Amazon
Avaya
Cisco
CompTIA
CrowdStrike
EC-Council
EXIN
Fortinet
Google
ISC
ISC2
ITIL
Juniper
Microsoft
NVIDIA
Okta
Palo Alto Networks
Salesforce
SAP
ServiceNow
All Vendors

Amazon AWS Certified Security - Specialty (Replaced with SCS-C03) SCS-C02 Dumps in PDF

Free Amazon SCS-C02 Real Questions (page: 8)

SCS-C02 PDF — 308 Questions

A company discovers a billing anomaly in its AWS account. A security consultant investigates the anomaly and discovers that an employee who left the company 30 days ago still has access to the account. The company has not monitored account activity in the past.
The security consultant needs to determine which resources have been deployed or reconfigured by the employee as quickly as possible.
Which solution will meet these requirements?

  1. In AWS Cost Explorer, filter chart data to display results from the past 30 days. Export the results to a data table. Group the data table by resource.
  2. Use AWS Cost Anomaly Detection to create a cost monitor. Access the detection history. Set the time frame to Last 30 days. In the search area, choose the service category.
  3. In AWS CloudTrail, filter the event history to display results from the past 30 days. Create an Amazon Athena table that contains the data. Partition the table by event source.
  4. Use AWS Audit Manager to create an assessment for the past 30 days. Apply a usage-based framework to the assessment. Configure the assessment to assess by resource.

Answer(s): C



A security engineer is checking an AWS CloudFormation template for vulnerabilities. The security engineer finds a parameter that has a default value that exposes an application's API key in plaintext. The parameter is referenced several times throughout the template. The security engineer must replace the parameter while maintaining the ability to reference the value in the template.
Which solution will meet these requirements in the MOST secure way?

  1. Store the API key value as a SecureString parameter in AWS Systems Manager Parameter Store. In the template, replace all references to the value with {{resolve:ssm:MySSMParameterName:1}}.
  2. Store the API key value in AWS Secrets Manager. In the template, replace all references to the value with {{resolve:secretsmanager:MySecretId:SecretString}}.
  3. Store the API key value in Amazon DynamoDB. In the template, replace all references to the value with {{resolve:dynamodb:MyTableName:MyPrimaryKey}}.
  4. Store the API key value in a new Amazon S3 bucket. In the template, replace all references to the value with {{resolve:s3:MyBucketName:MyObjectName}}.

Answer(s): B



A company's AWS CloudTrail logs are all centrally stored in an Amazon S3 bucket. The security team controls the company's AWS account. The security team must prevent unauthorized access and tampering of the CloudTrail logs.
Which combination of steps should the security team take? (Choose three.)

  1. Configure server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
  2. Compress log files with secure gzip.
  3. Create an Amazon EventBridge rule to notify the security team of any modifications on CloudTrail log files.
  4. Implement least privilege access to the S3 bucket by configuring a bucket policy.
  5. Configure CloudTrail log file integrity validation.
  6. Configure Access Analyzer for S3.

Answer(s): A,D,E



A company has several petabytes of data. The company must preserve this data for 7 years to comply with regulatory requirements. The company's compliance team asks a security officer to develop a strategy that will prevent anyone from changing or deleting the data.
Which solution will meet this requirement MOST cost-effectively?

  1. Create an Amazon S3 bucket. Configure the bucket to use S3 Object Lock in compliance mode. Upload the data to the bucket. Create a resource-based bucket policy that meets all the regulatory requirements.
  2. Create an Amazon S3 bucket. Configure the bucket to use S3 Object Lock in governance mode. Upload the data to the bucket. Create a user-based IAM policy that meets all the regulatory requirements.
  3. Create a vault in Amazon S3 Glacier. Create a Vault Lock policy in S3 Glacier that meets all the regulatory requirements. Upload the data to the vault.
  4. Create an Amazon S3 bucket. Upload the data to the bucket. Use a lifecycle rule to transition the data to a vault in S3 Glacier. Create a Vault Lock policy that meets all the regulatory requirements.

Answer(s): C



A-company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certificate, users saw the following message when trying to log in:
Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken)
A security engineer needs to provide a solution that corrects the error and minimizes operational overhead.
Which solution meets these requirements?

  1. Upload the third-party signing certificate’s new private key to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS Management Console.
  2. Sign the identity provider's metadata file with the new public key. Upload the signature to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
  3. Download the updated SAML metadata file from the identity service provider. Update the file in the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
  4. Configure the AWS identity provider entity defined in AWS Identity and Access Management (IAM) to synchronously fetch the new public key by using the AWS Management Console.

Answer(s): C



A company has several workloads running on AWS. Employees are required to authenticate using on-premises ADFS and SSO to access the AWS Management Console. Developers migrated an existing legacy web application to an Amazon EC2 instance. Employees need to access this application from anywhere on the internet, but currently, there is no authentication system built into the application.
How should the security engineer implement employee-only access to this system without changing the application?

  1. Place the application behind an Application Load Balancer (ALB). Use Amazon Cognito as authentication for the ALB. Define a SAML-based Amazon Cognito user pool and connect it to ADFS.
  2. Implement AWS IAM Identity Center (AWS Single Sign-On) in the management account and link it to ADFS as an identity provider. Define the EC2 instance as a managed resource, then apply an IAM policy on the resource.
  3. Define an Amazon Cognito identity pool, then install the connector on the Active Directory server. Use the Amazon Cognito SDK on the application instance to authenticate the employees using their Active Directory user names and passwords.
  4. Create an AWS Lambda custom authorizer as the authenticator for a reverse proxy on Amazon EC2. Ensure the security group on Amazon EC2 only allows access from the Lambda function.

Answer(s): A



A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are deployed in a private subnet of a VPC that does not have internet access. The EC2 instances and the S3 buckets are in the same AWS account.
The EC2 instances access the S3 buckets through an S3 gateway endpoint that has the default access policy. Each EC2 instance is associated with an instance profile role that has a policy that explicitly allows the s3:GetObject action and the s3:PutObject action for only the required S3 buckets.
The company learns that one or more of the EC2 instances are compromised and are exfiltrating data to an S3 bucket that is outside the company's organization in AWS Organizations. A security engineer must implement a solution to stop this exfiltration of data and to keep the EC2 processing job functional.
Which solution will meet these requirements?

  1. Update the policy on the S3 gateway endpoint to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company's values.
  2. Update the policy on the instance profile role to allow the S3 actions only if the value of the aws:ResourceOrgID condition key matches the company's value.
  3. Add a network ACL rule to the subnet of the EC2 instances to block outgoing connections on port 443.
  4. Apply an SCP on the AWS account to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company's values.

Answer(s): D



A company that operates in a hybrid cloud environment must meet strict compliance requirements. The company wants to create a report that includes evidence from on-premises workloads alongside evidence from AWS resources. A security engineer must implement a solution to collect, review, and manage the evidence to demonstrate compliance with company policy.
Which solution will meet these requirements?

  1. Create an assessment in AWS Audit Manager from a prebuilt framework or a custom framework. Upload manual evidence from the on-premises workloads. Add the evidence to the assessment. Generate an assessment report after Audit Manager collects the necessary evidence from the AWS resources.
  2. Install the Amazon CloudWatch agent on the on-premises workloads. Use AWS Config to deploy a conformance pack from a sample conformance pack template or a custom YAML template. Generate an assessment report after AWS Config identifies noncompliant workloads and resources.
  3. Set up the appropriate security standard in AWS Security Hub. Upload manual evidence from the on-premises workloads. Wait for Security Hub to collect the evidence from the AWS resources. Download the list of controls as a .csv file.
  4. Install the Amazon CloudWatch agent on the on-premises workloads. Create a CloudWatch dashboard to monitor the on-premises workloads and the AWS resources. Run a query on the workloads and resources. Download the results.

Answer(s): A



PDF
Viewing page 8 of 39

Share your comments for Amazon SCS-C02 exam with other users:

N
Norris
1/3/2023 8:06:00 PM

i passed my exam thanks to this braindumps questions. these questions are valid in us and i highly recommend it!

UNITED STATES
A
abuti
7/21/2023 6:10:00 PM

are they truely latest

Anonymous
C
Curtis Nakawaki
7/5/2023 8:46:00 PM

questions appear contemporary.

UNITED STATES
V
Vv
12/2/2023 6:31:00 AM

good to prepare in this site

UNITED STATES
P
praveenkumar
11/20/2023 11:57:00 AM

very helpful to crack first attempt

Anonymous
A
asad Raza
5/15/2023 5:38:00 AM

please upload this exam

CHINA
R
Reeta
7/17/2023 5:22:00 PM

please upload the c_activate22 dump questions with answer

SWEDEN
W
Wong
12/20/2023 11:34:00 AM

q10 - the answer should be a. if its c, the criteria will meet if either the prospect is not part of the suppression lists or if the job title contains vice president

MALAYSIA
D
david
12/12/2023 12:38:00 PM

this was on the exam as of 1211/2023

Anonymous
T
Tink
7/24/2023 9:23:00 AM

great for prep

GERMANY
J
Jaro
12/18/2023 3:12:00 PM

i think in question 7 the first answer should be power bi portal (not power bi)

Anonymous
9
9eagles
4/7/2023 10:04:00 AM

on question 10 and so far 2 wrong answers as evident in the included reference link.

Anonymous
T
Tai
8/28/2023 5:28:00 AM

wonderful material

SOUTH AFRICA
V
VoiceofMidnight
12/29/2023 4:48:00 PM

i passed!! ...but barely! got 728, but needed 720 to pass. the exam hit me with labs right out of the gate! then it went to multiple choice. protip: study the labs!

UNITED STATES
A
A K
8/3/2023 11:56:00 AM

correct answer for question 92 is c -aws shield

Anonymous
N
Nitin Mindhe
11/27/2023 6:12:00 AM

great !! it is really good

IRELAND
B
BailleyOne
11/22/2023 1:45:00 AM

explanations for the answers are to the point.

Anonymous
P
patel
10/25/2023 8:17:00 AM

how can rea next

INDIA
M
MortonG
10/19/2023 6:32:00 PM

question: 128 d is the wrong answer...should be c

EUROPEAN UNION
J
Jayant
11/2/2023 3:15:00 AM

thanks for az 700 dumps

Anonymous
B
Bipul Mishra
12/14/2023 7:12:00 AM

thank you for this tableau dumps . it will helpfull for tableau certification

UNITED STATES
H
hello
10/31/2023 12:07:00 PM

good content

Anonymous
M
Matheus
9/3/2023 2:14:00 PM

just testing if the comments are real

UNITED STATES
Y
yenvti2@gmail.com
8/12/2023 7:56:00 PM

very helpful for exam preparation

Anonymous
M
Miguel
10/5/2023 12:16:00 PM

question 11: https://help.salesforce.com/s/articleview?id=sf.admin_lead_to_patient_setup_overview.htm&type=5

SPAIN
N
Noushin
11/28/2023 4:52:00 PM

i think the answer to question 42 is b not c

CANADA
S
susan sandivore
8/28/2023 1:00:00 AM

thanks for the dump

Anonymous
A
Aderonke
10/31/2023 12:51:00 AM

fantastic assessments

Anonymous
P
Priscila
7/22/2022 9:59:00 AM

i find the xengine test engine simulator to be more fun than reading from pdf.

GERMANY
S
suresh
12/16/2023 10:54:00 PM

nice document

Anonymous
W
Wali
6/4/2023 10:07:00 PM

thank you for making the questions and answers intractive and selectable.

UNITED STATES
N
Nawaz
7/18/2023 1:10:00 AM

answers are correct?

UNITED STATES
D
das
6/23/2023 7:57:00 AM

can i belive this dump

INDIA
S
Sanjay
10/15/2023 1:34:00 PM

great site to practice for sitecore exam

INDIA
AI Tutor 👋 I’m here to help!