AWS Certified Specialty SCS-C02 Exam Questions and Answers PDF

Enable Amazon Macie for Sensitive Data Discovery (Option A):

Use Amazon Macie to identify personal health information (PHI) in S3 buckets.

Create an on-demand sensitive data discovery job with the PERSONAL_INFORMATION managed data identifier.

Enable AWS Audit Manager for Compliance Evidence (Option C):

Use AWS Audit Manager to automate evidence collection for compliance.

Select a supported framework (e.g., HIPAA) to assess compliance readiness.

Enable AWS Security Hub for Public Access Monitoring (Option E):

Enable Security Hub and use the AWS Foundational Security Best Practices standard.

Review the dashboard for failed controls related to S3 Block Public Access.

Advantages:

Automated Discovery: Macie and Security Hub reduce manual effort.

Centralized Compliance Management: Audit Manager streamlines evidence collection.

Amazon Macie Documentation

AWS Audit Manager Documentation

AWS Security Hub Documentation

To configure DNSSEC for a domain registered with Route 53, the most operationally efficient solution is to migrate the zone to Route 53 with DNSSEC signing enabled, create a key-signing key (KSK) that is based on an AWS Key Management Service (AWS KMS) customer managed key, and add a delegation signer (DS) record to the parent zone. This way, Route 53 handles the zone-signing key (ZSK) and the signing of the records in the hosted zone, and the customer only needs to manage the KSK in AWS KMS and provide the DS record to the domain registrar. Option A is incorrect because it does not involve migrating the zone to Route 53, which would simplify the DNSSEC configuration. Option B is incorrect because it creates both a ZSK and a KSK based on AWS KMS customer managed keys, which is unnecessary and less efficient than letting Route 53 manage the ZSK. Option C is incorrect because it does not involve migrating the zone to Route 53, and it requires running the dnssec-signzone command manually, which is less efficient than letting Route 53 sign the zone automatically.Verified References:

the reason why there were no alerts on the sudo commands. Sudo commands are commands that allow a user to execute commands as another user, usually the superuser or root. CloudWatch Logs agent is a software agent that can send log data from an EC2 instance to CloudWatch Logs, a service that monitors and stores log data. The CloudWatch Logs agent needs an IAM instance profile, which is a container for an IAM role that allows applications running on an EC2 instance to make API requests to AWS services. If the IAM instance profile on the EC2 instance was not properly configured to allow the CloudWatch Logs agent to push the logs to CloudWatch, then there would be no alerts on the sudo commands. The other options are either irrelevant or invalid for explaining why there were no alerts on the sudo commands.