AWS Certified Security-Specialty Exam dumps PDF

QUESTION: 73 Exam Topic: 1 Exam Pool A

An IAM account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication:

After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the IAM CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication?

Change the value of IAM MultiFactorAuthPresent to true.
Instruct users to run the IAM sts get-session-token CLI command and pass the multi- factor authentication --serial-number and --token-code parameters. Use these resulting values to make API/CLI calls
Implement federated API/CLI access using SAML 2.0, then configure the identityprovider to enforce multi-factor authentication.
Create a role and enforce multi-factor authentication in the role trust policy Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.

Answer(s): B

Reveal Solution Next Question

QUESTION: 74 Exam Topic: 1 Exam Pool A

Users report intermittent availability of a web application hosted on IAM. Monitoring systems report an excess of abnormal network traffic followed by high CPU utilization on the application web tier. Which of the following techniques will improve the availability of the application? (Select TWO.)

Deploy IAM WAF to block all unsecured web applications from accessing the internet.
Deploy an Intrusion Detection/Prevention System (IDS/IPS) to monitor or block unusual incoming network traffic.
Configure security groups to allow outgoing network traffic only from hosts that are protected with up-to-date antivirus software.
Create Amazon CloudFront distribution and configure IAM WAF rules to protect the web applications from malicious traffic.
Use the default Amazon VPC for externakfacing systems to allow IAM to actively block malicious network traffic affecting Amazon EC2 instances.

Answer(s): B,D

Reveal Solution Next Question

QUESTION: 75 Exam Topic: 1 Exam Pool A

A security engineer is asked to update an AW3 CoudTrail log file prefix for an existing trail. When attempting to save the change in the CloudTrail console, the security engineer receives the following error message. "There is a problem with the bucket policy''

What will enable the security engineer to saw the change?

Create a new trail with the updated log file prefix, and then delete the original nail Update the existing bucket policy in the Amazon S3 console with the new log the prefix, and then update the log file prefix in the CloudTrail console
Update the existing bucket policy in the Amazon S3 console to allow the security engineers principal to perform PutBucketPolicy. and then update the log file prefix in the CloudTrail console
Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail console.
Update the existing bucket policy in the Amazon S3 console to allow the security engineers principal to perform GetBucketPolicy, and then update the log file prefix in the CloudTrail console

Answer(s): C

Reference:

https://docs.IAM.amazon.com/IAMcloudtrail/latest/userguide/create-s3- bucket-policy-for-cloudtrail.html#cloudtrail-add-change-or-remove-a-bucket-prefix

Reveal Solution Next Question

QUESTION: 76 Exam Topic: 1 Exam Pool A

An application is currently secured using network access control lists and security groups. Web servers are located in public subnets behind an Application Load Balancer (ALB); application servers are located in private subnets.

How can edge security be enhanced to safeguard the Amazon EC2 instances against attack? (Choose two.)

Configure the application's EC2 instances to use NAT gateways for all inbound traffic.
Move the web servers to private subnets without public IP addresses.
Configure IAM WAF to provide DDoS attack protection for the ALB.
Require all inbound network traffic to route through a bastion host in the private subnet.
Require all inbound and outbound network traffic to route through an IAM Direct Connect connection.

Answer(s): B,C

Reveal Solution Next Question

QUESTION: 77 Exam Topic: 1 Exam Pool A

A company's development team is designing an application using IAM Lambda and Amazon Elastic Container Service (Amazon ECS). The development team needs to create IAM roles to support these systems. The company's security team wants to allow the developers to build IAM roles directly, but the security team wants to retain control over the permissions the developers can delegate to those roles. The development team needs access to more permissions than those required for the application's IAM services. The solution must minimize management overhead.

How should the security team prevent privilege escalation for both teams?

Enable IAM CloudTrail. Create a Lambda function that monitors the event history for privilege escalation events and notifies the security team.
Create a managed IAM policy for the permissions required. Reference the IAM policy as a permissions boundary within the development team's IAM role.
Enable IAM Organizations Create an SCP that allows the IAM CreateUser action but that has a condition that prevents API calls other than those required by the development team
Create an IAM policy with a deny on the IAMCreateUser action and assign the policy to the development team. Use a ticket system to allow the developers to request new IAM roles for their applications. The IAM roles will then be created by the security team.

Answer(s): A

Reveal Solution Next Question

QUESTION: 78 Exam Topic: 1 Exam Pool A

A financial institution has the following security requirements:

Cloud-based users must be contained in a separate authentication domain. Cloud-based users cannot access on-premises systems.

As part of standing up a cloud environment, the financial institution is creating a number of Amazon managed databases and Amazon EC2 instances. An Active Directory service exists on-premises that has all the administrator accounts, and these must be able to access the databases and instances.

How would the organization manage its resources in the MOST secure manner? (Choose two.)

Configure an IAM Managed Microsoft AD to manage the cloud resources.
Configure an additional on-premises Active Directory service to manage the cloud resources.
Establish a one-way trust relationship from the existing Active Directory to the new Active Directory service.
Establish a one-way trust relationship from the new Active Directory to the existing Active Directory service.
Establish a two-way trust between the new and existing Active Directory services.

Answer(s): A,D

Explanation:

Deploy a new forest/domain on IAM with one-way trust. If you are planning on leveraging credentials from an on-premises AD on IAM member servers, you must establish at least a one-way trust to the Active Directory running on IAM. In this model, the IAM domain becomes the resource domain where computer objects are located and on-premises domain becomes the account domain.

Reference:

https://d1.IAMstatic.com/whitepapers/adds-on- IAM.pdf
https://docs.IAM.amazon.com/directoryservice/latest/admin- guide/directory_microsoft_ad.html

Reveal Solution Next Question

QUESTION: 79 Exam Topic: 1 Exam Pool A

A Security Engineer has launched multiple Amazon EC2 instances from a private AMI using an IAM CloudFormation template. The Engineer notices instances terminating right after they are launched.

What could be causing these terminations?

The IAM user launching those instances is missing ec2:Runinstances permission.
The AMI used as encrypted and the IAM does not have the required IAM KMS permissions.
The instance profile used with the EC2 instances in unable to query instance metadata.
IAM currently does not have sufficient capacity in the Region.

Answer(s): B

Reference:

https://docs.IAM.amazon.com/IAMEC2/latest/UserGuide/troubleshooting- launch.html

Reveal Solution Next Question

QUESTION: 80 Exam Topic: 1 Exam Pool A

A company uses Microsoft Active Directory for access management for on-premises resources and wants to use the same mechanism for accessing its IAM accounts. Additionally, the development team plans to launch a public-facing application for which they need a separate authentication solution.

When coma nation of the following would satisfy these requirements? (Select TWO)

Set up domain controllers on Amazon EC2 to extend the on-premises directory to IAM
Establish network connectivity between on-premises and the user's VPC
Use Amazon Cognito user pools for application authentication
Use AD Connector tor application authentication.
Set up federated sign-in to IAM through ADFS and SAML.

Answer(s): C,D

Reveal Solution Next Question

Amazon AWS Certified Security-Specialty Exam (page: 10) Amazon AWS Certified Security - Specialty (SCS-C01) Updated on: 24-Mar-2026

QUESTION: 73 Exam Topic: 1 Exam Pool A

QUESTION: 74 Exam Topic: 1 Exam Pool A

QUESTION: 75 Exam Topic: 1 Exam Pool A

Reference:

QUESTION: 76 Exam Topic: 1 Exam Pool A

QUESTION: 77 Exam Topic: 1 Exam Pool A

QUESTION: 78 Exam Topic: 1 Exam Pool A

Explanation:

Reference:

QUESTION: 79 Exam Topic: 1 Exam Pool A

Reference:

QUESTION: 80 Exam Topic: 1 Exam Pool A

Amazon AWS Certified Security-Specialty Exam (page: 10)
Amazon AWS Certified Security - Specialty (SCS-C01)
Updated on: 24-Mar-2026