AWS Certified Security-Specialty Exam Questions and Answers (Page: 2)

QUESTION: 9 Exam Topic: 1 Exam Pool A

A company is outsourcing its operational support 1o an external company. The company's security officer must implement an access solution fen delegating operational support that minimizes overhead.

Which approach should the security officer take to meet these requirements?

implement Amazon Cognito identity pools with a role that uses a policy that denies the actions related to Amazon Cognito API management Allow the external company to federate through its identity provider
Federate IAM identity and Access Management (IAM) with the external company's identity provider Create an IAM role and attach a policy with the necessary permissions
Create an IAM group for me external company Add a policy to the group that denies IAM modifications Securely provide the credentials to the eternal company.
Use IAM SSO with the external company's identity provider. Create an IAM group to map to the identity provider user group, and attach a policy with the necessary permissions.

Answer(s): B

Reveal Solution Next Question

QUESTION: 10 Exam Topic: 1 Exam Pool A

A Security Engineer accidentally deleted the imported key material in an IAM KMS CMK. What should the Security Engineer do to restore the deleted key material?

Create a new CMK. Download a new wrapping key and a new import token to import the original key material
Create a new CMK Use the original wrapping key and import token to import the original key material.
Download a new wrapping key and a new import token Import the original key material into the existing CMK.
Use the original wrapping key and import token Import the original key material into the existing CMK

Answer(s): C

Reveal Solution Next Question

QUESTION: 11 Exam Topic: 1 Exam Pool A

A company has decided to use encryption in its IAM account to secure the objects in Amazon S3 using server-side encryption. Object sizes range from 16.000 B to 5 MB. The requirements are as follows:

· The key material must be generated and stored in a certified Federal Information Processing Standard (FIPS) 140-2 Level 3 machine.

· The key material must be available in multiple Regions.

Which option meets these requirements?

Use an IAM KMS customer managed key and store the key material in IAM with replication across Regions
Use an IAM customer managed key, import the key material into IAM KMS using in- house IAM CloudHSM. and store the key material securely in Amazon S3.
Use an IAM KMS custom key store backed by IAM CloudHSM clusters, and copy backups across Regions
Use IAM CloudHSM to generate the key material and backup keys across Regions Use the Java Cryptography Extension (JCE) and Public Key Cryptography Standards #11 (PKCS #11) encryption libraries to encrypt and decrypt the data.

Answer(s): D

Reveal Solution Next Question

QUESTION: 12 Exam Topic: 1 Exam Pool A

A company's Security Officer is concerned about the risk of IAM account root user logins and has assigned a Security Engineer to implement a notification solution for near-real-time alerts upon account root user logins.

How should the Security Engineer meet these requirements?

Create a cron job that runs a script lo download the IAM IAM security credentials We. parse the file for account root user logins and email the Security team's distribution 1st
Run IAM CloudTrail logs through Amazon CloudWatch Events to detect account roo4 user logins and trigger an IAM Lambda function to send an Amazon SNS notification to the Security team's distribution list.
Save IAM CloudTrail logs to an Amazon S3 bucket in the Security team's account Process the CloudTrail logs with the Security Engineer's logging solution for account root user logins Send an Amazon SNS notification to the Security team upon encountering the account root user login events
Save VPC Plow Logs to an Amazon S3 bucket in the Security team's account and process the VPC Flow Logs with their logging solutions for account root user logins Send an Amazon SNS notification to the Security team upon encountering the account root user login events

Answer(s): B

Reveal Solution Next Question

QUESTION: 13 Exam Topic: 1 Exam Pool A

A company has a serverless application for internal users deployed on IAM. The application uses IAM Lambda for the front end and for business logic. The Lambda function accesses an Amazon RDS database inside a VPC The company uses IAM Systems Manager Parameter Store for storing database credentials. A recent security review highlighted the following issues

The Lambda function has internet access.
The relational database is publicly accessible.
The database credentials are not stored in an encrypted state.

Which combination of steps should the company take to resolve these security issues? (Select THREE)

Disable public access to the RDS database inside the VPC
Move all the Lambda functions inside the VPC.
Edit the IAM role used by Lambda to restrict internet access.
Create a VPC endpoint for Systems Manager. Store the credentials as a string parameter. Change the parameter type to an advanced parameter.
Edit the IAM role used by RDS to restrict internet access.
Create a VPC endpoint for Systems Manager. Store the credentials as a SecureString parameter.

Answer(s): A,B,E

Reveal Solution Next Question

QUESTION: 14 Exam Topic: 1 Exam Pool A

After a recent security audit involving Amazon S3, a company has asked assistance reviewing its S3 buckets to determine whether data is properly secured. The first S3 bucket on the list has the following bucket policy.

Is this bucket policy sufficient to ensure that the data is not publicity accessible?

Yes, the bucket policy makes the whole bucket publicly accessible despite now the S3 bucket ACL or object ACLs are configured.
Yes, none of the data in the bucket is publicity accessible, regardless of how the S3 bucket ACL and object ACLs are configured.
No, the IAM user policy would need to be examined first to determine whether any data is publicly accessible.
No, the S3 bucket ACL and object ACLs need to be examined first to determine whether any data is publicly accessible.

Answer(s): A

Reveal Solution Next Question

QUESTION: 15 Exam Topic: 1 Exam Pool A

A company wants to encrypt data locally while meeting regulatory requirements related to key exhaustion. The encryption key can be no more than 10 days old or encrypt more than 2" 16 objects Any encryption key must be generated on a FlPS-validated hardware security module (HSM). The company is cost-conscious, as plans to upload an average of 100 objects to Amazon S3 each second for sustained operations across 5 data producers

When approach MOST efficiently meets the company's needs?

Use the IAM Encryption SDK and set the maximum age to 10 days and the minimum number of messages encrypted to 3" 16. Use IAM Key Management Service (IAM KMS) to generate the master key and data key Use data key caching with the Encryption SDk during the encryption process.
Use IAM Key Management Service (IAM KMS) to generate an IAM managed CMK. Then use Amazon S3 client-side encryption configured to automatically rotate with every object
Use IAM CloudHSM to generate the master key and data keys. Then use Boto 3 and Python to locally encrypt data before uploading the object Rotate the data key every 10 days or after 2" 16 objects have been Uploaded to Amazon 33
Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) and set the master key to automatically rotate.

Answer(s): A

Reveal Solution Next Question

QUESTION: 16 Exam Topic: 1 Exam Pool A

A Web Administrator for the website example.com has created an Amazon CloudFront distribution for dev.example.com, with a requirement to configure HTTPS using a custom TLS certificate imported to IAM Certificate Manager.

Which combination of steps is required to ensure availability of the certificate in the CloudFront console? (Choose two.)

Call UploadServerCertificate with /cloudfront/dev/ in the path parameter.
Import the certificate with a 4, 096-bit RSA public key.
Ensure that the certificate, private key, and certificate chain are PKCS #12-encoded.
Import the certificate in the us-east-1 (N. Virginia) Region.
Ensure that the certificate, private key, and certificate chain are PEM-encoded.

Answer(s): D,E

Reveal Solution Next Question

Amazon AWS Certified Security-Specialty Exam (page: 2) Amazon AWS Certified Security - Specialty (SCS-C01) Updated on: 09-Feb-2026

QUESTION: 9 Exam Topic: 1 Exam Pool A

QUESTION: 10 Exam Topic: 1 Exam Pool A

QUESTION: 11 Exam Topic: 1 Exam Pool A

QUESTION: 12 Exam Topic: 1 Exam Pool A

QUESTION: 13 Exam Topic: 1 Exam Pool A

QUESTION: 14 Exam Topic: 1 Exam Pool A

QUESTION: 15 Exam Topic: 1 Exam Pool A

QUESTION: 16 Exam Topic: 1 Exam Pool A

Amazon AWS Certified Security-Specialty Exam (page: 2)
Amazon AWS Certified Security - Specialty (SCS-C01)
Updated on: 09-Feb-2026