AWS Certified Security - Specialty

• #301

  A company recently performed an annual security assessment of its AWS environment. The assessment showed that audit logs are not available beyond 90 days and that unauthorized changes to IAM policies are made without detection. How should a security engineer resolve these issues?

  • ACreate an Amazon S3 lifecycle policy that archives AWS CloudTrail trail logs to Amazon S3 Glacier after 90 days. Configure Amazon Inspector to provide a notification when a policy change is made to resources.
  • BConfigure AWS Artifact to archive AWS CloudTrail logs Configure AWS Trusted Advisor to provide a notification when a policy change is made to resources.
  • CConfigure Amazon CloudWatch to export log groups to Amazon S3. Configure AWS CloudTrail to provide a notification when a policy change is made to resources.
  • DCreate an AWS CloudTrail trail that stores audit logs in Amazon S3. Configure an AWS Config rule to provide a notif cation when a policy change is made to resources.
  उत्तर दिखाएँ
• #302

  A company hosts a web application on an Apache Web server. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The company configured the EC2 instances to send the Apache Web server logs to an Amazon CloudWatch Logs group that the company has configured to expire after 1 year. Recently, the company discovered in the Apache Web server logs that a specific IP address is sending suspicious requests to the Web application. A security engineer wants to analyze the past week of Apache Web server logs to determine how many requests that the IP address sent and the corresponding URLs that the IP address requested. What should the security engineer do to meet these requirements with the LEAST effort?

  • AExport the CloudWatch Logs group data to Amazon S3. Use Amazon Macie to query the logs for the specific IP address and the requested URLs.
  • BConfigure a CloudWatch Logs subscription to stream the log group to an Amazon OpenSearch Service cluster. Use OpenSearch Service to analyze the logs for the specific IP address and the requested URLs.
  • CUse CloudWatch Logs Insights and a custom query syntax to analyze the CloudWatch logs for the specific IP address and the requested URLs.
  • DExport the CloudWatch Logs group data to Amazon S3. Use AWS Glue to crawl the S3 bucket for only the log entries that contain the specific IP ad-dress. Use AWS Glue to view the results.
  उत्तर दिखाएँ
• #3032 चुनें

  During a security event, it is discovered that some Amazon EC2 instances have not been sending Amazon CloudWatch logs. Which steps can the Security Engineer take to troubleshoot this issue? (Choose TWO)

  • AConnect to the EC2 instances that are not sending the appropriate logs and verify that the CloudWatch Logs agent is running.
  • BLog in to the AWS account and select CloudWatch Logs. Check for any monitored EC2 instances that are in the Alerting state and restart them using the EC2 console.
  • CVerify that the EC2 instances have a route to the public AWS API endpoints.
  • DConnect to the EC2 instances that are not sending logs. Use the command prompt to verify that the right permissions have been set for the Amazon SNS topic.
  • EVerify that the network access control lists and security groups of the EC2 instances have the access to send logs over SNMP.
  उत्तर दिखाएँ
• #304

  A Security Administrator is performing a log analysis as a result of a suspected AWS account compromise. The Administrator wants to analyze suspicious AWS CloudTrail log files but is overwhelmed by the volume of audit logs being generated. What approach enables the Administrator to search through the logs MOST efficiently?

  • AImplement a write-only CloudTrail event filter to detect any modifications to the AWS account resources.
  • BConfigure Amazon Macie to classify and discover sensitive data in the Amazon S3 bucket that contains the CloudTrail audit logs.
  • CConfigure Amazon Athena to read from the CloudTrail S3 bucket and query the logs to examine account activities.
  • DEnable Amazon S3 event notifications to trigger an AWS Lambda function that sends an email alarm when there are new CloudTrail API entries.
  उत्तर दिखाएँ
• #305

  A company uses Amazon GuardDuty to detect threats and malicious activities in AWS accounts. The company has subscribed to a third-party threat intelligence list uploaded to an Amazon S3 bucket. How should the security engineer efficiently use the threat list across all company AWS accounts?

  • AEnsure the S3 bucket policy allows all company AWS accounts access to the threat list. Use an AWS Lambda function to automatically add the threat list to all company AWS accounts.
  • BEnsure GuardDuty is in master-member configuration. Add the threat list to the master account referencing the S3 object that contains the threat list.
  • CEnsure all accounts are part of the same organization in AWS Organizations. Add the threat list to any company account within AWS Organizations.
  • DEnsure the threat list in the S3 bucket is publicly accessible. Use an Amazon CloudWatch Events event on GuardDuty findings to match IPs against the threat list.
  उत्तर दिखाएँ
• #306

  A company requires that SSH commands used to access its AWS instance be traceable to the user who executed each command. How should a Security Engineer accomplish this?

  • AAllow inbound access on port 22 at the security group attached to the instance. Use AWS Systems Manager Session Manager for shell access to Amazon EC2 instances with the user tag defined. Enable Amazon CloudWatch togging for Systems Manager sessions.
  • BUse Amazon S3 to securely store one Privacy Enhanced Mail Certificate (PEM file) for each user. Allow Amazon EC2 to read from Amazon S3 and import every user that wants to use SSH to access EC2 instances. Allow inbound access on port 22 at the security group attached to the instance. Install the Amazon CloudWatch agent on the EC2 instance and configure it to ingest audit logs for the instance.
  • CDeny inbound access on port 22 at the security group attached to the instance. Use AWS Systems Manager Session Manager for shell access to Amazon EC2 instances with the user tag defined. Enable Amazon CloudWatch togging for Systems Manager sessions.
  • DUse Amazon S3 to securely store one Privacy Enhanced Mall Certificate (PEM file) for each team or group. Allow Amazon EC2 to read from Amazon S3 and import every user that wants to use SSH to access EC2 instances. Allow inbound access on pod 22 at the security group attached to the instance. Install the Amazon CloudWatch agent on the EC2 instance and configure it to ingest audit logs for the instance.
  उत्तर दिखाएँ
• #307

  A Security Engineer must design a system that can detect whether a file on an Amazon EC2 host has been modified. The system must then alert the Security Engineer of the modification. What is the MOST efficient way to meet these requirements?

  • AInstall antivirus software and ensure that signatures are up-to-date. Configure Amazon CloudWatch alarms to send alerts for security events.
  • BInstall host-based IDS software to check for file integrity. Export the logs to Amazon CloudWatch Logs for monitoring and alerting.
  • CExport system log files to Amazon S3. Parse the log files using an AWS Lambda function that will send alerts of any unauthorized system login attempts through Amazon SNS.
  • DUse Amazon CloudWatch Logs to detect file system changes. If a change is detected, automatically terminate and recreate the instance from the most recent AMI. Use Amazon SNS to send notification of the event.
  उत्तर दिखाएँ
• #308

  A security engineer is using AWS Organizations and wants to optimize SCPs. The security engineer needs to ensure that the SCPs conform to best practices. Which approach should the security engineer take to meet this requirement?

  • AUse AWS IAM Access Analyzer to analyze the policies. View the findings from policy validation checks.
  • BReview AWS Trusted Advisor checks for all accounts in the organization.
  • CSet up AWS Audit Manager. Run an assessment for all AWS Regions for all accounts.
  • DEnsure that Amazon Inspector agents are installed on all Amazon EC2 in-stances in all accounts.
  उत्तर दिखाएँ
• #3093 चुनें

  An Amazon S3 bucket is encrypted using an AWS KMS CMK. An IAM user is unable to download objects from the S3 bucket using the AWS Management Console; however, other users can download objects from the S3 bucket. Which policies should the Security Engineer review and modify to resolve this issue? (Choose THREE)

  • AThe CMK policy.
  • BThe VPC endpoint policy.
  • CThe S3 bucket policy.
  • DThe S3 ACL.
  • EThe IAM policy.
  उत्तर दिखाएँ
• #310

  A company has several workloads running on AWS. Employees are required to authenticate using on-premises ADFS and SSO to access the AWS Management Console. Developers migrated an existing legacy web application to an Amazon EC2 instance. Employees need to access this application from anywhere on the internet, but currently, there is no authentication system built into the application. How should the security engineer implement employee-only access to this system without changing the application?

  • APlace the application behind an Application Load Balancer (ALB). Use Amazon Cognito as authentication for the ALB. Define a SAML-based Amazon Cognito user pool and connect it to ADFS.
  • BImplement AWS IAM Identity Center (AWS Single Sign-On) in the management account and link it to ADFS as an identity provider. Define the EC2 instance as a managed resource, then apply an IAM policy on the resource.
  • CDefine an Amazon Cognito identity pool, then install the connector on the Active Directory server. Use the Amazon Cognito SDK on the application instance to authenticate the employees using their Active Directory user names and passwords.
  • DCreate an AWS Lambda custom authorizer as the authenticator for a reverse proxy on Amazon EC2. Ensure the security group on Amazon EC2 only allows access from the Lambda function.
  उत्तर दिखाएँ
• #311

  A Security Engineer has discovered that, although encryption was enabled on the Amazon S3 bucket example bucket, anyone who has access to the bucket has the ability to retrieve the files. The Engineer wants to limit access to each IAM user can access an assigned folder only. What should the Security Engineer do to achieve this?

  • AUse envelope encryption with the AWS-managed CMK aws/s3.
  • BCreate a customer-managed CMK with a key policy granting kms:Decrypt based on the '${aws:username}' variable.
  • CCreate a customer-managed CMK for each user. Add each user as a key user in their corresponding key policy.
  • DChange the applicable IAM policy to grant S3 access to 'Resource': 'arn:aws:s3:::examplebucket/${aws:username}/'.
  उत्तर दिखाएँ
• #312

  A Security Engineer accidentally deleted the imported key material in an AWS KMS CMK. What should the Security Engineer do to restore the deleted key material?

  • ACreate a new CMK. Download a new wrapping key and a new import token to import the original key material.
  • BCreate a new CMK Use the original wrapping key and import token to import the original key material.
  • CDownload a new wrapping key and a new import token Import the original key material into the existing CMK.
  • DUse the original wrapping key and import token Import the original key material into the existing CMK.
  उत्तर दिखाएँ
• #3133 चुनें

  Authorized Administrators are unable to connect to an Amazon EC2 Linux bastion host using SSH over the internet. The connection either fails to respond or generates the following error message: Network error: Connection timed out. What could be responsible for the connection failure? (Select THREE)

  • AThe NAT gateway in the subnet where the EC2 instance is deployed has been misconfigured.
  • BThe internet gateway of the VPC has been reconfigured.
  • CThe security group denies outbound traffic on ephemeral ports.
  • DThe route table is missing a route to the internet gateway.
  • EThe NACL denies outbound traffic on ephemeral ports.
  • FThe host-based firewall is denying SSH traffic.
  उत्तर दिखाएँ
• #314

  A company is running an Amazon RDS for MySQL DB instance in a VPC. The VPC must not send or receive network traffic through the internet. A security engineer wants to use AWS Secrets Manager to rotate the DB instance credentials automatically. Because of a security policy, the security engineer cannot use the standard AWS Lambda function that Secrets Manager provides to rotate the credentials. The security engineer deploys a custom Lambda function in the VPC. The custom Lambda function will be responsible for rotating the secret in Secrets Manager. The security engineer edits the DB instance's security group to allow connections from this function. When the function is invoked, the function cannot communicate with Secrets Manager to rotate the secret properly. What should the security engineer do so that the function can rotate the secret?

  • AAdd an egress-only internet gateway to the VPC. Allow only the Lambda function's subnet to route traffic through the egress-only internet gateway.
  • BAdd a NAT gateway to the VPC. Configure only the Lambda function's subnet with a default route through the NAT gateway.
  • CConfigure a VPC peering connection to the default VPC for Secrets Manager. Configure the Lambda function's subnet to use the peering connection for routes.
  • DConfigure a Secrets Manager interface VPC endpoint. Include the Lambda function's private subnet during the configuration process.
  उत्तर दिखाएँ
• #315

  A pharmaceutical company has digitized versions of historical prescriptions stored on premises. The company would like to move these prescriptions to AWS and perform analytics on the data in them. Any operation with this data requires that the data be encrypted in transit and at rest. Which application flow would meet the data protection requirements on AWS?

  • ADigitized files -> Amazon Kinesis Data Analytics.
  • BDigitized files -> Amazon Kinesis Data Firehose -> Amazon S3 -> Amazon Athena.
  • CDigitized files -> Amazon Kinesis Data Streams -> Kinesis Client Library consumer -> Amazon S3 -> Athena.
  • DDigitized files -> Amazon Kinesis Data Firehose -> Amazon Elasticsearch.
  उत्तर दिखाएँ
• #316

  A company has implemented IAM WAF and Amazon CloudFront for an application. The application runs on Amazon EC2 instances that are part of an Auto Scaling group. The Auto Scaling group is behind an Application Load Balancer (ALB). The IAM WAF web ACL uses an IAM Managed Rules rule group and is associated with the CloudFront distribution. CloudFront receives the request from IAM WAF and then uses the ALB as the distribution's origin. During a security review, a security engineer discovers that the infrastructure is susceptible to a large, layer 7 DDoS attack. How can the security engineer improve the security at the edge of the solution to defend against this type of attack?

  • AConfigure the CloudFront distribution to use the Lambda@Edge feature. Create an IAM Lambda function that imposes a rate limit on CloudFront viewer requests. Block the request if the rate limit is exceeded.
  • BConfigure the IAM WAF web ACL so that the Web ACL has more capacity units to process all IAM WAF rules faster.
  • CConfigure IAM WAF with a rate-based rule that imposes a rate limit that automatically blocks requests when the rate limit is exceeded.
  • DConfigure the CloudFront distribution to use IAM WAF as its origin instead of the ALB.
  उत्तर दिखाएँ
• #3173 चुनें

  A company has a serverless application for internal users deployed on AWS. The application uses AWS Lambda for the front end and for business logic. The Lambda function accesses an Amazon RDS database inside a VPC. The company uses AWS Systems Manager Parameter Store for storing database credentials. A recent security review highlighted the following issues. The Lambda function has internet access. The relational database is publicly accessible. The database credentials are not stored in an encrypted state. Which combination of steps should the company take to resolve these security issues? (Select THREE)

  • ADisable public access to the RDS database inside the VPC.
  • BMove all the Lambda functions inside the VPC.
  • CEdit the IAM role used by Lambda to restrict internet access.
  • DCreate a VPC endpoint for Systems Manager. Store the credentials as a string parameter. Change the parameter type to an advanced parameter.
  • EEdit the IAM role used by RDS to restrict internet access.
  • FCreate a VPC endpoint for Systems Manager. Store the credentials as a Secure String parameter.
  उत्तर दिखाएँ
• #3183 चुनें

  A website currently runs on Amazon EC2, with mostly static content on the site. Recently, the site was subjected to a DDoS attack, and a Security Engineer was tasked with redesigning the edge security to help mitigate this risk in the future. What are some ways the Engineer could achieve this? (Select THREE)

  • AUse AWS X-Ray to inspect the traffic going to the EC2 instances.
  • BMove the static content to Amazon S3, and front this with an Amazon CloudFront distribution.
  • CChange the security group configuration to block the source of the attack traffic.
  • DUse AWS WAF security rules to inspect the inbound traffic.
  • EUse Amazon Inspector assessment templates to inspect the inbound traffic.
  • FUse Amazon Route 53 to distribute traffic.
  उत्तर दिखाएँ
• #319

  A security engineer needs to ensure their company's use of AWS meets AWS security best practices. As part of this, the AWS account root user must not be used for daily work. The root user must be monitored for use, and the security team must be alerted as quickly as possible if the root user is used. Which solution meets these requirements?

  • ASet up an Amazon CloudWatch Events rule that triggers an Amazon SNS notification.
  • BCreate root user access keys. Use an AWS Lambda function to parse AWS CloudTrail logs from Amazon S3 and generate notifications using Amazon SNS.
  • CSet up a rule in AWS Config to trigger root user events. Trigger an AWS Lambda function and generate notifications using Amazon SNS.
  • DUse Amazon Inspector to monitor the usage of the root user and generate notifications using Amazon SNS.
  उत्तर दिखाएँ
• #320

  A company is planning to use Amazon Elastic File System (Amazon EFS) with its on-premises servers. The company has an existing IAM Direct Connect connection established between its on-premises data center and an IAM Region Security policy states that the company's on-premises firewall should only have specific IP addresses added to the allow list and not a CIDR range. The company also wants to restrict access so that only certain data center-based servers have access to Amazon EFS. How should a security engineer implement this solution?

  • AAdd the file-system-id efs IAM-region amazonIAM com URL to the allow list for the data center firewall. Install the IAM CLI on the data center-based servers to mount the EFS file system in the EFS security group add the data center IP range to the allow list. Mount the EFS using the EFS file system name.
  • BAssign an Elastic IP address to Amazon EFS and add the Elastic IP address to the allow list for the data center firewall. Install the IAM CLI on the data center-based servers to mount the EFS file system. In the EFS security group, add the IP addresses of the data center servers to the allow list. Mount the EFS using the Elastic IP address.
  • CAdd the EFS file system mount target IP addresses to the allow list for the data center firewall. In the EFS security group, add the data center server IP addresses to the allow list. Use the Linux terminal to mount the EFS file system using the IP address of one of the mount targets.
  • DAssign a static range of IP addresses for the EFS file system by contacting IAM Support. In the EFS security group add the data center server IP addresses to the allow list. Use the Linux terminal to mount the EFS file system using one of the static IP addresses.
  उत्तर दिखाएँ

अपना स्कोर ट्रैक करना, समयबद्ध मॉक परीक्षा देना और AI व्याख्या पाना चाहते हैं? निःशुल्क खाता बनाएँ