SCS-C01 Exam Questions and Answers | Exam-Dumps (Page: 13)

QUESTION: 61 Exam Topic: 1 Exam Pool A

Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic.

Which of the following troubleshooting steps should be performed?

Check inbound and outbound security groups, looking for DENY rules.
Check inbound and outbound Network ACL rules, looking for DENY rules.
Review the rejected packet reason codes in the VPC Flow Logs.
Use IAM X-Ray to trace the end-to-end application flow

Answer(s): C

Reveal Solution Next Question

QUESTION: 62 Exam Topic: 1 Exam Pool A

A security engineer has created an Amazon Cognito user pool. The engineer needs to manually verify the ID and access token sent by the application for troubleshooting purposes

What is the MOST secure way to accomplish this?

Extract the subject (sub), audience (aud), and cognito:username from the ID token payload Manually check the subject and audience for the user name In the user pool
Search for the public key with a key ID that matches the key ID In the header of the token. Then use a JSON Web Token (JWT) library to validate the signature of the token and extract values, such as the expiry date
Verify that the token is not expired. Then use the token_use claim function In Amazon Cognito to validate the key IDs
Copy the JSON Web Token (JWT) as a JSON document Obtain the public JSON Web Key (JWK) and convert It to a pem file. Then use the file to validate the original JWT.

Answer(s): A

Reveal Solution Next Question

QUESTION: 63 Exam Topic: 1 Exam Pool A

The Development team receives an error message each time the team members attempt to encrypt or decrypt a Secure String parameter from the SSM Parameter Store by using an IAM KMS customer managed key (CMK).

Which CMK-related issues could be responsible? (Choose two.)

The CMK specified in the application does not exist.
The CMK specified in the application is currently in use.
The CMK specified in the application is using the CMK KeyID instead of CMK Amazon Resource Name.
The CMK specified in the application is not enabled.
The CMK specified in the application is using an alias.

Answer(s): A,D

Reference:

https://docs.amazonIAM.cn/en_us/kms/latest/developerguide/services- parameter-store.html

Reveal Solution Next Question

QUESTION: 64 Exam Topic: 1 Exam Pool A

A company is using IAM Organizations to manage multiple IAM member accounts. All of these accounts have Amazon GuardDuty enabled in all Regions. The company's IAM Security Operations Center has a centralized security account for logging and monitoring. One of the member accounts has received an excessively high bill A security engineer discovers that a compromised Amazon EC2 instance is being used to mine crypto currency. The Security Operations Center did not receive a GuardDuty finding in the central security account.but there was a GuardDuty finding in the account containing the compromised EC2 instance. The security engineer needs to ensure an GuardDuty finding are available in the security account.

What should the security engineer do to resolve this issue?

Set up an Amazon CloudWatch Event rule to forward ail GuardDuty findings to the security account Use an IAM Lambda function as a target to raise findings
Set up an Amazon CloudWatch Events rule to forward all GuardDuty findings to the security account Use an IAM Lambda function as a target to raise findings in IAM Security Hub
Check that GuardDuty in the security account is able to assume a role in the compromised account using the GuardDuty fast findings permission Schedule an Amazon CloudWatch Events rule and an IAM Lambda function to periodically check for GuardDuty findings
Use the IAM GuardDuty get-members IAM CLI command m the security account to see if the account is listed Send an invitation from GuardDuty m the security account to GuardDuty in the compromised account Accept the invitation to forward all future GuardDuty findings

Answer(s): D

Reveal Solution Next Question

QUESTION: 65 Exam Topic: 1 Exam Pool A

A company needs its Amazon Elastic Block Store (Amazon EBS) volumes to be encrypted at all times. During a security incident. EBS snapshots of suspicious instances are shared to a forensics account for analysis A security engineer attempting to share a suspicious EBS snapshot to the forensics account receives the following error

"Unable to share snapshot: An error occurred (OperationNotPermitted) when calling the ModifySnapshotAttribute operation: Encrypted snapshots with EBS default key cannot be shared.

Which combination of steps should the security engineer take in the incident account to complete the sharing operation? (Select THREE )

Create a customer managed CMK Copy the EBS snapshot encrypting the destination snapshot using the new CMK.
Allow forensics accounting principals to use the CMK by modifying its policy.
Create an Amazon EC2 instance. Attach the encrypted and suspicious EBS volume. Copy data from the suspicious volume to an unencrypted volume. Snapshot the unencrypted volume
Copy the EBS snapshot to the new decrypted snapshot
Restore a volume from the suspicious EBS snapshot. Create an unencrypted EBS volume of the same size.
Share the target EBS snapshot with the forensics account.

Answer(s): A,B,F

Reveal Solution Next Question

Amazon SCS-C01 Exam (page: 13) Amazon AWS Certified Security - Specialty (SCS-C01) Updated on: 25-Dec-2025

QUESTION: 61 Exam Topic: 1 Exam Pool A

QUESTION: 62 Exam Topic: 1 Exam Pool A

QUESTION: 63 Exam Topic: 1 Exam Pool A

Reference:

QUESTION: 64 Exam Topic: 1 Exam Pool A

QUESTION: 65 Exam Topic: 1 Exam Pool A

Amazon SCS-C01 Exam (page: 13)
Amazon AWS Certified Security - Specialty (SCS-C01)
Updated on: 25-Dec-2025