← Back to exam page

Free AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C02 – Amazon AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C02 Practice Test Question

Loading demo links...

Showing 28–30 of 31 questions

Question 28 (Topic 1)

A security engineer is investigating a malware infection that has spread across a set of Amazon EC2 instances. A key indicator of the compromise is outbound traffic on TCP port 2905 to a set of command and control hosts on the internet. The security engineer creates a network ACL rule that denies the identified outbound traffic. The security engineer applies the network ACL rule to the subnet of the EC2 instances. The security engineer must identify any EC2 instances that are trying to communicate on TCP port 2905. Which solution will identify the affected EC2 instances with the LEAST operational effort?

Select an option, then click Submit answer.

  • ○ Create a Network Access Scope in Amazon VPC Network Access Analyzer. Use the Network Access Scope to identify EC2 instances that try to send traffic to TCP port 2905.
  • ○ Enable VPC flow logs for the VPC where the affected EC2 instances are located. Configure the flow logs to capture rejected traffic. In the flow logs, search for REJECT records that have a destination TCP port of 2905.
  • ○ Enable Amazon GuardDuty. Create a custom GuardDuty IP list to create a finding when an EC2 instance tries to communicate with one of the command and control hosts. Use Amazon Detective to identify the EC2 instances that initiate the communication.
  • ○ Create a firewall in AWS Network Firewall. Attach the firewall to the subnet of the EC2 instances. Create a custom rule to identify and log traffic from the firewall on TCP port 2905. Create an Amazon CloudWatch Logs metric filter to identify firewall logs that reference traffic on TCP port 2905.
Question 29 (Topic 1)

A company controls user access by using IAM users and groups in AWS accounts across an organization in AWS Organizations. The company uses an external identity provider (IdP) for workforce single sign-on (SSO). The company needs to implement a solution to provide a single management portal to access accounts within the organization. The solution must support the external IdP as a federation source. Which solution will meet these requirements?

Select an option, then click Submit answer.

  • ○ Enable AWS IAM Identity Center. Specify the external IdP as the identity source.
  • ○ Enable federation with AWS Identity and Access Management (IAM). Specify the external IdP as the identity source.
  • ○ Migrate to Amazon Verified Permissions. Implement fine-grained access to AWS by using policy-based access control (PBAC).
  • ○ Migrate users to AWS Directory Service. Use AWS Control Tower to centralize security across the organization.
Question 30 (Topic 1)

A company must create annual snapshots of Amazon Elastic Block Store (Amazon EBS) volumes. The company must retain the snapshots for 10 years. The company will use AWS Key Management Service (AWS KMS) to encrypt the EBS volumes and snapshots. The encryption keys must be rotated automatically every year. Snapshots that were created in previous years must be readable after rotation of the encryption keys. Which type of KMS keys should the company use for encryption to meet these requirements?

Select an option, then click Submit answer.

  • ○ Asymmetric AWS managed KMS keys with key material created by AWS KMS
  • ○ Symmetric customer managed KMS keys with key material created by AWS KMS
  • ○ Symmetric customer managed KMS keys with custom imported key material
  • ○ Asymmetric AWS managed KMS keys with custom imported key material