SCS-C02 Amazon Web Services AWS Certified Security - Specialty Free Practice Exam Questions (2025 Updated)

To mitigate a credential stuffing attack against a web-based application behind an Application Load Balancer (ALB), creating an AWS WAF web ACL with a custom rule to block requests containing the known malicious user agent string is an effective solution. This approach allows for precise targeting of the attack vector (the user agent string of the device emulator) without impacting legitimate users. AWS WAF provides the capability to inspect HTTP(S) requests and block those that match defined criteria, such as specific strings in the user agent header, thereby preventing malicious requests from reaching the application.

Requirement Analysis:

The application should only be accessible to subsidiary companies over TCP port 443.

Direct public internet access must be restricted.

Use AWS PrivateLink:

AWS PrivateLink allows secure access to services across accounts and VPCs without exposing them to the public internet.

Steps to Implement:

Parent Account:

Create aPrivateLink Endpoint Servicelinked to the Network Load Balancer (NLB).

Update the security group for the EC2 instances to allow traffic from the PrivateLink endpoint on TCP port 443.

Subsidiary Accounts:

CreateInterface Endpointsin the subsidiary VPCs. These endpoints securely route traffic to the parent company's application via PrivateLink.

Advantages of This Solution:

Compliance: Ensures secure communication without internet exposure.

Scalability: Easily supports all 1,500 subsidiaries.

Operational Simplicity: Centralized service in the parent account, while subsidiaries connect securely via endpoints.

AWS PrivateLink Documentation

Using Security Groups with AWS PrivateLink

To configure DNSSEC for a domain registered with Route 53, the most operationally efficient solution is to migrate the zone to Route 53 with DNSSEC signing enabled, create a key-signing key (KSK) that is based on an AWS Key Management Service (AWS KMS) customer managed key, and add a delegation signer (DS) record to the parent zone. This way, Route 53 handles the zone-signing key (ZSK) and the signing of the records in the hosted zone, and the customer only needs to manage the KSK in AWS KMS and provide the DS record to the domain registrar. Option A is incorrect because it does not involve migrating the zone to Route 53, which would simplify the DNSSEC configuration. Option B is incorrect because it creates both a ZSK and a KSK based on AWS KMS customer managed keys, which is unnecessary and less efficient than letting Route 53 manage the ZSK. Option C is incorrect because it does not involve migrating the zone to Route 53, and it requires running the dnssec-signzone command manually, which is less efficient than letting Route 53 sign the zone automatically.Verified References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-configure-dnssec.html

https://aws.amazon.com/about-aws/whats-new/2020/12/announcing-amazon-route-53-support-dnssec/

A bastion host is a special purpose computer on a network specifically designed and configured to withstand attacks. The computer generally hosts a single application, for example a proxy server, and all other services are removed or limited to reduce the threat to the computer.

In IAM, A bastion host is kept on a public subnet. Users log on to the bastion host via SSH or RDP and then use that session to manage other hosts in the private subnets.

Options A and B are invalid because the bastion host needs to sit on the public network. Option D is invalid because bastion hosts are not used for monitoring For more information on bastion hosts, just browse to the below URL:

https://docsIAM.amazon.com/quickstart/latest/linux-bastion/architecture.htl

The correct answer is: Bastion hosts allow users to log in using RDP or SSH and use that session to SSH into internal network to access private subnet resources.

Submit your Feedback/Queries to our Experts

Understanding the Problem:

Logs are encrypted with a KMS-managed key (SSE-KMS), and the security engineer can read digest files but not the log files.

This indicates that the issue lies in permissions related to decryption.

KMS Key Policy:

The key policy for the KMS-managed key must explicitly allow the security engineer’s IAM user or role thekms:Decryptpermission.

Example Key Policy:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Principal": {

"AWS": "arn:aws:iam:::user/"

},

"Action": "kms:Decrypt",

"Resource": "*"

}

]

}

Verify the IAM Role/Policy:

Ensure that no conflicting IAM policy denies thekms:Decryptaction for the security engineer’s user or role.

Enable Access to Encrypted Logs:

Update the KMS key policy to include permissions for reading and decrypting CloudTrail logs.

AWS KMS Key Policy Documentation

Server-Side Encryption with KMS for CloudTrail

The IAM Documentation mentions the following

To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it you can use CloudTrail log file integrity validation. This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection. You can use the IAM CLI to validate the files in the location where CloudTrail delivered them

Validated log files are invaluable in security and forensic investigations. For example, a validated log file enables you to assert positively that the log file itself has not changed, or that particular user credentials performed specific API activity. The CloudTrail log file integrity validation process also lets you know if a log file has been deleted or changed, or assert positively that no log files were delivered to your account during a given period of time.

Options B.C and D is invalid because you need to check for log File Integrity Validation for cloudtrail logs

For more information on Cloudtrail log file validation, please visit the below URL:

http://docs.IAM.amazon.com/IAMcloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html

The correct answer is: Use CloudTrail Log File Integrity Validation.

omit your Feedback/Queries to our Expert

the reason why there were no alerts on the sudo commands. Sudo commands are commands that allow a user to execute commands as another user, usually the superuser or root. CloudWatch Logs agent is a software agent that can send log data from an EC2 instance to CloudWatch Logs, a service that monitors and stores log data. The CloudWatch Logs agent needs an IAM instance profile, which is a container for an IAM role that allows applications running on an EC2 instance to make API requests to AWS services. If the IAM instance profile on the EC2 instance was not properly configured to allow the CloudWatch Logs agent to push the logs to CloudWatch, then there would be no alerts on the sudo commands. The other options are either irrelevant or invalid for explaining why there were no alerts on the sudo commands.

A bucket policy is a resource-based policy that defines permissions for a specific S3 bucket. It can be used to grant cross-account access to another AWS account or an IAM user or role in another account. A bucket policy can also specify which actions, resources, and conditions are allowed or denied.

A bucket ACL is an access control list that grants basic read or write permissions to predefined groups of users. It cannot be used to grant cross-account access to a specific IAM user or role in another account.

An object ACL is an access control list that grants basic read or write permissions to predefined groups of users for a specific object in an S3 bucket. It cannot be used to grant cross-account access to a specific IAM user or role in another account.

A user policy is an IAM policy that defines permissions for an IAM user or role in the same account. It cannot be used to grant cross-account access to another AWS account or an IAM user or role in another account.

For more information, see Provide cross-account access to objects in Amazon S3 buckets and Example 2: Bucket owner granting cross-account bucket permissions.

Comprehensive and Detailed Explanation From Exact Extract:

Amazon OpenSearch Service provides near real-time log ingestion and indexing, full-text search, and analytics capabilities. Using the Security Analytics feature, you can define detection rules and configure alerts based on log patterns or threat indicators. These alerts can be routed to Amazon SNS topics for notification and automation workflows.

This meets the requirements for:

Near real-time log ingestion and search

Rule-based detection and alerting

Integration with SNS for notifications

This solution aligns with best practices under the Logging and Monitoring domain in the AWS Certified Security – Specialty curriculum.

This answer is correct because ensuring that the security groups allow bidirectional communication between the Lambda function and the EC2 instance will resolve the error. The error indicates that the Lambda function cannot connect to the database, which might be due to firewall rules blocking the traffic. By allowing outbound connections from the Lambda function and inbound connections to the EC2 instance, the security engineer can enable the rotation function to access and update the database credentials.

Amazon Security Lake, when configured with a delegated administrator account in AWS Organizations, provides a centralized solution for aggregating, organizing, and prioritizing security data from multiple sources including AWS services, AWS Marketplace solutions, and on-premises systems. By enabling Security Lake for the organization and adding the necessary AWS accounts, the solution centralizes the collection and analysis of log data. This setup leverages the organization's structure to streamline log aggregation and normalization, making it an efficient solution for the specified requirements. The use of Amazon Athena for querying the log data further enhances the ability to analyze and respond to security findings across the organization.

Multi-factor authentication can add one more layer of security to your IAM account Even when you go to your Security Credentials dashboard one of the items is to enable MFA on your root account

C:\Users\wk\Desktop\mudassar\Untitled.jpg

Option A is invalid because you need to have a good password policy Option B is invalid because there is no IAM Geo-Lock Option D is invalid because this is not a recommended practices For more information on MFA, please visit the below URL

http://docs.IAM.amazon.com/IAM/latest/UserGuide/id credentials mfa.htmll

The correct answer is: Use MFA on all users and accounts, especially on the root account.

Submit your Feedback/Queries to our Experts

To resolve the issue of the Lambda function failing to create the report while adhering to the principle of least privilege, follow these steps:

Identify Required Permissions:

Determine the specific AWS Security Hub and Amazon Inspector actions the Lambda function needs to perform.

Common actions include:

securityhub:Get*

securityhub:List*

securityhub:Batch*

securityhub:Describe*

Create a Custom IAM Policy:

In the AWS Management Console, navigate to the IAM service.

Create a new policy with permissions tailored to the Lambda function's needs.

Define the policy to allow the necessary actions on the specific Security Hub resource.

For example:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": [

"securityhub:Get*",

"securityhub:List*",

"securityhub:Batch*",

"securityhub:Describe*"

],

"Resource": "arn:aws:securityhub:us-west-2::product/aws/inspector"

}

]

}

This policy grants the Lambda function the necessary read-only permissions to interact with Security Hub and Amazon Inspector.

Attach the Policy to the Lambda Execution Role:

Identify the IAM role associated with your Lambda function.

Attach the newly created custom policy to this role.

This ensures the Lambda function has the required permissions when invoked.

Test the Lambda Function:

Invoke the Lambda function to verify it can successfully create the report without permission errors.

Monitor the function's execution to ensure it operates as expected.

Implement Least Privilege Principle:

Regularly review and adjust the permissions to ensure they remain aligned with the function's requirements.

Remove any unnecessary permissions to minimize security risks.

Defining Lambda function permissions with an execution role: This AWS documentation provides guidance on creating and managing execution roles for Lambda functions, emphasizing the importance of granting least privilege access.

AWS Documentation

Managing permissions in AWS Lambda: This resource offers insights into best practices for managing permissions, including the use of identity-based and resource-based policies to control access to Lambda resources.

AWS Documentation

Grant least privilege access: Part of the AWS Well-Architected Framework, this document discusses the principle of least privilege and provides strategies for implementing it effectively within AWS environments.

AWS Documentation

AWS managed policies for AWS Lambda: This page details the AWS managed policies available for Lambda, which can serve as a starting point for creating custom policies tailored to specific needs.

AWS Documentation

Applying the principles of least privilege in AWS Lambda: This guide explores how to apply the principle of least privilege in AWS Lambda functions, focusing on avoiding granting wildcard permissions in IAM policies.

Orchestra

By following these steps and utilizing the referenced AWS documentation, you can ensure that your Lambda function has the necessary permissions to create the report while adhering to the principle of least privilege.