SCS-C02 Leak Questions

One can use the IAM Encryption CLI to encrypt the data before sending it across to the S3 bucket. Options A and C are invalid because this would still mean that data is transferred in plain text Option D is invalid because you cannot just enable client side encryption for the S3 bucket For more information on Encrypting and Decrypting data, please visit the below URL:

The correct answer is: Use the IAM Encryption CLI to encrypt the data first Submit your Feedback/Queries to our Experts

The steps that the Security Engineer should take to check for known vulnerabilities and limit the attack surface are:

B. Review the application security groups to ensure that only the necessary ports are open. This is a good practice to reduce the exposure of the EC2 instances to potential attacks from the Internet.Application security groups are a feature of Azure that allow you to group virtual machines and define network security policies based on those groups1.

D. Use Amazon Inspector to periodically scan the backend instances. This is a service that helps you to identify vulnerabilities and exposures in your EC2 instances and applications.Amazon Inspector can perform automated security assessments based on predefined or custom rules packages2.

Using Amazon Verified Permissions:

Verified Permissions is designed for fine-grained authorization using policies.

It supports integrating identity sources like Amazon Cognito for user-based permissions.

Integrate Cognito with Verified Permissions:

Configure the Cognito identity pool as the identity provider for Verified Permissions.

Use user attributes from Cognito to define policies in Verified Permissions.

Create a Policy Store:

Define a policy store in Verified Permissions to manage and evaluate fine-grained permissions.

Map Cognito Tokens to Schema:

Use Cognito's access tokens to map user attributes (e.g., roles, groups) to the Verified Permissions schema.

Advantages:

Fine-Grained Authorization: Allows precise control over resource access based on user attributes.

Scalability: Centralized policy management supports large-scale applications.

Amazon Verified Permissions Documentation

Using Cognito with Verified Permissions