Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

SCS-C02 Amazon AWS Certified Security - Specialty

  • Amazon
  • 5 free sample questions

About this exam

SCS-C02 is the Amazon exam Amazon AWS Certified Security - Specialty. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
SCS-C02
Vendor
Amazon
Practice questions
Not available yet
Free sample questions
5
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for SCS-C02.

Question 1

A company is developing a highly resilient application to be hosted on multiple Amazon EC2 instances . The application will store highly sensitive user data in Amazon RDS tables

The application must

• Include migration to a different IAM Region in the application disaster recovery plan.

• Provide a full audit trail of encryption key administration events

• Allow only company administrators to administer keys.

• Protect data at rest using application layer encryption

A Security Engineer is evaluating options for encryption key management

Why should the Security Engineer choose IAM CloudHSM over IAM KMS for encryption key management in this situation?

  1. Option A:

    The key administration event logging generated by CloudHSM is significantly moreextensive than IAM KMS.

  2. Option B:

    CloudHSM ensures that only company support staff can administer encryption keys, whereas IAM KMS allows IAM staff to administer keys

  3. Option C:

    The ciphertext produced by CloudHSM provides more robust protection against brute force decryption attacks than the ciphertext produced by IAM KMS

  4. Option D:

    CloudHSM provides the ability to copy keys to a different Region, whereas IAM KMS does not

Show answer and explanation

Correct answer: B

CloudHSM allows full control of your keys such including Symmetric (AES), Asymmetric (RSA), Sha-256, SHA 512, Hash Based, Digital Signatures (RSA). On the other hand, AWS Key Management Service is a multi-tenant key storage that is owned and managed byAWS1.

Question 2

A company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters to run its Kubernetes-based applications. The company uses Amazon GuardDuty to protect the applications. EKS Protection is enabled in GuardDuty. However, the corresponding GuardDuty feature is not monitoring the Kubernetes-based applications.

  1. Option A:

    Enable VPC flow logs for the VPC that hosts the EKS clusters.

  2. Option B:

    Assign the CloudWatchEventsFullAccess AWS managed policy to the EKS clusters.

  3. Option C:

    Ensure that the AmazonGuardDutyFullAccess AWS managed policy is attached to the GuardDuty service role.

  4. Option D:

    Enable the control plane logs in Amazon EKS. Ensure that the logs are ingested into Amazon CloudWatch.

Show answer and explanation

Correct answer: D

To enable GuardDuty to monitor Kubernetes-based applications:

Enable Control Plane Logs:

GuardDuty uses control plane logs to detect malicious or unauthorized activity in Amazon EKS.

Enable EKS control plane logs (API, audit, authenticator) and ingest them into CloudWatch.

See all 5 free sample questions