AWS Certified Security - Specialty

• #201

  A company's on-premises data center forwards DNS logs to a third-party security incident events management (SIEM) solution that alerts on suspicious behavior. The company wants to introduce a similar capability to its AWS accounts that includes automatic remediation. The company expects to double in size within the next few months. Which solution meets the company's current and future logging requirements?

  • AEnable Amazon GuardDuty and AWS Security Hub in all Regions and all accounts. Designate a master security account to receive all alerts from the child accounts. Set up specific rules within Amazon EventBridge to trigger an AWS Lambda function for remediation steps.
  • BIngest all AWS CloudTrail logs, VPC Flow Logs, and DNS logs into a single Amazon S3 bucket in a designated security account. Use the current on-premises SIEM to monitor the logs and send a notification to an Amazon SNS topic to alert the security team of remediation steps.
  • CIngest all AWS CloudTrail logs, VPC Flow Logs, and DNS logs into a single Amazon S3 bucket in a designated security account. Launch an Amazon EC2 instance and install the current SIEM to monitor the logs and send a notification to an Amazon SNS topic to alert the security team of remediation steps.
  • DEnable Amazon GuardDuty and AWS Security Hub in all Regions and all accounts. Designate a master security account to receive all alerts from the child accounts. Create an AWS Organizations SCP that denies access to certain API calls that are on an ignore list.
  उत्तर दिखाएँ
• #202

  A Security Engineer manages AWS Organizations for a company. The Engineer would like to restrict AWS usage to allow Amazon S3 only in one of the organizational units (OUs). The Engineer adds the following SCP to the OU:

  • AMove the account to a new OU and deny IAM: permissions.
  • BAdd a Deny policy for all non-S3 services at the account level.
  • CChange the policy to:
  • DDetach the default FullAWSAccess SCP.
  उत्तर दिखाएँ
• #2032 चुनें

  A Security Engineer is defining the logging solution for a newly developed product. Systems Administrators and Developers need to have appropriate access to event log files in AWS CloudTrail to support and troubleshoot the product. Which combination of controls should be used to protect against tampering with and unauthorized access to log files? (Choose TWO)

  • AEnsure that the log file integrity validation mechanism is enabled.
  • BEnsure that all log files are written to at least two separate Amazon S3 buckets in the same account.
  • CEnsure that Systems Administrators and Developers can edit log files, but prevent any other access.
  • DEnsure that Systems Administrators and Developers with job-related need-to-know requirements only are capable of viewing - but not modifying - the log files.
  • EEnsure that all log files are stored on Amazon EC2 instances that allow SSH access from the internal corporate network only.
  उत्तर दिखाएँ
• #204

  A company is testing an application that runs on an Amazon EC2 Linux instance. A single 500 GB Amazon Elastic Block Store (Amazon EBS) General Purpose SSO (gp2) volume is attached to the EC2 instance. The company will deploy the application on multiple EC2 instances in an Auto Scaling group. All instances require access to the data that is stored in the EBS volume. The company needs a highly available and resilient solution that does not introduce significant changes to the application's code. Which solution will meet these requirements?

  • AProvision an EC2 instance that uses NFS server software. Attach a single 500 GB gp2 EBS volume to the instance.
  • BProvision an Amazon FSx for Windows File Server file system. Configure the file system as an SMB file store within a single Availability Zone.
  • CProvision an EC2 instance with two 250 GB Provisioned IOPS SSD EBS volumes.
  • DProvision an Amazon Elastic File System (Amazon EFS) file system. Configure the file system to use General Purpose performance mode.
  उत्तर दिखाएँ
• #205

  A company is using AWS Organizations to manage multiple AWS member accounts. All of these accounts have Amazon GuardDuty enabled in all Regions. The company's AW5 Security Operations Center has a centralized security account for logging and monitoring. One of the member accounts has received an excessively high bill A security engineer discovers that a compromised Amazon EC2 instance is being used to mine crypto currency. The Security Operations Center did not receive a GuardDuty finding in the central security account. but there was a GuardDuty finding in the account containing the compromised EC2 instance. The security engineer needs to ensure an GuardDuty finding are available in the security account. What should the security engineer do to resolve this issue?

  • ASet up an Amazon CloudWatch Event rule to forward ail GuardDuty findings to the security account Use an AWS Lambda function as a target to raise findings.
  • BSet up an Amazon CloudWatch Events rule to forward all GuardDuty findings to the security account Use an AWS Lambda function as a target to raise findings in AWS Security Hub.
  • CCheck that GuardDuty in the security account is able to assume a role in the compromised account using the GuardDuty fast findings permission Schedule an Amazon CloudWatch Events rule and an AWS Lambda function to periodically check for GuardDuty findings.
  • DUse the aws GuardDuty get-members AWS CLI command m the security account to see if the account is listed Send an invitation from GuardDuty m the security account to GuardDuty in the compromised account Accept the invitation to forward all future GuardDuty findings.
  उत्तर दिखाएँ
• #206

  A distributed web application is installed across several EC2 instances in public subnets residing in two Availability Zones. Apache logs show several intermittent brute-force attacks from hundreds of IP addresses at the layer 7 level over the past six months. What would be the BEST way to reduce the potential impact of these attacks in the future?

  • AUse custom route tables to prevent malicious traffic from routing to the instances.
  • BUpdate security groups to deny traffic from the originating source IP addresses.
  • CUse network ACLs.
  • DInstall intrusion prevention software (IPS) on each instance.
  उत्तर दिखाएँ
• #207

  An ecommerce company has a web application architecture that runs primarily on containers. The application containers are deployed on Amazon Elastic Container Service (Amazon ECS). The container images for the application are stored in Amazon Elastic Container Registry (Amazon ECR). The company's security team is performing an audit of components of the application architecture. The security team identifies issues with some container images that are stored in the container repositories. The security team wants to address these issues by implementing continual scanning and on-push scanning of the container images. The security team needs to implement a solution that makes any findings from these scans visible in a centralized dashboard. The security team plans to use the dashboard to view these findings along with other security-related findings that they intend to generate in the future. There are specific repositories that the security team needs to exclude from the scanning process. Which solution will meet these requirements?

  • AUse Amazon Inspector. Create inclusion rules in Amazon ECR to match repositories that need to be scanned. Push Amazon Inspector findings to AWS Security Hub.
  • BUse ECR basic scanning of container images. Create inclusion rules in Amazon ECR to match repositories that need to be scanned. Push findings to AWS Security Hub.
  • CUse ECR basic scanning of container images. Create inclusion rules in Amazon ECR to match repositories that need to be scanned. Push findings to Amazon Inspector.
  • DUse Amazon Inspector. Create inclusion rules in Amazon Inspector to match repositories that need to be scanned. Push Amazon Inspector findings to AWS Config.
  उत्तर दिखाएँ
• #208

  There are currently multiple applications hosted in a VPC. During monitoring it has been noticed that multiple port scans are coming in from a specific IP Address block. The internal security team has requested that all offending IP Addresses be denied for the next 24 hours. Which of the following is the best method to quickly and temporarily deny access from the specified IP Address's.

  • ACreate an AD policy to modify the. Windows Firewall settings on all hosts in the VPC to deny access from the IP Address block.
  • BModify the Network ACLs associated with all public subnets in the VPC to deny access from the IP Address block.
  • CAdd a rule to all of the VPC Security Groups to deny access from the IP Address block.
  • DModify the. Windows Firewall settings on all AMI'S that your organization uses in that VPC to deny access from the IP address block.
  उत्तर दिखाएँ
• #209

  A Security Architect is evaluating managed solutions for storage of encryption keys. The requirements are: Storage is accessible by using only VPCs. Service has tamper-evident controls. Access logging is enabled. Storage has high availability. Which of the following services meets these requirements?

  • AAmazon S3 with default encryption.
  • BAWS CloudHSM.
  • CAmazon DynamoDB with server-side encryption.
  • DAWS Systems Manager Parameter Store.
  उत्तर दिखाएँ
• #210

  Which of the following minimizes the potential attack surface for applications?

  • AUse security groups to provide stateful firewalls for Amazon EC2 instances at the hypervisor level.
  • BUse network ACLs to provide stateful firewalls at the VPC level to prevent access to any specific AWS resource.
  • CUse AWS Direct Connect for secure trusted connections between EC2 instances within private subnets.
  • DDesign network security in a single layer within the perimeter network (also known as DMZ, demilitarized zone, and screened subnet) to facilitate quicker responses to threats.
  उत्तर दिखाएँ
• #2113 चुनें

  A company's AWS CloudTrail logs are all centrally stored in an Amazon S3 bucket. The security team controls the company's AWS account. The security team must prevent unauthorized access and tampering of the CloudTrail logs. Which combination of steps should the security team take? (Choose THREE)

  • AConfigure server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
  • BCompress log file with secure gzip.
  • CCreate an Amazon EventBridge (Amazon CloudWatch Events) rule to notify the security team of any modifications on CloudTrail log files.
  • DImplement least privilege access to the S3 bucket by configuring a bucket policy.
  • EConfigure CloudTrail log file integrity validation.
  • FConfigure Access Analyzer for S3.
  उत्तर दिखाएँ
• #212

  A company has complex connectivity rules governing ingress, egress, and communications between Amazon EC2 instances. The rules are so complex that they cannot be implemented within the limits of the maximum number of security groups and network access control lists (network ACLs). What mechanism will allow the company to implement all required network rules without incurring additional cost?

  • AConfigure AWS WAF rules to implement the required rules.
  • BUse the operating system built-in, host-based firewall to implement the required rules.
  • CUse a NAT gateway to control ingress and egress according to the requirements.
  • DLaunch an EC2-based firewall product from the AWS Marketplace, and implement the required rules in that product.
  उत्तर दिखाएँ
• #2133 चुनें

  A company's Chief Security Officer has requested that a Security Analyst review and improve the security posture of each company AWS account. The Security Analyst decides to do this by improving AWS account root user security. Which actions should the Security Analyst take to meet these requirements? (Choose THREE)

  • ADelete the access keys for the account root user in every account.
  • BCreate an admin IAM user with administrative privileges and delete the account root user in every account.
  • CImplement a strong password to help protect account-level access to the AWS Management Console by the account root user.
  • DEnable multi-factor authentication (MFA) on every account root user in all accounts.
  • ECreate a custom IAM policy to limit permissions to required actions for the account root user and attach the policy to the account root user.
  • FAttach an IAM role to the account root user to make use of the automated credential rotation in AWS STS.
  उत्तर दिखाएँ
• #214

  A company that operates in a hybrid cloud environment must meet strict compliance requirements. The company wants to create a report that includes evidence from on-premises workloads alongside evidence from AWS resources. A security engineer must implement a solution to collect, review, and manage the evidence to demonstrate compliance with company policy. Which solution will meet these requirements?

  • ACreate an assessment in AWS Audit Manager from a prebuilt framework or a custom framework. Upload manual evidence from the on-premises workloads. Add the evidence to the assessment. Generate an assessment report after Audit Manager collects the necessary evidence from the AWS resources.
  • BInstall the Amazon CloudWatch agent on the on-premises workloads. Use AWS Config to deploy a conformance pack from a sample conformance pack template or a custom YAML template. Generate an assessment report after AWS Config identifies noncompliant workloads and resources.
  • CSet up the appropriate security standard in AWS Security Hub. Upload manual evidence from the on-premises workloads. Wait for Security Hub to collect the evidence from the AWS resources. Download the list of controls as a .csv file.
  • DInstall the Amazon CloudWatch agent on the on-premises workloads. Create a CloudWatch dashboard to monitor the on-premises workloads and the AWS resources. Run a query on the workloads and resources. Download the results.
  उत्तर दिखाएँ
• #215

  The AWS Systems Manager Parameter Store is being used to store database passwords used by an AWS Lambda function. Because this is sensitive data, the parameters are stored as type SecureString and protected by an AWS KMS key that allows access through IAM. When the function executes, this parameter cannot be retrieved as the result of an access denied error. Which of the following actions will resolve the access denied error?

  • AUpdate the ssm.amazonaws.com principal in the KMS key policy to allow kms:Decrypt.
  • BUpdate the Lambda configuration to launch the function in a VPC.
  • CAdd a policy to the role that the Lambda function uses, allowing kms:Decrypt for the KMS key.
  • DAdd lambda.amazonaws.com as a trusted entity on the IAM role that the Lambda function uses.
  उत्तर दिखाएँ
• #216

  A company's application runs on an Amazon EC2 instance and stores objects in an Amazon S3 bucket. The EC2 instance is using an instance profile that provides access to read and write objects in the S3 bucket. The S3 bucket contains objects and has not been configured for any encryption at rest. The company is adopting a new security policy that mandates encryption at rest for all S3 buckets, encryption at rest for all objects in S3 buckets, and key rotation once every year. What should a security engineer do to meet these requirements?

  • AEnable server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for the S3 bucket. Configure annual automatic key rotation. Use an S3 Batch Operations job with the COPY command to change all the objects in the S3 bucket to use the SSE-S3 key. Configure the EC2 instance profile with permissions to use the SSE-S3 key. Configure S3 data events to encrypt an object during a write operation.
  • BCreate a new AWS Key Management Service (AWS KMS) customer managed key. Configure annual automatic key rotation. Enable server-side encryption with AWS KMS keys (SSE-KMS) for the S3 bucket. Add a bucket policy to the S3 bucket to enforce SSE-KMS encryption. Configure the EC2 instance profile with permissions to use the customer managed key.
  • CCreate a new AWS Key Management Service (AWS KMS) customer managed key. Configure annual automatic key rotation. Enable server-side encryption with AWS KMS keys (SSE-KMS) for the S3 bucket. Use an S3 Batch Operations job with the COPY command to change all the objects in the S3 bucket to use the customer managed key. Configure the EC2 instance profile with permissions to use the customer managed key.
  • DEnable server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for the S3 bucket. Configure annual automatic key rotation. Configure the EC2 instance profile with permissions to use the SSE-S3 key. Use the AWS CLI to copy the S3 objects in place by specifying the SSE-S3 key as the encryption key. Configure S3 data events to encrypt an object during a write operation.
  उत्तर दिखाएँ
• #217

  An organization policy states that all encryption keys must be automatically rotated every 12 months. Which AWS Key Management Service (KMS) key type should be used to meet this requirement?

  • AAWS managed Customer Master Key (CMK)
  • BCustomer managed CMK with AWS generated key material.
  • CCustomer managed CMK with imported key material.
  • DAWS managed data key.
  उत्तर दिखाएँ
• #218

  An organization wants to be alerted when an unauthorized Amazon EC2 instance in its VPC performs a network port scan against other instances in the VPC. When the Security team performs its own internal tests in a separate account by using pre-approved third-party scanners from the AWS Marketplace, the Security team also then receives multiple Amazon GuardDuty events from Amazon CloudWatch alerting on its test activities. How can the Security team suppress alerts about authorized security tests while still receiving alerts about the unauthorized activity?

  • AUse a filter in AWS CloudTrail to exclude the IP addresses of the Security team's EC2 instances.
  • BAdd the Elastic IP addresses of the Security team's EC2 instances to a trusted IP list in Amazon GuardDuty.
  • CInstall the Amazon Inspector agent on the EC2 instances that the Security team uses.
  • DGrant the Security team's EC2 instances a role with permissions to call Amazon GuardDuty API operations.
  उत्तर दिखाएँ
• #219

  Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic. Which of the following troubleshooting steps should be performed?

  • ACheck inbound and outbound security groups, looking for DENY rules.
  • BCheck inbound and outbound Network ACL rules, looking for DENY rules.
  • CReview the rejected packet reason codes in the VPC Flow Logs.
  • DUse AWS X-Ray to trace the end-to-end application flow.
  उत्तर दिखाएँ
• #220

  A company is storing data in Amazon S3 Glacier. The security engineer implemented a new vault lock policy for 10TB of data and called initiate-vault-lock operation 12 hours ago. The audit team identified a typo in the policy that is allowing unintended access to the vault. What is the MOST cost-effective way to correct this?

  • ACall the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again.
  • BCopy the vault data to a new S3 bucket. Delete the vault. Create a new vault with the data.
  • CUpdate the policy to keep the vault lock in place.
  • DUpdate the policy. Call initiate-vault-lock operation again to apply the new policy.
  उत्तर दिखाएँ

अपना स्कोर ट्रैक करना, समयबद्ध मॉक परीक्षा देना और AI व्याख्या पाना चाहते हैं? निःशुल्क खाता बनाएँ