CertsTopics Logo

Weekend Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Complete SCS-C01 Amazon Web Services Materials

Page: 41 / 44
Total 589 questions
Get SCS-C01 Full Access Download SCS-C01 PDF

AWS Certified Security - Specialty Questions and Answers

Question 161

An application makes calls to IAM services using the IAM SDK. The application runs on Amazon EC2 instances with an associated IAM role. When the application attempts to access an object within an Amazon S3 bucket; the Administrator receives the following error message: HTTP 403: Access Denied.

Which combination of steps should the Administrator take to troubleshoot this issue? (Select three.)

Options:

A.

Confirm that the EC2 instance's security group authorizes S3 access.

B.

Verify that the KMS key policy allows decrypt access for the KMS key for this IAM principle.

C.

Check the S3 bucket policy for statements that deny access to objects.

D.

Confirm that the EC2 instance is using the correct key pair.

E.

Confirm that the IAM role associated with the EC2 instance has the proper privileges.

F.

Confirm that the instance and the S3 bucket are in the same Region.

Question 162

An organization operates a web application that serves users globally. The application runs on Amazon EC2 instances behind an Application Load Balancer. There is an Amazon CloudFront distribution in front of the load balancer, and the organization uses IAM WAF. The application is currently experiencing a volumetric attack whereby the attacker is exploiting a bug in a popular mobile game.

The application is being flooded with HTTP requests from all over the world with the User-Agent set to the following string: Mozilla/5.0 (compatible; ExampleCorp; ExampleGame/1.22; Mobile/1.0)

What mitigation can be applied to block attacks resulting from this bug while continuing to service legitimate requests?

Options:

A.

Create a rule in IAM WAF rules with conditions that block requests based on the presence of ExampleGame/1.22 in the User-Agent header

B.

Create a geographic restriction on the CloudFront distribution to prevent access to the application from most geographic regions

C.

Create a rate-based rule in IAM WAF to limit the total number of requests that the web application services.

D.

Create an IP-based blacklist in IAM WAF to block the IP addresses that are originating from requests that contain ExampleGame/1.22 in the User-Agent header.

Question 163

Your company is planning on hosting an internal network in IAM. They want machines in the VPC to authenticate using private certificates. They want to minimize the work and maintenance in working with certificates. What is the ideal way to fulfil this requirement.

Please select:

Options:

A.

Consider using Windows Server 2016 Certificate Manager

B.

Consider using IAM Certificate Manager

C.

Consider using IAM Access keys to generate the certificates

D.

Consider using IAM Trusted Advisor for managing the certificates

Question 164

A Software Engineer is trying to figure out why network connectivity to an Amazon EC2 instance does not appear to be working correctly. Its security group allows inbound HTTP traffic from 0.0.0.0/0, and the outbound rules have not been modified from the default. A custom network ACL associated with its subnet allows inbound HTTP traffic from 0.0.0.0/0 and has no outbound rules.

What would resolve the connectivity issue?

Options:

A.

The outbound rules on the security group do not allow the response to be sent to the client on the ephemeral port range.

B.

The outbound rules on the security group do not allow the response to be sent to the client on the HTTP port.

C.

An outbound rule must be added to the network ACL to allow the response to be sent to the client on the ephemeral port range.

D.

An outbound rule must be added to the network ACL to allow the response to be sent to the client on the HTTP port.

Page: 41 / 44
Total 589 questions
Get SCS-C01 Full Access Download SCS-C01 PDF