Note! Following SCS-C01 Exam is Retired now. Please select the alternative replacement for your Exam Certification. The new exam code is SCS-C02

SCS-C01 Exam Dumps - AWS Certified Security - Specialty

Go to page:

<< First
Prev
5
6
7
8
9
10
11
12
13
14
Next
Last >>

Question # 73

DDoS attacks that happen at the application layer commonly target web applications with lower volumes of traffic compared to infrastructure attacks. To mitigate these types of attacks, you should probably want to include a WAF (Web Application Firewall) as part of your infrastructure. To inspect all HTTP requests, WAFs sit in-line with your application traffic. Unfortunately, this creates a scenario where WAFs can become a point of failure or bottleneck. To mitigate this problem, you need the ability to run multiple WAFs on demand during traffic spikes. This type of scaling for WAF is done via a "WAF sandwich." Which of the following statements best describes what a "WAF sandwich" is? Choose the correct answer from the options below

Please select:

The EC2 instance running your WAF software is placed between your private subnets and any NATed connections to the internet.

The EC2 instance running your WAF software is placed between your public subnets and your Internet Gateway.

The EC2 instance running your WAF software is placed between your public subnets and your private subnets.

The EC2 instance running your WAF software is included in an Auto Scaling group and placed in between two Elastic load balancers.

Full Access

Question # 74

An application running on EC2 instances in a VPC must access sensitive data in the data center. The access must be encrypted in transit and have consistent low latency. Which hybrid architecture will meet these requirements?

Please select:

Expose the data with a public HTTPS endpoint.

A VPN between the VPC and the data center over a Direct Connect connection

A VPN between the VPC and the data center.

A Direct Connect connection between the VPC and data center

Full Access

Question # 75

You have been given a new brief from your supervisor for a client who needs a web application set up on IAM. The a most important requirement is that MySQL must be used as the database, and this database must not be hosted in tÂ« public cloud, but rather at the client's data center due to security risks. Which of the following solutions would be the ^ best to assure that the client's requirements are met? Choose the correct answer from the options below

Please select:

Build the application server on a public subnet and the database at the client's data center. Connect them with a VPN connection which uses IPsec.

Use the public subnet for the application server and use RDS with a storage gateway to access and synchronize the data securely from the local data center.

Build the application server on a public subnet and the database on a private subnet with a NAT instance between them.

Build the application server on a public subnet and build the database in a private subnet with a secure ssh connection to the private subnet from the client's data center.

Full Access

Question # 76

You are designing a connectivity solution between on-premises infrastructure and Amazon VPC. Your server's on-premises will be communicating with your VPC instances. You will be establishing IPSec tunnels over the internet. Yo will be using VPN gateways and terminating the IPsec tunnels on IAM-supported customer gateways. Which of the following objectives would you achieve by implementing an IPSec tunnel as outlined above? Choose 4 answers form the options below

Please select:

End-to-end protection of data in transit

End-to-end Identity authentication

Data encryption across the internet

Protection of data in transit over the Internet

Peer identity authentication between VPN gateway and customer gateway

Data integrity protection across the Internet

Full Access

Question # 77

You have a set of Keys defined using the IAM KMS service. You want to stop using a couple of keys , but are not sure of which services are currently using the keys. Which of the following would be a safe option to stop using the keys from further usage.

Please select:

Delete the keys since anyway there is a 7 day waiting period before deletion

Disable the keys

Set an alias for the key

Change the key material for the key

Full Access

Question # 78

An EC2 Instance hosts a Java based application that access a DynamoDB table. This EC2 Instance is currently serving production based users. Which of the following is a secure way of ensuring that the EC2 Instance access the Dynamo table

Please select:

Use IAM Roles with permissions to interact with DynamoDB and assign it to the EC2 Instance

Use KMS keys with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

Use IAM Access Keys with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

Use IAM Access Groups with the right permissions to interact with DynamoDB and assign it to the EC2 Instance

Full Access

Question # 79

An application is designed to run on an EC2 Instance. The applications needs to work with an S3 bucket. From a security perspective , what is the ideal way for the EC2 instance/ application to be configured?

Please select:

Use the IAM access keys ensuring that they are frequently rotated.

Assign an IAM user to the application that has specific access to only that S3 bucket

Assign an IAM Role and assign it to the EC2 Instance

Assign an IAM group and assign it to the EC2 Instance

Full Access

Question # 80

A company has hundreds of IAM accounts, and a centralized Amazon S3 bucket used to collect IAM CloudTrail for all of these accounts. A security engineer wants to create a solution that will enable the company to run ad hoc queues against its CloudTrail logs dating back 3 years from when the trails were first enabled in the companyâ€™s IAM account.

How should the company accomplish this with the least amount of administrative overhead?

Run an Amazon EMP cluster that uses a MapReduce job to be examine the CloudTrail trails.

Use the events history/feature of the CloudTrail console to query the CloudTrail trails.

Write an IAM Lambda function to query the CloudTrail trails Configure the Lambda function to be executed whenever a new file is created in the CloudTrail S3 bucket.

Create an Amazon Athena table that tools at the S3 bucket the CloudTrail trails are being written to Use Athena to run queries against the trails.

Full Access

Go to page: