AWS Certified Security - Specialty SCS-C03Demo

A company operates several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company requires a solution to identify Kubernetes security risks by monitoring Amazon EKS audit logs, as well as operating system, networking, and file events. The solution must send email alerts for any detected risks to a mailing list associated with a security team.

Which solution meets these requirements?

A company hosts an application on an Amazon EC2 instance. The application creates invoices and saves them in an Amazon S3 bucket. The instance profile attached to the instance has the required access to the S3 bucket.

The company must share every invoice with multiple clients who do not have AWS credentials. Each client must be able to download only that client’s own invoices. Clients must download invoices within 1 hour after invoice creation. Clients must use only temporary credentials to access the company’s AWS resources.

A security engineer creates a script that runs on the EC2 instance. The script uses the instance profile to create an S3 presigned URL for the clients. Each presigned URL expires after 1 hour.

Which additional step will satisfy these requirements?

A company operates critical workloads in an on-premises data center. The company wants to implement an AWS-based disaster recovery (DR) solution that achieves an RTO of less than 1 hour. The company must continuously replicate physical and virtual servers. It must optimize costs for data storage and bandwidth use. The DR solution must be automated.

Which solution meets these requirements?

A company uses AWS IAM Identity Center to control access to its AWS accounts. The accounts belong to an organization in AWS Organizations.

A security engineer must establish delegated administration of IAM Identity Center in the organization’s management account.

Which combination of steps should the security engineer complete in IAM Identity Center before setting up delegated administration?

A company has recently configured Amazon GuardDuty and is receiving a large number of findings from IP addresses inside the company. A security engineer has confirmed that these IP addresses are trusted and permitted.

Which combination of steps should the security engineer perform to configure GuardDuty so it does not generate findings for these IP addresses?

A company uses Amazon EC2 instances to host frontend services behind an Application Load Balancer. Amazon Elastic Block Store (Amazon EBS) volumes are attached to the EC2 instances. The company uses Amazon S3 buckets to store large image and music files.

The company has implemented an AWS security architecture to prevent, detect, and isolate potential ransomware attacks. The company now wants to reduce risk further.

A security engineer must develop a disaster recovery solution that can restore normal operations if an attacker bypasses the preventive and detective controls. The solution must meet an RPO of 1 hour.

Which solution will meet these requirements?

A company operates workloads in the us-east-1 Region. The company has never deployed resources in any other AWS Region and has no multi-Region resources. The company must replicate its workloads and infrastructure to the us-west-1 Region.

A security engineer must implement a solution that uses AWS Secrets Manager to store secrets in both Regions. The solution must use AWS Key Management Service (AWS KMS) to encrypt the secrets, minimize latency, and continue to work when only one Region is available.

The security engineer creates the secrets in us-east-1 by using Secrets Manager.

What should the security engineer do next to meet these requirements?

A company uses Amazon API Gateway to expose REST APIs to its users. An API developer needs to analyze API access patterns without having to parse log files.

Which combination of steps meets these requirements with the LEAST effort?

A company uses an AWS Organizations organization to manage multiple AWS accounts. Users access the AWS accounts by using IAM users and secret access keys. A security team requires that all account access use temporary security credentials that expire after 60 minutes. Users must use a SAML-based identity provider (IdP) to access the accounts.

Which solution meets these requirements?

A security engineer must prepare for a security audit of an AWS account.

Choose the AWS resource that meets each requirement. Each resource can be selected once or not at all.

A security team manages a company’s AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security team can administer the KMS keys. The company’s application team has a software process that occasionally requires temporary access to the keys. The security team must provide that software process with access to the keys.

Which solution meets these requirements with the LEAST operational overhead?

A corporate cloud-security policy states that communications between the company’s VPC and KMS must remain entirely within the AWS network and must not use public service endpoints.

Which combination of the following actions MOST fulfills this requirement?

A company discovers that one of its Amazon EC2 instances suddenly has high CPU utilization. The company does not know whether the EC2 instance has been compromised or whether the operating system is conducting background cleanup.

Which combination of steps should a security engineer take before investigating the issue?

A startup uses one AWS account with resources in one AWS Region. A security engineer configures an AWS CloudTrail trail in that same Region, using the AWS CLI, to deliver log files to an Amazon S3 bucket.

Because the company is expanding, it adds resources in multiple Regions. The security engineer finds that logs from the new Regions are not arriving in the S3 bucket.

What should the security engineer do to resolve this issue with the LEAST operational overhead?

A company in France uses Amazon Cognito with the Cognito Hosted UI as an identity broker for its sign-in and sign-up processes. The company is marketing an application and expects that every application user will be from France.

When the company launches the application, its security team notices fraudulent application sign-ups. Most fraudulent registrations originate from users outside France.

The security team requires a solution that performs custom validation at sign-up. Based on the validation results, the solution must allow or deny the registration request.

Which combination of steps meets these requirements?

A security engineer is designing security controls for a fleet of Amazon EC2 instances running sensitive workloads in a VPC. The engineer must implement a solution that detects and mitigates software vulnerabilities on the EC2 instances.

Which solution meets this requirement?

A company is developing a web application that must authenticate external users across multiple microservices hosted on Amazon Elastic Container Service (Amazon ECS). The solution must use temporary credentials and minimize the administrative overhead of maintaining user databases.

Select and arrange the correct steps from the list to implement a secure authentication strategy that satisfies these requirements. Select each step once or not at all.

A company uses AWS Config rules to find Amazon S3 buckets that do not comply with the company’s data protection policy. The S3 buckets are hosted across several AWS Regions and several AWS accounts. The accounts belong to an organization in AWS Organizations.

The company requires a solution that remediates the organization’s existing noncompliant S3 buckets and any noncompliant S3 buckets created in the future.

Which solution meets these requirements?

A company uses an AWS Organizations organization to manage multiple AWS accounts. The company wants to centrally provide users with access to Amazon Q Developer.

Which solution meets this requirement?

A company uses two AWS accounts: Account A and Account B. Each account contains a VPC. An application running in the VPC in Account A must write to an Amazon S3 bucket in Account B. The application in Account A already has permission to write to the S3 bucket in Account B.

The application and the S3 bucket are located in the same AWS Region. The company must not send network traffic across the public internet.

Which solution satisfies these requirements?

A security engineer needs to assess configuration changes to a particular AWS resource to confirm that the resource complies with standards. However, the security engineer is worried about cases where several configuration changes occur on the resource in rapid succession. The security engineer wants to record only that resource’s most recent configuration to show the cumulative effect of the changes.

Which solution meets this requirement in the MOST operationally efficient manner?

A company has engaged a third party to audit multiple AWS accounts. Cross-account IAM roles have been created in every account being audited to support the audit. The auditor is experiencing difficulty accessing some accounts.

Which of the following could be causing this issue?

A company is investigating a rise in its monthly AWS bill. The company determines that malicious actors compromised several Amazon EC2 instances and used them to host webpages for a large email-phishing campaign.

A security engineer must implement a solution that monitors future cost increases to help identify malicious activity.

Which solution will provide the company with the EARLIEST detection of cost increases?

A company operates an internet-facing open-source software platform. The legacy platform no longer receives security updates. It uses Amazon Route 53 weighted load balancing to route traffic to two Amazon EC2 instances that connect to an Amazon RDS cluster. A recent report indicates that the platform is vulnerable to SQL injection attacks and includes attack samples. The company’s security engineer must secure the system against SQL injection attacks within 24 hours. The solution must require the least effort and maintain normal operations throughout implementation.

What should the security engineer do to satisfy these requirements?