Amazon SCS-C02 Exam Prep
AWS Certified Security - Specialty (Replaced with SCS-C03) (Page 2 )

• Answer: D

• The strongest security comes from enforcing access at the storage layer. An IAM policy scoped to the Cognito identity prefix restricts each user to their own S3 prefix (folder), so users can only access their own files regardless of client or server code.
• This per-user isolation reduces risk of cross-user data access and is more robust than UI validation or Lambda/API validation alone.
• Implementation note: attach a policy to the Cognito identity role that allows actions on arn:aws:s3:::your-bucket/${cognito-identity.amazonaws.com:sub}/* (per-user prefix). Ensure TLS in transit and enable at-rest encryption (SSE-S3 or SSE-KMS). Use multipart upload for large files up to 300 MB.

1. Determine which host was infected first—the originating host.
2. Decide whether each other host is clean or infected based on communication and event logs.

• Compare timestamps and find the earliest suspicious event.
• Look for the host that initiated the malicious connection, file transfer, exploit, or command—not merely a host that later received traffic.
• Follow the timeline through the firewall:

• A host is likely infected if it both receives suspicious activity and then initiates related malicious traffic.
• A host may be clean if the firewall blocked the connection and there is no evidence of execution or follow-on communication.

• The Accrue liability on product receipt flag controls whether a liability is accrued and posted at the time of receiving the item.
• If this checkbox is unchecked, receipts won’t create postings to the Product receipt journal. Enabling it ensures the system posts inventory value and the vendor liability when the item is received.

• Go to the Item model group setup form.
• Enable (check) Accrue liability on product receipt.
• Save.

• The other option, Include physical value, affects how physical value is handled but is not the direct cause of postings to the product receipt journal. If issues persist after enabling accrual, you may need to verify related posting definitions or journal setup.

• Interactive development and exploration
• Small datasets
• Lightweight transformations or testing
• Avoiding the overhead and cost of multiple workers

• Automated reports: Jobs may benefit from job clusters or SQL warehouses.
• Working with SQL in Databricks SQL: Databricks SQL warehouses are the relevant compute option.
• Automatically scaling for larger data: A multi-node cluster with autoscaling is more suitable.
• Large amounts of data: Distributed worker nodes are generally needed.

• Correct answer: only new data added to the eventhouse (option E).
• Why: When you enable OneLake availability for the eventhouse, OneLake starts syncing data going forward. It does not automatically backfill or copy over data that already exists in the eventhouse before the enablement.
• What that means in practice: Any data added to the eventhouse after you enable OneLake will appear in OneLake (and be visible from OneLake file explorer). Pre-existing data in the eventhouse stays there unless you perform a separate backfill/copy operation outside the standard OneLake enablement.
• How to verify: add a small new dataset to the eventhouse after enabling OneLake availability, then check OneLake to confirm the new dataset appears.

• Workspace: Stores notebooks, libraries, jobs, and other project resources.
• Notebooks: Interactive documents containing code, queries, visualizations, and explanations. Common languages include Python, SQL, Scala, and R.
• Clusters: Groups of virtual machines that run Spark workloads. Clusters can be started, stopped, and automatically scaled.
• Data access: Databricks can read from services such as Azure Data Lake Storage, Azure Blob Storage, and Azure SQL.
• Jobs: Automate notebooks or data-processing workflows on a schedule or in response to events.

• Correct answer: C) After installing ES on the search head(s) and running the distributed configuration management tool.

• ES requires the Splunk_TA_ForIndexes.spl add-on on indexers to apply index-time configurations. It should be deployed via the distributed configuration management (DCM) flow after ES is installed on the search heads, so the indexers receive the proper configuration in a controlled, versioned bundle.

• A) Deploying when adding apps to the deployment server isn’t the ES-specific order; it bypasses the ES-instantiated workflow.
• B) Installing Splunk_TA_ForIndexes.spl first isn’t the recommended order; ES needs to be installed on the search heads first.
• D) It isn’t limited to indexer cluster sites or cluster master commands; the standard flow uses DCM to push the TA to indexers in general.

• In Microsoft Entra (Azure AD), admin roles can be scoped to either the entire directory (tenant) or to an Administrative Unit (AU). To assign a role at an AU scope, the user must be a member of that AU.

• Roles in question: Security Administrator and User Administrator can be scoped either to the Directory or to a specific AU.

• User1 is a member of AU1. Therefore, User1 can be assigned either at the AU scope (AU1) or at the Directory scope (global).

• User2 is not a member of AU1. Therefore, User2 cannot be assigned at the AU scope; the valid scope for User2 is only the Directory scope.

• User1: can be assigned at AU1 and at Directory scopes.
• User2: can be assigned only at the Directory scope.

• VPC: A logically isolated virtual network in a cloud environment; it describes networking, not shared application access.
• NFV: Replaces dedicated network appliances with virtualized network functions.
• SaaS: A cloud service model in which users consume an application without managing its infrastructure. It could describe how the application is delivered, but the question emphasizes serving multiple user groups, which points to multitenancy.

• As the project progresses, you gain information, refine requirements, and lock down baselines (scope, schedule, cost). This reduces overall risk and uncertainty because more is known and addressed.
• At the same time, changes become more costly over time. Later changes can affect already approved baselines, cause rework, impact the critical path, require more coordination, and incur penalties or delays, all of which raise the cost of making changes.

• Azure Resource Manager (ARM) templates define Azure resources in a declarative JSON file.
• You can deploy the same template repeatedly for each business unit, ensuring that identical resources are created consistently.
• Templates reduce manual administrative effort and support repeatable, automated deployments.
• Parameters can customize values such as names, regions, and sizes while keeping the overall resource configuration the same.

• Premium file shares: contoso104 only
• Blob access tiers: contoso101, contoso102, and contoso103

• Premium Azure Files shares require a storage account with the FileStorage account kind. This is a specialized account type and is not used for blob storage.
• Blob access tiers such as Hot, Cool, and—where supported—Archive apply to blob-capable accounts, such as General-purpose v2 or BlobStorage accounts shown in the exhibit.
• contoso104 is therefore excluded from the blob-tier selection because it is the premium Files account.

• A. Number ? Decimal — Correct. Salesforce Number fields are represented in Apex as Decimal.
• D. Date/Time ? Datetime — This is correct conceptually, but “Dateline” is not an Apex type. If the option literally says “Dateline,” it is incorrect.
• E. Checkbox ? Boolean — Correct. A checkbox contains true or false.

• Number ? Integer — A Number field maps to Decimal, even when its scale is zero.
• Text Area ? List<String> — A text area maps to a single String, not a list.

• IPsec: Protects traffic at the network layer, commonly for VPNs; it is not WPA2’s authentication protocol.
• SSL: Protects specific application sessions and has largely been replaced by TLS.
• SSH: Secures remote command-line administration.

• Sales Processes define the set of Opportunity stages for a given workflow.
• Record Types let you have different data models (different fields and picklist values) on the same object.
• Page Layouts control which fields are shown/required for each record type.

• Create three Sales Processes so each team can use its own stages.
• Create three Record Types so each team has its own fields and picklist values.
• Create three Page Layouts so each record type shows the appropriate fields.

• The two correct options are:

• The two incorrect options:

• Network Security Groups (NSGs) control network traffic to and from Azure resources.
• By applying NSGs to the web tier and the database tier (subnets or NICs), you can:

• NSGs provide the necessary granularity (source/destination, port, protocol) to enforce the desired traffic patterns between tiers.
• For easier management you can use separate subnets for each tier or, optionally, use Application Security Groups to simplify rule management.

• Answer: A

• Reason: The Standard web tier is the lowest tier that provides dedicated compute, built-in load balancing across instances, and sufficient storage to host multiple apps with custom domains. Basic may lack the required scalability/storage, while Free/Shared do not offer dedicated compute or proper load balancing.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• A private IP address on the virtual network
• A public IP address associated with its IP configuration

• The correct option is A: Data architecture.

• Why: In the AWS CAF, the Platform perspective covers the technical foundation and architecture that enable cloud workloads to run reliably and efficiently. This includes how data is modeled, stored, and accessed across the enterprise—the core of data architecture.

• Quick mapping for the other options:

• Drop violating frames
• Log or alert on the violation
• Shut down or restrict the port

• Load balancer: Distributes application traffic; it does not control switch MAC learning.
• IPS: May detect some network attacks but is not the primary control for switch MAC-table exhaustion.
• NGFW: Protects traffic crossing network boundaries, while MAC flooding occurs at the switching/LAN layer.

• B. Enable column profile — This turns on column profiling, which computes statistics like min and max for each column.
• C. Show column profile in details pane — This ensures the per-column profile is visible in the details pane.
• E. Enable details pane — This makes the details pane available so you can view the column profile there.

• A. Show column value distribution may help with distribution but isn’t specifically about min/max.
• D. Show column quality details shows data quality (valid/null counts), not min/max.

• Help the team identify the causes of delays.
• Encourage continuous improvement through retrospectives.
• Support the team in changing its process, tools, or collaboration methods.
• Help remove impediments that the team cannot resolve independently.

• A: An impediment log may help, but simply maintaining it does not ensure the impediments are resolved.
• B: Directing the team to solutions conflicts with agile self-management.
• C: Adding impediments to the product backlog could delay their resolution and treats them like product features.

• Secure: uses encryption, such as HTTPS or SFTP.
• Cross-platform: supported by many languages and operating systems.
• Internet-friendly: designed to communicate across networks, usually using standard Internet protocols.

• JSON/REST over HTTPS — widely supported, secure, and Internet-friendly.
• SOAP over HTTPS — also secure and highly cross-platform, though more heavyweight.
• XML over SFTP — secure file-based exchange, but it is not an API-style interface.

• Correct answer: S3 Versioning

• Why the other options aren’t suitable for this protection:

• Quick tip: For enhanced protection, enable Versioning (and consider related features like Object Lock for write-once scenarios in specific compliance cases).

• A — VARIANT "null" values are not the same as SQL NULL: Correct.

• B — Frequent, single-row DMLs: Incorrect.

• C — Validate data before loading into the target table: Correct.

• D — Use staging tables to manage MERGE statements: Correct.

• Create and manage catalogs of approved IT services
• Govern and publish infrastructure-as-code (IaC) templates, commonly AWS CloudFormation templates
• Control which users can deploy specific products and configurations
• Apply versioning, permissions, and deployment constraints

• AWS Resource Explorer: Searches and discovers AWS resources; it does not govern IaC templates.
• AWS Organizations: Manages multiple AWS accounts, policies, and consolidated billing.
• AWS Systems Manager: Helps operate and manage deployed resources, such as patching and automation, but is not primarily a catalog for governed IaC products.

• The problem describes the class updating field-level security on some profiles. To prevent updating fields that are not updateable for the current user, you should check each field’s updateability before making changes. Use DescribeFieldResult.isUpdateable() (e.g., via Field.describe() on each field) to guard updates.

• A and D (With Sharing): Running a class with Sharing affects record visibility, not whether a field can be updated by a user. It doesn’t prevent updates to fields the user shouldn’t modify.
• C (WITH SECURITY_ENFORCED in SOQL): This enforces FLS/FRC during queries, but it doesn’t control whether the Apex code updates fields or modifies permissions. It’s not addressing the update behavior directly.

• administrators — Full access to switch configuration and REST API functions; excessive for this requirement.
• sysadmin — Intended for highly privileged system administration, not basic monitoring.
• helpdesk — More limited and focused on troubleshooting/support functions; it does not match the stated default role and level-1 requirement as directly.

• Users retain their existing usernames and passwords.
• Existing accounts can be used to access Azure-based resources.
• Administrators avoid manually recreating thousands of accounts.
• The transition is less disruptive before the on-premises data center is retired.

• Options:

• Answer: The correct choice is A (800-61r3).

• NIST SP 800-61 Rev. 3 is the dedicated guide for incident handling/response and reflects the latest guidance on the incident response lifecycle (preparation, detection/analysis, containment, eradication, recovery, post-incident activity).
• 800-61r2 is an older revision of the same incident response guide.
• 800-53 covers security and privacy controls, not a specific incident response standard.
• 800-171 focuses on protecting CUI in non-federal systems and networks, not incident response guidance.

• Batch processing, such as scheduled data transformations
• Streaming processing, such as continuously ingesting events

• Manipulating data with multiple languages: Mainly a benefit of Databricks and Spark.
• Real-time notebook collaboration: A workspace/notebook feature.
• Alerts for query failures: A Databricks SQL or job-monitoring feature.
• Distributing complex operations: Primarily a Spark compute capability.