Cisco®
Oracle
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
Microsoft
VMware
Avaya
SAP
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk®
All Vendors
  2. Home
  3. Exams
  4. Amazon
  5. SCS-C01

Free Amazon SCS-C01 Exam Braindumps (page: 15)

Page 15 of 134
PDF with 532 Questions

A company has several production IAM accounts and a central security IAM account. The security account is used for centralized monitoring and has IAM privileges to all resources in every corporate account. All of the company's Amazon S3 buckets are tagged with a value denoting the data classification of their contents.

A Security Engineer is deploying a monitoring solution in the security account that will enforce bucket policy compliance. The system must monitor S3 buckets in all production accounts and confirm that any policy change is in accordance with the bucket's data classification. If any change is out of compliance; the Security team must be notified quickly.

Which combination of actions would build the required solution? (Choose three.)

  1. Configure Amazon CloudWatch Events in the production accounts to send all S3 events to the security account event bus.
  2. Enable Amazon GuardDuty in the security account. and join the production accounts as members.
  3. Configure an Amazon CloudWatch Events rule in the security account to detect S3 bucket creation or modification events.
  4. Enable IAM Trusted Advisor and activate email notifications for an email address assigned to the security contact.
  5. Invoke an IAM Lambda function in the security account to analyze S3 bucket settings in response to S3 events, and send non-compliance notifications to the Security team.
  6. Configure event notifications on S3 buckets for PUT; POST, and DELETE events.

Answer(s): D,E,F



A security engineer need to ensure their company's uses of IAM meets IAM security best practices. As part of this, the IAM account root user must not be used for daily work. The root user must be monitored for use, and the Security team must be alerted as quickly as possible if the root user is used.

Which solution meets these requirements?

  1. Set up an Amazon CloudWatch Events rule that triggers an Amazon SNS notification.
  2. Set up an Amazon CloudWatch Events rule that triggers an Amazon SNS notification logs from S3 and generate notifications using Amazon SNS.
  3. Set up a rule in IAM config to trigger root user events. Trigger an IAM Lambda function and generate notifications using Amazon SNS.
  4. Use Amazon Inspector to monitor the usage of the root user and generate notifications using Amazon SNS

Answer(s): A



An external Auditor finds that a company's user passwords have no minimum length. The company is currently using two identity providers:

· IAM IAM federated with on-premises Active Directory

· Amazon Cognito user pools to accessing an IAM Cloud application developed by the company

Which combination o1 actions should the Security Engineer take to solve this issue? (Select TWO.)

  1. Update the password length policy In the on-premises Active Directory configuration.
  2. Update the password length policy In the IAM configuration.
  3. Enforce an IAM policy In Amazon Cognito and IAM IAM with a minimum password length condition.
  4. Update the password length policy in the Amazon Cognito configuration.
  5. Create an SCP with IAM Organizations that enforces a minimum password length for IAM IAM and Amazon Cognito.

Answer(s): A,D



A company has hundreds of IAM accounts, and a centralized Amazon S3 bucket used to collect IAM CloudTrail for all of these accounts. A security engineer wants to create a solution that will enable the company to run ad hoc queues against its CloudTrail logs dating back 3 years from when the trails were first enabled in the company's IAM account.

How should the company accomplish this with the least amount of administrative overhead?

  1. Run an Amazon EMP cluster that uses a MapReduce job to be examine the CloudTrail trails.
  2. Use the events history/feature of the CloudTrail console to query the CloudTrail trails.
  3. Write an IAM Lambda function to query the CloudTrail trails Configure the Lambda function to be executed whenever a new file is created in the CloudTrail S3 bucket.
  4. Create an Amazon Athena table that tools at the S3 bucket the CloudTrail trails are being written to Use Athena to run queries against the trails.

Answer(s): D



Viewing page 15 of 134
Viewing questions 57 - 60 out of 532 questions



Post your Comments and Discuss Amazon SCS-C01 exam prep with other Community members:

SCS-C01 Exam Discussions & Posts