AWS Certified Security-Specialty Exam dumps PDF

QUESTION: 65 Exam Topic: 1 Exam Pool A

A company needs its Amazon Elastic Block Store (Amazon EBS) volumes to be encrypted at all times. During a security incident. EBS snapshots of suspicious instances are shared to a forensics account for analysis A security engineer attempting to share a suspicious EBS snapshot to the forensics account receives the following error

"Unable to share snapshot: An error occurred (OperationNotPermitted) when calling the ModifySnapshotAttribute operation: Encrypted snapshots with EBS default key cannot be shared.

Which combination of steps should the security engineer take in the incident account to complete the sharing operation? (Select THREE )

Create a customer managed CMK Copy the EBS snapshot encrypting the destination snapshot using the new CMK.
Allow forensics accounting principals to use the CMK by modifying its policy.
Create an Amazon EC2 instance. Attach the encrypted and suspicious EBS volume. Copy data from the suspicious volume to an unencrypted volume. Snapshot the unencrypted volume
Copy the EBS snapshot to the new decrypted snapshot
Restore a volume from the suspicious EBS snapshot. Create an unencrypted EBS volume of the same size.
Share the target EBS snapshot with the forensics account.

Answer(s): A,B,F

Reveal Solution Next Question

QUESTION: 66 Exam Topic: 1 Exam Pool A

A convoys data lake uses Amazon S3 and Amazon Athena. The company's security engineer has been asked to design an encryption solution that meets the company's data protection requirements. The encryption solution must work with Amazon S3 and keys managed by the company. The encryption solution must be protected in a hardware security module that is validated id Federal information Processing Standards (FPS) 140-2 Level 3.

Which solution meets these requirements?

Use client-side encryption with an IAM KMS customer-managed key implemented with the IAM Encryption SDK
Use IAM CloudHSM to store the keys and perform cryptographic operations Save the encrypted text in Amazon S3
Use an IAM KMS customer-managed key that is backed by a custom key store using IAM CloudHSM
Use an IAM KMS customer-managed key with the bring your own key (BYOK) feature to import a key stored in IAM CloudHSM

Answer(s): B

Reveal Solution Next Question

QUESTION: 67 Exam Topic: 1 Exam Pool A

A company's information security team want to do near-real-time anomaly detection on Amazon EC2 performance and usage statistics. Log aggregation is the responsibility of a security engineer. To do the study, the Engineer needs gather logs from all of the company's IAM accounts in a single place.

How should the Security Engineer go about doing this?

Log in to each account four times a day and filter the IAM CloudTrail log data, then copy and paste the logs in to the Amazon S3 bucket in the destination account.
Set up Amazon CloudWatch to stream data to an Amazon S3 bucket in each source account. Set up bucket replication for each source account into a centralized bucket owned by the Security Engineer.
Set up an IAM Config aggregator to collect IAM configuration data from multiple sources.
Set up Amazon CloudWatch cross-account log data sharing with subscriptions in each account. Send the logs to Amazon Kinesis Data Firehose in the Security Engineer's account.

Answer(s): D

Explanation:

Read the prerequisites in the question carefully. The solution must support "near real time" analysis of the log data. Cloudwatch doesn't stream logs to S3; it supports exporting them to S3 with an up to 12 hour expected delay:

https://docs.IAM.amazon.com/AmazonCloudWatch/latest/logs/S3Export.html

"Log data can take up to 12 hours to become available for export. For near real-time analysis of log data, see Analyzing log data with CloudWatch Logs Insights or Real-time processing of log data with subscriptions instead."
https://docs.IAM.amazon.com/AmazonCloudWatch/latest/logs/Subscriptions.html

"You can use subscriptions to get access to a real-time feed of log events from CloudWatch Logs and have it delivered to other services such as an Amazon Kinesis stream, an Amazon Kinesis Data Firehose stream, or IAM Lambda for custom processing, analysis, or loading to other systems. When log events are sent to the receiving service, they are Base64 encoded and compressed with the gzip format." https://docs.IAM.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions.
html

Reveal Solution Next Question

QUESTION: 68 Exam Topic: 1 Exam Pool A

A company has a VPC with several Amazon EC2 instances behind a NAT gateway. The company's security policy states that all network traffic must be logged and must include the original source and destination IP addresses. The existing VPC Flow Logs do not include this information. A security engineer needs to recommend a solution.

Which combination of steps should the security engineer recommend? (Select TWO )

Edit the existing VPC Flow Logs. Change the log format of the VPC Flow Logs from the Amazon default format to a custom format.
Delete and recreate the existing VPC Flow Logs. Change the log format of the VPC Flow Logs from the Amazon default format to a custom format.
Change the destination to Amazon CloudWatch Logs.
Include the pkt-srcaddr and pkt-dstaddr fields in the log format.
Include the subnet-id and instance-id fields in the log format.

Answer(s): A,E

Reveal Solution Next Question

QUESTION: 69 Exam Topic: 1 Exam Pool A

A company requires that SSH commands used to access its IAM instance be traceable to the user who executed each command.

How should a Security Engineer accomplish this?

Allow inbound access on port 22 at the security group attached to the instance Use IAM

Systems Manager Session Manager for shell access to Amazon EC2 instances with the user tag defined Enable Amazon CloudWatch togging tor Systems Manager sessions
Use Amazon S3 to securely store one Privacy Enhanced Mail Certificate (PEM file) for each user Allow Amazon EC2 to read from Amazon S3 and import every user that wants to use SSH to access EC2 instances Allow inbound access on port 22 at the security group attached to the instance Install the Amazon CloudWatch agent on the EC2 instance and configure it to ingest audit logs for the instance
Deny inbound access on port 22 at the security group attached to the instance Use IAM Systems Manager Session Manager tor shell access to Amazon EC2 instances with the user tag defined Enable Amazon CloudWatch togging for Systems Manager sessions
Use Amazon S3 to securely store one Privacy Enhanced Mall Certificate (PEM fie) for each team or group Allow Amazon EC2 to read from Amazon S3 and import every user that wants to use SSH to access EC2 instances Allow inbound access on pod 22 at the security group attached to the instance Install the Amazon CloudWatch agent on the EC2 instance and configure it to ingest audit logs for the instance

Answer(s): C

Reveal Solution Next Question

QUESTION: 70 Exam Topic: 1 Exam Pool A

A Security Engineer has been asked to troubleshoot inbound connectivity to a web server. This single web server is not receiving inbound connections from the internet, whereas all other web servers are functioning properly.

The architecture includes network ACLs, security groups, and a virtual security appliance. In addition, the Development team has implemented Application Load Balancers (ALBs) to distribute the load across all web servers. It is a requirement that traffic between the web servers and the internet flow through the virtual security appliance.

The Security Engineer has verified the following:

1. The rule set in the Security Groups is correct

2. The rule set in the network ACLs is correct

3. The rule set in the virtual appliance is correct

Which of the following are other valid items to troubleshoot in this scenario? (Choose two.)

Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to a NAT gateway.
Verify which Security Group is applied to the particular web server's elastic networkinterface (ENI).
Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to the virtual security appliance.
Verify the registered targets in the ALB.
Verify that the 0.0.0.0/0 route in the public subnet points to a NAT gateway.

Answer(s): C,D

Reference:

https://docs.IAM.amazon.com/IAMEC2/latest/UserGuide/using-eni.html

Reveal Solution Next Question

QUESTION: 71 Exam Topic: 1 Exam Pool A

While securing the connection between a company's VPC and its on-premises data center, a Security Engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). The ping command did not return a response. The flow log in the VPC showed the following:

2 123456789010 eni-1235b8ca 203.0.113.12 172.31.16.139 0 0 1 4 336 1432917027 1432917142 ACCEPT OK

2 123456789010 eni-1235b8ca 172.31.16.139 203.0.113.12 0 0 1 4 336 1432917094 1432917142 REJECT OK

What action should be performed to allow the ping to work?

In the security group of the EC2 instance, allow inbound ICMP traffic.
In the security group of the EC2 instance, allow outbound ICMP traffic.
In the VPC's NACL, allow inbound ICMP traffic.
In the VPC's NACL, allow outbound ICMP traffic.

Answer(s): D

Reveal Solution Next Question

QUESTION: 72 Exam Topic: 1 Exam Pool A

A large government organization is moving to the cloud and has specific encryption requirements. The first workload to move requires that a customer's data be immediately destroyed when the customer makes that request.

Management has asked the security team to provide a solution that will securely store the data, allow only authorized applications to perform encryption and decryption and allow for immediate destruction of the data

Which solution will meet these requirements?

Use IAM Secrets Manager and an IAM SDK to create a unique secret for the customer- specific data
Use IAM Key Management Service (IAM KMS) and the IAM Encryption SDK to generate and store a data encryption key for each customer.
Use IAM Key Management Service (IAM KMS) with service-managed keys to generate and store customer-specific data encryption keys
Use IAM Key Management Service (IAM KMS) and create an IAM CloudHSM custom key store Use CloudHSM to generate and store a new CMK for each customer.

Answer(s): A

Reveal Solution Next Question

Amazon AWS Certified Security-Specialty Exam (page: 9) Amazon AWS Certified Security - Specialty (SCS-C01) Updated on: 24-Mar-2026

QUESTION: 65 Exam Topic: 1 Exam Pool A

QUESTION: 66 Exam Topic: 1 Exam Pool A

QUESTION: 67 Exam Topic: 1 Exam Pool A

Explanation:

QUESTION: 68 Exam Topic: 1 Exam Pool A

QUESTION: 69 Exam Topic: 1 Exam Pool A

QUESTION: 70 Exam Topic: 1 Exam Pool A

Reference:

QUESTION: 71 Exam Topic: 1 Exam Pool A

QUESTION: 72 Exam Topic: 1 Exam Pool A

Amazon AWS Certified Security-Specialty Exam (page: 9)
Amazon AWS Certified Security - Specialty (SCS-C01)
Updated on: 24-Mar-2026