AWS Certified Specialty SCS-C01 Updated Exam

AWS Certified Security - Specialty Questions and Answers

Question 169

An IAM account includes two S3 buckets: bucket1 and bucket2. The bucket2 does not have a policy defined, but bucket1 has the following bucket policy:

In addition, the same account has an IAM User named “alice”, with the following IAM policy.

Which buckets can user “alice” access?

Options:

Bucket1 only

Bucket2 only

Both bucket1 and bucket2

Neither bucket1 nor bucket2

Question 170

An IAM Lambda function was misused to alter data, and a Security Engineer must identify who invoked the function and what output was produced. The Engineer cannot find any logs created by the Lambda function in Amazon CloudWatch Logs.

Which of the following explains why the logs are not available?

Options:

The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.

The Lambda function was executed by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs.

The execution role for the Lambda function did not grant permissions to write to the Amazon S3 bucket where CloudWatch Logs stores the logs.

The version of the Lambda function that was executed was not current.

Question 171

A Security Engineer received an IAM Abuse Notice listing EC2 instance IDs that are reportedly abusing other hosts.

Which action should the Engineer take based on this situation? (Choose three.)

Options:

Use IAM Artifact to capture an exact image of the state of each instance.

Create EBS Snapshots of each of the volumes attached to the compromised instances.

Capture a memory dump.

Revoke all network ingress and egress except for to/from a forensics workstation.

Run Auto Recovery for Amazon EC2.

Question 172

A Security Administrator is performing a log analysis as a result of a suspected IAM account compromise. The Administrator wants to analyze suspicious IAM CloudTrail log files but is overwhelmed by the volume of audit logs being generated.

What approach enables the Administrator to search through the logs MOST efficiently?

Options:

Implement a “write-only” CloudTrail event filter to detect any modifications to the IAM account resources.

Configure Amazon Macie to classify and discover sensitive data in the Amazon S3 bucket that contains the CloudTrail audit logs.

Configure Amazon Athena to read from the CloudTrail S3 bucket and query the logs to examine account activities.

Enable Amazon S3 event notifications to trigger an IAM Lambda function that sends an email alarm when there are new CloudTrail API entries.

New Year Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

AWS Certified Specialty SCS-C01 Updated Exam

AWS Certified Security - Specialty Questions and Answers

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Options:

Answer:

CompTIA

Fortinet

Microsoft

Salesforce