support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Amazon
  4. SCS-C02

Free SCS-C02 Exam Braindumps
AWS Certified Security - Specialty (Replaced with SCS-C03) Questions 66–70 (page: 15)

Updated On: 10-Feb-2026
Page 15 of 61
PDF with 308 Questions

A security engineer is configuring account-based access control (ABAC) to allow only specific principals to put objects into an Amazon S3 bucket. The principals already have access to Amazon S3.
The security engineer needs to configure a bucket policy that allows principals to put objects into the S3 bucket only if the value of the Team tag on the object matches the value of the Team tag that is associated with the principal. During testing, the security engineer notices that a principal can still put objects into the S3 bucket when the tag values do not match.
Which combination of factors are causing the PutObject operation to succeed when the tag values are different? (Choose two.)

  1. The principal's identity-based policy grants access to put objects into the S3 bucket with no conditions.
  2. The principal's identity-based policy overrides the condition because the identity-based policy contains an explicit allow.
  3. The S3 bucket's resource policy does not deny access to put objects.
  4. The S3 bucket's resource policy cannot allow actions to the principal.
  5. The bucket policy does not apply to principals in the same zone of trust.

Answer(s): A,C



A company is hosting multiple applications within a single VPC in its AWS account. The applications are running behind an Application Load Balancer that is associated with an AWS WAF web ACL. The company's security team has identified that multiple port scans are originating from a specific range of IP addresses on the internet.
A security engineer needs to deny access from the offending IP addresses.
Which solution will meet these requirements?

  1. Modify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.
  2. Add a rule to all security groups to deny the incoming requests from the IP address range.
  3. Modify the AWS WAF web ACL with a rate-based rule statement to deny the incoming requests from the IP address range.
  4. Configure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny the incoming requests based on the match condition.

Answer(s): A



A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The auditor is having trouble accessing some of the accounts.
Which of the following may be causing this problem? (Choose three.)

  1. The external ID used by the auditor is missing or incorrect.
  2. The auditor is using the incorrect password.
  3. The auditor has not been granted sts:AssumeRole for the role in the destination account.
  4. The Amazon EC2 role used by the auditor must be set to the destination account role.
  5. The secret key used by the auditor is missing or incorrect.
  6. The role ARN used by the auditor is missing or incorrect.

Answer(s): A,C,F



A security engineer needs to configure an Amazon S3 bucket policy to restrict access to an S3 bucket that is named DOC-EXAMPLE-BUCKET. The policy must allow access to only DOC-EXAMPLE-BUCKET from only the following endpoint: vpce-1a2b3c4d. The policy must deny all access to DOC-EXAMPLE-BUCKET if the specified endpoint is not used.
Which bucket policy statement meets these requirements?

Answer(s): B



A company has a group of Amazon EC2 instances in a single private subnet of a VPC with no internet gateway attached. A security engineer has installed the Amazon CloudWatch agent on all instances in that subnet to capture logs from a specific application. To ensure that the logs flow securely, the company's networking team has created VPC endpoints for CloudWatch monitoring and CloudWatch logs. The networking team has attached the endpoints to the VPC.
The application is generating logs However, when the security engineer queries CloudWatch, the logs do not appear.
Which combination of steps should the security engineer take to troubleshoot this issue? (Choose three.)

  1. Ensure that the EC2 instance profile that is attached to the EC2 instances has permissions to create log streams and write logs.
  2. Create a metric filter on the logs so that they can be viewed in the AWS Management Console.
  3. Check the CloudWatch agent configuration file on each EC2 instance to make sure that the CloudWatch agent is collecting the proper log files.
  4. Check the VPC endpoint policies of both VPC endpoints to ensure that the EC2 instances have permissions to use them.
  5. Create a NAT gateway in the subnet so that the EC2 instances can communicate with CloudWatch.
  6. Ensure that the security groups allow all the EC2 instances to communicate with each other to aggregate logs before sending.

Answer(s): A,C,D



  PDF
Viewing page 15 of 61
Viewing questions 71 - 75 out of 308 questions


Post your Comments and Discuss Amazon SCS-C02 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!