Pre-Summer Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 65pass65

AWS-Security-Specialty AWS Certified Security Specialty (SCS-C03) is now Stable and With Pass Result | Test Your Knowledge for Free

Exams4sure Dumps

AWS-Security-Specialty Practice Questions

AWS Certified Security Specialty (SCS-C03)

Last Update 3 days ago
Total Questions : 179

Dive into our fully updated and stable AWS-Security-Specialty practice test platform, featuring all the latest AWS Certified Security Specialty exam questions added this week. Our preparation tool is more than just a Amazon study aid; it's a strategic advantage.

Our free AWS Certified Security Specialty practice questions crafted to reflect the domains and difficulty of the actual exam. The detailed rationales explain the 'why' behind each answer, reinforcing key concepts about AWS-Security-Specialty. Use this test to pinpoint which areas you need to focus your study on.

AWS-Security-Specialty PDF

AWS-Security-Specialty PDF (Printable)
$52.5
$150

AWS-Security-Specialty Testing Engine

AWS-Security-Specialty PDF (Printable)
$70
$200

AWS-Security-Specialty PDF + Testing Engine

AWS-Security-Specialty PDF (Printable)
$104.65
$299
Question # 41

A company runs a web application on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are in the same VPC subnet as other workloads.

A security engineer deploys an Amazon GuardDuty detector in the same AWS Region as the EC2 instances and integrates GuardDuty with AWS Security Hub.

The security engineer needs to implement an automated solution to detect and appropriately respond to anomalous traffic patterns for the web application. The solution must comply with AWS best practices forinitial response to security incidentsand mustminimize disruptionto the web application.

Which solution will meet these requirements?

Options:

A.  

Disable the EC2 instance profile credentials by using AWS Lambda.

B.  

Create an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic. Configure the function to remove the affected instance from the Auto Scaling group and attach a restricted security group.

C.  

Update the subnet network ACL to block traffic from the detected source IP addresses.

D.  

Send GuardDuty findings to Amazon SNS for email notification.

Discussion 0
Question # 42

A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager.

Which solution will meet the requirements?

Options:

A.  

Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.

B.  

Use a parameter in the CloudFormation template to reference the database credentials. Encrypt the CloudFormation template by using AWS KMS.

C.  

Use a SecureString parameter in the CloudFormation template to reference the database credentials in Secrets Manager.

D.  

Use a SecureString parameter in the CloudFormation template to reference an encrypted value in AWS KMS.

Discussion 0
Question # 43

A company uses AWS IAM Identity Center with SAML 2.0 federation. The company decides to change its federation source from one identity provider (IdP) to another. The underlying directory for both IdPs is Active Directory.

Which solution will meet this requirement?

Options:

A.  

Disable all existing users and groups within IAM Identity Center that were part of the federation with the original IdP.

B.  

Modify the attribute mappings within the IAM Identity Center trust relationship to match information that the new IdP sends.

C.  

Reconfigure all existing IAM roles in the company ' s AWS accounts to explicitly trust the new IdP as the principal.

D.  

Confirm that the Network Time Protocol (NTP) clock skew is correctly set between IAM Identity Center and the new IdP endpoints.

Discussion 0
Question # 44

A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. Each Availability Zone contains one public subnet and one private subnet. Three route tables exist: one for the public subnets and one for each private subnet.

The security engineer discovers that all four subnets are routing traffic through the internet gateway that is attached to the VP

C.  

Which combination of steps should the security engineer take to remediate this scenario? (Select TWO.)

Options:

A.  

Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.

B.  

Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.

C.  

Modify the route tables for the public subnets to add a local route to the VPC CIDR range.

D.  

Modify the route tables for the private subnets to route 0.0.0.0/0 to the NAT gateway in the public subnet of the same Availability Zone.

E.  

Modify the route tables for the private subnets to route 0.0.0.0/0 to the internet gateway.

Discussion 0
Question # 45

A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are deployed in a private subnet that does not have internet access.

The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy. Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required S3 buckets.

The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3 bucket that isoutside the company’s AWS Organization. The processing job must continue to function.

Which solution will meet these requirements?

Options:

A.  

Update the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and aws:PrincipalOrgId match the company’s organization.

B.  

Update the instance profile role policy to require aws:ResourceOrgId.

C.  

Add a network ACL rule to block outbound traffic on port 443.

D.  

Apply an SCP that restricts S3 actions using organization condition keys.

Discussion 0
Question # 46

A company needs to detect unauthenticated access to its Amazon Elastic Kubernetes Service (Amazon EKS) clusters. The solution must require no additional configuration of the existing EKS deployment.

Which solution will meet these requirements with the LEAST operational effort?

Options:

A.  

Install a third-party security add-on.

B.  

Enable AWS Security Hub and monitor Kubernetes findings.

C.  

Monitor CloudWatch Container Insights metrics for EKS.

D.  

Enable Amazon GuardDuty and use EKS Audit Log Monitoring.

Discussion 0
Question # 47

A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster. The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys.

How can the security engineer meet these requirements?

Options:

A.  

To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon Athena.

B.  

To create the keys, use Amazon S3 and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.

C.  

To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon GuardDuty.

D.  

To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.

Discussion 0
Question # 48

A company has hundreds of AWS accounts in an organization in AWS Organizations. The company operates out of a single AWS Region. The company has a dedicated security tooling AWS account in the organization. The security tooling account is configured as the organization ' s delegated administrator for Amazon GuardDuty and AWS Security Hub. The company has configured the environment to automatically enable GuardDuty and Security Hub for existing AWS accounts and new AWS accounts.

The company is performing control tests on specific GuardDuty findings to make sure that the company ' s security team can detect and respond to security events. The security team launched an Amazon EC2 instance and attempted to run DNS requests against a test domain,example.com, to generate a DNS finding. However, the GuardDuty finding was never created in the Security Hub delegated administrator account.

Why was the finding not created in the Security Hub delegated administrator account?

Options:

A.  

VPC flow logs were not turned on for the VPC where the EC2 instance was launched.

B.  

The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver.

C.  

The GuardDuty integration with Security Hub was never activated in the AWS account where the finding was generated.

D.  

Cross-Region aggregation in Security Hub was not configured.

Discussion 0
Question # 49

A company is developing an application that runs across a combination of Amazon EC2 On-Demand Instances and Spot Instances. A security engineer needs to provide a logging solution that makes logs for all instances available from a single location. The solution must allow only a specific set of users to analyze the logs for event patterns. The users must be able to use SQL queries on the logs to perform root cause analysis.

Which solution will meet these requirements?

Options:

A.  

Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group. Allow only specific users to access the log group. Use CloudWatch Logs Insights to query the log group.

B.  

Configure the EC2 instances to send application logs to a single Amazon S3 bucket. Allow only specific users to access the S3 bucket. Use Amazon CloudWatch Logs Insights to query the log files in the S3 bucket.

C.  

Configure each EC2 instance to send its application logs to its own specific Amazon CloudWatch Logs log group. Allow only specific users to access the log groups. Use Amazon Athena to query all the log groups.

D.  

Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group. Grant Amazon Detective access to the log group. Allow only specific users to use Detective to analyze the logs.

Discussion 0
Question # 50

A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running in Amazon Elastic Container Service (Amazon ECS). This solution must also handle volatile traffic patterns.

Which solution would have the MOST scalability and LOWEST latency?

Options:

A.  

Configure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.

B.  

Configure an Application Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.

C.  

Configure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers.

D.  

Configure Amazon Route 53 to use multivalue answer routing to send traffic to the containers.

Discussion 0
Get AWS-Security-Specialty dumps and pass your exam in 24 hours!

Free Exams Sample Questions