AWS Certified Security - Specialty

• #21

  The InfoSec team has mandated that in the future only approved Amazon Machine Images (AMIs) can be used. How can the InfoSec team ensure compliance with this mandate?

  • ATerminate all Amazon EC2 instances and relaunch them with approved AMIs.
  • BPatch all running instances by using AWS Systems Manager.
  • CDeploy AWS Config rules and check all running instances for compliance.
  • DDefine a metric filter in Amazon CloudWatch Logs to verify compliance.
  উত্তর দেখুন
• #22

  A company does not allow the permanent installation of SSH keys onto an Amazon Linux 2 EC2 instance. However, three employees who have IAM user accounts require access to the EC2 instance. The employees must use an SSH session to perform critical duties. How can a security engineer provide the appropriate access to the EC2 instance to meet these requirements?

  • AUse AWS Systems Manager Inventory to select the EC2 instance and connect. Provide the IAM user accounts with the permissions to use Systems Manager Inventory.
  • BUse AWS Systems Manager Run Command to open an SSH connection to the EC2 instance. Provide the IAM user accounts with the permissions to use Run Command.
  • CUse AWS Systems Manager Session Manager. Provide the IAM user accounts with the permissions to use Systems Manager Session Manager.
  • DConnect to the EC2 instance as the ec2-user through the AWS Management Console's EC2 SSH client method. Provide the IAM user accounts with access to use the EC2 service in the AWS Management Console.
  উত্তর দেখুন
• #23

  A company is designing a multi-account structure for its development teams. The company is using AWS Organizations and AWS Single Sign-On (AWS SSO). The company must implement a solution so that the development teams can use only specific AWS Regions and so that each AWS account allows access to only specific AWS services. Which solution will meet these requirements with the LEAST operational overhead?

  • AUse AWS SSO to set up service-linked roles with IAM policy statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
  • BDeactivate AWS Security Token Service (AWS STS) in Regions that the developers are not allowed to use.
  • CCreate SCPs that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
  • DFor each AWS account, create tailored identity-based policies for AWS SSO. Use statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
  উত্তর দেখুন
• #242টি বাছুন

  A company uses Amazon API Gateway to present REST APIs to users. An API developer wants to analyze API access patterns without the need to parse the log files. Which combination of steps will meet these requirements with the LEAST effort? (Select TWO)

  • AConfigure access logging for the required API stage.
  • BConfigure an AWS CloudTrail trail destination for API Gateway events. Configure filters on the userldentity, userAgent, and sourcelPAddress fields.
  • CConfigure an Amazon S3 destination for API Gateway logs. Run Amazon Athena queries to analyze API access information.
  • DUse Amazon CloudWatch Logs Insights to analyze API access information.
  • ESelect the Enable Detailed CloudWatch Metrics option on the required API stage.
  উত্তর দেখুন
• #25

  Which option for the use of the AWS Key Management Service (KMS) supports key management best practices that focus on minimizing the potential scope of data exposed by a possible future key compromise?

  • AUse KMS automatic key rotation to replace the master key, and use this new master key for future encryption operations without re-encrypting previously encrypted data.
  • BGenerate a new Customer Master Key (CMK), re-encrypt all existing data with the new CMK, and use it for all future encryption operations.
  • CChange the CMK alias every 90 days, and update key-calling applications with the new key alias.
  • DChange the CMK permissions to ensure that individuals who can provision keys are not the same individuals who can use the keys.
  উত্তর দেখুন
• #26

  A company plans to create individual child accounts within an existing organization in IAM Organizations for each of its DevOps teams. AWS CloudTrail has been enabled and configured on all accounts to write audit logs to an Amazon S3 bucket in a centralized IAM account. A security engineer needs to ensure that DevOps team members are unable to modify or disable this configuration. How can the security engineer meet these requirements?

  • ACreate an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to the IAM account root user.
  • BCreate an S3 bucket policy in the specified destination account for the CloudTrail trail that prohibits configuration changes from the IAM account root user in the source account.
  • CCreate an SCP that prohibits changes to the specific CloudTrail trail and apply the SCP to the appropriate organizational unit or account in Organizations.
  • DCreate an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to a new IAM group. Have team members use individual IAM accounts that are members of the new IAM group.
  উত্তর দেখুন
• #273টি বাছুন

  A recent security audit found that AWS CloudTrail logs are insufficiently protected from tampering and unauthorized access. Which actions must the Security Engineer take to address these audit findings? (Select THREE)

  • AEnsure CloudTrail log file validation is turned on.
  • BConfigure an S3 lifecycle rule to periodically archive CloudTrail logs into Glacier for long-term storage.
  • CUse an S3 bucket with tight access controls that exists m a separate account.
  • DUse Amazon Inspector to monitor the file integrity of CloudTrail log files.
  • ERequest a certificate through ACM and use a generated certificate private key to encrypt CloudTrail log files.
  • FEncrypt the CloudTrail log files with server-side encryption with AWS KMS-managed keys (SSE-KMS).
  উত্তর দেখুন
• #28

  A company's database developer has just migrated an Amazon RDS database credential to be stored and managed by AWS Secrets Manager. The developer has also enabled rotation of the credential within the Secrets Manager console and set the rotation to change every 30 days. After a short period of time, a number of existing applications have failed with authentication errors. What is the MOST likely cause of the authentication errors?

  • AMigrating the credential to RDS requires that all access come through requests to the Secrets Manager.
  • BEnabling rotation in Secrets Manager causes the secret to rotate immediately, and the applications are using the earlier credential.
  • CThe Secrets Manager IAM policy does not allow access to the RDS database.
  • DThe Secrets Manager IAM policy does not allow access for the applications.
  উত্তর দেখুন
• #29

  A security engineer is configuring a new website that is named example.com. The security engineer wants to secure communications with the website by requiring users to connect to example.com through HTTPS. Which of the following is a valid option for storing SSL/TLS certificates?

  • ACustom SSL certificate that is stored in AWS Key Management Service (AWS KMS).
  • BDefault SSL certificate that is stored in Amazon CloudFront.
  • CCustom SSL certificate that is stored in AWS Certificate Manager (ACM).
  • DDefault SSL certificate that is stored in Amazon S3.
  উত্তর দেখুন
• #302টি বাছুন

  A company's Security Engineer has been asked to monitor and report all AWS account root user activities. Which of the following would enable the Security Engineer to monitor and report all root user activities? (Select TWO)

  • AConfiguring AWS Organizations to monitor root user API calls on the paying account.
  • BCreating an Amazon CloudWatch Events rule that will trigger when any API call from the root user is reported.
  • CConfiguring Amazon Inspector to scan the AWS account for any root user activity.
  • DConfiguring AWS Trusted Advisor to send an email to the Security team when the root user logs in to the console.
  • EUsing Amazon SNS to notify the target group.
  উত্তর দেখুন
• #31

  You need to create a policy and apply it for just an individual user. How could you accomplish this in the right way?

  • AAdd an IAM managed policy for the user.
  • BAdd a service policy for the user.
  • CAdd an IAM role for the user.
  • DAdd an inline policy for the user.
  উত্তর দেখুন
• #32

  A company needs to use HTTPS when connecting to its web applications to meet compliance requirements. These web applications run in Amazon VPC on Amazon EC2 instances behind an Application Load Balancer (ALB). A security engineer wants to ensure that the load balancer win only accept connections over port 443. even if the ALB is mistakenly configured with an HTTP listener. Which configuration steps should the security engineer take to accomplish this task?

  • ACreate a security group with a rule that denies Inbound connections from 0.0.0.0/0 on port 00. Attach this security group to the ALB to overwrite more permissive rules from the ALB's default security group.
  • BCreate a network ACL that denies inbound connections from 0 0.0.0/0 on port 80 Associate the network ACL with the VPC s internet gateway.
  • CCreate a network ACL that allows outbound connections to the VPC IP range on port 443 only. Associate the network ACL with the VPC's internet gateway.
  • DCreate a security group with a single inbound rule that allows connections from 0.0.0.0/0 on port 443. Ensure this security group is the only one associated with the ALB.
  উত্তর দেখুন
• #33

  The Security Engineer has discovered that a new application that deals with highly sensitive data is storing Amazon S3 objects with the following key pattern, which itself contains highly sensitive data. Pattern: "randomID_datestamp_PII.csv" Example: "1234567_12302017_000-00-0000 csv" The bucket where these objects are being stored is using server-side encryption (SSE). Which solution is the most secure and cost-effective option to protect the sensitive data?

  • ARemove the sensitive data from the object name, and store the sensitive data using S3 user-defined metadata.
  • BAdd an S3 bucket policy that denies the action s3:GetObject.
  • CUse a random and unique S3 object key, and create an S3 metadata index in Amazon DynamoDB using client-side encrypted attributes.
  • DStore all sensitive objects in Binary Large Objects (BLOBS) in an encrypted Amazon RDS instance.
  উত্তর দেখুন
• #343টি বাছুন

  A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS. Which steps should be taken to authenticate to AWS services using the company's on-premises Active Directory? (Choose THREE)

  • ACreate IAM roles with permissions corresponding to each Active Directory group.
  • BCreate IAM groups with permissions corresponding to each Active Directory group.
  • CCreate a SAML provider with IAM.
  • DCreate a SAML provider with Amazon Cloud Directory.
  • EConfigure AWS as a trusted relying party for the Active Directory.
  • FConfigure IAM as a trusted relying party for Amazon Cloud Directory.
  উত্তর দেখুন
• #35

  A Security Engineer is working with the development team to design a supply chain application that stores sensitive inventory data in an Amazon S3 bucket. The application will use an AWS KMS customer master key (CMK) to encrypt the data on Amazon S3. The inventory data on Amazon S3 will be shared of vendors. All vendors will use AWS principals from their own AWS accounts to access the data on Amazon S3. The vendor list may change weekly, and the solution must support cross-account access. What is the MOST efficient way to manage access control for the KMS CMK7?

  • AUse KMS grants to manage key access. Programmatically create and revoke grants to manage vendor access.
  • BUse an IAM role to manage key access. Programmatically update the IAM role policies to manage vendor access.
  • CUse KMS key policies to manage key access. Programmatically update the KMS key policies to manage vendor access.
  • DUse delegated access across AWS accounts by using IAM roles to manage key access. Programmatically update the IAM trust policy to manage cross- account vendor access.
  উত্তর দেখুন
• #36

  An organization has a system in AWS that allows a large number of remote workers to submit data files. File sizes vary from a few kilobytes to several megabytes. A recent audit highlighted a concern that data files are not encrypted while in transit over untrusted networks. Which solution would remediate the audit finding while minimizing the effort required?

  • AUpload an SSL certificate to IAM, and configure Amazon CloudFront with the passphrase for the private key.
  • BCall KMS.Encrypt() in the client, passing in the data file contents, and call KMS.Decrypt() server-side.
  • CUse AWS Certificate Manager to provision a certificate on an Elastic Load Balancing in front of the web service's servers.
  • DCreate a new VPC with an Amazon VPC VPN endpoint, and update the web service's DNS record.
  উত্তর দেখুন
• #37

  A company wants to monitor the deletion of AWS Key Management Service (AWS KMS) customer managed keys. A security engineer needs to create an alarm that will notify the company before a KMS key is deleted. The security engineer has configured the integration of AWS CloudTrail with Amazon CloudWatch. What should the security engineer do next to meet these requirements?

  • ASpecify the deletion time of the key material during KMS key creation. Create a custom AWS Config rule to assess the key's scheduled deletion. Configure the rule to trigger upon a configuration change. Send a message to an Amazon Simple Notification Service (Amazon SNS) topic if the key is scheduled for deletion.
  • BCreate an Amazon EventBridge rule to detect KMS API calls of DeleteAlias. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the EventBridge rule.
  • CCreate an Amazon EventBridge rule to detect KMS API calls of DisableKey and ScheduleKeyDeletion. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the EventBridge rule.
  • DCreate an Amazon Simple Notification Service (Amazon SNS) policy to detect KMS API calls of RevokeGrant and ScheduleKeyDeletion. Create an AWS Lambda function to generate the alarm and send the notification to the company. Add the Lambda function as the target of the SNS policy.
  উত্তর দেখুন
• #38

  Example.com is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). Third-party host intrusion detection system (HIDS) agents that capture the traffic of the EC2 instance are running on each host. The company must ensure they are using privacy enhancing technologies for users, without losing the assurance the third-party solution offers. What is the MOST secure way to meet these requirements?

  • AEnable TLS pass through on the ALB, and handle decryption at the server using Elliptic Curve Diffie-Hellman (ECDHE) cipher suites.
  • BCreate a listener on the ALB that uses encrypted connections with Elliptic Curve Diffie-Hellman (ECDHE) cipher suites, and pass the traffic in the clear to the server.
  • CCreate a listener on the ALB that uses encrypted connections with Elliptic Curve Diffie-Hellman (ECDHE) cipher suites, and use encrypted connections to the servers that do not enable Perfect Forward Secrecy (PFS).
  • DCreate a listener on the ALB that does not enable Perfect Forward Secrecy (PFS) cipher suites, and use encrypted connections to the servers using Elliptic Curve Diffie-Hellman (ECDHE) cipher suites.
  উত্তর দেখুন
• #39

  A company's Security Officer is concerned about the risk of AWS account root user logins and has assigned a Security Engineer to implement a notification solution for near-real-time alerts upon account root user logins. How should the Security Engineer meet these requirements?

  • ACreate a cron job that runs a script to download the AWS IAM security credentials. We parse the file for account root user logins and email the Security team's distribution list.
  • BRun AWS CloudTrail logs through Amazon CloudWatch Events to detect account roo4 user logins and trigger an AWS Lambda function to send an Amazon SNS notification to the Security team's distribution list.
  • CSave AWS CloudTrail logs to an Amazon S3 bucket in the Security team's account Process the CloudTrail logs with the Security Engineer's logging solution for account root user logins Send an Amazon SNS notification to the Security team upon encountering the account root user login events.
  • DSave VPC Plow Logs to an Amazon S3 bucket in the Security team's account and process the VPC Flow Logs with their logging solutions for account root user logins Send an Amazon SNS notification to the Security team upon encountering the account root user login events.
  উত্তর দেখুন
• #40

  A security engineer is checking an AWS CloudFormation template for vulnerabilities. The security engineer finds a parameter that has a default value that exposes an application's API key in plaintext. The parameter is referenced several times throughout the template. The security engineer must replace the parameter while maintaining the ability to reference the value in the template. Which solution will meet these requirements in the MOST secure way?

  • AStore the API key value as a SecureString parameter in AWS Systems Manager Parameter Store. In the template, replace all references to the value with {{resolve:ssm:MySSMParameterName:1}}.
  • BStore the API key value in AWS Secrets Manager. In the template, replace all references to the value with {{resolve:secretsmanager:MySecretId:SecretString}}.
  • CStore the API key value in Amazon DynamoDB. In the template, replace all references to the value with {{resolve:dynamodb:MyTableName:MyPrimaryKey}}.
  • DStore the API key value in a new Amazon S3 bucket. In the template, replace all references to the value with {{resolve:s3:MyBucketName:MyObjectName}}.
  উত্তর দেখুন

নিজের স্কোর রাখতে, সময়সীমার মক পরীক্ষা দিতে ও AI ব্যাখ্যা পেতে চান? বিনামূল্যে অ্যাকাউন্ট খুলুন