Amazon SCS-C02 Exam Real Questions

Prepare and pass your AWS Certified Security Specialty with free SCS-C02 exam questions.

Page: 1 / 97

Total 481 Questions | Updated On: Sep 26, 2024

Add To Cart

Question 1

A security team has mandated that only approved Amazon Machine Images (AMIs) can be used for launching Amazon EC2 instances. The security team requires a method of automatically validating compliance with the new mandate.

Which solution can the security team use to find unapproved AMIs for new and existing Amazon EC2 instances?

A : eate an Amazon CloudWatch custom metric that reports the AMI ID of EC2 instances.

B : ploy the AWS Config rule “ebs-optimized-instance” and specify the approved AMI ARNs.

C : ploy the AWS Config rule “approved_ami_by_id” and specify the approved AMI IDs.

D : eate a user data script that checks the AMI ID in instance metadata for compliance.

Answer: C

Question 2

A corporation is preparing to acquire several companies. A Security Engineer must design a solution to ensure that newly acquired IAM accounts follow the corporation's security best practices. The solution should monitor each Amazon S3 bucket for unrestricted public write access and use IAM managed services. What should the Security Engineer do to meet these requirements?

A : Configure Amazon Macie to continuously check the configuration of all S3 buckets.

B : Enable IAM Config to check the configuration of each S3 bucket.

C : Set up IAM Systems Manager to monitor S3 bucket policies for public write access.

D : Configure an Amazon EC2 instance to have an IAM role and a cron job that checks the status of all S3 buckets.

Answer: C

Question 3

Due to compliance requirements, a company must rotate encryption keys every year. An AWS KMS key was created using imported key material. A security engineer needs a process to rotate the KMS key.

Which key rotation process is MOST efficient?

A : lect the option to enable automatic rotation for the existing KMS key.

B : load new key material into the existing KMS key.

C : eate a new KMS key and update the existing Key Alias to point to the new KMS key.

D : eate a new KMS key and change the application to point to the new KMS key.

Answer: C

Question 4

A company needs to retain tog data archives for several years to be compliant with regulations. The tog data is no longer used but It must be retained What Is the MOST secure and cost-effective solution to meet these requirements?

A : Archive the data to Amazon S3 and apply a restrictive bucket policy to deny the s3 DeleteOotect API

B : Archive the data to Amazon S3 Glacier and apply a Vault Lock policy

C : Archive the data to Amazon S3 and replicate it to a second bucket in a second IAM Region Choose theÃ‚Â S3 Standard-Infrequent Access (S3 Standard-1A) storage class and apply a restrictive bucket policy to deny the s3 DeleteObject API

D : Migrate the log data to a 16 T8 Amazon Elastic Block Store (Amazon EBS) volume Create a snapshot of the EBS volume

Answer: B

Question 5

A security vulnerability has been discovered that could lead to sensitive data being leaked on TCP port 5601. The development team is working on updating the code, but it could take several days. A security engineer must identify any hosts attempting to send data over port 5601 and prevent the traffic leaving the network.

How can the security engineer accomplish this goal?

A : pture IP traffic using VPC Flow Logs and create a metric filter with an alarm that notifies the security team if connection attempts are made. Then, update NACLs to block the traffic

B : tall the unified CloudWatch agent on Amazon EC2 instances and collect log files in CloudWatch Logs. Create a metric filter with an alarm that notifies the security team if connection attempts are made. Then, update NACLs to block the traffic.

C : Run an Amazon Inspector custom network assessment to identify Amazon EC2 instances that have TCP port 5601 open. Then, update security groups to block the traffic.

D : AWS CloudTrail to log API actions in an Amazon S3 bucket. Use Amazon Athena to query the log files and identify attempts to connect. Then, update security groups to block the traffic.

Answer: A

Page: 1 / 97

Total 481 Questions | Updated On: Sep 26, 2024

Add To Cart