AWS Certified Security - Specialty

• #61

  A company's Developers plan to migrate their on-premises applications to Amazon EC2 instances running Amazon Linux AMIs. The applications are accessed by a group of partner companies. The Security Engineer needs to implement the following host-based security measures for these instances: Block traffic from documented known bad IP addresses. Detect known software vulnerabilities and CIS Benchmarks compliance. Which solution addresses these requirements?

  • ALaunch the EC2 instances with an IAM role attached. Include a user data script that uses the AWS CLI to retrieve the list of bad IP addresses from AWS Secrets Manager and uploads it as a threat list in Amazon GuardDuty. Use Amazon Inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance
  • BLaunch the EC2 instances with an IAM role attached. Include a user data script that uses the AWS CLl to create NACLs blocking ingress traffic from the known bad IP addresses in the EC2 instance's subnets. Use AWS Systems Manager to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance
  • CLaunch the EC2 instances with an IAM role attached. Include a user data script that uses the AWS CLl to create and attach security groups that only allow an allow listed source IP address range inbound. Use Amazon Inspector to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance
  • DLaunch the EC2 instances with an IAM role attached. Include a user data script that creates a cron job to periodically retrieve the list of bad IP addresses from Amazon S3, and configures iptabies on the instances blocking the list of bad IP addresses. Use Amazon inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance.
  उत्तर दिखाएँ
• #62

  A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator. A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application. Which solution will meet these requirements?

  • ACreate an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.
  • BModify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack.
  • CCreate an AWS WAF web ACL for the ALB Create a custom rule that blocks requests that contain the user agent string of the device emulator.
  • DCreate an AWS WAF web ACL for the ALB. Create a custom rule that allows requests from legitimate user agent strings.
  उत्तर दिखाएँ
• #63

  A company is hosting multiple applications within a single VPC in its AWS account. The applications are running behind an Application Load Balancer that is associated with an AWS WAF web ACL. The company's security team has identified that multiple port scans are originating from a specific range of IP addresses on the internet. A security engineer needs to deny access from the offending IP addresses. Which solution will meet these requirements?

  • AModify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.
  • BAdd a rule to all security groups to deny the incoming requests from the IP address range.
  • CModify the AWS WAF web ACL with a rate-based rule statement to deny incoming requests from the IP address range.
  • DConfigure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny the incoming requests based on the match condition.
  उत्तर दिखाएँ
• #642 चुनें

  What are the MOST secure ways to protect the AWS account root user of a recently opened AWS account? (Choose TWO)

  • AUse the AWS account root user access keys instead of the AWS Management Console.
  • BEnable multi-factor authentication for the AWS IAM users with the AdministratorAccess managed policy attached to them.
  • CUse AWS KMS to encrypt all AWS account root user and AWS IAM access keys and set automatic rotation to 30 days.
  • DDo not create access keys for the AWS account root user; instead, create AWS IAM users.
  • EEnable multi-factor authentication for the AWS account root user.
  उत्तर दिखाएँ
• #65

  A company has thousands of AWS Lambda functions. While reviewing the Lambda functions, a security engineer discovers that sensitive information is being stored in environment variables and is viewable as plaintext in the Lambda console. The values of the sensitive information are only a few characters long. What is the MOST cost-effective way to address this security issue?

  • ASet up IAM policies from the Lambda console to hide access to the environment variables.
  • BUse AWS Step Functions to store the environment variables. Access the environment variables at runtime. Use IAM permissions to restrict access to the environment variables to only the Lambda functions that require access.
  • CStore the environment variables in AWS Secrets Manager, and access them at runtime. Use IAM permissions to restrict access to the secrets to only the Lambda functions that require access.
  • DStore the environment variables in AWS Systems Manager Parameter Store as secure string parameters, and access them at runtime. Use IAM permissions to restrict access to the parameters to only the Lambda functions that require access.
  उत्तर दिखाएँ
• #66

  A startup company is using a single AWS account that has resources in a single AWS Region. A security engineer configures an AWS CloudTrail trail in the same Region to deliver log files to an Amazon S3 bucket by using the AWS CLI. Because of expansion, the company adds resources in multiple Regions. The security engineer notices that the logs from the new Regions are not reaching the S3 bucket. What should the security engineer do to fix this issue with the LEAST amount of operational overhead?

  • ACreate a new CloudTrail trail. Select the new Regions where the company added resources.
  • BChange the S3 bucket to receive notifications to track all actions from all Regions.
  • CCreate a new CloudTrail trail that applies to all Regions.
  • DChange the existing CloudTrail trail so that it applies to all Regions.
  उत्तर दिखाएँ
• #67

  A Security Engineer launches two Amazon EC2 instances in the same Amazon VPC but in separate Availability Zones. Each instance has a public IP address and is able to connect to external hosts on the internet. The two instances are able to communicate with each other by using their private IP addresses, but they are not able to communicate with each other when using their public IP addresses. Which action should the Security Engineer take to allow communication over the public IP addresses?

  • AAssociate the instances to the same security groups.
  • BAdd 0.0.0.0/0 to the egress rules of the instance security groups.
  • CAdd the instance IDs to the ingress rules of the instance security groups.
  • DAdd the public IP addresses to the ingress rules of the instance security groups.
  उत्तर दिखाएँ
• #683 चुनें

  An Amazon EC2 instance is part of an EC2 Auto Scaling group that is behind an Application Load Balancer (ALB). It is suspected that the EC2 instance has been compromised. Which steps should be taken to investigate the suspected compromise? (Choose THREE)

  • ADetach the elastic network interface from the EC2 instance.
  • BInitiate an Amazon Elastic Block Store volume snapshot of all volumes on the EC2 instance.
  • CDisable any Amazon Route 53 health checks associated with the EC2 instance.
  • DDe-register the EC2 instance from the ALB and detach it from the Auto Scaling group.
  • EAttach a security group that has restrictive ingress and egress rules to the EC2 instance.
  • FAdd a rule to an AWS WAF to block access to the EC2 instance.
  उत्तर दिखाएँ
• #69

  Some highly sensitive analytics workloads are to be moved to Amazon EC2 hosts. Threat modeling has found that a risk exists where a subnet could be maliciously or accidentally exposed to the internet. Which of the following mitigations should be recommended?

  • AUse AWS Config to detect whether an Internet Gateway is added and use an AWS Lambda function to provide auto-remediation.
  • BWithin the Amazon VPC configuration, mark the VPC as private and disable Elastic IP addresses.
  • CUse IPv6 addressing exclusively on the EC2 hosts, as this prevents the hosts from being accessed from the internet.
  • DMove the workload to a Dedicated Host, as this provides additional network security controls and monitoring.
  उत्तर दिखाएँ
• #702 चुनें

  A company plans to move most of its IT infrastructure to AWS. They want to leverage their existing on-premises Active Directory as an identity provider for AWS. Which combination of steps should a Security Engineer take to federate the company's on-premises Active Directory with AWS? (Choose TWO)

  • ACreate IAM roles with permissions corresponding to each Active Directory group.
  • BCreate IAM groups with permissions corresponding to each Active Directory group.
  • CConfigure Amazon Cloud Directory to support a SAML provider.
  • DConfigure Active Directory to add relying party trust between Active Directory and AWS.
  • EConfigure Amazon Cognito to add relying party trust between Active Directory and AWS.
  उत्तर दिखाएँ
• #712 चुनें

  A company uses Amazon RDS for MySQL as a database engine for its applications. A recent security audit revealed an RDS instance that is not compliant with company policy for encrypting data at rest. A security engineer at the company needs to ensure that all existing RDS databases are encrypted using server-side encryption and that any future deviations from the policy are detected. Which combination of steps should the security engineer take to accomplish this? (Select TWO)

  • ACreate an AWS Config rule to detect the creation of encrypted RDS databases. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.
  • BUse AWS System Manager State Manager to detect RDS database encryption configuration drift. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to track state changes and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.
  • CCreate a read replica for the existing unencrypted RDS database and enable replica encryption in the process. Once the replica becomes active, promote it into a standalone database instance and terminate the unencrypted database instance.
  • DTake a snapshot of the unencrypted RDS database. Copy the snapshot and enable snapshot encryption in the process. Restore the database instance from the newly created encrypted snapshot. Terminate the unencrypted database instance.
  • EEnable encryption for the identified unencrypted RDS instance by changing the configurations of the existing database.
  उत्तर दिखाएँ
• #723 चुनें

  A company is building a data lake on Amazon S3. The data consists of millions of small files containing sensitive information. The security team has the following requirements for the architecture: Data must be encrypted in transit. Data must be encrypted at rest. The bucket must be private, but if the bucket is accidentally made public, the data must remain confidential. Which combination of steps would meet the requirements? (Select THREE)

  • AEnable AES-256 encryption using server-side encryption with Amazon S3-managed encryption keys (SSE-S3) on the S3 bucket.
  • BEnable default encryption with server-side encryption with AWS KMS-managed keys (SSE-KMS) on the S3 bucket.
  • CAdd a bucket policy that includes a deny if a PutObject request does not include aws:SecureTransport.
  • DAdd a bucket policy with aws:SourceIp to Allow uploads and downloads from the corporate intranet only.
  • EAdd a bucket policy that includes a deny if a PutObject request does not include s3:x-amz-server-side-encryption: "aws: kms".
  • FEnable Amazon Macie to monitor and act on changes to the data lake's S3 bucket.
  उत्तर दिखाएँ
• #73

  A Security Engineer must implement mutually authenticated TLS connections between containers that communicate inside a VPC. Which solution would be MOST secure and easy to maintain?

  • AUse AWS Certificate Manager to generate certificates from a public certificate authority and deploy them to all the containers.
  • BCreate a self-signed certificate in one container and use AWS Secrets Manager to distribute the certificate to the other containers to establish trust.
  • CUse AWS Certificate Manager Private Certificate Authority (ACM PCA) to create a subordinate certificate authority, then create the private keys in the containers and sign them using the ACM PCA API.
  • DUse AWS Certificate Manager Private Certificate Authority (ACM PCA) to create a subordinate certificate authority, then use AWS Certificate Manager to generate the private certificates and deploy them to all the containers.
  उत्तर दिखाएँ
• #742 चुनें

  A company needs a forensic-logging solution for hundreds of applications running in Docker on Amazon EC2 The solution must perform real-time analytics on the togs must support the replay of messages and must persist the logs. Which IAM services should be used to meet these requirements? (Select TWO)

  • AAmazon Athena.
  • BAmazon Kinesis.
  • CAmazon SQS.
  • DAmazon Elasticsearch.
  • EAmazon EMR.
  उत्तर दिखाएँ
• #75

  A company has multiple AWS accounts that are part of AW5 Organizations. The company's Security team wants to ensure that even those Administrators with full access to the company's AWS accounts are unable to access the company's Amazon S3 buckets How should this be accomplished?

  • AUseSCPs.
  • BAdd a permissions boundary to deny access to Amazon S3 and attach it to all roles.
  • CUse an S3 bucket policy.
  • DCreate a VPC endpoint for Amazon S3 and deny statements for access to Amazon S3.
  उत्तर दिखाएँ
• #76

  During a recent security audit, it was discovered that multiple teams in a large organization have placed restricted data in multiple Amazon S3 buckets, and the data may have been exposed. The auditor has requested that the organization identify all possible objects that contain personally identifiable information (PII) and then determine whether this information has been accessed. What solution will allow the Security team to complete this request?

  • AUsing Amazon Athena, query the impacted S3 buckets by using the PII query identifier function. Then, create a new Amazon CloudWatch metric for Amazon S3 object access to alert when the objects are accessed.
  • BEnable Amazon Macie on the S3 buckets that were impacted, then perform data classification. For identified objects that contain PII, use the research function for auditing AWS CloudTrail logs and S3 bucket logs for GET operations.
  • CEnable Amazon GuardDuty and enable the PII rule set on the S3 buckets that were impacted, then perform data classification. Using the PII findings report from GuardDuty, query the S3 bucket logs by using Athena for GET operations.
  • DEnable Amazon Inspector on the S3 buckets that were impacted, then perform data classification. For identified objects that contain PII, query the S3 bucket logs by using Athena for GET operations.
  उत्तर दिखाएँ
• #77

  A company uses AWS Organizations to manage several AWs accounts. The company processes a large volume of sensitive data. The company uses a serverless approach to microservices. The company stores all the data in either Amazon S3 or Amazon DynamoDB. The company reads the data by using either AWS Lambda functions or container-based services that the company hosts on Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate. The company must implement a solution to encrypt all the data at rest and enforce least privilege data access controls. The company creates an AWS Key Management Service (AWS KMS) customer managed key. What should the company do next to meet these requirements?

  • ACreate a key policy that allows the kms:Decrypt action only for Amazon S3 and DynamoDB. Create an SCP that denies the creation of S3 buckets and DynamoDB tables that are not encrypted with the key.
  • BCreate an IAM policy that denies the kms:Decrypt action for the key. Create a Lambda function than runs on a schedule to attach the policy to any new roles. Create an AWS Config rule to send alerts for resources that are not encrypted with the key.
  • CCreate a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda, and Amazon EKS. Create an SCP that denies the creation of S3 buckets and DynamoDB tables that are not encrypted with the key.
  • DCreate a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda, and Amazon EKS. Create an AWS Config rule to send alerts for resources that are not encrypted with the key.
  उत्तर दिखाएँ
• #78

  While securing the connection between a company's VPC and its on-premises data center, a security engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). The ping command did not return a response. The flow log in the VPC showed the following. What action should be performed to allow the ping to work?

  • AIn the security group of the EC2 instance, allow inbound ICMP traffic.
  • BIn the security group of the EC2 instance, allow outbound ICMP traffic.
  • CIn the VPC's NACL, allow inbound ICMP traffic.
  • DIn the VPC's NACL, allow outbound ICMP traffic.
  उत्तर दिखाएँ
• #79

  A company has deployed Amazon GuardDuty and now wants to implement automation for potential threats. The company has decided to start with RDP brute force attacks that come from Amazon EC2 instances in the company's AWS environment. A security engineer needs to implement a solution that blocks the detected communication from a suspicious instance until investigation and potential remediation can occur. Which solution will meet these requirements?

  • AConfigure GuardDuty to send the event to an Amazon Kinesis data stream. Process the eventwith an Amazon Kinesis Data Analytics for Apache Flink application that sends a notification to the company through Amazon Simple Notification Service (Amazon SNS). Add rules to the network ACL to block traffic to and from the suspicious instance.
  • BConfigure GuardDuty to send the event to Amazon EventBridge (Amazon CloudWatch Events). Deploy an AWS WAF web ACL. Process the event with an AWS Lambda function that sends a notification to the company through Amazon Simple Notification Service (Amazon SNS) and adds a web ACL rule to block traffic to and from the suspicious instance.
  • CEnable AWS Security Hub to ingest GuardDuty findings and send the event to Amazon EventBridge (Amazon CloudWatch Events). Deploy AWS Network Firewall. Process the event with an AWS Lambda function that adds a rule to a Network Firewall firewall policy to block traffic to and from the suspicious instance.
  • DEnable AWS Security Hub to ingest GuardDuty findings. Configure an Amazon Kinesis data stream as an event destination for Security Hub. Process the event with an AWS Lambda function that replaces the security group of the suspicious instance with a security group that does not allow any connections.
  उत्तर दिखाएँ
• #803 चुनें

  A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The auditor is having trouble accessing some of the accounts. Which of the following may be causing this problem? (Choose THREE)

  • AThe external ID used by the auditor is missing or incorrect.
  • BThe auditor is using the incorrect password.
  • CThe auditor has not been granted sts:AssumeRole for the role in the destination account.
  • DThe Amazon EC2 role used by the auditor must be set to the destination account role.
  • EThe secret key used by the auditor is missing or incorrect.
  • FThe role ARN used by the auditor is missing or incorrect.
  उत्तर दिखाएँ

अपना स्कोर ट्रैक करना, समयबद्ध मॉक परीक्षा देना और AI व्याख्या पाना चाहते हैं? निःशुल्क खाता बनाएँ