SCS-C01 Exam Training Practice Tests (Amazon AWS Certified Security

Question 1

A company is designing a new application stack. The design includes web servers and backend servers that are hosted on Amazon EC2 instances. The design also includes an Amazon Aurora MySQL DB cluster.
The EC2 instances are m an Auto Scaling group that uses launch templates. The EC2 instances for the web layer and the backend layer are backed by Amazon Elastic Block Store (Amazon EBS) volumes. No layers are encrypted at rest. A security engineer needs to implement encryption at rest.
Which combination of steps will meet these requirements? (Select TWO.)

A. Apply AWS Key Management Service (AWS KMS) encryption to the existing DB cluster. B. Modify EBS default encryption settings in the target AWS Region to enable encryption. Use an Auto Scaling group instance refresh. C. Create a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster. D. Modify the launch templates for the web layer and the backend layer to add AWS Certificate Manager (ACM) encryption for the attached EBS volumes. Use an Auto Scaling group instance refresh. E. Apply AWS Certificate Manager (ACM) encryption to the existing DB cluster.

Correct Answer: B,C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

A company has two teams, and each team needs to access its respective Amazon S3 buckets. The company anticipates adding more teams that also will have their own S3 buckets. When the company adds these teams, team members will need the ability to be assigned to multiple teams. Team members also will need the ability to change teams. Additional S3 buckets can be created or deleted.
An IAM administrator must design a solution to accomplish these goals. The solution also must be scalable and must require the least possible operational overhead.
Which solution meets these requirements?

A. Implement a role-based access control (RBAC) authorization model. Create the corresponding policies, and attach them to the IAM users. B. Create an IAM role for each team. Create a policy for each team that allows the team to access its respective S3 buckets only. Attach the policy to the corresponding role. C. Create IAM roles that are labeled with an access tag value of a team. Create one policy that allows dynamic access to S3 buckets with the same tag. Attach the policy to the IAM roles. Tag the S3 buckets accordingly. D. Add users to groups that represent the teams. Create a policy for each team that allows the team to access its respective S3 buckets only. Attach the policy to the corresponding group.

Correct Answer: D

Question 3

An application is designed to run on an EC2 Instance. The applications needs to work with an S3 bucket. From a security perspective , what is the ideal way for the EC2 instance/ application to be configured?
Please select:

A. Assign an IAM user to the application that has specific access to only that S3 bucket B. Use the IAM access keys ensuring that they are frequently rotated. C. Assign an IAM Role and assign it to the EC2 Instance D. Assign an IAM group and assign it to the EC2 Instance

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

A Security Architect has been asked to review an existing security architecture and identify why the application servers cannot successfully initiate a connection to the database servers. The following summary describes the architecture:
1 An Application Load Balancer, an internet gateway, and a NAT gateway are configured in the public subnet 2. Database, application, and web servers are configured on three different private subnets.
3 The VPC has two route tables: one for the public subnet and one for all other subnets The route table for the public subnet has a 0 0 0 0/0 route to the internet gateway The route table for all other subnets has a 0 0.0.0/0 route to the NAT gateway. All private subnets can route to each other
4 Each subnet has a network ACL implemented that limits all inbound and outbound connectivity to only the required ports and protocols
5 There are 3 Security Groups (SGs) database application and web Each group limits all inbound and outbound connectivity to the minimum required Which of the following accurately reflects the access control mechanisms the Architect should verify1?

A. Inbound SG configuration on database servers
Outbound SG configuration on application servers
Inbound and outbound network ACL configuration on the database subnet
Inbound and outbound network ACL configuration on the application server subnet B. Outbound SG configuration on database servers Inbound SG configuration on application servers inbound and outbound network ACL configuration on the database subnet Inbound and outbound network ACL configuration on the application server subnet C. Inbound SG configuration on database servers Outbound SG configuration on application servers Inbound network ACL configuration on the database subnet Outbound network ACL configuration on the application server subnet. D. Inbound and outbound SG configuration on database servers Inbound and outbound SG configuration on application servers Inbound network ACL configuration on the database subnet Outbound network ACL configuration on the application server subnet

Correct Answer: B

Question 5

A company is setting up products to deploy in IAM Service Catalog. Management is concerned that when users launch products, elevated IAM privileges will be required to create resources. How should the company mitigate this concern?

A. Add a launch constraint to each product in the portfolio. B. Add a template constraint to each product in the portfolio. C. Update the IAM CloudFormalion template backing the product to include a service role configuration. D. Define resource update constraints for each product in the portfolio.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

A Developer reported that IAM CloudTrail was disabled on their account. A Security Engineer investigated the account and discovered the event was undetected by the current security solution. The Security Engineer must recommend a solution that will detect future changes to the CloudTrail configuration and send alerts when changes occur.
What should the Security Engineer do to meet these requirements?

A. Use Amazon Inspector to automatically detect security issues. Send alerts using Amazon SNS. B. Update security contact details in IAM account settings for IAM Support to send alerts when suspicious activity is detected. C. Create an Amazon CloudWatch Events rule to monitor Amazon GuardDuty findings. Send email notifications using Amazon SNS. D. Use IAM Resource Access Manager (IAM RAM) to monitor the IAM CloudTrail configuration. Send notifications using Amazon SNS.

Correct Answer: C

Question 7

An application running on EC2 instances in a VPC must call an external web service via TLS (port 443). The instances run in public subnets.
Which configurations below allow the application to function and minimize the exposure of the instances? Select 2 answers from the options given below Please select:

A. A network ACL with rules that allow outgoing traffic on port 443 and incoming traffic on port 443. B. A security group with rules that allow outgoing traffic on port 443 and incoming traffic on port 443. C. A network ACL with rules that allow outgoing traffic on port 443 and incoming traffic on ephemeral ports D. A security group with a rule that allows outgoing traffic on port 443 E. A network ACL with a rule that allows outgoing traffic on port 443. F. A security group with rules that allow outgoing traffic on port 443 and incoming traffic on ephemeral ports.

Correct Answer: C,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

An Amazon EC2 instance is part of an EC2 Auto Scaling group that is behind an Application Load Balancer (ALB). It is suspected that the EC2 instance has been compromised.
Which steps should be taken to investigate the suspected compromise? (Choose three.)

A. Attach a security group that has restrictive ingress and egress rules to the EC2 instance. B. Add a rule to an IAM WAF to block access to the EC2 instance. C. Disable any Amazon Route 53 health checks associated with the EC2 instance. D. Initiate an Amazon Elastic Block Store volume snapshot of all volumes on the EC2 instance. E. De-register the EC2 instance from the ALB and detach it from the Auto Scaling group. F. Detach the elastic network interface from the EC2 instance.

Correct Answer: A,D,E

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

The Security Engineer for a mobile game has to implement a method to authenticate users so that they can save their progress. Because most of the users are part of the same OpenID-Connect compatible social media website, the Security Engineer would like to use that as the identity provider.
Which solution is the SIMPLEST way to allow the authentication of users using their social media identities?

A. Amazon Cognito B. Amazon Cloud Directory C. AssumeRoleWithWebIdentity API D. Active Directory (AD) Connector

Correct Answer: A

Question 10

A company has several production IAM accounts and a central security IAM account. The security account is used for centralized monitoring and has IAM privileges to all resources in every corporate account. All of the company's Amazon S3 buckets are tagged with a value denoting the data classification of their contents.
A Security Engineer is deploying a monitoring solution in the security account that will enforce bucket policy compliance. The system must monitor S3 buckets in all production accounts and confirm that any policy change is in accordance with the bucket's data classification. If any change is out of compliance; the Security team must be notified quickly.
Which combination of actions would build the required solution? (Choose three.)

A. Configure an Amazon CloudWatch Events rule in the security account to detect S3 bucket creation or modification events. B. Invoke an IAM Lambda function in the security account to analyze S3 bucket settings in response to S3 events, and send non-compliance notifications to the Security team. C. Configure Amazon CloudWatch Events in the production accounts to send all S3 events to the security account event bus. D. Enable Amazon GuardDuty in the security account. and join the production accounts as members. E. Configure event notifications on S3 buckets for PUT; POST, and DELETE events. F. Enable IAM Trusted Advisor and activate email notifications for an email address assigned to the security contact.

Correct Answer: B,E,F

Question 11

A company wants to monitor the deletion of AWS Key Management Service (AWS KMS) customer managed keys. A security engineer needs to create an alarm that will notify the company before a KMS key is deleted. The security engineer has configured the integration of AWS CloudTrail with Amazon CloudWatch.
What should the security engineer do next to meet these requirements?

A. Specify the deletion time of the key material during KMS key creation. Create a custom AWS Config rule to assess the key's scheduled deletion. Configure the rule to trigger upon a configuration change. Send a message to an Amazon Simple Notification Service (Amazon SNS) topic if the key is scheduled for deletion. B. Create an Amazon EventBridge rule to detect KMS API calls of DeleteAlias. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the EventBridge rule. C. Create an Amazon EventBridge rule to detect KMS API calls of DisableKey and ScheduleKeyDeletion. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the EventBridge rule. D. Create an Amazon Simple Notification Service (Amazon SNS) policy to detect KMS API calls of RevokeGrant and ScheduleKeyDeletion.Create an AWS Lambda function to generate the alarm and send the notification to the company. Add the Lambda function as the target of the SNS policy.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 12

Unapproved changes were previously made to a company's Amazon S3 bucket. A security engineer configured IAM Config to record configuration changes made to the company's S3 buckets. The engineer discovers there are S3 configuration changes being made, but no Amazon SNS notifications are being sent. The engineer has already checked the configuration of the SNS topic and has confirmed the configuration is valid.
Which combination of steps should the security engineer take to resolve the issue? (Select TWO.)

A. Verify the security engineer's IAM user has an attached policy that allows all IAM Config actions. B. Configure policies attached to S3 buckets to allow IAM Config to record changes to the buckets. C. Configure the S3 bucket ACLs to allow IAM Config to record changes to the buckets. D. Attach the AmazonS3ReadOnryAccess managed policy to the IAM user. E. Assign the IAMConfigRole managed policy to the IAM Config role

Correct Answer: B,E

Question 13

A Security Engineer who was reviewing IAM Key Management Service (IAM KMS) key policies found this statement in each key policy in the company IAM account.

What does the statement allow?

A. Only principals from account 111122223333 that have an IAM policy applied that grants access to this key to use the key. B. Only the root user from account 111122223333 to use the key. C. All principals from account 111122223333 to use the key but only on Amazon S3. D. All principals from all IAM accounts to use the key.

Correct Answer: A

Amazon AWS Certified Security - Specialty - SCS-C01 Exam Practice Test