slide 1:

How to Prepare for AWS Security Specialty Certification AWS SCS-C01 Certification Made Easy with VMExam.com.

slide 2:

SCS-C01 Security Specialty Certification Details Exam Code SCS-C01 Full Exam Name AWS Certified Security - Specialty No. of Questions 65 Online Practice Exam AWS Certified Security - Specialty Practice Test Sample Questions AWS SCS-C01 Sample Questions Passing Score 750 / 1000 Time Limit 170 minutes Exam Fees 300 USD Become successful with VMExam.com

slide 3:

AWS SCS-C01 Study Guide • Perform enough practice with with related Security Specialty certification on VMExam.com. • Understand the Exam Topics very well. • Identify your weak areas from practice test and do more practice with VMExam.com. Become successful with VMExam.com

slide 4:

Security Specialty Certification Syllabus Syllabus Topics Incident Response Logging and Monitoring Infrastructure Security Identity and Access Management Data Protection Become successful with VMExam.com

slide 5:

Security Specialty Training Details Training: AWS Security Fundamentals Second Edition Security Engineering on AWS Exam Readiness - AWS Certified Security - Specialty Note: Trainings details are Given in the Description of the Video. Become successful with VMExam.com

slide 6:

AWS SCS-C01 Sample Questions Become successful with VMExam.com

slide 7:

Que.01: An Application team is designing a solution with two applications. The Security team wants the applications logs to be captured in two different places because one of the applications produces logs with sensitive data. Which solution meets the requirement with the LEAST risk and effort Options: a Use Amazon CloudWatch Logs to capture all logs write an AWS Lambda function that parses thelog fileand move sensitive datato a differentlog. b Use Amazon CloudWatch Logs with two log groups with one for each application and use an AWSIAM policy tocontrolaccesstothelog groupsas required. c Aggregate logs into one file then use Amazon CloudWatch Logs and then design two CloudWatchmetric filterstofiltersensitive data fromthelogs. d Add logic to the application that saves sensitive data logs on the Amazon EC2 instances local storage and write a batch script that logs into the Amazon EC2 instances and moves sensitive logs to a secure location. Become successful with VMExam.com

slide 8:

Answer b Use Amazon CloudWatch Logs with two log groups with one for each application and use an AWS IAM policy to control access to the log groups as required. Become successful with VMExam.com

slide 9:

Que.02: A Security Engineer has been informed that a user’s access key has been found on GitHub. The Engineer must ensure that this access key cannot continue to be used and must assess whether the access key was used to perform any unauthorized activities. Which steps must be taken to perform these tasks Options: a Review the users IAM permissions and delete any unrecognized or unauthorized resources. b Delete the user review Amazon CloudWatch Logs in all regions and report the abuse. c Delete or rotate the u se r’ s key review the AWS CloudTrail logs in all regions and delete anyunrecognized orunauthorized resources. d Instruct the user to remove the key from the GitHub submission rotate keys and re- deploy any instances thatwere launched. Become successful with VMExam.com

slide 10:

Answer c Delete or rotate the user’s key review the AWS CloudTrail logs in all regions and delete any unrecognized or unauthorized resources. Become successful with VMExam.com

slide 11:

Que.03: A corporate cloud security policy states that communication between the companys VPC and KMS must travel entirely within the AWS network and not use public service endpoints. Which combination of the following actions MOST satisfies this requirement Select TWO. Options: a Add the aws:sourceVpce condition to the AWS KMS key policy referencing the companys VPC endpoint ID. b Remove the VPC internet gateway from the VPC and add a virtual private gateway to theVPC to prevent direct public internet connectivity. c Create aVPC endpoint forAWSKMS with private DNS enabled. d Use the KMS ImportKey featuretosecurely transfertheAWSKMS key over aVPN. e Add the following condition tothe AWSKMS key policy: "aws:SourceIp": "10.0.0.0/16". Become successful with VMExam.com

slide 12:

Answer a Add the aws:sourceVpce condition to the AWS KMS key policy referencing the companys VPC endpoint ID. c Create a VPC endpoint for AWS KMS with private DNS enabled. Become successful with VMExam.com

slide 13:

Que.04: A Security Engineer must ensure that all API calls are collected across all company accounts and that they are preserved online and are instantly available for analysis for 90 days. For compliance reasons this data must be restorable for 7 years. Which steps must be taken to meet the retention needs in a scalable cost- effective way Options: a Enable AWS CloudTrail logging across all accounts to a centralized Amazon S3 bucket with versioning enabled. Set a lifecycle policy to move the data to Amazon Glacier daily and expire the data after90 days. b Enable AWS CloudTrail logging across all accounts to S3 buckets. Set a lifecycle policy to expire the data in each bucketafter7 years. c Enable AWS CloudTrail logging across all accounts to Amazon Glacier. Set a lifecycle policyto expire the data after 7 years. d Enable AWS CloudTrail logging across all accounts to a centralized Amazon S3 bucket. Set a lifecycle policy to move the data to Amazon Glacier after90 days and expire the data after7 years. Become successful with VMExam.com

slide 14:

Answer d Enable AWS CloudTrail logging across all accounts to a centralized Amazon S3 bucket. Set a lifecycle policy to move the data to Amazon Glacier after 90 days and expire the data after 7 years. Become successful with VMExam.com

slide 15:

Que.05: A company decides to place database hosts in its own VPC and to set up VPC peering to different VPCs containing the application and web tiers. The application servers are unable to connect to the database. Which network troubleshooting steps should be taken to resolve the issue Select TWO. Options: a Check to see if theapplication servers are in a private subnet orpublic subnet. b Check the route tables for the application server subnets for routes to the VPC peering connection. c Check the NACLs for the database subnets for rules that allow traffic from the internet. d Check the database security groups for rules that allow traffic from the application servers. e Check to see if thedatabaseVPChasan internet gateway Become successful with VMExam.com

slide 16:

Answer b Check the route tables for the application server subnets for routes to the VPC peering connection. d Check the database security groups for rules that allow traffic from the application servers. Become successful with VMExam.com

slide 17:

AWS Security Specialty Certification Guide • The AWS Certification is increasingly becoming important for the career of employees. • Try our Security Specialty mock test. • For more information on AWS Certification please refer to Description which is Given Below. Become successful with VMExam.com

slide 18:

More Info on AWS Certification Visit www.vmexam.com Become successful with VMExam.com