SCS-C01 sample questions

Question 1

A Security Administrator has a website hosted in Amazon S3. The Administrator has been given the following requirements:

. Users may access the website by using an Amazon CloudFront distribution.
. Users may not access the website directly by using an Amazon S3 URL.

Which configurations will support these requirements? (Choose two.)

Accepted Answer

Associate an origin access identity with the CloudFront distribution

Accepted Answer

Modify the S3 bucket permissions so that only the origin access identity can access the bucket contents.

Answer

Implement a “Principal”: “cloudfront.amazonaws.com” condition in the S3 bucket policy.

Answer

Implement security groups so that the S3 bucket can be accessed only by using the intended CloudFront distribution.

Answer

Configure the S3 bucket policy so that it is accessible only through VPC endpoints, and place the CloudFront distribution into the specified VPC

Question 2

A company has a forensic logging use case whereby several hundred applications running on Docker on EC2 need to send logs to a central location. The Security Engineer must create a logging solution that is able to perform real-time analytics on the log files, grants the ability to replay events, and persists data.

Which AWS Services, together, can satisfy this use case? (Choose two.)

Accepted Answer

Amazon Kines

Accepted Answer

Amazon Cloud Watch

Answer

Amazon Elasticsear

Answer

Amazon SQS

Answer

Amazon Athena

Question 3

A Security Engineer is implementing a solution to allow users to seamlessly encrypt Amazon S3 objects without having to touch the keys directly. The solution must be highly scalable without requiring continual management. Additionally, the organization must be able to immediately delete the encryption keys.

Which solution meets these requirements?

Accepted Answer

Use KMS with AWS imported key material and then use the DeletelmportedKeyMaterial API to remove the key material if necessary.

Answer

Use AWS KMS with AWS managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.

Answer

Use AWS CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.

Answer

Use the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the key if necessary.

Question 4

A Security Engineer accidentally deleted the imported key material in an AWS KMS CMK.

What should the Security Engineer do to restore the deleted key material?

Accepted Answer

Create a new CMK. Use the original wrapping key and import token to import the original key material.

Answer

Create a new CMK. Download a new wrapping key and a new import token to import the original key material.

Answer

Download a new wrapping key and a new import token. Import the original key material into the existing CMK.

Answer

Use the original wrapping key and import token. Import the original key material into the existing CMK.

Question 5

A Security Engineer discovers that developers have been adding rules to security groups that allow SSH and RDP traffic from 0.0.0.0/0 instead of the organization firewall IP.

What is the most efficient way to remediate the risk of this activity?

Accepted Answer

Use network access control lists to block source IP addresses matching 0.0.0.0/0.

Answer

Delete the internet gateway associated with the VPC.

Answer

Use a host-based firewall to prevent access from all but the organization’s firewall IP.

Answer

Use AWS Config rules to detect 0.0.0.0/0 and invoke an AWS Lambda function to update the security group with the organization's firewall IP.

Question 6

Auditors for a health care company have mandated that all data volumes be encrypted at rest. Infrastructure is deployed mainly via AWS CloudFormation; however, third-party frameworks and manual deployment are required on some legacy systems.

What is the BEST way to monitor, on a recurring basis, whether all EBS volumes are encrypted?

Accepted Answer

Configure an AWS Config rule to run on a recurring basis for volume encryption.

Answer

On a recurring basis, update all 1AM user policies to require that EC2 instances are created with an encrypted volume.

Answer

set up Amazon Inspector rules for volume encryption to run on a recurring schedule.

Answer

Use CloudWatch Logs to determine whether instances were created with an encrypted volume.

Question 7

A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS.

Which steps should be taken to authenticate to AWS services using the company’s on-premises Active Directory? (Choose three.)

Accepted Answer

A Create 1AM roles with permissions corresponding to each Active Directory group.

Accepted Answer

Create a SAML provider with 1A

Accepted Answer

Configure AWS as a trusted relying party for the Active Directory

Answer

Create 1AM groups with permissions corresponding to each Active Directory group

Answer

Create a SAML provider with Amazon Cloud Directory

Answer

Configure 1AM as a trusted relying party for Amazon Cloud Directory.

Question 8

A company wants to deploy a distributed web application on a fleet of EC2 instances. The fleet will be fronted by a Classic Load Balancer that will be configured to terminate the TLS connection. The company wants to make sure that all past and current TLS traffic to the Classic Load Balancer stays secure, even if the certificate private key is leaked.

To ensure the company meets these requirements, a Security Engineer can configure a Classic Load Balancer with:

Accepted Answer

An HTTPS listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.

Answer

An HTTPS listener that uses a certificate that is managed by Amazon Certification Manager.

Answer

An HTTPS listener that uses the latest AWS predefined ELBSecurityPolicy-TLS-1-2-2017-01 security policy.

Answer

A TCP listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.

Question 9

A large corporation is creating a multi-account strategy and needs to determine how its employees should access the AWS Infrastructure.

Which of the following solutions would provide the MOST scalable solution?

Accepted Answer

Create dedicated 1AM users within each AWS account that employees can assume though federation based upon group membership in their existing identity provider.

Answer

Use a centralized account with 1AM roles that employees can assume through federation with their existing identity provider. Use cross-account roles to allow the federated users to assume their target role in the resource accounts.

Answer

Configure the AWS Security Token Service to use Kerberos tokens so that users can use their existing corporate user names and passwords to access AWS resources directly.

Answer

Configure the 1AM trust policies within each account’s role to set up a trust back to the corporation’s existing identity provider, allowing users to assume the role based off their SAML token.

Question 10

Compliance requirements state that all communications between company on-premises hosts and EC2 instances be encrypted in transit. Hosts use custom proprietary protocols fortheir communication, and EC2 instances need to be fronted by a load balancer for increased availability.

Which of the following solutionswill meet these requirements?

Accepted Answer

Route all traffic through a TCP listener on a Classic Load Balancer, and terminate the TLS connection on the EC2 instances.

Answer

Offload SSL termination onto an SSL listener on a Classic Load Balancer, and use a TCP connection between the load balancer and the EC2 instances.

Answer

Create an HTTPS listener using an Application Load Balancer, and route all of the communication through that load balancer.

Answer

Offload SSL termination onto an SSL listener using an Application Load Balancer, and re-spawn and SSL connection between the load balancer and the EC2 instances.

Free SCS-C01 sample questions

A Security Engineer accidentally deleted the imported key material in an AWS KMS CMK. What should the Security Engineer do to restore the deleted key material?

A Security Engineer discovers that developers have been adding rules to security groups that allow SSH and RDP traffic from 0.0.0.0/0 instead of the organization firewall IP. What is the most efficient way to remediate the risk of this activity?

A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS. Which steps should be taken to authenticate to AWS services using the company’s on-premises Active Directory? (Choose three.)

A large corporation is creating a multi-account strategy and needs to determine how its employees should access the AWS Infrastructure. Which of the following solutions would provide the MOST scalable solution?

10 more free samples are waiting