Itcertkr SCS-C03 최신 PDF 버전 시험 문제집을 무료로 Google Drive에서 다운로드하세요: https://drive.google.com/open?id=1qPk1-BCDJDuJECvK8r1_SDthZP7ptX7i
Amazon인증 SCS-C03시험을 패스하여 자격증을 취득하는게 꿈이라구요? Itcertkr에서 고객님의Amazon인증 SCS-C03시험패스꿈을 이루어지게 지켜드립니다. Itcertkr의 Amazon인증 SCS-C03덤프는 가장 최신시험에 대비하여 만들어진 공부자료로서 시험패스는 한방에 끝내줍니다.
| Certification Vendor: | Amazon Web Services (AWS) |
|---|---|
| Exam Name: | AWS Certified Security - Specialty (SCS-C03) |
| Exam Number: | SCS-C03 |
| Real Exam Qty: | 65 (multiple choice and multiple response) |
| Available Languages: | Simplified Chinese, English, Korean, Japanese |
| Certificate Validity Period: | 3 years |
| Related Certifications: | AWS Certified DevOps Engineer - Professional AWS Certified Advanced Networking - Specialty AWS Certified Solutions Architect - Associate AWS Certified Solutions Architect - Professional AWS Certified SysOps Administrator - Associate |
| Passing Score: | 750 (scaled score out of 1000) |
| Exam Duration: | 170 minutes |
| Exam Price: | $300 USD |
| Exam Format: | Multiple choice, Multiple response |
| Recommended Training: | AWS Certified Security - Specialty Exam Prep AWS Skill Builder - Security Learning Path |
| Exam Registration: | AWS Certification Portal AWS Certification Official Registration |
| Sample Questions: | Amazon SCS-C03 Sample Questions |
| Exam Way: | Online proctored or testing center (onsite) |
| Pre Condition: | No mandatory prerequisite, but recommended experience: 5+ years in IT security and 2+ years securing AWS workloads |
| Official Syllabus URL: | https://aws.amazon.com/certification/certified-security-specialty/ |
Amazon인증SCS-C03시험을 패스하여 자격증을 취득한다면 여러분의 미래에 많은 도움이 될 것입니다.Amazon인증SCS-C03시험자격증은 it업계에서도 아주 인지도가 높고 또한 알아주는 시험이며 자격증 하나로도 취직은 문제없다고 볼만큼 가치가 있는 자격증이죠.Amazon인증SCS-C03시험은 여러분이 it지식테스트시험입니다.
| 주제 | 소개 |
|---|---|
| 주제 1 |
|
| 주제 2 |
|
| 주제 3 |
|
| 주제 4 |
|
| 주제 5 |
|
질문 # 36
A security engineer needs to prepare Amazon EC2 instances for quarantine during a security incident. AWS Systems Manager Agent (SSM Agent) is installed, and a script exists to install and update forensic tools.
Which solution will quarantine EC2 instances during a security incident?
정답：A
설명：
AWS Systems Manager Run Command enables secure, remote execution of commands on EC2 instances without requiring network access or inbound ports. According to the AWS Certified Security - Specialty Study Guide, Run Command is a recommended mechanism for incident response actions such as installing forensic tools, collecting evidence, or applying quarantine controls.
By granting the SSM Agent permission to execute a predefined Run Command document, the security engineer can immediately run the quarantine script across affected instances. This approach supports automation, scalability, and auditability, all of which are critical during security incidents.
Options A, B, and C do not directly enforce quarantine or execute response actions. Tracking versions and storing scripts alone do not trigger incident response.
AWS documentation highlights Systems Manager Run Command as a core capability for automated containment and investigation.
Referenced AWS Specialty Documents:
AWS Certified Security - Specialty Official Study Guide
AWS Systems Manager Run Command
AWS Incident Response Automation
질문 # 37
A company has a web application that reads from and writes to an Amazon S3 bucket. The company needs to authenticate all S3 API calls with AWS credentials.
Which solution will provide the application with AWS credentials?
정답：C
설명：
Amazon Cognito identity pools provide temporary AWS credentials by exchanging web identity tokens with AWS STS using AssumeRoleWithWebIdentity. According to AWS Certified Security - Specialty documentation, this is the correct mechanism for granting applications AWS credentials.
User pools authenticate users but do not issue AWS credentials. Identity pools integrate with IAM roles and STS, enabling secure, temporary access to AWS services.
Referenced AWS Specialty Documents:
AWS Certified Security - Specialty Official Study Guide
Amazon Cognito Identity Pools
AWS STS Web Identity Federation
질문 # 38
A company uses an organization in AWS Organizations to manage multiple AWS accounts.
Users access AWS accounts by using IAM users and secret access keys. A security team requires all access to accounts to use temporary security credentials that expire after 60 minutes.
Users must use a SAML-based identity provider (IdP) to access the accounts.
Which solution will meet these requirements?
정답：D
설명：
AWS IAM Identity Center is the correct solution because it centrally manages access across AWS Organizations accounts, integrates with an external SAML identity provider, and issues temporary credentials for both console and CLI access. The session duration can be configured on permission sets, including a 60-minute limit, and users can retrieve short-lived credentials through the AWS CLI by signing in through IAM Identity Center. IAM users can then be removed so that all account access uses temporary credentials only.
질문 # 39
A company wants to establish separate AWS Key Management Service (AWS KMS) keys to use for different AWS services. The company's security engineer created the following key policy to allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructureDeployment IAM role:
{
"Version": "2012-10-17",
"Id": "key-policy-ebs",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Allow use of the key",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/aws-reserved/sso.amazonaws.com/InfrastructureDeployment"
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:ViaService": "ec2.us-west-2.amazonaws.com"
}
}
}
]
}
The security engineer recently discovered that IAM rolesother thanthe InfrastructureDeployment role used this key for other services.
Which change to the policy should the security engineer make to resolve these issues?
정답：C
설명：
AWS KMS key policies can restrict how and when a key is used by applyingconditions such as kms:
ViaService, which limits usage to requests that originate from a specific AWS service. According to the AWS Certified Security - Specialty Official Study Guide and AWS KMS documentation, the kms:ViaService condition is evaluated against the service that calls KMS on behalf of the principal.
Using StringEquals with kms:ViaService restricts usage toexactly one service endpoint. However, AWS services can invoke KMS throughservice variants, internal endpoints, or additional service integrations.
When StringEquals is used, these variations can unintentionally bypass the condition, allowing the key to be used by other services through different internal service paths.
Changing the condition operator from StringEquals to StringLike ensures thatonly EC2-related service calls that match the intended service pattern are allowed, while still preventing use by unrelated AWS services.
This aligns with AWS guidance to use StringLike when service invocation patterns may vary.
Option B is incorrect because the root principal statement is required to retain administrative control over the key. Option C is invalid because changing Regions does not address unauthorized service usage. Option D does not restrict key usage and does not mitigate the issue.
AWS documentation explicitly recommendstightening condition operatorsin KMS key policies to prevent unintended service access while maintaining required functionality.
* AWS Certified Security - Specialty Official Study Guide
* AWS Key Management Service Developer Guide
* AWS KMS Key Policy Best Practices
질문 # 40
A company is attempting to conduct forensic analysis on an Amazon EC2 instance, but the company is unable to connect to the instance by using AWS Systems Manager Session Manager. The company has installed AWS Systems Manager Agent (SSM Agent) on the EC2 instance.
The EC2 instance is in a subnet in a VPC that does not have an internet gateway attached. The company has associated a security group with the EC2 instance. The security group does not have inbound or outbound rules. The subnet's network ACL allows all inbound and outbound traffic.
Which combination of actions will allow the company to conduct forensic analysis on the EC2 instance without compromising forensic data? (Select THREE.)
정답：C,E,F
설명：
AWS Systems Manager Session Manager requires secure outbound HTTPS connectivity from the EC2 instance to Systems Manager endpoints. In a VPC without internet access, AWS Certified Security - Specialty documentation recommends using interface VPC endpoints to enable private connectivity without exposing the instance to the internet.
Creating a VPC interface endpoint for Systems Manager allows the SSM Agent to communicate securely with the Systems Manager service. The endpoint must have an attached security group that allows inbound traffic on port 443 from the VPC CIDR range. Additionally, the EC2 instance security group must allow outbound HTTPS traffic on port 443 so the agent can initiate connections.
Option C is incorrect because creating or associating key pairs enables SSH access, which can alter forensic evidence and violates forensic best practices. Option B is unnecessary because Session Manager does not require inbound rules on the EC2 instance. Option F is invalid because EC2 does not use interface endpoints for management connectivity.
This combination ensures secure, private access for forensic investigation while preserving evidence integrity and adhering to AWS incident response best practices.
질문 # 41
......
SCS-C03높은 통과율 시험덤프공부: https://www.itcertkr.com/SCS-C03_exam.html
그 외, Itcertkr SCS-C03 시험 문제집 일부가 지금은 무료입니다: https://drive.google.com/open?id=1qPk1-BCDJDuJECvK8r1_SDthZP7ptX7i