Login/Register
This topic focuses on identifying security threats and responding to incidents in AWS environments. Candidates learn how to design effective incident response plans, detect anomalies using AWS security services, and take immediate action to protect compromised resources. Mastering this area ensures readiness to handle real-world security incidents efficiently.
This section emphasizes the importance of continuous monitoring and logging for maintaining security visibility. Candidates learn how to configure logging services, analyze logs, and create alerting systems to detect suspicious activities. It also includes troubleshooting logging solutions to ensure accurate and reliable security monitoring.
This topic covers securing AWS infrastructure, including networks, edge services, and compute resources. Candidates learn how to implement security controls, protect workloads, and reduce risks across cloud environments. The focus is on building resilient and secure architectures that can defend against potential threats.
This section focuses on controlling access to AWS resources through secure identity management. Candidates learn how to design and implement authentication and authorization mechanisms, manage users and roles, and apply best practices for least privilege access. Strong IAM skills are essential for protecting cloud environments.
This topic explains how to secure sensitive data in AWS environments. Candidates learn techniques for protecting data both at rest and in transit using encryption and key management services. It also includes managing data lifecycle policies and safeguarding credentials to ensure data confidentiality and integrity.
This section focuses on governance, compliance, and centralized security management in AWS. Candidates learn how to manage multiple accounts, enforce security policies, and conduct audits to identify vulnerabilities. It also covers aligning cloud environments with compliance standards and implementing best practices for secure resource management.
Exam Name:
AWS Certified Security - Specialty (old)
Registration Code:
SCS-C02
Related Certification:
Amazon Specialty Certification
Certification Provider:
Amazon
Correct Answer: C
To avoid AccessDeniedExceptions when users first attempt to encrypt using the CMK, the security specialist should recommend the following solution:
Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. This allows the engineering team to use the grant token as a form of temporary authorization for the grant.
Instruct users to use that grant token in their call to encrypt. This allows the users to use the grant token as a proof that they have permission to use the CMK, and to avoid any eventual consistency issues with the grant creation.
To securely store the API key, the security team should do the following:
Create a secret in AWS Secrets Manager in the security account to store the API key using AWS Key Management Service (AWS KMS) for encryption. This allows the security team to encrypt and manage the API key centrally, and to configure automatic rotation schedules for it.
Grant access to the IAM role used by the Lambda function so that the function can retrieve the key from Secrets Manager and call the API. This allows the security team to avoid storing the API key with the source code, and to use IAM policies to control access to the secret.
Correct Answer: C
