AWS Certified Security-Specialty Exam dumps PDF

QUESTION: 57 Exam Topic: 1 Exam Pool A

A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots.

After performing a gap analysis of its disaster recovery procedures and backup strategies, the company is concerned that, next time, it will not be able to recover the EC2 instances if the IAM account was compromised and Amazon EBS snapshots were deleted.

All EBS snapshots are encrypted using an IAM KMS CMK.

Which solution would solve this problem?

Create a new Amazon S3 bucket Use EBS lifecycle policies to move EBS snapshots to the new S3 bucket. Move snapshots to Amazon S3 Glacier using lifecycle policies, and apply Glacier Vault Lock policies to prevent deletion
Use IAM Systems Manager to distribute a configuration that performs local backups of all attached disks to Amazon S3.
Create a new IAM account with limited privileges. Allow the new account to access the IAM KMS key used to encrypt the EBS snapshots, and copy the encrypted snapshots to the new account on a recuning basis
Use IAM Backup to copy EBS snapshots to Amazon S3.

Answer(s): A

Reveal Solution Next Question

QUESTION: 58 Exam Topic: 1 Exam Pool A

A city is implementing an election results reporting website that will use Amazon GoudFront The website runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. Election results are updated hourly and are stored as .pdf tiles in an Amazon S3 bucket. A Security Engineer needs to ensure that all external access to the website goes through CloudFront.

Which solution meets these requirements?

Create an IAM role that allows CloudFront to access the specific S3 bucket. Modify the S3 bucket policy to allow only the new IAM role to access its contents. Create an interface VPC endpoint for CloudFront to securely communicate with the ALB.
Create an IAM role that allows CloudFront to access the specific S3 bucket. Modify the S3 bucket policy to allow only the new IAM role to access its contents. Associate the ALB with a security group that allows only incoming traffic from the CloudFront service to communicate with the AL
Create an origin access identity (OAI) in CloudFront. Modify the S3 bucket policy to allow only the new OAI to access the bucket contents. Create an interface VPC endpoint for CloudFront to securely communicate with the ALB.
Create an origin access identity (OAI) in CloudFront. Modify the S3 bucket policy to allow only the new OAI to access the bucket contents. Associate the ALB with a security group that allows only incoming traffic from the CloudFront service to communicate with the ALB.

Answer(s): C

Reveal Solution Next Question

QUESTION: 59 Exam Topic: 1 Exam Pool A

A company has an IAM account and allows a third-party contractor who uses another IAM account, to assume certain IAM roles. The company wants to ensure that IAM roles can be assumed by the contractor only if the contractor has multi-factor authentication enabled on their IAM user accounts

What should the company do to accomplish this?

A)

B)

C)

D)

Option A
Option B
Option C
Option D

Answer(s): A

Reveal Solution Next Question

QUESTION: 60 Exam Topic: 1 Exam Pool A

A Security Engineer is setting up a new IAM account. The Engineer has been asked to continuously monitor the company's IAM account using automated compliance checks based on IAM best practices and Center for Internet Security (CIS) IAM Foundations Benchmarks

How can the Security Engineer accomplish this using IAM services?

Enable IAM Config and set it to record all resources in all Regions and global resources. Then enable IAM Security Hub and confirm that the CIS IAM Foundations compliance standard is enabled
Enable Amazon Inspector and configure it to scan all Regions for the CIS IAM Foundations Benchmarks. Then enable IAM Security Hub and configure it to ingest the Amazon Inspector findings
Enable Amazon Inspector and configure it to scan all Regions for the CIS IAM Foundations Benchmarks. Then enable IAM Shield in all Regions to protect the account from DDoS attacks.
Enable IAM Config and set it to record all resources in all Regions and global resources Then enable Amazon Inspector and configure it to enforce CIS IAM Foundations Benchmarks using IAM Config rules.

Answer(s): A

Reference:

https://docs.IAM.amazon.com/securityhub/latest/userguide/securityhub- standards-cis-config-resources.html

Reveal Solution Next Question

QUESTION: 61 Exam Topic: 1 Exam Pool A

Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic.

Which of the following troubleshooting steps should be performed?

Check inbound and outbound security groups, looking for DENY rules.
Check inbound and outbound Network ACL rules, looking for DENY rules.
Review the rejected packet reason codes in the VPC Flow Logs.
Use IAM X-Ray to trace the end-to-end application flow

Answer(s): C

Reveal Solution Next Question

QUESTION: 62 Exam Topic: 1 Exam Pool A

A security engineer has created an Amazon Cognito user pool. The engineer needs to manually verify the ID and access token sent by the application for troubleshooting purposes

What is the MOST secure way to accomplish this?

Extract the subject (sub), audience (aud), and cognito:username from the ID token payload Manually check the subject and audience for the user name In the user pool
Search for the public key with a key ID that matches the key ID In the header of the token. Then use a JSON Web Token (JWT) library to validate the signature of the token and extract values, such as the expiry date
Verify that the token is not expired. Then use the token_use claim function In Amazon Cognito to validate the key IDs
Copy the JSON Web Token (JWT) as a JSON document Obtain the public JSON Web Key (JWK) and convert It to a pem file. Then use the file to validate the original JWT.

Answer(s): A

Reveal Solution Next Question

QUESTION: 63 Exam Topic: 1 Exam Pool A

The Development team receives an error message each time the team members attempt to encrypt or decrypt a Secure String parameter from the SSM Parameter Store by using an IAM KMS customer managed key (CMK).

Which CMK-related issues could be responsible? (Choose two.)

The CMK specified in the application does not exist.
The CMK specified in the application is currently in use.
The CMK specified in the application is using the CMK KeyID instead of CMK Amazon Resource Name.
The CMK specified in the application is not enabled.
The CMK specified in the application is using an alias.

Answer(s): A,D

Reference:

https://docs.amazonIAM.cn/en_us/kms/latest/developerguide/services- parameter-store.html

Reveal Solution Next Question

QUESTION: 64 Exam Topic: 1 Exam Pool A

A company is using IAM Organizations to manage multiple IAM member accounts. All of these accounts have Amazon GuardDuty enabled in all Regions. The company's IAM Security Operations Center has a centralized security account for logging and monitoring. One of the member accounts has received an excessively high bill A security engineer discovers that a compromised Amazon EC2 instance is being used to mine crypto currency. The Security Operations Center did not receive a GuardDuty finding in the central security account.but there was a GuardDuty finding in the account containing the compromised EC2 instance. The security engineer needs to ensure an GuardDuty finding are available in the security account.

What should the security engineer do to resolve this issue?

Set up an Amazon CloudWatch Event rule to forward ail GuardDuty findings to the security account Use an IAM Lambda function as a target to raise findings
Set up an Amazon CloudWatch Events rule to forward all GuardDuty findings to the security account Use an IAM Lambda function as a target to raise findings in IAM Security Hub
Check that GuardDuty in the security account is able to assume a role in the compromised account using the GuardDuty fast findings permission Schedule an Amazon CloudWatch Events rule and an IAM Lambda function to periodically check for GuardDuty findings
Use the IAM GuardDuty get-members IAM CLI command m the security account to see if the account is listed Send an invitation from GuardDuty m the security account to GuardDuty in the compromised account Accept the invitation to forward all future GuardDuty findings

Answer(s): D

Reveal Solution Next Question

Amazon AWS Certified Security-Specialty Exam (page: 8) Amazon AWS Certified Security - Specialty (SCS-C01) Updated on: 24-Mar-2026

QUESTION: 57 Exam Topic: 1 Exam Pool A

QUESTION: 58 Exam Topic: 1 Exam Pool A

QUESTION: 59 Exam Topic: 1 Exam Pool A

QUESTION: 60 Exam Topic: 1 Exam Pool A

Reference:

QUESTION: 61 Exam Topic: 1 Exam Pool A

QUESTION: 62 Exam Topic: 1 Exam Pool A

QUESTION: 63 Exam Topic: 1 Exam Pool A

Reference:

QUESTION: 64 Exam Topic: 1 Exam Pool A

Amazon AWS Certified Security-Specialty Exam (page: 8)
Amazon AWS Certified Security - Specialty (SCS-C01)
Updated on: 24-Mar-2026