SCS-C01 sample questions

Question 1

Developers in an organization have moved from a standard application deployment to containers. The Security Engineer is tasked with ensuring that containers are secure.

Which strategies will reduce the attack surface and enhance the security of the containers? (Choose two.)

Accepted Answer

Limit resource consumption (CPU, memory), networking connections, ports, and unnecessary container libraries

Accepted Answer

Use Docker Notary framework to sign task definitions.

Answer

Use the containers to automate security deployment

Answer

Segregate container by host, function, and data classification.

Answer

Enable container breakout at the host kerne

Question 2

During a recent internal investigation, it was discovered that all API logging was disabled in a production account, and the root user had created new API keys that appear to have been used several times.
What could have been done to detect and automatically remediate the incident?

Accepted Answer

Using Amazon CloudWatch, create a CloudWatch event that detects AWS CloudTrail deactivation and a separate Amazon Trusted Advisor check to automatically detect the creation of root API keys. Then use a Lambda function to enable AWS CloudTrail and deactivate the root API keys.

Answer

Using Amazon Inspector, review all of the API calls and configure the inspector agent to leverage SNS topics to notify security of the change to AWS CloudTrail, and revoke the new API keys for the root user.

Answer

Using AWS Config, create a config rule that detects when AWS CloudTrail is disabled, as well as any calls to the root user create-api-key. Then use a Lambda function to re-enable CloudTrail logs and deactivate the root API keys.

Answer

Using Amazon CloudTrail, create a new CloudTrail event that detects the deactivation of CloudTrail logs, and a separate CloudTrail event that detects the creation of root API keys. Then use a Lambda function to enable CloudTrail and deactivate the root API keys.

Question 3

A Security Administrator has a website hosted in Amazon S3. The Administrator has been given the following requirements:

. Users may access the website by using an Amazon CloudFront distribution.
. Users may not access the website directly by using an Amazon S3 URL.

Which configurations will support these requirements? (Choose two.)

Accepted Answer

Associate an origin access identity with the CloudFront distribution

Accepted Answer

Modify the S3 bucket permissions so that only the origin access identity can access the bucket contents.

Answer

Implement a “Principal”: “cloudfront.amazonaws.com” condition in the S3 bucket policy.

Answer

Implement security groups so that the S3 bucket can be accessed only by using the intended CloudFront distribution.

Answer

Configure the S3 bucket policy so that it is accessible only through VPC endpoints, and place the CloudFront distribution into the specified VPC

Question 4

A company has a forensic logging use case whereby several hundred applications running on Docker on EC2 need to send logs to a central location. The Security Engineer must create a logging solution that is able to perform real-time analytics on the log files, grants the ability to replay events, and persists data.

Which AWS Services, together, can satisfy this use case? (Choose two.)

Accepted Answer

Amazon Kines

Accepted Answer

Amazon Cloud Watch

Answer

Amazon Elasticsear

Answer

Amazon SQS

Answer

Amazon Athena

Question 5

A Security Engineer is implementing a solution to allow users to seamlessly encrypt Amazon S3 objects without having to touch the keys directly. The solution must be highly scalable without requiring continual management. Additionally, the organization must be able to immediately delete the encryption keys.

Which solution meets these requirements?

Accepted Answer

Use KMS with AWS imported key material and then use the DeletelmportedKeyMaterial API to remove the key material if necessary.

Answer

Use AWS KMS with AWS managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.

Answer

Use AWS CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.

Answer

Use the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the key if necessary.

Question 6

A Security Engineer accidentally deleted the imported key material in an AWS KMS CMK.

What should the Security Engineer do to restore the deleted key material?

Accepted Answer

Create a new CMK. Use the original wrapping key and import token to import the original key material.

Answer

Create a new CMK. Download a new wrapping key and a new import token to import the original key material.

Answer

Download a new wrapping key and a new import token. Import the original key material into the existing CMK.

Answer

Use the original wrapping key and import token. Import the original key material into the existing CMK.

Question 7

A Security Engineer discovers that developers have been adding rules to security groups that allow SSH and RDP traffic from 0.0.0.0/0 instead of the organization firewall IP.

What is the most efficient way to remediate the risk of this activity?

Accepted Answer

Use network access control lists to block source IP addresses matching 0.0.0.0/0.

Answer

Delete the internet gateway associated with the VPC.

Answer

Use a host-based firewall to prevent access from all but the organization’s firewall IP.

Answer

Use AWS Config rules to detect 0.0.0.0/0 and invoke an AWS Lambda function to update the security group with the organization's firewall IP.

Question 8

Auditors for a health care company have mandated that all data volumes be encrypted at rest. Infrastructure is deployed mainly via AWS CloudFormation; however, third-party frameworks and manual deployment are required on some legacy systems.

What is the BEST way to monitor, on a recurring basis, whether all EBS volumes are encrypted?

Accepted Answer

Configure an AWS Config rule to run on a recurring basis for volume encryption.

Answer

On a recurring basis, update all 1AM user policies to require that EC2 instances are created with an encrypted volume.

Answer

set up Amazon Inspector rules for volume encryption to run on a recurring schedule.

Answer

Use CloudWatch Logs to determine whether instances were created with an encrypted volume.

Question 9

A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS.

Which steps should be taken to authenticate to AWS services using the company’s on-premises Active Directory? (Choose three.)

Accepted Answer

A Create 1AM roles with permissions corresponding to each Active Directory group.

Accepted Answer

Create a SAML provider with 1A

Accepted Answer

Configure AWS as a trusted relying party for the Active Directory

Answer

Create 1AM groups with permissions corresponding to each Active Directory group

Answer

Create a SAML provider with Amazon Cloud Directory

Answer

Configure 1AM as a trusted relying party for Amazon Cloud Directory.

Question 10

A company wants to deploy a distributed web application on a fleet of EC2 instances. The fleet will be fronted by a Classic Load Balancer that will be configured to terminate the TLS connection. The company wants to make sure that all past and current TLS traffic to the Classic Load Balancer stays secure, even if the certificate private key is leaked.

To ensure the company meets these requirements, a Security Engineer can configure a Classic Load Balancer with:

Accepted Answer

An HTTPS listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.

Answer

An HTTPS listener that uses a certificate that is managed by Amazon Certification Manager.

Answer

An HTTPS listener that uses the latest AWS predefined ELBSecurityPolicy-TLS-1-2-2017-01 security policy.

Answer

A TCP listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.

Top vendors

Top exams

Free SCS-C01 sample questions

Developers in an organization have moved from a standard application deployment to containers. The Security Engineer is tasked with ensuring that containers are secure. Which strategies will reduce the attack surface and enhance the security of the containers? (Choose two.)

During a recent internal investigation, it was discovered that all API logging was disabled in a production account, and the root user had created new API keys that appear to have been used several times. What could have been done to detect and automatically remediate the incident?

A Security Engineer accidentally deleted the imported key material in an AWS KMS CMK. What should the Security Engineer do to restore the deleted key material?

A Security Engineer discovers that developers have been adding rules to security groups that allow SSH and RDP traffic from 0.0.0.0/0 instead of the organization firewall IP. What is the most efficient way to remediate the risk of this activity?

A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS. Which steps should be taken to authenticate to AWS services using the company’s on-premises Active Directory? (Choose three.)

10 more free samples are waiting