Note! Following SCS-C01 Exam is Retired now. Please select the alternative replacement for your Exam Certification. The new exam code is SCS-C02

SCS-C01 Exam Dumps - AWS Certified Security - Specialty

Go to page:

<< First
Prev
2
3
4
5
6
7
8
9
10
11
Next
Last >>

Question # 49

A company has hired a third-party security auditor, and the auditor needs read-only access to all IAM resources and logs of all VPC records and events that have occurred on IAM. How can the company meet the auditor's requirements without comprising security in the IAM environment? Choose the correct answer from the options below

Please select:

Create a role that has the required permissions for the auditor.

Create an SNS notification that sends the CloudTrail log files to the auditor's email when CIoudTrail delivers the logs to S3, but do not allow the auditor access to the IAM environment.

The company should contact IAM as part of the shared responsibility model, and IAM will grant required access to th^ third-party auditor.

Enable CloudTrail logging and create an IAM user who has read-only permissions to the required IAM resources, including the bucket containing the CloudTrail logs.

Full Access

Question # 50

Every application in a company's portfolio has a separate IAM account for development and production. The security team wants to prevent the root user and all IAM users in the production accounts from accessing a specific set of unneeded services. How can they control this functionality?

Please select:

Create a Service Control Policy that denies access to the services. Assemble all production accounts in an organizational unit. Apply the policy to that organizational unit.

Create a Service Control Policy that denies access to the services. Apply the policy to the root account.

Create an IAM policy that denies access to the services. Associate the policy with an IAM group and enlist all users and the root users in this group.

Create an IAM policy that denies access to the services. Create a Config Rule that checks that all users have the policy m assigned. Trigger a Lambda function that adds the policy when found missing.

Full Access

Question # 51

An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that one particular group of IAM users should only access the test instances and not the production ones. How can the organization set that as a part of the policy?

Please select:

Launch the test and production instances in separate regions and allow region wise access to the group

Define the IAM policy which allows access based on the instance ID

Create an IAM policy with a condition which allows access to only small instances

Define the tags on the test and production servers and add a condition to the IAM policy which allows access to specification tags

Full Access

Question # 52

Your company has a set of EBS volumes defined in IAM. The security mandate is that all EBS volumes are encrypted. What can be done to notify the IT admin staff if there are any unencrypted volumes in the account.

Please select:

Use IAM Inspector to inspect all the EBS volumes

Use IAM Config to check for unencrypted EBS volumes

Use IAM Guard duty to check for the unencrypted EBS volumes

Use IAM Lambda to check for the unencrypted EBS volumes

Full Access

Question # 53

Your company is hosting a set of EC2 Instances in IAM. They want to have the ability to detect if any port scans occur on their IAM EC2 Instances. Which of the following can help in this regard?

Please select:

Use IAM inspector to consciously inspect the instances for port scans

Use IAM Trusted Advisor to notify of any malicious port scans

Use IAM Config to notify of any malicious port scans

Use IAM Guard Duty to monitor any malicious port scans

Full Access

Question # 54

Your IT Security team has identified a number of vulnerabilities across critical EC2 Instances in the company's IAM Account. Which would be the easiest way to ensure these vulnerabilities are remediated?

Please select:

Create IAM Lambda functions to download the updates and patch the servers.

Use IAM CLI commands to download the updates and patch the servers.

Use IAM inspector to patch the servers

Use IAM Systems Manager to patch the servers

Full Access

Question # 55

A company is planning on using IAM EC2 and IAM Cloudfrontfor their web application. For which one of the below attacks is usage of Cloudfront most suited for?

Please select:

Cross side scripting

SQL injection

DDoS attacks

Malware attacks

Full Access