AWS Certified Security - Specialty

• #1813 चुनें

  A company has multiple production AWS accounts. Each account has AWS CloudTrail configured to log to a single Amazon S3 bucket in a central account. Two of the production accounts have trails that are not logging anything to the S3 bucket. Which steps should be taken to troubleshoot the issue? (Choose THREE)

  • AVerify that the log file prefix is set to the name of the S3 bucket where the logs should go.
  • BVerify that the S3 bucket policy allows access for CloudTrail from the production AWS account IDs.
  • CCreate a new CloudTrail configuration in the account, and configure it to log to the account's S3 bucket.
  • DConfirm in the CloudTrail Console that each trail is active and healthy.
  • EOpen the global CloudTrail configuration in the master account, and verify that the storage location is set to the correct S3 bucket.
  • FConfirm in the CloudTrail Console that the S3 bucket name is set correctly.
  उत्तर दिखाएँ
• #182

  A company uses AWS Organizations to run workloads in multiple AWS accounts. Currently the individual team members at the company access all Amazon EC2 instances remotely by using SSH or Remote Desktop Protocol (RDP) The company does not have any audit trails and security groups are occasionally open. The company must secure access management and implement a centralized togging solution. Which solution will meet these requirements MOST securely?

  • AConfigure trusted access for AWS System Manager in Organizations. Configure a bastion host from the management account. Replace SSH and RDP by using Systems Manager Session Manager from the management account Configure Session Manager logging to Amazon CloudWatch Logs.
  • BReplace SSH and RDP with AWS Systems Manager Session Manager. Install Systems Manager Agent (SSM Agent) on the instances Attach the.
  • CAmazonSSMManagedlnstanceCore role to the instances. Configure session data streaming to Amazon CloudWatch Logs. Create a separate logging account that has appropriate cross-account permissions to audit the log data.
  • DInstall a bastion host in the management account. Reconfigure all SSH and RDP to allow access only from the bastion host Install AWS Systems Manager Agent (SSM Agent) on the bastion host Attach the AmazonSSMManagedlnstanceCore role to the bastion host. Configure session data streaming to Amazon CloudWatch Logs in a separate logging account to audit log data.
  • EReplace SSH and RDP with AWS Systems Manager State Manager. Install Systems Manager Agent (SSM Agent) on the instances Attach the AmazonSSMManagedlnstanceCore role to the instances. Configure session data streaming to Amazon CloudTrail. Use CloudTrail Insights to analyze the trail data.
  उत्तर दिखाएँ
• #1832 चुनें

  A company's security policy requires that VPC Flow Logs are enabled on all VPCs. A Security Engineer is looking to automate the process of auditing the VPC resources for compliance. What combination of actions should the Engineer take? (Choose TWO)

  • ACreate an AWS Lambda function that determines whether Flow Logs are enabled for a given VPC.
  • BCreate an AWS Config configuration item for each VPC in the company AWS account.
  • CCreate an AWS Config managed rule with a resource type of AWS:: Lambda:: Function.
  • DCreate an Amazon CloudWatch Event rule that triggers on events emitted by AWS Config.
  • ECreate an AWS Config custom rule, and associate it with an AWS Lambda function that contains the evaluating logic.
  उत्तर दिखाएँ
• #184

  An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication: After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication?

  • AChange the value of aws:MultiFactorAuthPresent to true.
  • BInstruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication ―-serial-number and -―token-code parameters. Use these resulting values to make API/CLI calls.
  • CImplement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
  • DCreate a role and enforce multi-factor authentication in the role trust policy Instruct users to run the aws sts assume-role CLI command and pass –-serial-number and ―-token-code parameters Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.
  उत्तर दिखाएँ
• #185

  A company hosts an application on Amazon EC2 that is subject to specific rules for regulatory compliance. One rule states that traffic to and from the workload must be inspected for network-level attacks. This involves inspecting the whole packet. To comply with this regulatory rule, a security engineer must install intrusion detection software on a c5n.4xlarge EC2 instance. The engineer must then configure the software to monitor traffic to and from the application instances. What should the security engineer do next?

  • APlace the network interface in promiscuous mode to capture the traffic.
  • BConfigure VPC Flow Logs to send traffic to the monitoring EC2 instance using a Network Load Balancer.
  • CConfigure VPC traffic mirroring to send traffic to the monitoring EC2 instance using a Network Load Balancer.
  • DUse Amazon Inspector to detect network-level attacks and trigger an IAM Lambda function to send the suspicious packets to the EC2 instance.
  उत्तर दिखाएँ
• #186

  A company is building applications in containers. The company wants to migrate its on-premises development and operations services from its on-premises data center to AWS. Management states that production systems must be cloud agnostic and use the same configuration and administrator tools across production systems. A solutions architect needs to design a managed solution that will align open-source software. Which solution meets these requirements?

  • ALaunch the containers on Amazon EC2 with EC2 instance worker nodes.
  • BLaunch the containers on Amazon Elastic Kubernetes Service (Amazon EKS) and EKS worker nodes.
  • CLaunch the containers on Amazon Elastic Containers service (Amazon ECS) with AWS Fargate instances.
  • DLaunch the containers on Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 instance worker nodes.
  उत्तर दिखाएँ
• #1872 चुनें

  A company that uses AWS Organizations is migrating workloads to AWS. The company's application team determines that the workloads will use Amazon EC2 instances, Amazon S3 buckets, Amazon DynamoDB tables, and Application Load Balancers. For each resource type, the company mandates that deployments must comply with the following requirements: All EC2 instances must be launched from approved AWS accounts. All DynamoDB tables must be provisioned with a standardized naming convention. All infrastructure that is provisioned in any accounts in the organization must be deployed by AWS CloudFormation templates. Which combination of steps should the application team take to meet these requirements? (Choose TWO)

  • ACreate CloudFormation templates in an administrator AWS account. Share the stack sets with an application AWS account. Restrict the template to be used specifically by the application AWS account.
  • BCreate CloudFormation templates in an application AWS account. Share the output with an administrator AWS account ta review compliant resources. Restrict output to only the administrator AWS account.
  • CUse permissions boundaries to prevent the application AWS account from provisioning specific resources unless conditions for the internal compliance requirements are met.
  • DUse SCPs to prevent the application AWS account from provisioning specific resources unless conditions for the internal compliance requirements are met.
  • EActivate AWS Config managed rules for each service in the application AWS account.
  उत्तर दिखाएँ
• #188

  A company has a compliance requirement to rotate its encryption keys on an annual basis. A Security Engineer needs a process to rotate the KMS Customer Master Keys (CMKs) that were created using imported key material. How can the Engineer perform the key rotation process MOST efficiently?

  • ACreate a new CMK, and redirect the existing Key Alias to the new CMK.
  • BSelect the option to auto-rotate the key.
  • CUpload new key material into the existing CMK.
  • DCreate a new CMK, and change the application to point to the new CMK.
  उत्तर दिखाएँ
• #189

  A company had one of its Amazon EC2 key pairs compromised. A Security Engineer must identify which current Linux EC2 instances were deployed and used the compromised key pair. How can this task be accomplished?

  • AObtain the list of instances by directly querying Amazon EC2 using: aws ec2 describe-instances –fi1ters "Name=key-name,Values=KEYNAMEHERE".
  • BObtain the fingerprint for the key pair from the AWS Management Console, then search for the fingerprint in the Amazon Inspector logs.
  • CObtain the output from the EC2 instance metadata using: curl http: //169.254.169.254/latest/meta-data/public- keys/0/.
  • DObtain the fingerprint for the key pair from the AWS Management Console, then search for the fingerprint in Amazon CloudWatch Logs using: aws logs filter-log-events.
  उत्तर दिखाएँ
• #190

  A company uses AWS Organizations and has production workloads across multiple AWS accounts. A security engineer needs to design a solution that will proactively monitor for suspicious behavior across all the accounts that contain production workloads. The solution must automate remediation of incidents across the production accounts. The solution also must publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when a critical security finding is detected. In addition, the solution must send all security incident logs to a dedicated account. Which solution will meet these requirements?

  • AActivate Amazon GuardDuty in each production account. In a dedicated logging account, aggregate all GuardDuty logs from each production account. Remediate incidents by configuring GuardDuty to directly invoke an AWS Lambda function. Configure the Lambda function to also publish notifications to the SNS topic.
  • BActivate AWS Security Hub in each production account. In a dedicated logging account, aggregate all Security Hub findings from each production account. Remediate incidents by using AWS Config and AWS Systems Manager. Configure Systems Manager to also publish notifications to the SNS topic.
  • CActivate Amazon GuardDuty in each production account. In a dedicated logging account, aggregate all GuardDuty logs from each production account. Remediate incidents by using Amazon EventBridge to invoke a custom AWS Lambda function from the GuardDuty findings. Configure the Lambda function to also publish notifications to the SNS topic.
  • DActivate AWS Security Hub in each production account. In a dedicated logging account, aggregate all Security Hub findings from each production account. Remediate incidents by using Amazon EventBridge to invoke a custom AWS Lambda function from the Security Hub findings. Configure the Lambda function to also publish notifications to the SNS topic.
  उत्तर दिखाएँ
• #1912 चुनें

  A Security Engineer is building a Java application that is running on Amazon EC2. The application communicates with an Amazon RDS instance and authenticates with a user name and password. Which combination of steps can the Engineer take to protect the credentials and minimize downtime when the credentials are rotated? (Choose TWO)

  • AHave a Database Administrator encrypt the credentials and store the ciphertext in Amazon S3. Grant permission to the instance role associated with the EC2 instance to read the object and decrypt the ciphertext.
  • BConfigure a scheduled job that updates the credential in AWS Systems Manager Parameter Store and notifies the Engineer that the application needs to be restarted.
  • CConfigure automatic rotation of credentials in AWS Secrets Manager.
  • DStore the credential in an encrypted string parameter in AWS Systems Manager Parameter Store. Grant permission to the instance role associated with the EC2 instance to access the parameter and the AWS KMS key that is used to encrypt it.
  • EConfigure the Java application to catch a connection failure and make a call to AWS Secrets Manager to retrieve updated credentials when the password is rotated. Grant permission to the instance role associated with the EC2 instance to access Secrets Manager.
  उत्तर दिखाएँ
• #192

  A company's data lake uses Amazon S3 and Amazon Athena. The company's security engineer has been asked to design an encryption solution that meets the company's data protection requirements. The encryption solution must work with Amazon S3 and keys managed by the company. The encryption solution must be protected in a hardware security module that is validated to Federal Information Processing Standards (FIPS) 140-2 Level 3. Which solution meets these requirements?

  • AUse client-side encryption with an AWS KMS customer-managed key implemented with the AWS Encryption SDK.
  • BUse AWS CloudHSM to store the keys and perform cryptographic operations. Save the encrypted text in Amazon S3.
  • CUse an AWS KMS customer-managed key that is backed by a custom key store using AWS CloudHSM.
  • DUse an AWS KMS customer-managed key with the bring your own key (BYOK) feature to import a key stored in AWS CloudHSM.
  उत्तर दिखाएँ
• #1932 चुनें

  A DevOps team is planning to deploy a containerized application on Amazon Elastic Container Service (Amazon ECS). The team will use an Application Load Balancer (ALB) to distribute the incoming traffic for the ECS application. A security engineer needs to terminate the TLS traffic at the ALB to ensure security of data in transit. Which solutions can the security engineer use to create a certificate and deploy the certificate at the ALB to meet these requirements? (Choose TWO)

  • AUse TLS tools to create a certificate signing request (CSR). Get the CSR signed by a certificate authority (CA) to produce a certificate. Import the certificate into AWS Certificate Manager (ACM).
  • BUse AWS Certificate Manager (ACM) to request a certificate. Specify the certificate fort the TLS listener on the ALB.
  • CUse AWS Key Management Service (AWS KMS) tools to create a certificate signing request (CSR). Get the CSR signed by a certificate authority (CA) to produce a certificate. Import the certificate into AWS Certificate Manager (ACM). Specify the certificate for the TLS listener on the ALB.
  • DConfigure automatic TLS support in the ECS cluster. Configure the ALB to pass the TLS connection to the containers in the cluster.
  • EGenerate a certificate while creating the ECS cluster. Import the certificate into AWS Certificate Manager (ACM). Specify the certificate for the TLS listener on the ALB.
  उत्तर दिखाएँ
• #194

  A company uses HTTP Live Streaming (HLS) to stream live video content to paying subscribers by using Amazon CloudFront. HLS splits the video content into chunks so that the user can request the right chunk based on different conditions Because the video events last for several hours, the total video is made up of thousands of chunks The origin URL is not disclosed and every user is forced to access the CloudFront URL The company has a web application that authenticates the paying users against an internal repository and a CloudFront key pair that is already issued. What is the simplest and MOST effective way to protect the content?

  • ADevelop the application to use the CloudFront key pair to create signed URLs that users will use to access the content.
  • BDevelop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content.
  • CDevelop the application to issue a security token that Lambda@Edge will receive to authenticate and authorize access to the content.
  • DKeep the CloudFront URL encrypted inside the application, and use AWS KMS to resolve the URL on-the-fly after the user is authenticated.
  उत्तर दिखाएँ
• #195

  A company is using Amazon Elastic Container Service (Amazon ECS) to run its container-based application on AWS. The company needs to ensure that the container images contain no severe vulnerabilities. The company also must ensure that only specific IAM roles and specific AWS accounts can access the container images. Which solution will meet these requirements with the LEAST management overhead?

  • APull images from the public container registry. Publish the images to Amazon Elastic Container Registry (Amazon ECR) repositories with scan on push configured in a centralized AWS account. Use a CI/CD pipeline to deploy the images to different AWS accounts. Use identity-based policies to restrict access to which IAM principals can access the images.
  • BPull images from the public container registry. Publish the images to a private container registry that is hosted on Amazon EC2 instances in a centralized AWS account. Deploy host-based container scanning tools to EC2 instances that run Amazon ECS. Restrict access to the container images by using basic authentication over HTTPS.
  • CPull images from the public container registry. Publish the images to Amazon Elastic Container Registry (Amazon ECR) repositories with scan on push configured in a centralized AWS account. Use a CI/CD pipeline to deploy the images to different AWS accounts. Use repository policies and identity-based policies to restrict access to which IAM principals and accounts can access the images.
  • DPull images from the public container registry. Publish the images to AWS CodeArtifact repositories in a centralized AWS account. Use a CI/CD pipeline to deploy the images to different AWS accounts. Use repository policies and identity-based policies to restrict access to which IAM principals and accounts can access the images.
  उत्तर दिखाएँ
• #196

  A company has a relational database workload that runs on Amazon Aurora MySQL. According to new compliance standards the company must rotate all database credentials every 30 days. The company needs a solution that maximizes security and minimizes development effort. Which solution will meet these requirements?

  • AStore the database credentials in AWS Secrets Manager. Configure automatic credential rotation for every 30 days.
  • BStore the database credentials in AWS Systems Manager Parameter Store. Create an AWS Lambda function to rotate the credentials every 30 days.
  • CStore the database credentials in an environment file or in a configuration file. Modify the credentials every 30 days.
  • DStore the database credentials in an environment file or in a configuration file. Create an AWS Lambda function to rotate the credentials every 30 days.
  उत्तर दिखाएँ
• #1972 चुनें

  A threat assessment has identified a risk whereby an internal employee could exfiltrate sensitive data from production host running inside AWS (Account 1). The threat was documented as follows: Threat description: A malicious actor could upload sensitive data from Server X by configuring credentials for an AWS account (Account 2) they control and uploading data to an Amazon S3 bucket within their control. Server X has outbound internet access configured via a proxy server. Legitimate access to S3 is required so that the application can upload encrypted files to an S3 bucket. Server X is currently using an IAM instance role. The proxy server is not able to inspect any of the server communication due to TLS encryption. Which of the following options will mitigate the threat? (Choose TWO)

  • ABypass the proxy and use an S3 VPC endpoint with a policy that whitelists only certain S3 buckets within Account 1.
  • BBlock outbound access to public S3 endpoints on the proxy server.
  • CConfigure Network ACLs on Server X to deny access to S3 endpoints.
  • DModify the S3 bucket policy for the legitimate bucket to allow access only from the public IP addresses associated with the application server.
  • ERemove the IAM instance role from the application server and save API access keys in a trusted and encrypted application config file.
  उत्तर दिखाएँ
• #198

  A company became aware that one of its access keys was exposed on a code sharing website 11 days ago. A Security Engineer must review all use of the exposed access keys to determine the extent of the exposure. The company enabled AWS CloudTrail m an regions when it opened the account. Which of the following will allow the Security Engineer 10 complete the task?

  • AFilter the event history on the exposed access key in the CloudTrail console Examine the data from the past 11 days.
  • BUse the IAM CLI to generate an IAM credential report Extract all the data from the past 11 days.
  • CUse Amazon Athena to query the CloudTrail logs from Amazon S3 Retrieve the rows for the exposed access key for the past 11 days.
  • DUse the Access Advisor tab in the IAM console to view all of the access key activity for the past 11 days.
  उत्तर दिखाएँ
• #199

  The Security Engineer for a mobile game has to implement a method to authenticate users so that they can save their progress. Because most of the users are part of the same OpenID-Connect compatible social media website, the Security Engineer would like to use that as the identity provider. Which solution is the SIMPLEST way to allow the authentication of users using their social media identities?

  • AAmazon Cognito.
  • BAssumeRoleWithWebIdentity API.
  • CAmazon Cloud Directory.
  • DActive Directory (AD) Connector.
  उत्तर दिखाएँ
• #200

  A security engineer must use AWS Key Management Service (AWS KMS) to design a key management solution for a set of Amazon Elastic Block Store (Amazon EBS) volumes that contain sensitive data. The solution needs to ensure that the key material automatically expires in 90 days. Which solution meets these criteria?

  • AA customer managed CMK that uses customer provided key material.
  • BA customer managed CMK that uses AWS provided key material.
  • CAn AWS managed CMK.
  • DOperating system-native encryption that uses GnuPG.
  उत्तर दिखाएँ

अपना स्कोर ट्रैक करना, समयबद्ध मॉक परीक्षा देना और AI व्याख्या पाना चाहते हैं? निःशुल्क खाता बनाएँ