AWS Certified Security - Specialty

• #261

  A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store's application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account. The company uses AWS Organizations and has an OU that is used only for these accounts. The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company's deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access. The security engineer already has created an AWS CloudFormation template that implements the deployment plan. What should the security engineer do next to meet the requirements in the MOST secure way?

  • ACreate an AWS Service Catalog portfolio in the organization's management account. Upload the CloudFormation template. Add the template to the portfolio's product list. Share the portfolio with the OU.
  • BUse the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. In the OU, create an SCP that allows access to the extension.
  • CCreate an AWS Service Catalog portfolio in the organization's management account. Upload the CloudFormation template. Add the template to the portfolio's product list. Create an IAM role that has a trust policy that allows cross-account access to the portfolio for users in the OU accounts. Attach the AWSServiceCatalogEndUserFullAccess managed policy to the role.
  • DUse the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. Share the extension with the OU.
  উত্তর দেখুন
• #262

  A Security Engineer must design a solution that enables the incident Response team to audit for changes to a user's IAM permissions in the case of a security incident. How can this be accomplished?

  • AUse AWS Config to review the IAM policy assigned to users before and after the incident.
  • BRun the GenerateCredentialReport via the AWS CLI, and copy the output to Amazon S3 daily for auditing purposes.
  • CCopy AWS CloudFormation templates to S3, and audit for changes from the template.
  • DUse Amazon EC2 Systems Manager to deploy images, and review AWS CloudTrail logs for changes.
  উত্তর দেখুন
• #263

  A security engineer is asked to update an AW3 CoudTrail log file prefix for an existing trail. When attempting to save the change in the CloudTrail console, the security engineer receives the following error message. There is a problem with the bucket policy.. What will enable the security engineer to saw the change?

  • ACreate a new trail with the updated log file prefix, and then delete the original nail Update the existing bucket policy in the Amazon S3 console with the new log the prefix, and then update the log file prefix in the CloudTrail console.
  • BUpdate the existing bucket policy in the Amazon S3 console to allow the security engineers principal to perform PutBucketPolicy, and then update the log file prefix in the CloudTrail console.
  • CUpdate the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail console.
  • DUpdate the existing bucket policy in the Amazon S3 console to allow the security engineers principal to perform GetBucketPolicy, and then update the log file prefix in the CloudTrail console.
  উত্তর দেখুন
• #264

  A company is using AWS Organizations to manage multiple AWS accounts for its human resources, finance, software development, and production departments. All the company's developers are part of the software development AWS account. The company discovers that developers have launched Amazon EC2 instances that were preconfigured with software that the company has not approved for use. The company wants to implement a solution to ensure that developers can launch EC2 instances with only approved software applications and only in the software development AWS account. Which solution will meet these requirements?

  • AIn the software development account, create AMIs of preconfigured instances that include only approved software. Include the AMI IDs in the condition section of an AWS CloudFormation template to launch the appropriate AMI based on the AWS Region. Provide the developers with the CloudFormation template to launch EC2 instances in the software development account.
  • BCreate an Amazon EventBridge rule that runs when any EC2 RunInstances API event occurs in the software development account. Specify AWS Systems Manager Run Command as a target of the rule. Configure Run Command to run a script that will install all approved software onto the instances that the developers launch.
  • CUse an AWS Service Catalog portfolio that contains EC2 products with appropriate AMIs that include only approved software. Grant the developers permission to access only the Service Catalog portfolio to launch a product in the software development account.
  • DIn the management account, create AMIs of preconfigured instances that include only approved software. Use AWS CloudFormation StackSets to launch the AMIs across any AWS account in the organization. Grant the developers permission to launch the stack sets within the management account.
  উত্তর দেখুন
• #2653টি বাছুন

  A recent security audit identified that a company's application team injects database credentials into the environment variables of an AWS Fargate task. The company's security policy mandates that all sensitive data be encrypted at rest and in transit. When combination of actions should the security team take to make the application compliant within the security policy? (Select THREE)

  • AStore the credentials securely in a file in an Amazon S3 bucket with restricted access to the application team IAM role Ask the application team to read the credentials from the S3 object instead.
  • BCreate an AWS Secrets Manager secret and specify the key/value pairs to be stored in this secret.
  • CModify the application to pull credentials from the AWS Secrets Manager secret instead of the environment variables.
  • DAdd the following statement to the container instance IAM role policy.
  • EAdd the following statement to the execution role policy.
  • FLog in to the AWS Fargate instance, create a script to read the secret value from AWS Secret Manager, and inject the environment variables. Ask the application team to redeploy the application.
  উত্তর দেখুন
• #266

  A company's Director of information Security wants a daily email report from AWS that contains recommendations for each company account to meet AWS Security best practices. Which solution would meet these requirements?

  • AIn every AWS account, configure AWS Lambda to query me AWS Support API for AWS Trusted Advisor security checks Send the results from Lambda to an Amazon SNS topic to send reports.
  • BConfigure Amazon GuardDuty in a master account and invite all other accounts to be managed by the master account Use GuardDuty's integration with Amazon SNS to report on findings.
  • CUse Amazon Athena and Amazon QuickSight to build reports off of AWS CloudTrail Create a daily Amazon CloudWatch trigger to run the report dally and email It using Amazon SNS.
  • DUse AWS Artifact's prebuilt reports and subscriptions Subscribe the Director of Information Security to the reports by adding the Director as the security alternate contact for each account.
  উত্তর দেখুন
• #267

  A company has a web-based application using Amazon CloudFront and running on Amazon Elastic Container Service (Amazon ECS) behind an Application Load Balancer (ALB). The ALB is terminating TLS and balancing load across ECS service tasks A security engineer needs to design a solution to ensure that application content is accessible only through CloudFront and that I is never accessible directly. How should the security engineer build the MOST secure solution?

  • AAdd an origin custom header. Set the viewer protocol policy to HTTP and HTTPS. Set the origin protocol pokey to HTTPS only. Update the application to validate the CloudFront custom header.
  • BAdd an origin custom header. Set the viewer protocol policy to HTTPS only. Set the origin protocol policy to match viewer. Update the application to validate the CloudFront custom header.
  • CAdd an origin custom header. Set the viewer protocol policy to redirect HTTP to HTTPS. Set the origin protocol policy to HTTP only. Update the application to validate the CloudFront custom header.
  • DAdd an origin custom header. Set the viewer protocol policy to redirect HTTP to HTTPS. Set the origin protocol policy to HTTPS only. Update the application to validate the CloudFront custom header.
  উত্তর দেখুন
• #2682টি বাছুন

  A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS account. Which solutions will provide the Lambda function this access? (Select TWO)

  • ACreate an IAM user that has only programmatic access. Create a new access key pair. Add environmental variables to the Lambda function with the access key ID and secret access key. Modify the Lambda function to use the environmental variables at run time during communication with Amazon S3.
  • BGenerate an Amazon EC2 key pair. Store the private key in AWS Secrets Man-ager. Modify the Lambda function to retrieve the private key from Secrets Manager and to use the private key during communication with Amazon S3.
  • CCreate an IAM role for the Lambda function. Attach an IAM policy that al-lows access to the S3 bucket.
  • DCreate an IAM role for the Lambda function. Attach a bucket policy to the S3 bucket to allow access. Specify the function's IAM role as the principal.
  • ECreate a security group. Attach the security group to the Lambda function. Attach a bucket policy that allows access to the S3 bucket through the security group ID.
  উত্তর দেখুন
• #2693টি বাছুন

  A company's application runs on Amazon EC2 and stores data in an Amazon S3 bucket. The company wants additional security controls in place to limit the likelihood of accidental exposure of data to external parties. Which combination of actions will meet this requirement? (Select THREE)

  • AEncrypt the data in Amazon S3 using server-side encryption with Amazon S3 managed encryption keys (SSE-S3)
  • BEncrypt the data in Amazon S3 using server-side encryption with AWS KMS managed encryption keys (SSE-KMS)
  • CCreate a new Amazon S3 VPC endpoint and modify the VPC's routing tables to use the new endpoint.
  • DUse the Amazon S3 Block Public Access feature.
  • EConfigure the bucket policy to allow access from the application instances only.
  • FUse a NACL to filter traffic to Amazon S3.
  উত্তর দেখুন
• #2702টি বাছুন

  An application has been built with Amazon EC2 instances that retrieve messages from Amazon SQS. Recently, IAM changes were made and the instances can no longer retrieve messages. What actions should be taken to troubleshoot the issue while maintaining least privilege? (Choose TWO)

  • AConfigure and assign an MFA device to the role used by the instances.
  • BVerify that the SQS resource policy does not explicitly deny access to the role used by the instances.
  • CVerify that the access key attached to the role used by the instances is active.
  • DAttach the AmazonSQSFullAccess managed policy to the role used by the instances.
  • EVerify that the role attached to the instances contains policies that allow access to the queue.
  উত্তর দেখুন
• #271

  A Security Engineer discovers that developers have been adding rules to security groups that allow SSH and RDP traffic from 0.0.0.0/0 instead of the organization firewall IP. What is the most efficient way to remediate the risk of this activity?

  • ADelete the internet gateway associated with the VPC.
  • BUse network access control lists to block source IP addresses matching 0.0.0.0/0.
  • CUse a host-based firewall to prevent access from all but the organization's firewall IP.
  • DUse AWS Config rules to detect 0.0.0.0/0 and invoke an AWS Lambda function to update the security group with the organization's firewall IP.
  উত্তর দেখুন
• #272

  A Security Engineer must add additional protection to a legacy web application by adding the following HTTP security headers: -Content Security-Policy -X-Frame-Options -X-XSS-Protection. The Engineer does not have access to the source code of the legacy web application. Which of the following approaches would meet this requirement?

  • AConfigure an Amazon Route 53 routing policy to send all web traffic that does not include the required headers to a black hole.
  • BImplement an AWS Lambda@Edge origin response function that inserts the required headers.
  • CMigrate the legacy application to an Amazon S3 static website and front it with an Amazon CloudFront distribution.
  • DConstruct an AWS WAF rule to replace existing HTTP headers with the required security headers by using regular expressions.
  উত্তর দেখুন
• #2732টি বাছুন

  A company has an application that uses an Amazon RDS PostgreSQL database. The company is developing an application feature that will store sensitive information for an individual in the database. During a security review of the environment, the company discovers that the RDS DB instance is not encrypting data at rest. The company needs a solution that will provide encryption at rest for all the existing data and for any new data that is entered for an individual. Which combination of options can the company use to meet these requirements? (Select TWO)

  • ACreate a snapshot of the DB instance. Copy the snapshot to a new snapshot, and enable encryption for the copy process. Use the new snapshot to restore the DB instance.
  • BModify the configuration of the DB instance by enabling encryption. Create a snapshot of the DB instance. Use the snapshot to restore the DB instance.
  • CUse IAM Key Management Service (AWS KMS) to create a new default IAM managed awards key. Select this key as the encryption key for operations with Amazon RDS.
  • DUse IAM Key Management Service (AWS KMS) to create a new CMK. Select this key as the encryption key for operations with Amazon RDS.
  • ECreate a snapshot of the DB instance. Enable encryption on the snapshoVUse the snapshot to restore the DB instance.
  উত্তর দেখুন
• #274

  A Security Engineer must enforce the use of only Amazon EC2, Amazon S3, Amazon RDS, Amazon DynamoDB, and AWS STS in specific accounts. What is a scalable and efficient approach to meet this requirement?

  • ASet up an AWS Organizations hierarchy, and replace the FullAWSAccess policy with the following Service Control Policy for the governed organization units.
  • BCreate multiple IAM users for the regulated accounts, and attach the following policy statement to restrict services as required.
  • CSet up an Organizations hierarchy, replace the global FullAWSAccess with the following Service Control Policy at the top level.
  • DSet up all users in the Active Directory for federated access to all accounts in the company. Associate Active Directory groups with IAM groups, and attach the following policy statement to restrict services as required.
  উত্তর দেখুন
• #275

  An application uses Amazon Cognito to manage end users' permissions when directly accessing AWS resources, including Amazon DynamoDB. A new feature request reads as follows: Provide a mechanism to mark customers as suspended pending investigation or suspended permanently. Customers should still be able to log in when suspended, but should not be able to make changes. The priorities are to reduce complexity and avoid potential for future security issues. Which approach will meet these requirements and priorities?

  • ACreate a new database field suspended_status and modify the application logic to validate that field when processing requests.
  • BAdd suspended customers to second Cognito user pool and update the application login flow to check both user pools.
  • CUse Amazon Cognito Sync to push out a suspension_status parameter and split the IAM policy into normal users and suspended users.
  • DMove suspended customers to a second Cognito group and define an appropriate IAM access policy for the group.
  উত্তর দেখুন
• #276

  An organization receives an alert that indicates that an EC2 instance behind an ELB Classic Load Balancer has been compromised. What techniques will limit lateral movement and allow evidence gathering?

  • ARemove the instance from the load balancer and terminate it.
  • BRemove the instance from the load balancer, and shut down access to the instance by tightening the security group.
  • CReboot the instance and check for any Amazon CloudWatch alarms.
  • DStop the instance and make a snapshot of the root EBS volume.
  উত্তর দেখুন
• #277

  A company hosts a web-based application that captures and stores sensitive data in an Amazon DynamoDB table. A security audit reveals that the application does not provide end-to-end data protection or the ability to detect unauthorized data changes. The software engineering team needs to make changes that will address the audit findings. Which set of steps should the software engineering team take?

  • AUse an AWS Key Management Service (AWS KMS) CMK. Encrypt the data at rest.
  • BUse AWS Certificate Manager (ACM) Private Certificate Authority Encrypt the data in transit.
  • CUse a DynamoDB encryption client. Use client-side encryption and sign the table items.
  • DUse the AWS Encryption SDK. Use client-side encryption and sign the table items.
  উত্তর দেখুন
• #278

  A systems engineer deployed containers from several custom-built images that an application team provided through a QA workflow The systems engineer used Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type as the target platform The system engineer now needs to collect logs from all containers into an existing Amazon CloudWatch log group. Which solution will meet this requirement?

  • ATurn on the awslogs log driver by specifying parameters for awslogs-group and awslogs-region m the LogConfiguration property.
  • BDownload and configure the CloudWatch agent on the container instances.
  • CSet up Fluent Bit and FluentO as a DaemonSet to send logs to Amazon CloudWatch Logs.
  • DConfigure an IAM policy that includes the togs CreateLogGroup action Assign the policy to the container instances.
  উত্তর দেখুন
• #279

  A company uses an external identity provider to allow federation into different IAM accounts. A security engineer for the company needs to identify the federated user that terminated a production Amazon EC2 instance a week ago. What is the FASTEST way for the security engineer to identify the federated user?

  • AReview the AWS CloudTrail event history logs in an Amazon S3 bucket and look for the Terminatelnstances event to identify the federated user from the role session name.
  • BFilter the AWS CloudTrail event history for the Terminatelnstances event and identify the assumed IAM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username.
  • CSearch the AWS CloudTrail logs for the Terminatelnstances event and note the event time. Review the IAM Access Advisor tab for all federated roles. The last accessed time should match the time when the instance was terminated.
  • DUse Amazon Athena to run a SQL query on the AWS CloudTrail logs stored in an Amazon S3 bucket and filter on the Terminatelnstances event. Identify the corresponding role and run another query to filter the AssumeRoleWithWebldentity event for the user name.
  উত্তর দেখুন
• #280

  A company is running internal microservices on Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type. The company is using Amazon Elastic Container Registry (Amazon ECR) private repositories. A security engineer needs to encrypt the private repositories by using AWS Key Management Service (AWS KMS). The security engineer also needs to analyze the container images for any common vulnerabilities and exposures (CVEs). Which solution will meet these requirements?

  • AEnable KMS encryption on the existing ECR repositories. Install Amazon Inspector Agent from the ECS container instances' user data. Run an assessment with the CVE rules.
  • BRecreate the ECR repositories with KMS encryption and ECR scanning enabled. Analyze the scan report after the next push of images.
  • CRecreate the ECR repositories with KMS encryption and ECR scanning enabled. Install AWS Systems
  • DEnable KMS encryption on the existing ECR repositories. Use AWS Trusted Advisor to check the ECS container instances and to verily the findings against a list of current CVEs.
  উত্তর দেখুন

নিজের স্কোর রাখতে, সময়সীমার মক পরীক্ষা দিতে ও AI ব্যাখ্যা পেতে চান? বিনামূল্যে অ্যাকাউন্ট খুলুন