Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Amazon
  5. AWS Certified Security-Specialty

Amazon AWS Certified Security-Specialty Exam
AWS Certified Security - Specialty (SCS-C01) (Page 10 )

Updated On: 30-Jan-2026
Page 10 of 108
PDF with 532 Questions

A global company must mitigate and respond to DDoS attacks at Layers 3, 4 and 7 All of the company's IAM applications are serverless with static content hosted on Amazon S3 using Amazon CloudFront and Amazon Route 53

Which solution will meet these requirements?

  1. Use IAM WAF with an upgrade to the IAM Business support plan
  2. Use IAM Certificate Manager with an Application Load Balancer configured with an origin access identity
  3. Use IAM Shield Advanced
  4. Use IAM WAF to protect IAM Lambda functions encrypted with IAM KMS and a NACL restricting all Ingress traffic

Answer(s): C



A company has a website with an Amazon CloudFront HTTPS distribution, an Application Load Balancer (ALB) with multiple web instances for dynamic website content, and an Amazon S3 bucket for static website content. The company's security engineer recently updated the website security requirements:

· HTTPS needs to be enforced for all data in transit with specific ciphers.

· The CloudFront distribution needs to be accessible from the internet only.

Which solution will meet these requirements?

  1. Set up an S3 bucket policy with the IAMsecuretransport key Configure the CloudFront origin access identity (OAI) with the S3 bucket Configure CloudFront to use specific ciphers. Enforce the ALB with an HTTPS listener only and select the appropriate security policy for the ciphers Link the ALB with IAM WAF to allow access from the CloudFront IP ranges.
  2. Set up an S3 bucket policy with the IAM:securetransport key. Configure the CloudFront origin access identity (OAI) with the S3 bucket. Enforce the ALB with an HTTPS listeneronly and select the appropriate security policy for the ciphers.
  3. Modify the CloudFront distribution to use IAM WAF. Force HTTPS on the S3 bucket with specific ciphers in the bucket policy. Configure an HTTPS listener only for the ALB. Set up a security group to limit access to the ALB from the CloudFront IP ranges
  4. Modify the CloudFront distribution to use the ALB as the origin. Enforce an HTTPS listener on the ALB. Create a path-based routing rule on the ALB with proxies that connect lo Amazon S3. Create a bucket policy to allow access from these proxies only.

Answer(s): A


Reference:

https://IAM.amazon.com/blogs/security/automatically-update-IAM-waf-ip- sets-with-IAM-ip-ranges/ to update CF ip range.



An application developer is using an IAM Lambda function that must use IAM KMS to perform encrypt and decrypt operations for API keys that are less than 2 KB Which key policy would allow the application to do this while granting least privilege?






  1. Option A
  2. Option B
  3. Option C
  4. Option D

Answer(s): C



A website currently runs on Amazon EC2 with mostly static content on the site. Recently, the site was subjected to a DDoS attack, and a Security Engineer was tasked with redesigning the edge security to help mitigate this risk in the future

What are some ways the Engineer could achieve this? (Select THREE )

  1. Use IAM X-Ray to inspect the traffic going 10 the EC2 instances
  2. Move the state content to Amazon S3 and font this with an Amazon CloudFront distribution
  3. Change the security group configuration to block the source of the attack traffic
  4. Use IAM WAF security rules to inspect the inbound traffic
  5. Use Amazon inspector assessment templates to inspect the inbound traffic
  6. Use Amazon Route 53 to distribute traffic

Answer(s): B,D,F



After multiple compromises of its Amazon EC2 instances, a company's Security Officer is mandating that memory dumps of compromised instances be captured for further analysis. A Security Engineer just received an EC2 abuse notification report from IAM stating that an EC2 instance running the most recent Windows Server 2019 Base AMI is compromised.

How should the Security Engineer collect a memory dump of the EC2 instance for forensic analysis?

  1. Give consent to the IAM Security team to dump the memory core on the compromised instance and provide it to IAM Support for analysis.
  2. Review memory dump data that the IAM Systems Manager Agent sent to Amazon CloudWatch Logs.
  3. Download and run the EC2Rescue for Windows Server utility from IAM.
  4. Reboot the EC2 Windows Server, enter safe mode, and select memory dump.

Answer(s): C


Reference:

https://docs.IAM.amazon.com/IAMEC2/latest/WindowsGuide/ec2rw-cli.html



Viewing page 10 of 108
Viewing questions 46 - 50 out of 532 questions



Post your Comments and Discuss Amazon AWS Certified Security-Specialty exam prep with other Community members:

Join the AWS Certified Security-Specialty Discussion