AWS Certified Security - Specialty

• #41

  An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installs the Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2 instances launch with an IAM role that has an IAM policy attached. The policy provides access to publish custom metrics to CloudWatch. The EC2 instances run in a private subnet inside a VPC The VPC provides access to the internet for private subnets through a NAT gateway. A security engineer notices that no logs are being published to CloudWatch Logs for the EC2 instances that the Auto Scaling group launches. The security engineer validates that the CloudWatch Logs agent is running and is configured properly on the EC2 instances. In addition, the security engineer validates that network communications are working properly to AWS services. What can the security engineer do to ensure that the logs are published to CloudWatch Logs?

  • AConfigure the IAM policy in use by the IAM role to have access to the required cloudwatch: API actions that will publish logs.
  • BAdjust the Amazon EC2 Auto Scaling service-linked role to have permissions to write to CloudWatch Logs.
  • CConfigure the IAM policy in use by the IAM role to have access to the required AWS logs: API actions that will publish logs.
  • DAdd an interface VPC endpoint to provide a route to CloudWatch Logs.
  Show answer
• #42Choose 2

  AWS CloudTrail is being used to monitor API calls in an organization. An audit revealed that CloudTrail is failing to deliver events to Amazon S3 as expected. What initial actions should be taken to allow delivery of CloudTrail events to S3? (Choose TWO)

  • AVerify that the S3 bucket policy allow CloudTrail to write objects.
  • BVerify that the IAM role used by CloudTrail has access to write to Amazon CloudWatch Logs.
  • CRemove any lifecycle policies on the S3 bucket that are archiving objects to Amazon Glacier.
  • DVerify that the S3 bucket defined in CloudTrail exists.
  • EVerify that the log file prefix defined in CloudTrail exists in the S3 bucket.
  Show answer
• #43

  A Security Engineer is troubleshooting an issue with a company's custom logging application. The application logs are written to an Amazon S3 bucket with event notifications enabled to send events to an Amazon SNS topic. All logs are encrypted at rest using an AWS KMS CMK. The SNS topic is subscribed to an encrypted Amazon SQS queue. The logging application polls the queue for new messages that contain metadata about the S3 object. The application then reads the content of the object from the S3 bucket for indexing. The Logging team reported that Amazon CloudWatch metrics for the number of messages sent or received is showing zero. No tags are being received. What should the Security Engineer do to troubleshoot this issue?

  • AOption A: Add the following statement to the IAM managed CMKs.
  • BOption B: Add the following statement to the CMK key policy.
  • COption C: Add the following statement to the CMK key policy.
  • DOption D: Add the following statement to the CMK key policy.
  Show answer
• #44

  An organization has three applications running on AWS, each accessing the same data on Amazon S3. The data on Amazon S3 is server-side encrypted by using an AWS KMS Customer Master Key (CMK). What is the recommended method to ensure that each application has its own programmatic access control permissions on the KMS CMK?

  • AChange the key policy permissions associated with the KMS CMK for each application when it must access the data in Amazon S3.
  • BHave each application assume an IAM role that provides permissions to use the AWS Certificate Manager CMK.
  • CHave each application use a grant on the KMS CMK to add or remove specific access controls on the KMS CMK.
  • DHave each application use an IAM policy in a user context to have specific access permissions on the KMS CMK.
  Show answer
• #45Choose 3

  A company has a single AWS account and uses an Amazon EC2 instance to test application code. The company recently discovered that the instance was compromised. The instance was serving up malware. The analysis of the instance showed that the instance was compromised 35 days ago. A security engineer must implement a continuous monitoring solution that automatically notifies the company's security team about compromised instances through an email distribution list for high severity findings. The security engineer must implement the solution as soon as possible. Which combination of steps should the security engineer take to meet these requirements? (Choose THREE)

  • AEnable AWS Security Hub in the AWS account.
  • BEnable Amazon GuardDuty in the AWS account.
  • CCreate an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team's email distribution list to the topic.
  • DCreate an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the security team's email distribution list to the queue.
  • ECreate an Amazon EventBridge rule for GuardDuty findings of high severity. Configure the rule to publish a message to the topic.
  • FCreate an Amazon EventBridge rule for Security Hub findings of high severity. Configure the rule to publish a message to the queue.
  Show answer
• #46Choose 2

  A Security Administrator has a website hosted in Amazon S3. The Administrator has been given the following requirements: Users may access the website by using an Amazon CloudFront distribution. Users may not access the website directly by using an Amazon S3 URL. Which configurations will support these requirements? (Choose TWO)

  • AAssociate an origin access identity with the CloudFront distribution.
  • BImplement a "Principal": "cloudfront.amazonaws.com" condition in the S3 bucket policy.
  • CModify the S3 bucket permissions so that only the origin access identity can access the bucket contents.
  • DImplement security groups so that the S3 bucket can be accessed only by using the intended CloudFront distribution.
  • EConfigure the S3 bucket policy so that it is accessible only through VPC endpoints, and place the CloudFront distribution into the specified VPC.
  Show answer
• #47Choose 2

  An ecommerce website was down for 1 hour following a DDoS attack Users were unable to connect to the website during the attack period. The ecommerce company's security team is worried about future potential attacks and wants to prepare for such events The company needs to minimize downtime in its response to similar attacks in the future. Which steps would help achieve this9 (Select TWO)

  • AEnable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
  • BSubscribe to AWS Shield Advanced and reach out to IAM Support in the event of an attack.
  • CUse VPC Flow Logs to monitor network: traffic and an IAM Lambda function to automatically block an attacker's IP using security groups.
  • DSet up an Amazon CloudWatch Events rule to monitor the AWS CloudTrail events in real time use IAM Config rules to audit the configuration, and use IAM Systems Manager for remediation.
  • EUse IAM WAF to create rules to respond to such attacks.
  Show answer
• #48

  A company deploys a set of standard IAM roles in AWS accounts. The IAM roles are based on job functions within the company. To balance operational efficiency and security, a security engineer implemented AWS Organizations SCPs to restrict access to critical security services in all company accounts. All of the company's accounts and OUs within AWS Organizations have a default FullAWSAccess SCP that is attached. The security engineer needs to ensure that no one can disable Amazon GuardDuty and AWS Security Hub. The security engineer also must not override other permissions that are granted by IAM policies that are defined in the accounts. Which SCP should the security engineer attach to the root of the organization to meet these requirements?

  • AOption A.
  • BOption B.
  • COption C.
  • DOption D.
  Show answer
• #49Choose 2

  The Security Engineer created a new AWS Key Management Service (AWS KMS) key with the following key policy. What are the effects of the key policy? (Choose TWO)

  • AThe policy allows access for the AWS account 111122223333 to manage key access though IAM policies.
  • BThe policy allows all IAM users in account 111122223333 to have full access to the KMS key.
  • CThe policy allows the root user in account 111122223333 to have full access to the KMS key.
  • DThe policy allows the KMS service-linked role in account 111122223333 to have full access to the KMS key.
  • EThe policy allows all IAM roles in account 111122223333 to have full access to the KMS key.
  Show answer
• #50

  A security engineer is designing an IAM policy for a script that will use the AWS CLI. The script currently assumes an IAM role that is attached to three AWS managed IAM policies: AmazonEC2FullAccess, AmazonDynamoDBFullAccess, and Ama-zonVPCFull Access. The security engineer needs to construct a least privilege IAM policy that will replace the AWS managed IAM policies that are attached to this role. Which solution will meet these requirements in the MOST operationally efficient way?

  • AIn AWS CloudTrail, create a trail for management events. Run the script with the existing AWS managed IAM policies. Use IAM Access Analyzer to generate a new IAM policy that is based on access activity in the trail. Replace the existing AWS managed IAM policies with the generated IAM poli-cy for the role.
  • BRemove the existing AWS managed IAM policies from the role. Attach the IAM Access Analyzer Role Policy Generator to the role. Run the script. Return to IAM Access Analyzer and generate a least privilege IAM policy. Attach the new IAM policy to the role.
  • CCreate an account analyzer in IAM Access Analyzer. Create an archive rule that has a filter that checks whether the Principal Arn value matches the ARN of the role. Run the script. Remove the existing AWS managed IAM policies from the role.
  • DIn AWS CloudTrail, create a trail for management events. Remove the existing AWS managed IAM policies from the role. Run the script. Find the authorization failure in the trail event that is associated with the script. Create a new IAM policy that includes the action and resource that caused the authorization failure. Repeat the process until the script succeeds. Attach the new IAM policy to the role.
  Show answer
• #51

  A company developed an application by using AWS Lambda, Amazon S3, Amazon Simple Notification Service (Amazon SNS), and Amazon DynamoDB. An external application puts objects into the company's S3 bucket and tags the objects with date and time. A Lambda function periodically pulls data from the company's S3 bucket based on date and time tags and inserts specific values into a DynamoDB table for further processing. The data includes personally identifiable information (Pll). The company must remove data that is older than 30 days from the S3 bucket and the DynamoDB table. Which solution will meet this requirement with the MOST operational efficiency?

  • AUpdate the Lambda function to add a TTL S3 flag to S3 objects. Create an S3 Lifecycle policy to expire objects that are older than 30 days by using the TTL S3 flag.
  • BCreate an S3 Lifecycle policy to expire objects that are older than 30 days. Update the Lambda function to add the TTL attribute in the DynamoDB table. Enable TTL on the DynamoDB table to expire entires that are older than 30 days based on the TTL attribute.
  • CCreate an S3 Lifecycle policy to expire objects that are older than 30 days and to add all prefixes to the S3 bucket. Update the Lambda function to delete entries that are older than 30 days.
  • DCreate an S3 Lifecycle policy to expire objects that are older than 30 days by using object tags. Update the Lambda function to delete entries that are older than 30 days.
  Show answer
• #52

  A company discovers a billing anomaly in its AWS account. A security consultant investigates the anomaly and discovers that an employee. Who left the company 30 days ago still has access to the account. The company has not monitored account activity in the past. The security consultant needs to determine. Which resources have been deployed or reconfigured by the employee as quickly as possible. Which solution will meet these requirements?

  • AIn AWS Cost Explorer, filter chart data to display results from the past 30 days. Export the results to a data table. Group the data table by re-source.
  • BUse AWS Cost Anomaly Detection to create a cost monitor. Access the detection history. Set the time frame to Last 30 days. In the search area, choose the service category.
  • CIn AWS CloudTrail, filter the event history to display results from the past 30 days. Create an Amazon Athena table that contains the data. Partition the table by event source.
  • DUse AWS Audit Manager to create an assessment for the past 30 days. Apply a usage-based framework to the assessment. Configure the assessment to assess by resource.
  Show answer
• #53Choose 3

  An application makes calls to AWS services using the AWS SDK. The application runs on Amazon EC2 instances with an associated IAM role. When the application attempts to access an object within an Amazon S3 bucket; the Administrator receives the following error message: HTTP 403: Access Denied. Which combination of steps should the Administrator take to troubleshoot this issue? (Choose THREE)

  • AConfirm that the EC2 instance's security group authorizes S3 access.
  • BVerify that the KMS key policy allows decrypt access for the KMS key for this IAM principle.
  • CCheck the S3 bucket policy for statements that deny access to objects.
  • DConfirm that the EC2 instance is using the correct key pair.
  • EConfirm that the IAM role associated with the EC2 instance has the proper privileges.
  • FConfirm that the instance and the S3 bucket are in the same Region.
  Show answer
• #54

  A company is testing its incident response plan for compromised credentials. The company runs a database on an Amazon EC2 instance and stores the sensitive data-base credentials as a secret in AWS Secrets Manager. The secret has rotation configured with an AWS Lambda function that uses the generic rotation function template. The EC2 instance and the Lambda function are deployed in the same private subnet. The VPC has a Secrets Manager VPC endpoint. A security engineer discovers that the secret cannot rotate. The security engineer determines that the VPC endpoint is working as intended. The Amazon Cloud-Watch logs contain the following error: "setSecret: Unable to log into database". Which solution will resolve this error?

  • AUse the AWS Management Console to edit the JSON structure of the secret in Secrets Manager so that the secret automatically conforms with the structure that the database requires.
  • BEnsure that the security group that is attached to the Lambda function al-lows outbound connections to the EC2 instance. Ensure that the security group that is attached to the EC2 instance allows inbound connections from the security group that is attached to the Lambda function.
  • CUse the Secrets Manager list-secrets command in the AWS CLI to list the secret. Identify the database
  • DAdd an internet gateway to the VPC. Create a NAT gateway in a public sub-net. Update the VPC route tables so that traffic from the Lambda function and traffic from the EC2 instance can reach the Secrets Manager public endpoint.
  Show answer
• #55

  A large company has hundreds of AWS accounts. The company needs to provide its employees with access to these accounts. The solution must maximize scalability and operational efficiency. Which solution meets these requirements?

  • AWith each AWS account, create dedicated IAM users that employees can assume through federation based upon group membership in their existing identity provider.
  • BUse a centralized account with IAM roles that employees can assume through federation with their existing identity provider. Create a custom authorizer by using AWS SDK to give federated users the ability to assume their target role in the resource accounts.
  • CImplement AWS Control Tower for multi-account management by integrating AWS Single Sign-On with the company's existing identity provider. Create IAM roles for the identity provider to assume.
  • DConfigure the IAM trust policies within each account's role to set up a trust back to the company's existing identity provider. Allow users to assume the role based on their SAML token.
  Show answer
• #56Choose 2

  The rule set in the virtual appliance is correct. Which of the following are other valid items to troubleshoot in this scenario? (Choose TWO)

  • AVerify that the 0.0.0.0/0 route in the route table for the Web server subnet points to a NAT gateway.
  • BVerify which Security Group is applied to the particular web server's elastic network interface (ENI).
  • CVerify that the 0.0.0.0/0 route in the route table for the Web server subnet points to the virtual security appliance.
  • DVerify the registered targets in the ALB.
  • EVerify that the 0.0.0.0/0 route in the public subnet points to a NAT gateway.
  Show answer
• #57

  A Solutions Architect is designing a web application that uses Amazon CloudFront, an Elastic Load Balancing Application Load Balancer, and an Auto Scaling group of Amazon EC2 instances. The load balancer and EC2 instances are in the US West (Oregon) region. It has been decided that encryption in transit is necessary by using a customer-branded domain name from the client to CloudFront and from CloudFront to the load balancer. Assuming that AWS Certificate Manager is used, how many certificates will need to be generated?

  • AOne in the US West (Oregon) region and one in the US East (Virginia) region.
  • BTwo in the US West (Oregon) region and none in the US East (Virginia) region.
  • COne in the US West (Oregon) region and none in the US East (Virginia) region.
  • DTwo in the US East (Virginia) region and none in the US West (Oregon) region.
  Show answer
• #58Choose 2

  A business requires a forensic logging solution for hundreds of Docker-based apps running on Amazon EC2. The solution must analyze logs in real time, provide message replay, and persist logs. Which Amazon Web Offerings (IAM) services should be employed to satisfy these requirements? (Select TWO)

  • AAmazon Athena.
  • BAmazon Kinesis.
  • CAmazon SQS.
  • DAmazon Elasticsearch.
  • EAmazon EMR.
  Show answer
• #59Choose 2

  A company is collecting AWS CloudTrail log data from multiple AWS accounts by managing individual trails in each account and forwarding log data to a centralized Amazon S3 bucket residing in a log archive account. After CloudTrail introduced support for AWS Organizations trails, the company decided to further centralize management and automate deployment of the CloudTrail logging capability across all of its AWS accounts. The company's security engineer created an AWS Organizations trail in the master account, enabled server-side encryption with AWS KMS managed keys (SSE-KMS) for the log files, and specified the same bucket as the storage location. However, the engineer noticed that logs recorded by the new trail were not delivered to the bucket. Which factors could cause this issue? (Select TWO)

  • AThe CMK key policy does not allow CloudTrail to make encrypt and decrypt API calls against the key.
  • BThe CMK key policy does not allow CloudTrail to make GenerateDataKey API calls against the key.
  • CThe IAM role used by the CloudTrail trail does not have permissions to make PutObject API calls against a folder created for the Organizations trail.
  • DThe S3 bucket policy does not allow CloudTrail to make PutObject API calls against a folder created for the Organizations trail.
  • EThe CMK key policy does not allow the IAM role used by the CloudTrail trail to use the key for crypto graphicaI operations.
  Show answer
• #60

  A company wants to prevent SSH access through the use of SSH key pairs for any Amazon Linux 2 Amazon EC2 instances in its AWS account. However, a system administrator occasionally will need to access these EC2 instances through SSH in an emergency. For auditing purposes, the company needs to record any commands that a user runs in an EC2 instance. What should a security engineer do to configure access to these EC2 instances to meet these requirements?

  • AUse the EC2 serial console. Configure the EC2 serial console to save all commands that are entered to an Amazon S3 bucket. Provide the EC2 instances with an IAM role that allows the EC2 serial console to access Amazon S3. Configure an IAM account for the system administrator. Provide an IAM policy that allows the IAM account to use the EC2 serial console.
  • BUse EC2 Instance Connect. Configure EC2 Instance Connect to save all commands that are entered to Amazon CloudWatch Logs. Provide the EC2 instances with an IAM role that allows the EC2 Instances to access CloudWatch Logs. Configure an IAM account for the system administrator. Provide an IAM policy that allows the IAM account to use EC2 Instance Connect.
  • CUse an EC2 key pair with an EC2 instance that needs SSH access. Access the EC2 instance with this key pair by using SSH. Configure the EC2 instance to save all commands that are entered to Amazon CloudWatch Logs. Provide the EC2 instance with an IAM role that allows the EC2 instance to access Amazon S3 and CloudWatch Logs.
  • DUse AWS Systems Manager Session Manager. Configure Session Manager to save all commands that are entered in a session to an Amazon S3 bucket. Provide the EC2 instances with an IAM role that allows Systems Manager to manage the EC2 instances. Configure an IAM account for the system administrator. Provide an IAM policy that allows the IAM account to use Session Manager.
  Show answer

Want to track your score, take timed mock exams and get AI explanations? Create a free account