SCS-C03 Questions Pass on Your First Attempt Dumps for AWS Certified Specialty Certified [Q141-Q157]

NEW QUESTION 141
A security engineer needs to develop a process to investigate and respond to potential security events on a company’s Amazon EC2 instances. All the EC2 instances are backed by Amazon EBS. The company uses AWS Systems Manager to manage all the EC2 instances and has installed Systems Manager Agent on all the EC2 instances.
The process that the security engineer is developing must comply with AWS security best practices and must meet the following requirements:
* A compromised EC2 instance’s volatile memory and non-volatile memory must be preserved for forensic purposes.
* A compromised EC2 instance’s metadata must be updated with corresponding incident ticket information.
* A compromised EC2 instance must remain online during the investigation but must be isolated to prevent the spread of malware.
* Any investigative activity during the collection of volatile data must be captured as part of the process.
Which combination of steps should the security engineer take to meet these requirements with the LEAST operational overhead? (Select THREE.)

Gather any relevant metadata for the compromised EC2 instance. Enable termination protection. Isolate the instance by updating the instance’s security groups to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing resources.

Gather any relevant metadata for the compromised EC2 instance. Enable termination protection. Move the instance to an isolation subnet that denies all source and destination traffic. Associate the instance with the subnet to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing resources.

Use Systems Manager Run Command to invoke scripts that collect volatile data.

Establish a Linux SSH or Windows Remote Desktop Protocol session to the compromised EC2 instance to invoke scripts that collect volatile data.

Create a snapshot of the compromised EC2 instance’s EBS volume for follow-up investigations. Tag the instance with any relevant metadata and incident ticket information.

Create a Systems Manager State Manager association to generate an EBS volume snapshot of the compromised EC2 instance. Tag the instance with any relevant metadata and incident ticket information.

NEW QUESTION 142
A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets. The company needs to replicate the S3 objects from the company’s primary AWS Region to a secondary Region to meet disaster recovery requirements.
The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region.
Which solution will meet these requirements?

Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.

Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.

Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region.

Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.Configure S3 object versioning on the S3 bucket in the secondary Region.

NEW QUESTION 143
A consultant agency needs to perform a security audit for a company’s production AWS account. Several consultants need access to the account. The consultant agency already has its own AWS account. The company requires multi-factor authentication (MFA) for all access to its production account. The company also forbids the use of long-term credentials.
Which solution will provide the consultant agency with access that meets these requirements?

Create an IAM group. Create an IAM user for each consultant. Add each user to the group. Turn on MFA for each consultant.

Configure Amazon Cognito on the company’s production account to authenticate against the consultant agency’s identity provider (IdP). Add MFA to a Cognito user pool.

Create an IAM role in the consultant agency’s AWS account. Define a trust policy that requires MFA.
In the trust policy, specify the company’s production account as the principal. Attach the trust policy to the role.

Create an IAM role in the company’s production account. Define a trust policy that requires MFA. In the trust policy, specify the consultant agency’s AWS account as the principal. Attach the trust policy to the role.

NEW QUESTION 144
A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 123456789012. The attack created workloads that are distributed across multiple AWS Regions.
The security engineer contains the attack and removes all compute and storage resources from all affected Regions. However, the attacker also created an AWS KMS key. The key policy on the KMS key explicitly allows IAM principal kms:* permissions.
The key was scheduled to be deleted the previous day. However, the key is still enabled and usable.
The key has an ARN of arn:aws:kms:us-east-2:123456789012:key/mrk-
0bb0212cd9864fdea0dcamzo26efb5670.
The security engineer must delete the key as quickly as possible.
Which solution will meet this requirement?

Log in to the account by using the account root user credentials. Re-issue the deletion request for the KMS key with a waiting period of 7 days.

Identify the other Regions where the KMS key ID is present and schedule the key for deletion in 7 days.

Update the IAM principal to allow kms:* permissions on the KMS key ARN. Re-issue the deletion request for the KMS key with a waiting period of 7 days.

Disable the KMS key. Re-issue the deletion request for the KMS key in 30 days.

NEW QUESTION 145
A company uses AWS IAM Identity Center with SAML 2.0 federation. The company decides to change its federation source from one identity provider (IdP) to another. The underlying directory for both IdPs is Active Directory.
Which solution will meet this requirement?

Modify the attribute mappings within the IAM Identity Center trust relationship to match information that the new IdP sends.

Disable all existing users and groups within IAM Identity Center that were part of the federation with the original IdP.

Confirm that the Network Time Protocol (NTP) clock skew is correctly set between IAM Identity Center and the new IdP endpoints.

Reconfigure all existing IAM roles in the company’s AWS accounts to explicitly trust the new IdP as the principal.

NEW QUESTION 146
A company uses an organization in AWS Organizations to manage multiple AWS accounts. A security engineer creates a WAF policy in AWS Firewall Manager in the us-east-1 Region. The security engineer sets the policy scope to apply to resources that are tagged withWAF- protected:truein one of the member accounts in the organization. The security engineer sets up a configuration to automatically remediate any noncompliant resources.
In a member account, the security engineer attempts to protect an Amazon API Gateway REST API in the us-east-1 Region by using a web ACL. However, after several minutes, the REST API is still not associated with the web ACL.
What is the likely cause of this issue?

Web ACLs cannot be applied to REST APIs.

The REST API is missing a tag that includes theWAF-protectedkey and a value oftrue.

The web ACL is already associated with another REST API.

The web ACL is already associated with an Amazon CloudFront distribution.

NEW QUESTION 147
A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off.
What is the MOST efficient way to implement this solution?

Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.

Create an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging API.

Create an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLogging event name to invoke an AWS Lambda function to call the StartLogging API.

Monitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.

NEW QUESTION 148
A company has installed a third-party application that is distributed on several Amazon EC2 instances and on- premises servers. Occasionally, the company ‘ s IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection.
Which solution will meet these requirements?

Create a bastion host with port forwarding to connect to the machines.

Set up AWS Systems Manager Session Manager to allow temporary connections.

Use AWS CloudShell to create serverless connections.

Set up an interface VPC endpoint for each machine for private connection.

NEW QUESTION 149
A company is developing an application that runs across a combination of Amazon EC2 On-Demand Instances and Spot Instances. A security engineer needs to provide a logging solution that makes logs for all instances available from a single location. The solution must allow only a specific set of users to analyze the logs for events patterns. The users must be able to use SQL queries on the logs to perform root cause analysis.
Which solution will meet these requirements?

Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group.
Allow only specific users to access the log group. Use CloudWatch Logs Insights to query the log group.

Configure the EC2 instances to send application logs to a single Amazon S3 bucket. Allow only specific users to access the S3 bucket. Use Amazon CloudWatch Logs Insights to query the log files in the S3 bucket.

Configure each EC2 instance to send its application logs to its own specific Amazon CloudWatch Logs log group. Allow only specific users to access the log groups. Use Amazon Athena to query all the log groups.

Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group.Grant Amazon Detective access to the log group. Allow only specific users to use Detective to query the log group.

NEW QUESTION 150
A systems administrator was attempting to launch a new Amazon EC2 instance with an encrypted boot volume using a new AWS KMS customer managed key. The EC2 console initially stated the launch was successful, but the instance was subsequently terminated. The IAM role used by the systems administrator has the following IAM permissions:
* ec2:Describe*
* ec2:AuthorizeSecurityGroupIngress
* kms:Encrypt
* kms:Decrypt
* kms:ReEncrypt*
* kms:GenerateDataKey*
* kms:DescribeKey
Which IAM permission is the systems administrator missing?

kms:GetKeyRotationStatus

kms:CreateGrant

kms:GenerateRandom

kms:EnableKey

NEW QUESTION 151
A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store’s application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account.
The company uses AWS Organizations and has an OU that is used only for these accounts.
The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company’s deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access. The security engineer already has created an AWS CloudFormation template that implements the deployment plan.
What should the security engineer do next to meet the requirements in theMOST secureway?

Create an AWS Service Catalog portfolio in the organization’s management account. Upload the CloudFormation template. Add the template to the portfolio’s product list. Share the portfolio with the OU.

Use the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. Create an SCP that allows access to the extension.

Create an AWS Service Catalog portfolio and create an IAM role for cross-account access. Attach the AWSServiceCatalogEndUserFullAccess managed policy to the role.

Use the CloudFormation CLI to create a module and share the extension directly with the OU.

NEW QUESTION 152
A company needs the ability to identify the root cause of security findings in an AWS account. The company has enabled VPC Flow Logs, Amazon GuardDuty, and AWS CloudTrail. The company must investigate any IAM roles that are involved in the security findings and must visualize the findings.
Which solution will meet these requirements?

Use Amazon Detective to run investigations on the IAM roles and to visualize the findings.

Use Amazon Inspector to run investigations on the IAM roles and visualize the findings.

Export GuardDuty findings to Amazon S3 and analyze them with Amazon Athena.

Enable AWS Security Hub and use custom actions to investigate IAM roles.

NEW QUESTION 153
A consultant agency needs to perform a security audit for a company’s production AWS account.
Several consultants need access to the account. The consultant agency already has its own AWS account. The company requires multi-factor authentication (MFA) for all access to its production account. The company also forbids the use of long-term credentials. Which solution will provide the consultant agency with access that meets these requirements?

Create an IAM group. Create an IAM user for each consultant. Add each user to the group. Turn on MFA for each consultant.

Configure Amazon Cognito on the company’s production account to authenticate against the consultant agency’s identity provider (IdP). Add MFA to a Cognito user pool.

Create an IAM role in the consultant agency’s AWS account. Define a trust policy that requires MFA. In the trust policy, specify the company’s production account as the principal. Attach the trust policy to the role.

Create an IAM role in the company’s production account. Define a trust policy that requires MFA.In the trust policy, specify the consultant agency’s AWS account as the principal. Attach the trust policy to the role.

NEW QUESTION 154
A company’s web application is hosted on Amazon EC2 instances running behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. AWS CloudTrail is enabled and stores logs in Amazon S3 and Amazon CloudWatch Logs.
The operations team has observed some EC2 instances reboot at random. After rebooting, all access logs on the instances have been deleted. During an investigation, the operations team found that each reboot happened just after a PHP error occurred on the new-user-creation.php file. The operations team needs to view log information to determine if the company is being attacked.
Which set of actions will identify the suspect attacker’s IP address for future occurrences?

Configure VPC Flow Logs on the subnet where the ALB is located and stream the data to CloudWatch.Search for the new-user-creation.php occurrences in CloudWatch.

Configure the CloudWatch agent on the ALB and send application logs to CloudWatch Logs.

Configure the ALB to export access logs to an Amazon OpenSearch Service cluster and search for the new-user-creation.php occurrences.

Configure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3 bucket.Use Amazon Athena to query the logs and find the new-user-creation.php occurrences.

NEW QUESTION 155
A security engineer needs to implement a logging solution that captures detailed information about objects in an Amazon S3 bucket. The solution must include details such as the IAM identity that makes the request and the time the object was accessed. The data must be structured and available in near real time.
Which solution meets these requirements?

Enable Amazon S3 server access logging on the S3 bucket. Create a new S3 bucket to store the logs. Analyze the logs from the logging S3 bucket.

Enable AWS CloudTrail data event logging. Create a new S3 bucket to store the logs. Analyze the logs from the logging S3 bucket.

Configure AWS Config rules to log access to the objects stored in the S3 bucket.

Enable Amazon Macie to log access to the objects stored in the S3 bucket.

NEW QUESTION 156
A security engineer needs to prepare a company’s Amazon EC2 instances for quarantine during a security incident. The AWS Systems Manager Agent (SSM Agent) has been deployed to all EC2 instances. The security engineer has developed a script to install and update forensics tools on the EC2 instances. Which solution will quarantine EC2 instances during a security incident?

Create a rule in AWS Config to track SSM Agent versions.

Configure Systems Manager Session Manager to deny all connection requests from external IP addresses.

Store the script in Amazon S3 and grant read access to the instance profile.

Configure IAM permissions for the SSM Agent to run the script as a predefined Systems Manager Run Command document.

NEW QUESTION 157
A security team manages a company’s AWS Key Management Service (AWS KMS) customer managed keys.
Only members of the security team can administer the KMS keys. The company’s application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team’s software process with access to the keys.
Which solution will meet these requirements with the LEAST operational overhead?

Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.

Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals. Revert this change when the application team no longer needs access.

Create a key grant to allow the application team to use the KMS keys. Revoke the grant when the application team no longer needs access.

Create a new KMS key by generating key material on premises. Import the key material to AWS KMS whenever the application team needs access. Grant the application team permissions to use the key.

Free valid test braindumps

SCS-C03 Questions Pass on Your First Attempt Dumps for AWS Certified Specialty Certified [Q141-Q157]

Leave a Reply Cancel reply