File Info
| Exam | AWS Certified Security - Specialty |
| Number | SCS-C02 |
| File Name | Amazon.SCS-C02.VCEplus.2024-01-16.45q.tqb |
| Size | 441 KB |
| Posted | Jan 16, 2024 |
| Download | Amazon.SCS-C02.VCEplus.2024-01-16.45q.tqb |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
A company wants to monitor the deletion of customer managed CMKs A security engineer must create an alarm that will notify the company before a CMK is deleted The security engineer has configured the integration of IAM CloudTrail with Amazon CloudWatch
What should the security engineer do next to meet this requirement?
- Use inbound rule 100 to allow traffic on TCP port 443 Use inbound rule 200 to deny traffic on TCP port 3306 Use outbound rule 100 to allow traffic on TCP port 443
- Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port 443
- Use inbound rule 100 to allow traffic on TCP port range 1024-65535 Use inbound rule 200 to deny traffic on TCP port 3306 Use outbound rule 100 to allow traffic on TCP port 443
- Use inbound rule 100 to deny traffic on TCP port 3306 Use inbound rule 200 to allow traffic on TCP port 443 Use outbound rule 100 to allow traffic on TCP port 443
Correct answer: A
Question 2
A company is hosting a static website on Amazon S3 The company has configured an Amazon CloudFront distribution to serve the website contents The company has associated an IAM WAF web ACL with the CloudFront distribution. The web ACL ensures that requests originate from the United States to address compliance restrictions.
THE company is worried that the S3 URL might still be accessible directly and that requests can bypass the CloudFront distribution
Which combination of steps should the company take to remove direct access to the S3 URL? (Select TWO. )
- Select 'Restrict Bucket Access' in the origin settings of the CloudFront distribution
- Create an origin access identity (OAI) for the S3 origin
- Update the S3 bucket policy to allow s3 GetObject with a condition that the IAM Referer key matches the secret value Deny all other requests
- Configure the S3 bucket poky so that only the origin access identity (OAI) has read permission for objects in the bucket
- Add an origin custom header that has the name Referer to the CloudFront distribution Give the header a secret value.
Correct answer: AD
Question 3
A company's security team is building a solution for logging and visualization. The solution will assist the company with the large variety and velocity of data that it receives from IAM across multiple accounts. The security team has enabled IAM CloudTrail and VPC Flow Logs in all of its accounts. In addition, the company has an organization in IAM Organizations and has an IAM Security Hub master account.
The security team wants to use Amazon Detective However the security team cannot enable Detective and is unsure why
What must the security team do to enable Detective?
- Enable Amazon Macie so that Secunty H jb will allow Detective to process findings from Macie.
- Disable IAM Key Management Service (IAM KMS) encryption on CtoudTrail logs in every member account of the organization
- Enable Amazon GuardDuty on all member accounts Try to enable Detective in 48 hours
- Ensure that the principal that launches Detective has the organizations ListAccounts permission
Correct answer: D
