AWS Certified Security - Specialty

• #3612টি বাছুন

  An organization is using Amazon CloudWatch Logs with agents deployed on its Linux Amazon EC2 instances. The agent configuration files have been checked and the application log files to be pushed are configured correctly. A review has identified that logging from specific instances is missing. Which steps should be taken to troubleshoot the issue? (Choose TWO)

  • AUse an EC2 run command to confirm that the awslogs service is running on all instances.
  • BVerify that the permissions used by the agent allow creation of log groups/streams and to put log events.
  • CCheck whether any application log entries were rejected because of invalid time stamps by reviewing /var/cwlogs/rejects.log.
  • DCheck that the trust relationship grants the service cwlogs.amazonaws.com permission to write objects to the Amazon S3 staging bucket.
  • EVerify that the time zone on the application servers is in UTC.
  উত্তর দেখুন
  💬আলোচনা
• #362

  A security engineer has created an Amazon Cognito user pool. The engineer needs to manually verify the ID and access token sent by the application for troubleshooting purposes. What is the MOST secure way to accomplish this?

  • AExtract the subject (sub), audience (aud), and cognito:username from the ID token payload Manually check the subject and audience for the user name In the user pool.
  • BSearch for the public key with a key ID that matches the key ID In the header of the token. Then use a JSON Web Token (JWT) library to validate the signature of the token and extract values, such as the expiry date.
  • CVerify that the token is not expired. Then use the token_use claim function In Amazon Cognito to validate the key IDs.
  • DCopy the JSON Web Token (JWT) as a JSON document Obtain the public JSON Web Key (JWK) and convert It to a pem file. Then use the file to validate the original JWT.
  উত্তর দেখুন
  💬আলোচনা
• #363

  What is the function of the following AWS Key Management Service (KMS) key policy attached to a customer master key (CMK)?

  • AThe Amazon WorkMail and Amazon SES services have delegated KMS encrypt and decrypt permissions to the ExampleUser principal in the 111122223333 account.
  • BThe ExampleUser principal can transparently encrypt and decrypt email exchanges specifically between ExampleUser and AWS.
  • CThe CMK is to be used for encrypting and decrypting only when the principal is ExampleUser and the request comes from WorkMail or SES in the specified region.
  • DThe key policy allows WorkMail or SES to encrypt or decrypt on behalf of the user for any CMK in the account.
  উত্তর দেখুন
  💬আলোচনা
• #364

  A security engineer is configuring a mechanism to send an alert when three or more failed sign-in attempts to the AWS Management Console occur during a 5-minute period. The security engineer creates a trail in AWS CloudTrail to assist in this work. Which solution will meet these requirements?

  • AIn CloudTrail, turn on Insights events on the trail. Configure an alarm on the insight with eventName matching ConsoleLogin and errorMessage matching Failed authentication. Configure a threshold of 3 and a period of 5 minutes.
  • BConfigure CloudTrail to send events to Amazon CloudWatch Logs. Create a metric filter for the relevant log group. Create a filter pattern with eventName matching ConsoleLogin and errorMessage matching Failed authentication. Create a CloudWatch alarm with a threshold of 3 and a period of 5 minutes.
  • CCreate an Amazon Athena table from the CloudTrail events. Run a query for eventName matching ConsoleLogin and for errorMessage matching Failed authentication. Create a notification action from the query to send an Amazon Simple Notification Service (Amazon SNS) notification when the count equals 3 within a period of 5 minutes.
  • DIn AWS Identity and Access Management Access Analyzer, create a new analyzer. Configure the analyzer to send an Amazon Simple Notification Service (Amazon SNS) notification when a failed sign-in event occurs 3 times for any IAM user within a period of 5 minutes.
  উত্তর দেখুন
  💬আলোচনা
• #365

  A Security Engineer receives alerts that an Amazon EC2 instance on a public subnet is under an SFTP brute force attack from a specific IP address, which is a known malicious bot. What should the Security Engineer do to block the malicious bot?

  • AAdd a deny rule to the public VPC security group to block the malicious IP.
  • BAdd the malicious IP to IAM WAF backhsted IPs.
  • CConfigure Linux iptables or Windows Firewall to block any traffic from the malicious IP.
  • DModify the hosted zone in Amazon Route 53 and create a DNS sinkhole for the malicious IP.
  উত্তর দেখুন
  💬আলোচনা
• #366

  A company deploys a distributed web application on a fleet of Amazon EC2 instances. The fleet is behind an Application Load Balancer (ALB) that will be configured to terminate the TLS connection. All TLS traffic to the ALB must stay secure, even if the certificate private key is compromised. How can a security engineer meet this requirement?

  • ACreate an HTTPS listener that uses a certificate that is managed by IAM Certificate Manager (ACM).
  • BCreate an HTTPS listener that uses a security policy that uses a cipher suite with perfect toward secrecy (PFS).
  • CCreate an HTTPS listener that uses the Server Order Preference security feature.
  • DCreate a TCP listener that uses a custom security policy that allows only cipher suites with perfect forward secrecy (PFS).
  উত্তর দেখুন
  💬আলোচনা
• #3672টি বাছুন

  A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises data center for compliance reasons. The database is sensitive to network latency. Additionally, the data that travels between the on-premises data center and AWS must have IPsec encryption. Which combination of AWS solutions will meet these requirements? (Choose TWO)

  • AAWS Site-to-Site VPN.
  • BAWS Direct Connect.
  • CAWS VPN CloudHub.
  • DVPC peering.
  • ENAT gateway.
  উত্তর দেখুন
  💬আলোচনা
• #3683টি বাছুন

  A security engineer is working with a company to design an ecommerce application. The application will run on Amazon EC2 instances that run in an Auto Scaling group behind an Application Load Balancer (ALB). The application will use an Amazon RDS DB instance for its database. The only required connectivity from the internet is for HTTP and HTTPS traffic to the application. The application must communicate with an external payment provider that allows traffic only from a preconfigured allow list of IP addresses. The company must ensure that communications with the external payment provider are not interrupted as the environment scales. Which combination of actions should the security engineer recommend to meet these requirements? (Choose THREE)

  • ADeploy a NAT gateway in each private subnet for every Availability Zone that is in use.
  • BPlace the DB instance in a public subnet.
  • CPlace the DB instance in a private subnet.
  • DConfigure the Auto Scaling group to place the EC2 instances in a public subnet.
  • EConfigure the Auto Scaling group to place the EC2 instances in a private subnet.
  • FDeploy the ALB in a private subnet.
  উত্তর দেখুন
  💬আলোচনা
• #369

  For compliance reasons, an organization limits the use of resources to three specific AWS regions. It wants to be alerted when any resources are launched in unapproved regions. Which of the following approaches will provide alerts on any resources launched in an unapproved region?

  • ADevelop an alerting mechanism based on processing AWS CloudTrail logs.
  • BMonitor Amazon S3 Event Notifications for objects stored in buckets in unapproved regions.
  • CAnalyze Amazon CloudWatch Logs for activities in unapproved regions.
  • DUse AWS Trusted Advisor to alert on all resources being created.
  উত্তর দেখুন
  💬আলোচনা
• #3702টি বাছুন

  A company that uses AWS Organizations wants to see AWS Security Hub findings for many AWS accounts and AWS Regions. Some of the accounts are in the company's organization, and some accounts are in organizations that the company manages for customers. Although the company can see findings in the Security Hub administrator account for accounts in the company's organization, there are no findings from accounts in other organizations. Which combination of steps should the company take to see findings from accounts that are outside the organization that includes the Security Hub administrator account? (Select TWO)

  • AUse a designated administration account to automatically set up member accounts.
  • BCreate the AWS Service Role ForSecurrty Hub service-linked rote for Security Hub.
  • CSend an administration request from the member accounts.
  • DEnable Security Hub for all member accounts.
  • ESend invitations to accounts that are outside the company's organization from the Security Hub administrator account.
  উত্তর দেখুন
  💬আলোচনা
• #371

  A Development team has asked for help configuring the IAM roles and policies in a new AWS account. The team using the account expects to have hundreds of master keys and therefore does not want to manage access control for customer master keys (CMKs). Which of the following will allow the team to manage AWS KMS permissions in IAM without the complexity of editing individual key policies?

  • AThe account's CMK key policy must allow the account's IAM roles to perform KMS EnableKey.
  • BNewly created CMKs must have a key policy that allows the root principal to perform all actions.
  • CNewly created CMKs must allow the root principal to perform the kms CreateGrant API operation.
  • DNewly created CMKs must mirror the IAM policy of the KMS key administrator.
  উত্তর দেখুন
  💬আলোচনা
• #3722টি বাছুন

  A company has multiple VPCs in their account that are peered, as shown in the diagram. A Security Engineer wants to perform penetration tests of the Amazon EC2 instances in all three VPCs. How can this be accomplished? (Choose TWO)

  • ADeploy a pre-authorized scanning engine from the AWS Marketplace into VPC B, and use it to scan instances in all three VPCs. Do not complete the penetration test request form.
  • BDeploy a pre-authorized scanning engine from the Marketplace into each VPC, and scan instances in each VPC from the scanning engine in that VPC. Do not complete the penetration test request form.
  • CCreate a VPN connection from the data center to VPC A. Use an on-premises scanning engine to scan the instances in all three VPCs. Complete the penetration test request form for all three VPCs.
  • DCreate a VPN connection from the data center to each of the three VPCs. Use an on-premises scanning engine to scan the instances in each VPC. Do not complete the penetration test request form.
  • ECreate a VPN connection from the data center to each of the three VPCs. Use an on-premises scanning engine to scan the instances in each VPC. Complete the penetration test request form for all three VPCs.
  উত্তর দেখুন
  💬আলোচনা
• #373

  A company has an AWS account and allows a third-party contractor who uses another AWS account, to assume certain IAM roles. The company wants to ensure that IAM roles can be assumed by the contractor only if the contractor has multi-factor authentication enabled on their IAM user accounts. What should the company do to accomplish this?

  • AAdd the following condition to the IAM policy attached to all IAM roles: "Effect": "Deny", "Condition" : { "BoolItExists" : { "aws:MultiFactorAuthPresent" : false } }.
  • BAdd the following condition to the IAM policy attached to all IAM roles: "Effect": "Deny", "Condition" : { "Bool" : { "aws:MultiFactorAuthPresent" : false } }.
  • CAdd the following condition to the IAM policy attached to all IAM roles: "Effect": "Allow", "Condition" : { "Null" : { "aws:MultiFactorAuthPresent" : false } }.
  • DAdd the following condition to the IAM policy attached to all IAM roles: "Effect": "Allow", "Condition" : { "BoolItExists" : { "aws:MultiFactorAuthPresent" : false } }.
  উত্তর দেখুন
  💬আলোচনা
• #374

  A company wants to establish separate AWS Key Management Service (AWS KMS) keys to use for different AWS services. The company's security engineer created the following key policy to allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructueDeployment IAM role. The security engineer recently discovered that IAM roles other than the InfrastructureDeployment role used this key for other services. Which change to the policy should the security engineer make to resolve these issues?

  • AIn the statement block that contains the Sid Allow use of the key, under the Condition block, change StringEquals to StringLike.
  • BIn the policy document, remove the statement block that contains the Sid Enable IAM User Permissions. Add key management policies to the KMS policy.
  • CIn the statement block that contains the Sid Allow use of the key, under the Condition block, change the kms:ViaService value to ec2.us-east-1.amazonaws.com.
  • DIn the policy document, add a new statement block that grants the kms:Disable permission to the security engineer's IAM role.
  উত্তর দেখুন
  💬আলোচনা
• #375

  A Security Engineer has been asked to create an automated process to disable IAM user access keys that are more than three months old. Which of the following options should the Security Engineer use?

  • AIn the AWS Console, choose the IAM service and select Users. Review the Access Key Age column.
  • BDefine an IAM policy that denies access if the key age is more than three months and apply to all users.
  • CWrite a script that uses the GenerateCredentialReport, GetCredentialReport, and UpdateAccessKey APIs.
  • DCreate an Amazon CloudWatch alarm to detect aged access keys and use an AWS Lambda function to disable the keys older than 90 days.
  উত্তর দেখুন
  💬আলোচনা
• #376

  A Security Engineer noticed an anomaly within a company EC2 instance as shown in the image The Engineer must now investigate. What is causing the anomaly. What are the MOST effective steps to take to ensure that the instance is not further manipulated while allowing the Engineer to understand what happened?

  • ARemove the instance from the Auto Scaling group Place the instance within an isolation security group, detach the EBS volume launch an EC2 instance with a forensic toolkit and attach the E8S volume to investigate.
  • BRemove the instance from the Auto Scaling group and the Elastic Load Balancer Place the instance within an isolation security group, launch an EC2 instance with a forensic toolkit, and allow the forensic toolkit image to connect to the suspicious Instance to perform the Investigation.
  • CRemove the instance from the Auto Scaling group Place the Instance within an isolation security group, launch an EC2 Instance with a forensic toolkit and use the forensic toolkit imago to deploy an ENI as a network span port to inspect all traffic coming from the suspicious instance.
  • DRemove the instance from the Auto Scaling group and the Elastic Load Balancer Place the instance within an isolation security group, make a copy of the EBS volume from a new snapshot, launch an EC2 Instance with a forensic toolkit and attach the copy of the EBS volume to investigate.
  উত্তর দেখুন
  💬আলোচনা
• #377

  A company has a customer master key (CMK) with imported key materials. Company policy requires that all encryption keys must be rotated every year. What can be done to implement the above policy?

  • AEnable automatic key rotation annually for the CMK.
  • BUse AWS Command Line Interface to create an AWS Lambda function to rotate the existing CMK annually.
  • CImport new key material to the existing CMK and manually rotate the CMK.
  • DCreate a new CMK, import new key material to it, and point the key alias to the new CMK.
  উত্তর দেখুন
  💬আলোচনা
• #378

  A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots. The company uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt all Amazon Elastic Block Store (Amazon EBS) snapshots. The company performs a gap analysis of its disaster recovery procedures and backup strategies. A security engineer needs to implement a solution so that the company can recover the EC2 instances if the AWS account is compromised and the EBS snapshots are deleted. Which solution will meet this requirement?

  • ACreate a new Amazon S3 bucket. Use EBS lifecycle policies to move EBS snapshots to the new S3 bucket. Use lifecycle policies to move snapshots to the S3 Glacier Instant Retrieval storage class. Use S3 Object Lock to prevent deletion of the snapshots.
  • BUse AWS Systems Manager to distribute a configuration that backs up all attached disks to Amazon S3.
  • CCreate a new AWS account that has limited privileges. Allow the new account to access the KMS key that encrypts the EBS snapshots. Copy the encrypted snapshots to the new account on a recurring basis.
  • DUse AWS Backup to copy EBS snapshots to Amazon S3. Use S3 Object Lock to prevent deletion of the snapshots.
  উত্তর দেখুন
  💬আলোচনা
• #379

  An company is using AWS Secrets Manager to store secrets that are encrypted using a CMK and are stored in the security account 111122223333. One of the company's production accounts. 444455556666, must to retrieve the secret values from the security account 111122223333. A security engineer needs to apply a policy to the secret in the security account based on least privilege access so the production account can retrieve the secret value only. Which policy should the security engineer apply?

  • AOption A.
  • BOption B.
  • COption C.
  • DOption D.
  উত্তর দেখুন
  💬আলোচনা
• #380

  A Security Engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled. While testing the solution, the Security Engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?

  • AThe log files fail integrity validation and automatically are marked as unavailable.
  • BThe KMS key policy does not grant the Security Engineer's IAM user or role permissions to decrypt with it.
  • CThe bucket is set up to use server-side encryption with Amazon S3-managed keys (SSE-S3) as the default and does not allow SSE-KMS-encrypted files.
  • DAn IAM policy applicable to the Security Engineer's IAM user or role denies access to the CloudTrail/ prefix in the Amazon S3 bucket.
  উত্তর দেখুন
  💬আলোচনা

নিজের স্কোর রাখতে, সময়সীমার মক পরীক্ষা দিতে ও AI ব্যাখ্যা পেতে চান? বিনামূল্যে অ্যাকাউন্ট খুলুন