select TWO.)

A.

Create a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool.

B.

Use a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.

C.

Configure an app client for the application's Amazon Cognito user pool. Use the app client ID to validate the requests in the hosted Ul.

D.

Update the application's Amazon Cognito user pool to configure a geographic restriction setting.

E.

Use Amazon Cognito to configure a social identity provider (IdP) to validate the requests on the hosted Ul.




B.   

Use a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.






Question # 10



A security engineer wants to use Amazon Simple Notification Service (Amazon SNS) to send email alerts to a company's security team for Amazon GuardDuty findings that have a High severity level. The security engineer also wants to deliver these findings to a visualization tool for further examination. Which solution will meet these requirements?

A.

Set up GuardDuty to send notifications to an Amazon CloudWatch alarm with two targets in CloudWatch. From CloudWatch, stream the findings through Amazon Kinesis Data Streams into an Amazon OpenSearch Service domain as the first target for delivery. Use Amazon QuickSight to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for the CloudWatch alarm. Use event pattern matching with an Amazon EventBridge event rule to send only High severity findings in the alerts.

B.

Set up GuardDuty to send notifications to AWS CloudTrail with two targets in CloudTrail.
From CloudTrail, stream the findings through Amazon Kinesis Data Firehose into an Amazon OpenSearch Service domain as the first target for delivery. Use OpenSearch Dashboards to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for CloudTraiI. Use event pattern matching with a CloudTrail event rule to send only High severity findings in the alerts.

C.

Set up GuardDuty to send notifications to Amazon EventBridge with two targets. From EventBridge, stream the findings through Amazon Kinesis Data Firehose into an Amazon OpenSearch Service domain as the first target for delivery. Use OpenSearch Dashboards to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for EventBridge. Use event pattern matching with an EventBridge event rule to send only High severity findings in the alerts.

D.

Set up GuardDuty to send notifications to Amazon EventBridge with two targets. From EventBridge, stream the findings through Amazon Kinesis Data Streams into an Amazon OpenSearch Service domain as the first target for delivery. Use Amazon QuickSight to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for EventBridge. Use event pattern matching with an EventBridge event rule to send only High severity findings in the alerts.




C.   

Set up GuardDuty to send notifications to Amazon EventBridge with two targets. From EventBridge, stream the findings through Amazon Kinesis Data Firehose into an Amazon OpenSearch Service domain as the first target for delivery. Use OpenSearch Dashboards to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for EventBridge. Use event pattern matching with an EventBridge event rule to send only High severity findings in the alerts.





Get 327 AWS Certified Security - Specialty questions Access in less then $0.12 per day.

Total Questions Answers: 327
Last Updated: 25-Oct-2024
Available with 1, 3, 6 and 12 Months Free Updates Plans
PDF: $15 $64

Test Engine: $20 $80

PDF + Engine: $25 $99


Amazon Web Services SCS-C02 Dumps - Real Exam Questions


Exam Code: SCS-C02
Exam Name: AWS Certified Security - Specialty

  • 90 Days Free Updates
  • Amazon Web Services Experts Verified Answers
  • Printable PDF File Format
  • SCS-C02 Exam Passing Assurance

Get 100% Real SCS-C02 Exam Dumps With Verified Answers As Seen in the Real Exam. AWS Certified Security - Specialty Exam Questions are Updated Frequently and Reviewed by Industry TOP Experts for Passing AWS Certified Specialty Exam Quickly and Hassle Free.

Amazon Web Services SCS-C02 Dumps


Struggling with AWS Certified Security - Specialty prep? Get the edge you need!

Our carefully created SCS-C02 dumps give you the confidence to pass the exam. We offer:

  • Up-to-date AWS Certified Specialty practice questions: Stay current with the latest exam content.
  • PDF and test engine formats: Choose the study tools that work best for you.
  • Realistic Amazon Web Services SCS-C02 practice exam: Simulate the real exam experience and boost your readiness.
Pass your AWS Certified Specialty exam with ease. Try our study materials today!


Ace your AWS Certified Specialty exam with confidence!

We provide top-quality SCS-C02 exam dumps materials that are:
  • Accurate and up-to-date: Reflect the latest Amazon Web Services exam changes and ensure you are studying the right content. 
  • Comprehensive: Cover all exam topics so you do not need to rely on multiple sources. 
  • Convenient formats: Choose between PDF files and online AWS Certified Security - Specialty practice test for easy studying on any device.
Do not waste time on unreliable SCS-C02 practice test. Choose our proven AWS Certified Specialty study materials and pass with flying colors.

Try Dumps4free AWS Certified Security - Specialty 2024 PDFs today!

  • Assurance

    AWS Certified Security - Specialty practice exam has been updated to reflect the most recent questions from the Amazon Web Services SCS-C02 Exam.

  • Demo

    Try before you buy! Get a free demo of our AWS Certified Specialty exam dumps and see the quality for yourself. Need help? Chat with our support team.

  • Validity

    Our Amazon Web Services SCS-C02 PDF contains expert-verified questions and answers, ensuring you're studying the most accurate and relevant material.

  • Success

    Achieve SCS-C02 success! Our AWS Certified Security - Specialty exam questions give you the preparation edge.

If you have any question then contact our customer support at live chat or email us at support@dumps4free.com.