Free Amazon SCS-C01 Exam Dumps Questions & Answers

Your company is planning on IAM on hosting its IAM resources. There is a company policy which mandates that all security keys are completely managed within the company itself. Which of the following is the correct measure of following this policy?
Please select:

• A.  Using the IAM KMS service for creation of the keys and the company managing the key lifecycle thereafter.
• B.  Use S3 server-side encryption
• C.  Generating the key pairs for the EC2 Instances using puttygen
• D.  Use the EC2 Key pairs that come with IAM

A corporate cloud security policy states that communications between the company's VPC and KMS must travel entirely within the IAM network and not use public service endpoints.
Which combination of the following actions MOST satisfies this requirement? (Choose two.)

• A.  Create a VPC endpoint for IAM KMS with private DNS enabled.
• B.  Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.
• C.  Use the KMS Import Key feature to securely transfer the IAM KMS key over a VPN.
• D.  Add the following condition to the IAM KMS key policy: "IAM:SourceIp": "10.0.0.0/16".
• E.  Add the IAM:sourceVpce condition to the IAM KMS key policy referencing the company's VPC endpoint ID.

A web application gives users the ability to log in verify their membership's validity and browse artifacts that are stored in an Amazon S3 bucket. When a user attempts to download an object, the application must verify the permission to access the object and allow the user to download the object from a custom domain name such as example com.
What is the MOST secure way for a security engineer to implement this functionality?

• A.  Create an S3 presigned URL Provide the S3 presigned URL to the user through the application.
• B.  Implement an IAM policy to give the user read access to the S3 bucket.
• C.  Create an Amazon CloudFront signed URL. Provide the CloudFront signed URL to the user through the application.
• D.  Configure read-only access to the object by using a bucket ACL. Remove the access after a set time has elapsed.

Some highly sensitive analytics workloads are to be moved to Amazon EC2 hosts. Threat modeling has found that a risk exists where a subnet could be maliciously or accidentally exposed to the internet.
Which of the following mitigations should be recommended?

• A.  Move the workload to a Dedicated Host, as this provides additional network security controls and monitoring.
• B.  Use IAM Config to detect whether an Internet Gateway is added and use an IAM Lambda function to provide auto-remediation.
• C.  Use IPv6 addressing exclusively on the EC2 hosts, as this prevents the hosts from being accessed from the internet.
• D.  Within the Amazon VPC configuration, mark the VPC as private and disable Elastic IP addresses.

A Security Engineer discovers that developers have been adding rules to security groups that allow SSH and RDP traffic from 0.0.0.0/0 instead of the organization firewall IP.
What is the most efficient way to remediate the risk of this activity?

• A.  Use a host-based firewall to prevent access from all but the organization's firewall IP.
• B.  Delete the internet gateway associated with the VPC.
• C.  Use IAM Config rules to detect 0.0.0.0/0 and invoke an IAM Lambda function to update the security group with the organization's firewall IP.
• D.  Use network access control lists to block source IP addresses matching 0.0.0.0/0.