Amazon SCS-C03 Dumps Questions Answers

Amazon SCS-C03 Dumps

Dumps4download providing 100% reliable Exam dumps that are verified by experts panel. Our Dumps4download SCS-C03 study material are totally unique and exam questions are valid all over the world. By using our SCS-C03 dumps we assure you that you will pass your exam on first attempt. You can easily score more than 97%.

100% exam passing Guarantee on your purchased exams.

100% money back guarantee if you will not clear your exam.

Amazon SCS-C03 Practice Test Helps You Turn Dreams To Reality!

IT Professionals from every sector are looking up certifications to boost their careers. Amazon being the leader certification provider earns the most demand in the industry.

The Amazon Certification is your short-cut to an ever-growing success. In the process, Dumps4download is your strongest coordinator, providing you with the best SCS-C03 Dumps PDF as well as Online Test Engine. Let’s steer your career to a more stable future with interactive and effective SCS-C03 Practice Exam Dumps.

Many of our customers are already excelling in their careers after achieving their goals with our help. You can too be a part of that specialized bunch with a little push in the right direction. Let us help you tread the heights of success.

Apply for the SCS-C03 Exam right away so you can get certified by using our Amazon Dumps.

Bulk Exams Package

Dumps4download Leads You To A 100% Success in First Attempt!

Our SCS-C03 Dumps PDF is intended to meet the requirements of the most suitable method for exam preparation. We especially hired a team of experts to make sure you get the latest and compliant SCS-C03 Practice Test Questions Answers. These questions are been selected according to the most relevance as well as the highest possibility of appearing in the exam. So, you can be sure of your success in the first attempt.

Interactive & Effective SCS-C03 Dumps PDF + Online Test Engine

Aside from our Amazon SCS-C03 Dumps PDF, we invest in your best practice through Online Test Engine. They are designed to reflect the actual exam format covering each topic of your exam. Also, with our interactive interface focusing on the exam preparation is easier than ever. With an easy-to-understand, interactive and effective study material assisting you there is nothing that could go wrong. We are 100% sure that our SCS-C03 Questions Answers Practice Exam is the best choice you can make to pass the exam with top score.

How Dumps4download Creates Better Opportunities for You!

Dumps4download knows how hard it is for you to beat this tough Amazon Exam terms and concepts. That is why to ease your preparation we offer the best possible training tactics we know best. Online Test Engine provides you an exam-like environment and PDF helps you take your study guide wherever you are. Best of all, you can download SCS-C03 Dumps PDF easily or better print it. For the purpose of getting concepts across as easily as possible, we have used simple language. Adding explanations at the end of the SCS-C03 Questions and Answers Practice Test we ensure nothing slips your grasp.

The exam stimulation is 100 times better than any other test material you would encounter. Besides, if you are troubled with anything concerning AWS Certified Security – Specialty Exam or the SCS-C03 Dumps PDF, our 24/7 active team is quick to respond. So, leave us a message and your problem will be solved in a few minutes.

Get an Absolutely Free Demo Today!

Dumps4download offers an absolutely free demo version to test the product with sample features before actually buying it. This shows our concern for your best experience. Once you are thoroughly satisfied with the demo you can get the AWS Certified Security – Specialty Practice Test Questions instantly.

24/7 Online Support – Anytime, Anywhere

Have a question? You can contact us anytime, anywhere. Our 24/7 Online Support makes sure you have absolutely no problem accessing or using AWS Certified Security – Specialty Practice Exam Dumps. What’s more, Dumps4download is mobile compatible so you can access the site without having to log in to your Laptop or PC.

Features to use Dumps4download SCS-C03 Dumps:

• Thousands of satisfied customers.
• Good grades are 100% guaranteed.
• 100% verified by Experts panel.
• Up to date exam data.
• Dumps4download data is 100% trustworthy.
• Passing ratio more than 99%
• 100% money back guarantee.

Amazon SCS-C03 Frequently Asked Questions

Amazon SCS-C03 Sample Questions

Question # 1

A company uses several AWS CloudFormation stacks to handle the deployment of a suiteof applications. The leader of the company's application development team notices that thestack deployments fail with permission errors when some team members try to deploy thestacks. However, other team members can deploy the stacks successfully.The team members access the account by assuming a role that has a specific set ofpermissions. All team members have permissions to perform operations on the stacks.Which combination of steps will ensure consistent deployment of the stacksMOSTsecurely? (Select THREE.)

A. Create a service role that has a composite principal that contains each service that needs the necessary permissions. 
B. Create a service role that has cloudformation.amazonaws.com as the service principal.
C. Add policies that reference each CloudFormation stack ARN.
D. Add policies that reference the ARNs of each AWS service that requires permissions.
E. Update each stack to use the service role.
F. Add a policy to each member role to allow the iam:PassRole action for the service role.

Show Answer

---

Question # 2

 security engineer is troubleshooting an AWS Lambda function that isnamedMyLambdaFunction. The function is encountering an error when the functionattempts to read the objects in an Amazon S3 bucket that is namedDOC-EXAMPLEBUCKET. The S3 bucket has the following bucket policy:{"Effect": "Allow","Principal": { "Service": "lambda.amazonaws.com" },"Action": "s3:GetObject","Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET","Condition": {"ArnLike": {"aws:SourceArn": "arn:aws:lambda:::function:MyLambdaFunction"}}}Which change should the security engineer make to the policy to ensure that the Lambdafunction can read the bucket objects?

A. Remove the Condition element. Change the Principal element to the following:{ "AWS":"arn:aws:lambda:::function:MyLambdaFunction" }
B. Change the Action element to the following:["s3:GetObject*", "s3:GetBucket*"]
C. Change the Resource element to"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*".
D. Change the Resource element to "arn:aws:lambda:::function:MyLambdaFunction".Change the Principal element to the following:{ "Service": "s3.amazonaws.com" }

Show Answer

---

Question # 3

A company is operating an open-source software platform that is internet facing. Thelegacy software platform no longer receives security updates. The software platformoperates using Amazon Route 53 weighted load balancing to send traffic to two AmazonEC2 instances that connect to an Amazon RDS cluster. A recent report suggests thissoftware platform is vulnerable to SQL injection attacks, with samples of attacks provided.The company’s security engineer must secure this system against SQL injection attackswithin 24 hours. The security engineer’s solution must involve the least amount of effortand maintain normal operations during implementation.What should the security engineer do to meet these requirements?

A. Create an Application Load Balancer with the existing EC2 instances as a target group.Create an AWS WAF web ACL containing rules that protect the application from this attack,then apply it to the ALB. Test to ensure the vulnerability has been mitigated, then redirectthe Route 53 records to point to the ALB. Update security groups on the EC2 instances toprevent direct access from the internet.
B. Create an Amazon CloudFront distribution specifying one EC2 instance as an origin.Create an AWS WAF web ACL containing rules that protect the application from this attack,then apply it to the distribution. Test to ensure the vulnerability has been mitigated, thenredirect the Route 53 records to point to CloudFront.
C. Obtain the latest source code for the platform and make the necessary updates. Testthe updated code to ensure that the vulnerability has been mitigated, then deploy thepatched version of the platform to the EC2 instances.
D. Update the security group that is attached to the EC2 instances, removing access fromthe internet to the TCP port used by the SQL database. Create an AWS WAF web ACLcontaining rules that protect the application from this attack, then apply it to the EC2instances. Test to ensure the vulnerability has been mitigated, then restore the securitygroup to the original setting.

Show Answer

---

Question # 4

A company has enabled AWS Config for its organization in AWS Organizations. Thecompany has deployed hundreds of Amazon S3 buckets across the organization. Asecurity engineer needs to identify any S3 buckets that are not encrypted with AWS KeyManagement Service (AWS KMS). The security engineer also must prevent objects thatare not encrypted with AWS KMS from being uploaded to the S3 buckets.Which solution will meet these requirements?

A. Use thes3-default-encryption-kmsAWS Config managed rule to identify unencrypted S3buckets. Create an SCP to allow thes3:PutObjectaction only when the object is encryptedwith AWS KMS.
B. Use thes3-default-encryption-kmsAWS Config managed rule to identify unencrypted S3buckets. Create bucket policies for each S3 bucket to deny thes3:PutObjectaction onlywhen the object has server-side encryption with S3 managed keys (SSE-S3).
C. Use thes3-bucket-ssl-requests-onlyAWS Config managed rule to identify unencryptedS3 buckets. Create an SCP to allow thes3:PutObjectaction only when the object isencrypted with AWS KMS
D. Use thes3-bucket-ssl-requests-onlyAWS Config managed rule to identify unencryptedS3 buckets. Create bucket policies for each S3 bucket to allow thes3:PutObjectaction onlywhen the object is encrypted with AWS KMS

Show Answer

---

Question # 5

A company needs to scan all AWS Lambda functions for code vulnerabilities.

A. Use Amazon Macie.
B. Enable Amazon Inspector Lambda scanning.
C. Use GuardDuty and Security Hub.
D. Use GuardDuty Lambda Protection.

Show Answer

---

Question # 6

A company runs a global ecommerce website that is hosted on AWS. The company usesAmazon CloudFront to serve content to its user base. The company wants to block inboundtraffic from a specific set of countries to comply with recent data regulation policies.Which solution will meet these requirements MOST cost-effectively?

A. Create an AWS WAF web ACL with an IP match condition to deny the countries' IPranges. Associate the web ACL with the CloudFront distribution.
B. Create an AWS WAF web ACL with a geo match condition to deny the specificcountries. Associate the web ACL with the CloudFront distribution.
C. Use the geo restriction feature in CloudFront to deny the specific countries.
D. Use geolocation headers in CloudFront to deny the specific countries.

Show Answer

---

Question # 7

A company’s security team needs to receive a notification whenever an AWS access keyhas not been rotated in 90 or more days. A security engineer must develop a solution thatprovides these notifications automatically.Which solution will meet these requirements with the LEAST amount of effort?

A. Deploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select theaccess-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days.Create an Amazon EventBridge rule with an event pattern that matches the compliancetype of NON_COMPLIANT from AWS Config for the managed rule. Configure EventBridgeto send an Amazon SNS notification to the security team.
B. Create a script to export a .csv file from the AWS Trusted Advisor check for IAM accesskey rotation. Load the script into an AWS Lambda function that will upload the .csv file toan Amazon S3 bucket. Create an Amazon Athena table query that runs when the .csv fileis uploaded to the S3 bucket. Publish the results for any keys older than 90 days by usingan invocation of an Amazon SNS notification to the security team.
C. Create a script to download the IAM credentials report on a periodic basis. Load thescript into an AWS Lambda function that will run on a schedule through AmazonEventBridge. Configure the Lambda script to load the report into memory and to filter thereport for records in which the key was last rotated at least 90 days ago. If any records aredetected, send an Amazon SNS notification to the security team
D. Create an AWS Lambda function that queries the IAM API to list all the users. Iteratethrough the users by using the ListAccessKeys operation. Verify that the value in theCreateDate field is not at least 90 days old. Send an SNS notification to the security team ifthe value is at least 90 days old. Create an EventBridge rule to schedule the Lambdafunction to run each day.

Show Answer

---

Question # 8

Service (Amazon EKS) clusters. The solution must require no additional configuration ofthe existing EKS deployment.Which solution will meet these requirements with the LEAST operational effort?

A. Install a third-party security add-on.
B. Enable AWS Security Hub and monitor Kubernetes findings.
C. Monitor CloudWatch Container Insights metrics for EKS.
D. Enable Amazon GuardDuty and use EKS Audit Log Monitoring.

Show Answer

---

Question # 9

A company needs to detect unauthenticated access to its Amazon Elastic KubernetesService (Amazon EKS) clusters. The solution must require no additional configuration ofthe existing EKS deployment.Which solution will meet these requirements with the LEAST operational effort?

A. Install a third-party security add-on.
B. Enable AWS Security Hub and monitor Kubernetes findings.
C. Monitor CloudWatch Container Insights metrics for EKS.
D. Enable Amazon GuardDuty and use EKS Audit Log Monitoring.

Show Answer

---

Question # 10

A company hosts a web application on an Apache web server. The application runs onAmazon EC2 instances that are in an Auto Scaling group. The company configured theEC2 instances to send the Apache web server logs to an Amazon CloudWatch Logs groupthat the company has configured to expire after 1 year.Recently, the company discovered in the Apache web server logs that a specific IP addressis sending suspicious requests to the web application. A security engineer wants to analyzethe past week of Apache web server logs to determine how many requests that the IPaddress sent and the corresponding URLs that the IP address requested.What should the security engineer do to meet these requirements with the LEAST effort?

A. Export the CloudWatch Logs group data to Amazon S3. Use Amazon Macie to query thelogs for the specific IP address and the requested URLs.
B. Configure a CloudWatch Logs subscription to stream the log group to an AmazonOpenSearch Service cluster. Use OpenSearch Service to analyze the logs for the specificIP address and the requested URLs
C. Use CloudWatch Logs Insights and a custom query syntax to analyze the CloudWatchlogs for the specific IP address and the requested URLs.
D. Export the CloudWatch Logs group data to Amazon S3. Use AWS Glue to crawl the S3bucket for only the log entries that contain the specific IP address. Use AWS Glue to viewthe results.

Show Answer

---

Question # 11

A company needs to build a code-signing solution using an AWS KMS asymmetric key andmust store immutable evidence of key creation and usage for compliance and auditpurposes.Which solution meets these requirements?

A. Create an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrailtrail with log file validation enabled for KMS events. Store logs in the bucket and grantauditors access.
B. Log application events to Amazon CloudWatch Logs and export them.
C. Capture KMS API calls using EventBridge and store them in DynamoDB.
D. Track KMS usage with CloudWatch metrics and dashboards.

Show Answer

---

Question # 12

A consultant agency needs to perform a security audit for a company's production AWSaccount. Several consultants need access to the account. The consultant agency alreadyhas its own AWS account. The company requires multi-factor authentication (MFA) for allaccess to its production account. The company also forbids the use of long-termcredentials.Which solution will provide the consultant agency with access that meets theserequirements?

A. Create an IAM group. Create an IAM user for each consultant. Add each user to thegroup. Turn on MFA for each consultant.
B. Configure Amazon Cognito on the company’s production account to authenticateagainst the consultant agency's identity provider (IdP). Add MFA to a Cognito user pool
C. Create an IAM role in the consultant agency's AWS account. Define a trust policy thatrequires MFA. In the trust policy, specify the company's production account as theprincipal. Attach the trust policy to the role
D. Create an IAM role in the company’s production account. Define a trust policy thatrequires MFA. In the trust policy, specify the consultant agency's AWS account as theprincipal. Attach the trust policy to the role.

Show Answer

---

Question # 13

A company uses an organization in AWS Organizations to manage multiple AWS accounts.The company uses AWS IAM Identity Center to manage access to the accounts. Thecompany uses AWS Directory Service as an identity source. Employees access the AWSconsole and specific AWS accounts and permissions through the AWS access portal.A security engineer creates a new permissions set in IAM Identity Center and assigns thepermissions set to one of the member accounts in the organization. The security engineerassigns the permissions set to a user group for developers namedDevOpsin the memberaccount. The security engineer expects all the developers to see the new permissions setlisted for the member account in the AWS access portal. All the developers except for onecan see the permissions set. The security engineer must ensure that the remainingdeveloper can see the permissions set in the AWS access portal.Which solution will meet this requirement?

A. Add the remaining developer to the DevOps group in Directory Service.
B. Remove and then re-add the permissions set in the member account.
C. Add the service-linked role for organization to the member account.
D. Update the permissions set to allow console access for the remaining developer.

Show Answer

---

Question # 14

A company has an AWS Lambda function that requires access to an Amazon S3 bucket.The company’s security policy requires that connections to Amazon S3 are over a privatenetwork and are secure.The company has configured a gateway VPC endpoint in the VPC to allow access toAmazon S3. The company has configured the Lambda function to run inside the VPC.Additionally, the company has configured the Lambda function to use a private subnet thathas a route to the internet through a NAT gateway. Other resources in the VPC use thisprivate subnet to access the internet successfully. When the Lambda function runs, it usesthe NAT gateway instead of the gateway VPC endpoint to access Amazon S3.What can a security engineer do to ensure that the Lambda function uses the gatewayVPC endpoint for Amazon S3?

A. Remove the route to the NAT gateway within the route table of the private subnet thatthe Lambda function uses.
B. Associate the gateway VPC endpoint with the route table of the private subnet that theLambda function uses.
C. Adjust the gateway VPC endpoint policy to allow access from the Lambda function’snetwork interface address.
D. Configure the Lambda function’s security group to allow connections to the S3 networkaddress space.

Show Answer

---

Question # 15

A security engineer received an Amazon GuardDuty alert indicating a finding involving theAmazon EC2 instance that hosts the company's primary website. The GuardDuty findingreceived read:UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The securityengineer confirmed that a malicious actor used API access keys intended for the EC2instance from a country where the company does not operate. The security engineer needsto deny access to the malicious actor.What is the first step the security engineer should take?

A. Open the EC2 console and remove any security groups that allow inbound traffic from0.0.0.0/0.
B. Install the AWS Systems Manager Agent on the EC2 instance and run an inventoryreport.
C. Install the Amazon Inspector agent on the host and run an assessment with the CVErules package
D. Open the IAM console and revoke all IAM sessions that are associated with the instanceprofile.

Show Answer

---

Question # 16

Notify when IAM roles are modified.

A. Use Amazon Detective.
B. Use EventBridge with CloudTrail events.
C. Use CloudWatch metric filters.
D. Use CloudWatch subscription filters.

Show Answer

---

Question # 17

A company runs several applications on Amazon Elastic Kubernetes Service (AmazonEKS). The company needs a solution to detect any Kubernetes security risks by monitoringAmazon EKS audit logs in addition to operating system, networking, and file events. Thesolution must send email alerts for any identified risks to a mailing list that is associatedwith a security team.Which solution will meet these requirements?

A. Deploy AWS Security Hub and enable security standards that contain EKS controls.Create an Amazon Simple Notification Service (Amazon SNS) topic and set the securityteam's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevantSecurity Hub events to the SNS topic.
B. Enable Amazon Inspector container image scanning. Configure Amazon Detective toanalyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Usean AWS Lambda function to process the logs and to send email alerts to the security team.
C. Enable Amazon GuardDuty. Enable EKS Protection and Runtime Monitoring forAmazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS)topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridgerule to send relevant GuardDuty events to the SNS topic.
D. Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. ConfigureAmazon CloudWatch Logs to collect EKS audit logs. Create an Amazon Simple NotificationService (Amazon SNS) topic and set the security team's mailing list as a subscriber.Configure a CloudWatch alarm to publish a message to the SNS topic when new audit logsare generated.

Show Answer

---

Question # 18

A company's security engineer receives an abuse notification from AWS. The notificationindicates that someone is hosting malware from the company's AWS account. Afterinvestigation, the security engineer finds a new Amazon S3 bucket that an IAM usercreated without authorization.Which combination of steps should the security engineer take toMINIMIZE theconsequencesof this compromise? (Select THREE.)

A. Encrypt all AWS CloudTrail logs.
B. Turn on Amazon GuardDuty.
C. Change the password for all IAM users.
D. Rotate or delete all AWS access keys.
E. Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
F. Delete any resources that are unrecognized or unauthorized.

Show Answer

---

Question # 19

An ecommerce website was down for 1 hour following a DDoS attack. Users were unableto connect to the website during the attack period. The ecommerce company's securityteam is worried about future potential attacks and wants to prepare for such events. Thecompany needs to minimize downtime in its response to similar attacks in the future.Which steps would help achieve this? (Select TWO.)

A. Enable Amazon GuardDuty to automatically monitor for malicious activity and blockunauthorized access.
B. Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of anattack.
C. Use VPC Flow Logs to monitor network traffic and an AWS Lambda function toautomatically block an attacker’s IP using security groups.
D. Set up an Amazon EventBridge rule to monitor the AWS CloudTrail events in real time,use AWS Config rules to audit the configuration, and use AWS Systems Manager forremediation.
E. Use AWS WAF to create rules to respond to such attacks.

Show Answer

---

Question # 20

A company has an organization in AWS Organizations. The company’s security team isdeveloping automation to capture Amazon EC2 forensic evidence within any AWS accountin the organization. The company has encrypted the Amazon EBS volumes of all the EC2instances in the organization by default by using the AWS managed key. The automationconsists of AWS Lambda functions and AWS Step Functions state machines.The automation assumes an IAM role in the target AWS account. The automation takessnapshots of suspicious EC2 instances and assigns permissions to allow the securityteam’s account to copy the snapshots. The security team has an AWS KMS key to encryptthe snapshots. During testing, the automation fails to copy the snapshots into the securityteam’s AWS account.Which combination of steps should the security team take so that the automation cancapture EC2 forensic evidence in all AWS accounts in the organization? (Select THREE.)

A. In the target AWS account, update the KMS key policy on the AWS managed key toexplicitly allow the kms:Decrypt and kms:CreateGrant actions to the automation’s IAM role.
B. In the target AWS account, create a customer managed KMS key. Update theautomation’s IAM role to allow the kms:Encrypt, kms:Decrypt, kms:GenerateDataKey*, andkms:CreateGrant actions.
C. In the security team’s AWS account, update the automation’s IAM role to allow thekms:Encrypt, kms:Decrypt, and kms:CreateGrant actions for the AWS managed key.
D. In the security team’s AWS account, update the automation’s IAM role to allow thekms:Encrypt, kms:Decrypt, kms:GenerateDataKey*, and kms:CreateGrant actions for thecustomer managed KMS key.
E. In the security team’s AWS account, update the automation code to take EBS snapshotsand to use the AWS managed key.
F. In the security team’s AWS account, update the automation code to take EBS snapshotsand to use the customer managed KMS key.

Show Answer

---

Question # 21

A company is storing data in Amazon S3 Glacier. A security engineer implemented a newvault lock policy for 10 TB of data and called the initiate-vault-lock operation 12 hours ago.The audit team identified a typo in the policy that is allowing unintended access to the vault.What is the MOST cost-effective way to correct this error?

A. Call the abort-vault-lock operation. Update the policy. Call the initiate-vault-lockoperation again.
B. Copy the vault data to a new S3 bucket. Delete the vault. Create a new vault with thedata.
C. Update the policy to keep the vault lock in place.
D. Update the policy. Call the initiate-vault-lock operation again to apply the new policy.

Show Answer

---

Question # 22

A company needs a solution to protect critical data from being permanently deleted. Thedata is stored in Amazon S3 buckets. The company needs to replicate the S3 objects fromthe company's primary AWS Region to a secondary Region to meet disaster recoveryrequirements. The company must also ensure that users who have administrator accesscannot permanently delete the data in the secondary Region.Which solution will meet these requirements?

A. Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault inthe secondary Region. Enable AWS Backup Vault Lock in governance mode for thebackups in the secondary Region.
B. Implement S3 Object Lock in compliance mode in the primary Region. Configure S3replication to replicate the objects to an S3 bucket in the secondary Region.
C. Configure S3 replication to replicate the objects to an S3 bucket in the secondaryRegion. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucketin the secondary Region.
D. Configure S3 replication to replicate the objects to an S3 bucket in the secondaryRegion. Configure S3 object versioning on the S3 bucket in the secondary Region.

Show Answer

---

Question # 23

A company needs to migrate several applications to AWS. This will require storing morethan 5,000 credentials. To meet compliance requirements, the company will use its existingpassword management system for key rotation, auditing, and integration with third-partysecrets containers. The company has a limited budget and is seeking the most costeffective solution that is still secure.How should the company accomplish this at the LOWEST cost?

A. Configure the company’s key management solution to integrate with AWS SystemsManager Parameter Store.
B. Configure the company’s key management solution to integrate with AWS SecretsManager.
C. Use an Amazon S3 encrypted bucket to store the secrets and configure the applicationswith the appropriate roles to access the secrets.
D. Configure the company’s key management solution to integrate with AWS CloudHSM.

Show Answer

---

Question # 24

A company runs several applications on Amazon Elastic Kubernetes Service (AmazonEKS). The company needs a solution to detect any Kubernetes security risks by monitoringAmazon EKS audit logs in addition to operating system, networking, and file events. Thesolution must send email alerts for any identified risks to a mailing list that is associatedwith a security team.Which solution will meet these requirements?

A. Deploy AWS Security Hub and enable security standards that contain EKS controls.Create an Amazon Simple Notification Service (Amazon SNS) topic and set the securityteam’s mailing list as a subscriber. Use an Amazon EventBridge rule to send relevantSecurity Hub events to the SNS topic
B. Enable Amazon Inspector container image scanning. Configure Amazon Detective toanalyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Usean AWS Lambda function to process the logs and to send email alerts to the security team.
C. Enable Amazon GuardDuty. Enable EKS Protection and Runtime Monitoring forAmazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS)topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridgerule to send relevant GuardDuty events to the SNS topic.
D. Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. ConfigureAmazon CloudWatch Logs to collect EKS audit logs. Create an Amazon Simple NotificationService (Amazon SNS) topic and set the security team's mailing list as a subscriber.Configure a CloudWatch alarm to publish a message to the SNS topic when new audit logsare generated

Show Answer

---

Question # 25

A company's security engineer receives an abuse notification from AWS indicating thatmalware is being hosted from the company’s AWS account. The security engineerdiscovers that an IAM user created a new Amazon S3 bucket without authorization.Which combination of steps should the security engineer take to MINIMIZE theconsequences of this compromise? (Select THREE.)

A. Encrypt all AWS CloudTrail logs.
B. Turn on Amazon GuardDuty.
C. Change the password for all IAM users.
D. Rotate or delete all AWS access keys.
E. Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
F. Delete any resources that are unrecognized or unauthorized.

Show Answer

---

Question # 26

A company is operating an open-source software platform that is internet facing. Thelegacy software platform no longer receives security updates. The software platformoperates using Amazon Route 53 weighted load balancing to send traffic to two AmazonEC2 instances that connect to an Amazon RDS cluster. A recent report suggests thissoftware platform is vulnerable to SQL injection attacks, with samples of attacks provided.The company's security engineer must secure this system against SQL injection attackswithin 24 hours. The solution must involve the least amount of effort and maintain normaloperations during implementation.What should the security engineer do to meet these requirements?

A. Create an Application Load Balancer with the existing EC2 instances as a target group.Create an AWS WAF web ACL containing rules that protect the application from this attack,then apply it to the ALB. Test to ensure the vulnerability has been mitigated, then redirectthe Route 53 records to point to the ALB. Update security groups on the EC2 instances toprevent direct access from the internet.
B. Create an Amazon CloudFront distribution specifying one EC2 instance as an origin.Create an AWS WAF web ACL containing rules that protect the application from this attack,then apply it to the distribution. Test to ensure the vulnerability has been mitigated, thenredirect the Route 53 records to point to CloudFront.
C. Obtain the latest source code for the platform and make the necessary updates. Testthe updated code to ensure that the vulnerability has been mitigated, then deploy thepatched version of the platform to the EC2 instances.
D. Update the security group that is attached to the EC2 instances, removing access fromthe internet to the TCP port used by the SQL database. Create an AWS WAF web ACLcontaining rules that protect the application from this attack, then apply it to the EC2instances.

Show Answer

---

Question # 27

A company is running a new workload across accounts in an organization in AWSOrganizations. All running resources must have a tag of CostCenter, and the tag must haveone of three approved values. The company must enforce this policy and must prevent anychanges of the CostCenter tag to a non-approved value.Which solution will meet these requirements?

A. Use AWS Config custom policy rule and an SCP to deny non-approvedaws:RequestTag/CostCenter values.
B. Use CloudTrail + EventBridge + Lambda to block creation.
C. Enable tag policies, define allowed values, enforce noncompliant operations, and use anSCP to deny creation when aws:RequestTag/CostCenter is null.
D. Enable tag policies and use EventBridge + Lambda to block changes.

Show Answer

---

Question # 28

A company sends Amazon RDS snapshots to two accounts as part of its disaster recovery(DR) plan. The snapshots must be encrypted. However, each account needs to be able todecrypt the snapshots in case of a DR event.Which solution will meet these requirements?

A. Use the default AWS Key Management Service (AWS KMS) key to generate thesnapshots. Create an AWS Lambda function that copies the KMS encryption key to the twoaccounts.
B. Use an AWS Key Management Service (AWS KMS) customer managed key to generatethe snapshots. Create an AWS Lambda function that imports the KMS key in the twoaccounts.
C. Use the default AWS Key Management Service (AWS KMS) key to generate thesnapshots. Share the KMS key with the two accounts by using an IAM principal that hasthe proper KMS permissions in each account.
D. Use an AWS Key Management Service (AWS KMS) customer managed key to generatethe snapshots. Share the KMS key with the two accounts by using an IAM principal thathas the proper KMS permissions in each account.

Show Answer

---

Testimonials