AWS Certified Security - Specialty

• #3212 चुनें

  The Security Engineer is managing a traditional three-tier web application that is running on Amazon EC2 instances. The application has become the target of increasing numbers of malicious attacks from the Internet. What steps should the Security Engineer take to check for known vulnerabilities and limit the attack surface? (Choose TWO)

  • AUse AWS Certificate Manager to encrypt all traffic between the client and application servers.
  • BReview the application security groups to ensure that only the necessary ports are open.
  • CUse Elastic Load Balancing to offload Secure Sockets Layer encryption.
  • DUse Amazon Inspector to periodically scan the backend instances.
  • EUse AWS Key Management Services to encrypt all the traffic between the client and application servers.
  उत्तर दिखाएँ
• #322

  A company has an AWS Lambda function that needs read access to an Amazon S3 bucket that is located in the same AWS account. Which solution will meet these requirements in the MOST secure manner?

  • AApply an S3 bucket policy that grants read access to the S3 bucket.
  • BApply an IAM role to the Lambda function. Apply an IAM policy to the role to grant read access to the S3 bucket.
  • CEmbed an access key and a secret key in the Lambda function's code to grant the required IAM permissions for read access to the S3 bucket.
  • DApply an IAM role to the Lambda function. Apply an IAM policy to the role to grant read access to all S3 buckets in the account.
  उत्तर दिखाएँ
• #323

  A security engineer is auditing a production system and discovers several additional IAM roles that are not required and were not previously documented during the last audit 90 days ago. The engineer is trying to find out who created these IAM roles and when they were created. The solution must have the lowest operational overhead. Which solution will meet this requirement?

  • AImport AWS CloudTrail logs from Amazon S3 into an Amazon Elasticsearch Service cluster, and search through the combined logs for CreateRole events.
  • BCreate a table in Amazon Athena for AWS CloudTrail events. Query the table in Amazon Athena for CreateRole events.
  • CUse AWS Config to look up the configuration timeline for the additional IAM roles and view the linked AWS CloudTrail event.
  • DDownload the credentials report from the IAM console to view the details for each IAM entity, including the creation dates.
  उत्तर दिखाएँ
• #324

  A company's policy requires that all API keys be encrypted and stored separately from source code in a centralized security account. This security account is managed by the company's security team. However, an audit revealed that an API key is stored with the source code of an AWS Lambda function in an AWS CodeCommit repository in the DevOps account. How should the security team securely store the API key?

  • ACreate a CodeCommit repository in the security account using AWS Key Management Service (AWS KMS) for encryption. Require the development team to migrate the Lambda source code to this repository.
  • BStore the API key in an Amazon S3 bucket in the security account using server-side encryption with Amazon S3 managed encryption keys (SSE-S3) to encrypt the key. Create a presigned URL for the S3 key, and specify the URL in a Lambda environmental variable in the AWS CloudFormation template. Update the Lambda function code to retrieve the key using the URL and call the API.
  • CCreate a secret in AWS Secrets Manager in the security account to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the function can retrieve the key from Secrets Manager and call the API.
  • DCreate an encrypted environment variable for the Lambda function to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the function can decrypt the key at runtime.
  उत्तर दिखाएँ
• #325

  A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running In Amazon Elastic Container Service (Amazon ECS). This solution will also handle volatile traffic patterns. Which solution would have the MOST scalability and LOWEST latency?

  • AConfigure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
  • BConfigure an Application Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
  • CConfigure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers.
  • DConfigure Amazon Route 53 to use multivalue answer routing to send traffic to the containers.
  उत्तर दिखाएँ
• #3263 चुनें

  A company always needs its Amazon Elastic Block Store (Amazon EBS) volumes to be encrypted During a security incident. EBS snapshots of suspicious instances are shared to a forensics account for analysis A security engineer attempting to share a suspicious EBS snapshot to the forensics account receives the following error "Unable to share snapshot: An error occurred (OperationNotPermitted) when calling the ModifySnapshotAttribute operation: Encrypted snapshots with EBS default key cannot be shared. Which combination of steps should the security engineer take in the incident account to complete the sharing operation? (Select THREE)

  • ACreate a customer managed CMK Copy the EBS snapshot encrypting the destination snapshot using the new CMK.
  • BAllow forensics accounting principals to use the CMK by modifying its policy.
  • CCreate an Amazon EC2 instance. Attach the encrypted and suspicious EBS volume. Copy data from the suspicious volume to an unencrypted volume. Snapshot the unencrypted volume.
  • DCopy the EBS snapshot to the new decrypted snapshot.
  • ERestore a volume from the suspicious EBS snapshot. Create an unencrypted EBS volume of the same size.
  • FShare the target EBS snapshot with the forensics account.
  उत्तर दिखाएँ
• #327

  A company is running a legacy application on Amazon EC2 instances in multiple Availability Zones behind a software load balancer that runs on an active/standby set of EC2 instances. For disaster recovery, the company has created a warm standby version of the application environment that is deployed in another AWS Region. The domain for the application uses a hosted zone from Amazon Route 53. The company needs the application to use static IP addresses, even in the case of a failover event to the secondary Region. The company also requires the client's source IP address to be available for auditing purposes. Which solution meets these requirements with the LEAST amount of operational overhead?

  • AReplace the software load balancer with an AWS Application Load Balancer. Create an AWS Global Accelerator accelerator. Add an endpoint group for each Region. Configure Route 53 health checks. Add an alias record that points to the accelerator.
  • BReplace the software load balancer with an AWS Network Load Balancer. Create an AWS Global Accelerator accelerator. Add an endpoint group for each Region. Configure Route 53 health checks. Add a CNAME record that points to the DNS name of the accelerator.
  • CReplace the software load balancer with an AWS Application Load Balancer. Use AWS Global Accelerator to create two separate accelerators. Add an endpoint group for each Region. Configure Route 53 health checks. Add a record set that is configured for active-passive DNS failover. Point the record set to the DNS names of the two accelerators.
  • DReplace the software load balancer with an AWS Network Load Balancer. Use AWS Global Accelerator to create two separate accelerators. Add an endpoint group for each Region. Configure Route 53 health checks. Add a record set that is configured for weighted round-robin DNS failover. Point the record set to the DNS names of the two accelerators.
  उत्तर दिखाएँ
• #328

  A company has implemented centralized logging and monitoring of AWS CloudTrail logs from all Regions in an Amazon S3 bucket. The log Hies are encrypted using AWS KMS. A Security Engineer is attempting to review the log files using a third-party tool hosted on an Amazon EC2 instance. The Security Engineer is unable to access the logs in the S3 bucket and receives an access denied error message. What should the Security Engineer do to fix this issue?

  • ACheck that the role the Security Engineer uses grants permission to decrypt objects using the KMS CMK.
  • BCheck that the role the Security Engineer uses grants permission to decrypt objects using the KMS CMK and gives access to the S3 bucket and objects.
  • CCheck that the role the EC2 instance profile uses grants permission to decrypt objects using the KMS CMK and gives access to the S3 bucket and objects.
  • DCheck that the role the EC2 instance profile uses grants permission to decrypt objects using the KMS CMK.
  उत्तर दिखाएँ
• #329

  A company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certificate, users saw the following message. When trying to log in: Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code:InvalidldentityToken). A security engineer needs to provide a solution that corrects the error and minimizes operational overhead. Which solution meets these requirements?

  • AUpload the third-party signing certificate's new private key to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS Management Console.
  • BSign the identity provider's metadata file with the new public key. Upload the signature to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CU.
  • CDownload the updated SAML metadata file from the identity service provider. Update the file in the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
  • DConfigure the AWS identity provider entity defined in AWS Identity and Access Management (IAM) to synchronously fetch the new public key by using the AWS Management Console.
  उत्तर दिखाएँ
• #330

  To meet regulatory requirements, a Security Engineer needs to implement an IAM policy that restricts the use of AWS services to the us-east-1 Region. What policy should the Engineer implement?

  • AOption A.
  • BOption B.
  • COption C.
  • DOption D.
  उत्तर दिखाएँ
• #331

  A Developer's laptop was stolen. The laptop was not encrypted, and it contained the SSH key used to access multiple Amazon EC2 instances. A SecurityEngineer has verified that the key has not been used, and has blocked port 22 to all EC2 instances while developing a response plan. How can the Security Engineer further protect currently running instances?

  • ADelete the key-pair key from the EC2 console, then create a new key pair.
  • BUse the modify-instance-attribute API to change the key on any EC2 instance that is using the key.
  • CUse the EC2 RunCommand to modify the authorized_keys file on any EC2 instance that is using the key.
  • DUpdate the key pair in any AMI used to launch the EC2 instances, then restart the EC2 instances.
  उत्तर दिखाएँ
• #332

  A company uses an Amazon S3 bucket to store reports Management has mandated that all new objects stored in this bucket must be encrypted at rest using server-side encryption with a client-specified IAM Key Management Service (AWS KMS) CMK owned by the same account as the S3 bucket. The IAM account number is 111122223333, and the bucket name is report bucket. The company's security specialist must write the S3 bucket policy to ensure the mandate can be Implemented. Which statement should the security specialist include in the policy?

  • AOption A.
  • BOption B.
  • COption C.
  • DOption D.
  उत्तर दिखाएँ
• #333

  An organization has tens of applications deployed on thousands of Amazon EC2 instances. During testing, the Application team needs information to let them know whether the network access control lists (network ACLs) and security groups are working as expected. How can the Application team's requirements be met?

  • ATurn on VPC Flow Logs, send the logs to Amazon S3, and use Amazon Athena to query the logs.
  • BInstall an Amazon Inspector agent on each EC2 instance, send the logs to Amazon S3, and use Amazon EMR to query the logs.
  • CCreate an AWS Config rule for each network ACL and security group configuration, send the logs to Amazon S3, and use Amazon Athena to query the logs.
  • DTurn on AWS CloudTrail, send the trails to Amazon S3, and use AWS Lambda to query the trails.
  उत्तर दिखाएँ
• #334

  A company has two AWS accounts, each containing one VPC. The first VPC has a VPN connection with its corporate network. The second VPC, without a VPN, hosts an Amazon Aurora database cluster in private subnets. Developers manage the Aurora database from a bastion host in a public subnet as shown in the image. A security review has flagged this architecture as vulnerable, and a Security Engineer has been asked to make this design more secure. The company has a short deadline and a second VPN connection to the Aurora account is not possible. How can the Security Engineer securely set up the bastion host?

  • AMove the bastion host to the VPC with VPN connectivity. Create a VPC peering relationship between the bastion host VPC and Aurora VPC.
  • BCreate an SSH port forwarding tunnel on the Developer's workstation to the bastion host to ensure that only authorized SSH clients can access the bastion host.
  • CMove the bastion host to the VPC with VPN connectivity. Create a cross-account trust relationship between the bastion VPC and Aurora VPC, and update the Aurora security group for the relationship.
  • DCreate an AWS Direct Connect connection between the corporate network and the Aurora account, and adjust the Aurora security group for this connection.
  उत्तर दिखाएँ
• #335

  A Security Administrator is restricting the capabilities of company root user accounts. The company uses AWS Organizations and has enabled it for all feature sets, including consolidated billing. The top-level account is used for billing and administrative purposes, not for operational AWS resource purposes. How can the Administrator restrict usage of member root user accounts across the organization?

  • ADisable the use of the root user account at the organizational root. Enable multi-factor authentication of the root user account for each organizational member account.
  • BConfigure IAM user policies to restrict root account capabilities for each Organizations member account.
  • CCreate an organizational unit (OU) in Organizations with a service control policy that controls usage of the root user. Add all operational accounts to the new OU.
  • DConfigure AWS CloudTrail to integrate with Amazon CloudWatch Logs and then create a metric filter for RootAccountUsage.
  उत्तर दिखाएँ
• #336

  A company needs to store multiple years of financial records. The company wants to use Amazon S3 to store copies of these documents. The company must implement a solution to prevent the documents from being edited, replaced, or deleted for 7 years after the documents are stored in Amazon S3. The solution must also encrypt the documents at rest. A security engineer creates a new S3 bucket to store the documents. What should the security engineer do next to meet these requirements?

  • AConfigure S3 server-side encryption. Create an S3 bucket policy that has an explicit deny rule for all users for s3:DeleteObject and s3:PutObject API calls. Configure S3 Object Lock to use governance mode with a retention period of 7 years.
  • BConfigure S3 server-side encryption. Configure S3 Versioning on the S3 bucket. Configure S3 Object Lock to use compliance mode with a retention period of 7 years.
  • CConfigure S3 Versioning. Configure S3 Intelligent-Tiering on the S3 bucket to move the documents to S3 Glacier Deep Archive storage. Use S3 server-side encryption immediately. Expire the objects after 7 years.
  • DSet up S3 Event Notifications and use S3 server-side encryption. Configure S3 Event Notifications to target an AWS Lambda function that will review any S3 API call to the S3 bucket and deny the s3:DeleteObject and s3:PutObject API calls. Remove the S3 event notification after 7 years.
  उत्तर दिखाएँ
• #337

  After multiple compromises of its Amazon EC2 instances, a company's Security Officer is mandating that memory dumps of compromised instances be captured for further analysis. A Security Engineer just received an EC2 abuse notification report from AWS stating that an EC2 instance running the most recent. Windows Server 2019 Base AMI is compromised. How should the Security Engineer collect a memory dump of the EC2 instance for forensic analysis?

  • AGive consent to the AWS Security team to dump the memory core on the compromised instance and provide it to AWS Support for analysis.
  • BReview memory dump data that the AWS Systems Manager Agent sent to Amazon CloudWatch Logs.
  • CDownload and run the EC2Rescue for Windows Server utility from AWS.
  • DReboot the EC2 Windows Server, enter safe mode, and select memory dump.
  उत्तर दिखाएँ
• #338

  A security engineer logs in to the AWS Lambda console with administrator permissions. The security engineer is trying to view logs in Amazon CloudWatch for a Lambda function that is named my Function. When the security engineer chooses the option in the Lambda console to view logs in CloudWatch, an error loading Log Streams message appears. The IAM policy for the Lambda function's execution role contains the following. How should the security engineer correct the error?

  • AMove the logs:CreateLogGroup action to the second Allow statement.
  • BAdd the logs:PutDestination action to the second Allow statement.
  • CAdd the logs:GetLogEvents action to the second Allow statement.
  • DAdd the logs:CreateLogStream action to the second Allow statement.
  उत्तर दिखाएँ
• #3392 चुनें

  An IAM user with fill EC2 permissions could bot start an Amazon EC2 instance after it was stopped for a maintenance task. Upon starting the instance, the instance state would change to Pending, but after a few seconds, it would switch back to Stopped. An inspection revealed that the instance has attached Amazon EBS volumes that were encrypted by using a Customer Master Key (CMK). When these encrypted volumes were detached, the IAM user was able to start the EC2 instances. The IAM user policy is as follows. What additional items need to be added to the IAM user policy? (Choose TWO)

  • Akms:GenerateDataKey.
  • Bkms:Decrypt.
  • Ckms:CreateGrant.
  • D"Condition": { "Bool": { "kms:ViaService": "ec2.us-west-2.amazonaws.com" } }.
  • E"Condition": { "Bool": { "kms:GrantIsForAWSResource": true } }.
  उत्तर दिखाएँ
• #340

  A company wants to monitor the deletion of customer managed CMKs. A security engineer must create an alarm that will notify the company before a CMK is deleted. The security engineer has configured the integration of AWS CloudTrail with Amazon CloudWatch. What should the security engineer do next to meet this requirement?

  • AWithin AWS Key Management Service (AWS KMS), specify the deletion time of the key material during CMK creation. AWS KMS will automatically create a CloudWatch alarm.
  • BCreate an Amazon EventBridge (Amazon CloudWatch Events) rule to look for API calls of DeleteAlias. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the Eventbridge (CloudWatch Events) rule.
  • CCreate an Amazon EventBridge (Amazon CloudWatch Events) rule to look for API calls of DisableKey and ScheduleKeyDeletion. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the Eventbridge (CloudWatch Events) rule.
  • DCreate an Amazon Simple Notification Service (Amazon SNS) policy to look for AWS Key Management Service (AWS KMS) API calls of RevokeGrant and ScheduleKeyDeletion. Create an AWS Lambda function to generate the alarm and send the notification to the company. Add the Lambda function as the target of the SNS policy.
  उत्तर दिखाएँ

अपना स्कोर ट्रैक करना, समयबद्ध मॉक परीक्षा देना और AI व्याख्या पाना चाहते हैं? निःशुल्क खाता बनाएँ