AWS Certified Security - Specialty

• #101Pilih 3

  A security alert has been raised for an Amazon EC2 instance in a customer account that is exhibiting strange behavior. The Security Engineer must first isolate the EC2 instance and then use tools for further investigation. What should the Security Engineer use to isolate and research this event? (Choose THREE)

  • AAWS CloudTrail.
  • BAmazon Athena.
  • CAWS Key Management Service (AWS KMS).
  • DVPC Flow Logs.
  • EAWS Firewall Manager.
  • FSecurity groups.
  Tampilkan jawaban
• #102Pilih 2

  A security engineer is designing an IAM policy to protect AWS API operations. The policy must enforce multi-factor authentication (MFA) for IAM users to access certain services in the AWS production account. Each session must remain valid for only 2 hours. The current version of the IAM policy is as follows. Which combination of conditions must the security engineer add to the IAM policy to meet these requirements? (Choose TWO)

  • A"Bool": {"aws:MultiFactorAuthPresent": "true"}.
  • B"Bool": {"aws:MultiFactorAuthPresent": "false"}.
  • C"NumericLessThan": {"aws:MultiFactorAuthAge": "7200"}.
  • D"NumericGreaterThan": {"aws:MultiFactorAuthAge": "7200"}.
  • E"NumericLessThan": {"MaxSessionDuration": "7200"}.
  Tampilkan jawaban
• #103Pilih 3

  Which of the following are valid configurations for using SSL certificates with Amazon CloudFront? (Select THREE)

  • ADefault AWS Certificate Manager certificate.
  • BCustom SSL certificate stored in AWS KMS.
  • CDefault CloudFront certificate.
  • DCustom SSL certificate stored in AWS Certificate Manager.
  • EDefault SSL certificate stored in AWS Secrets Manager.
  • FCustom SSL certificate stored in AWS IAM.
  Tampilkan jawaban
• #104

  A company stores sensitive documents in Amazon S3 by using server-side encryption with an AWS Key Management Service (AWS KMS) CMK. A new requirement mandates that the CMK that is used for these documents can be used only for S3 actions. Which statement should the company add to the key policy to meet this requirement?

  • AOption A.
  • BOption B.
  • COption C.
  • DOption D.
  Tampilkan jawaban
• #105

  Due to new compliance requirements, a Security Engineer must enable encryption with customer-provided keys on corporate data that is stored in DynamoDB. The company wants to retain full control of the encryption keys. Which DynamoDB feature should the Engineer use to achieve compliance'?

  • AUse AWS Certificate Manager to request a certificate. Use that certificate to encrypt data prior to uploading it to DynamoDB.
  • BEnable S3 server-side encryption with the customer-provided keys. Upload the data to Amazon S3, and then use S3Copy to move all data to DynamoDB
  • CCreate a KMS master key. Generate per-record data keys and use them to encrypt data prior to uploading it to DynamoDS. Dispose of the cleartext and encrypted data keys after encryption without storing.
  • DUse the DynamoDB Java encryption client to encrypt data prior to uploading it to DynamoDB.
  Tampilkan jawaban
• #106

  Example.com hosts its internal document repository on Amazon EC2 instances. The application runs on EC2 instances and previously stored the documents on encrypted Amazon EBS volumes. To optimize the application for scale, example.com has moved the files to Amazon S3. The security team has mandated that all the files are securely deleted from the EBS volume, and it must certify that the data is unreadable before releasing the underlying disks. Which of the following methods will ensure that the data is unreadable by anyone else?

  • AChange the volume encryption on the EBS volume to use a different encryption mechanism. Then, release the EBS volumes back to AWS.
  • BRelease the volumes back to AWS. AWS immediately wipes the disk after it is deprovisioned.
  • CDelete the encryption key used to encrypt the EBS volume. Then, release the EBS volumes back to AWS.
  • DDelete the data by using the operating system delete commands. Run Quick Format on the drive and then release the EBS volumes back to AWS.
  Tampilkan jawaban
• #107Pilih 2

  A company is hosting a static website on Amazon S3 The company has configured an Amazon CloudFront distribution to serve the website contents. The company has associated an IAM WAF web ACL with the CloudFront distribution. The Web ACL ensures that requests originate from the United States to address compliance restrictions. THE company is worried that the S3 URL might still be accessible directly and that requests can bypass the CloudFront distribution. Which combination of steps should the company take to remove direct access to the S3 URL? (Select TWO)

  • ASelect Restrict Bucket Access in the origin settings of the CloudFront distribution
  • BCreate an origin access identity (OAI) for the S3 origin.
  • CUpdate the S3 bucket policy to allow s3 GetObject with a condition that the IAM Referer key matches the secret value Deny all other.
  • DConfigure the S3 bucket poky so that only the origin access identity (OAI) has read permission for objects in the bucket.
  • EAdd an origin custom header that has the name Referer to the CloudFront distribution Give the header a secret value.
  Tampilkan jawaban
• #108Pilih 3

  A company has several production AWS accounts and a central security AWS account. The security account is used for centralized monitoring and has IAM privileges to all resources in every corporate account. All of the company's Amazon S3 buckets are tagged with a value denoting the data classification of their contents. A Security Engineer is deploying a monitoring solution in the security account that will enforce bucket policy compliance. The system must monitor S3 buckets in all production accounts and confirm that any policy change is in accordance with the bucket's data classification. If any change is out of compliance; the Security team must be notified quickly. Which combination of actions would build the required solution? (Choose THREE)

  • AConfigure Amazon CloudWatch Events in the production accounts to send all S3 events to the security account event bus.
  • BEnable Amazon GuardDuty in the security account. and join the production accounts as members.
  • CConfigure an Amazon CloudWatch Events rule in the security account to detect S3 bucket creation or modification events.
  • DEnable AWS Trusted Advisor and activate email notifications for an email address assigned to the security contact.
  • EInvoke an AWS Lambda function in the security account to analyze S3 bucket settings in response to S3 events, and send non-compliance notifications to the Security team.
  • FConfigure event notifications on S3 buckets for PUT; POST, and DELETE events.
  Tampilkan jawaban
• #109Pilih 3

  A Security Engineer is working with a Product team building a web application on AWS. The application uses Amazon S3 to host the static content, Amazon API Gateway to provide RESTful services; and Amazon DynamoDB as the backend data store. The users already exist in a directory that is exposed through a SAML identity provider. Which combination of the following actions should the Engineer take to enable users to be authenticated into the web application and call APIs? (Choose THREE)

  • ACreate a custom authorization service using AWS Lambda.
  • BConfigure a SAML identity provider in Amazon Cognito to map attributes to the Amazon Cognito user pool attributes.
  • CConfigure the SAML identity provider to add the Amazon Cognito user pool as a relying party.
  • DConfigure an Amazon Cognito identity pool to integrate with social login providers.
  • EUpdate DynamoDB to store the user email addresses and passwords.
  • FUpdate API Gateway to use a COGNITO_USER_POOLS authorizer.
  Tampilkan jawaban
• #110

  A company wants to remove all SSH keys permanently from a specific subset of its Amazon Linux 2 Amazon EC2 instances that are using the same IAM instance profile However three individuals who have IAM user accounts will need to access these instances by using an SSH session to perform critical duties How can a security engineer provide the access to meet these requirements?

  • AAssign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager. Provide the IAM user accounts with permission to use Systems Manager. Remove the SSH keys from the EC2 instances. Use Systems Manager Inventory to select the EC2 instance and connect.
  • BAssign an IAM policy to the IAM user accounts to provide permission to use AWS Systems Manager. Run Command. Remove the SSH keys from the EC2 instances. Use Run Command to open an SSH connection to the EC2 instance.
  • CAssign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager. Provide the IAM user accounts with permission to use Systems Manager. Remove the SSH keys from the EC2 instances Use Systems Manager Session Manager to select the EC2 instance and connect.
  • DAssign an IAM policy to the IAM user accounts to provide permission to use the EC2 service in the AWS Management Console. Remove the SSH keys from the EC2 instances. Connect to the EC2 instance as the ec2-user through the AWS Management Console's EC2 SSH client method.
  Tampilkan jawaban
• #111

  A company plans to use custom AMIs to launch Amazon EC2 instances across multiple AWS accounts in a single Region to perform security monitoring and analytics tasks. The EC2 instances are launched in EC2 Auto Scaling groups. To increase the security of the solution, a Security Engineer will manage the lifecycle of the custom AMIs in a centralized account and will encrypt them with a centrally managed AWS KMS CMK. The Security Engineer configured the KMS key policy to allow cross-account access. However, the EC2 instances are still not being properly launched by the EC2 Auto Scaling groups. Which combination of configuration steps should the Security Engineer take to ensure the EC2 Auto Scaling groups have been granted the proper permissions to execute tasks?

  • ACreate a customer-managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Create an IAM role in all applicable accounts and configure its access policy to allow the use of the centrally managed CMK for cryptographical operations. Configure EC2 Auto Scaling groups within each applicable account to use the created IAM role to launch EC2 instances.
  • BCreate a customer-managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Create an IAM role in all applicable accounts and configure its access policy with permissions to create grants for the centrally managed CMK. Use this IAM role to create a grant for the centrally managed CMK with permissions to perform cryptographical operations and with the EC2 Auto Scaling service-linked role defined as the grantee principal.
  • CCreate a customer-managed CMK or an AWS managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Use the CMK administrator to create a CMK grant that includes permissions to perform cryptographical operations that define EC2 Auto Scaling service-linked roles from all other accounts as the grantee principal.
  • DCreate a customer-managed CMK or an AWS managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Modify the access policy for the EC2 Auto Scaling roles to perform cryptographical operations against the centrally managed CMK.
  Tampilkan jawaban
• #112

  A company has Windows Amazon EC2 instances in a VPC that are joined to on-premises Active Directory servers for domain services. The security team has enabled Amazon GuardDuty on the AWS account to alert on issues with the instances. During a weekly audit of network traffic, the Security Engineer notices that one of the EC2 instances is attempting to communicate with a known command-and- control server but failing. This alert does not show up in GuardDuty. Why did GuardDuty fail to alert to this behavior?

  • AGuardDuty did not have the appropriate alerts activated.
  • BGuardDuty does not see these DNS requests.
  • CGuardDuty only monitors active network traffic flow for command-and-control activity.
  • DGuardDuty does not report on command-and-control activity.
  Tampilkan jawaban
• #113

  A company has several critical applications running on a large fleet of Amazon EC2 instances. As part of a security operations review, the company needs to apply a critical operating system patch to EC2 instances within 24 hours of the patch becoming available from the operating system vendor. The company does not have a patching solution deployed on AWS, but does have AWS Systems Manager configured. The solution must also minimize administrative overhead. What should a security engineer recommend to meet these requirements?

  • ACreate an AWS Config rule defining the patch as a required configuration for EC2 instances.
  • BUse the AWS Systems Manager Run Command to patch affected instances.
  • CUse an AWS Systems Manager Patch Manager predefined baseline to patch affected instances.
  • DUse AWS Systems Manager Session Manager to log in to each affected instance and apply the patch.
  Tampilkan jawaban
• #114Pilih 2

  A Security Engineer has been asked to troubleshoot inbound connectivity to a web server. This single web server is not receiving inbound connections from the internet, whereas all other web servers are functioning properly. The architecture includes network ACLs, security groups, and a virtual security appliance. In addition, the Development team has implemented Application Load Balancers (ALBs) to distribute the load across all web servers. It is a requirement that traffic between the web servers and the internet flow through the virtual security appliance. The Security Engineer has verified the following: 1. The rule set in the Security Groups is correct 2. The rule set in the network ACLs is correct 3. The rule set in the virtual appliance is correct Which of the following are other valid items to troubleshoot in this scenario? (Choose TWO)

  • AVerify that the 0.0.0.0/0 route in the route table for the web server subnet points to a NAT gateway.
  • BVerify which Security Group is applied to the particular web server's elastic network interface (ENI).
  • CVerify that the 0.0.0.0/0 route in the route table for the web server subnet points to the virtual security appliance.
  • DVerify the registered targets in the ALB.
  • EVerify that the 0.0.0.0/0 route in the public subnet points to a NAT gateway.
  Tampilkan jawaban
• #115Pilih 2

  A developer 15 building a serverless application hosted on IAM that uses Amazon Redshift in a data store. The application has separate modules for read/write and read-only functionality. The modules need their own database users for compliance reasons. Which combination of steps should a security engineer implement to grant appropriate access? (Select TWO)

  • AConfigure cluster security groups for each application module to control access to database users that are required for read-only and read/write.
  • BConfigure a VPC endpoint for Amazon Redshift Configure an endpoint policy that maps database users to each application module, and allow access to the tables that are required for read-only and read/write.
  • CConfigure an IAM policy for each module Specify the ARN of an Amazon Redshift database user that allows the GetClusterCredentials API call.
  • DCreate focal database users for each module.
  • EConfigure an IAM policy for each module Specify the ARN of an IAM user that allows the GetClusterCredentials API call.
  Tampilkan jawaban
• #116

  A company plans to use AWS Key Management Service (AWS KMS) to implement an encryption strategy to protect data at rest. The company requires client-side encryption for company projects. The company is currently conducting multiple projects to test the company's use of AWS KMS. These tests have led to a sudden increase in the company's AWS resource consumption. The test projects include applications that issue multiple requests each second to KMS endpoints for encryption activities. The company needs to develop a solution that does not throttle the company's ability to use AWS KMS. The solution must improve key usage for client-side encryption and must be cost optimized. Which solution will meet these requirements?

  • AUse keyrings with the AWS Encryption SDK. Use each keyring individually or combine keyrings into a multi-keyring. Decrypt the data by using a keyring that has the primary key in the multi-keyring.
  • BUse data key caching. Use the local cache that the AWS Encryption SDK provides with a caching cryptographic materials manager.
  • CUse KMS key rotation. Use a local cache in the AWS Encryption SDK with a caching cryptographic materials manager.
  • DUse keyrings with the AWS Encryption SDK. Use each keyring individually or combine keyrings into a multi-keyring. Use any of the wrapping keys in the multi-keyring to decrypt the data.
  Tampilkan jawaban
• #117

  A company has deployed a custom DNS server in AWS. The Security Engineer wants to ensure that Amazon EC2 instances cannot use the Amazon-provided DNS. How can the Security Engineer block access to the Amazon-provided DNS in the VPC?

  • ADeny access to the Amazon DNS IP within all security groups.
  • BAdd a rule to all network access control lists that deny access to the Amazon DNS IP.
  • CAdd a route to all route tables that black holes traffic to the Amazon DNS IP.
  • DDisable DNS resolution within the VPC configuration.
  Tampilkan jawaban
• #118Pilih 2

  A company is using IAM Secrets Manager to store secrets for its production Amazon RDS database. The Security Officer has asked that secrets be rotated every 3 months. Which solution would allow the company to securely rotate the secrets? (Select TWO)

  • APlace the RDS instance in a public subnet and an IAM Lambda function outside the VPC. Schedule the Lambda function to run every 3 months to rotate the secrets.
  • BPlace the RDS instance in a private subnet and an IAM Lambda function inside the VPC in the private subnet. Configure the private subnet to use a NAT gateway. Schedule the Lambda function to run every 3 months to rotate the secrets.
  • CPlace the RDS instance in a private subnet and an IAM Lambda function outside the VPC. Configure the private subnet to use an internet gateway. Schedule the Lambda function to run every 3 months to rotate the secrets.
  • DPlace the RDS instance in a private subnet and an IAM Lambda function inside the VPC in the private subnet. Schedule the Lambda function to run quarterly to rotate the secrets.
  • EPlace the RDS instance in a private subnet and an IAM Lambda function inside the VPC in the private subnet. Configure a Secrets Manager interface endpoint. Schedule the Lambda function to run every 3 months to rotate the secrets.
  Tampilkan jawaban
• #119Pilih 2

  A Security Engineer has several thousand Amazon EC2 instances split across production and development environments. Each instance is tagged with its environment. The Engineer needs to analyze and patch all the development EC2 instances to ensure they are not currently exposed to any common vulnerabilities or exposures (CVEs). Which combination of steps is the MOST efficient way for the Engineer to meet these requirements? (Select TWO)

  • ALog on to each EC2 instance, check and export the different software versions installed, and verify this against a list of current CVEs.
  • BInstall the Amazon Inspector agent on all development instances. Build a custom rule package, and configure Inspector to perform a scan using this custom rule on all instances tagged as being in the development environment.
  • CInstall the Amazon Inspector agent on all development instances. Configure Inspector to perform a scan using the CVE rule package on all instances tagged as being in the development environment.
  • DInstall the Amazon EC2 System Manager agent on all development instances. Issue the Run command to EC2 System Manager to update all instances.
  • EUse AWS Trusted Advisor to check that all EC2 instances have been patched to the most recent version of operating system and installed software.
  Tampilkan jawaban
• #120Pilih 2

  A company has an application that uses dozens of Amazon DynamoDB tables to store data. Auditors find that the tables do not comply with the company's data protection policy. The company's retention policy states that all data must be backed up twice each month: once at midnight on the 15th day of the month and again at midnight on the 25th day of the month. The company must retain the backups for 3 months. Which combination of steps should a security engineer take to meet these requirements? (Choose TWO)

  • AUse the DynamoDB on-demand backup capability to create a backup plan. Configure a lifecycle policy to expire backups after 3 months.
  • BUse AWS DataSync to create a backup plan. Add a backup rule that includes a retention period of 3 months.
  • CUse AWS Backup to create a backup plan. Add a backup rule that includes a retention period of 3 months.
  • DSet the backup frequency by using a cron schedule expression. Assign each DynamoDB table to the backup plan.
  • ESet the backup frequency by using a rate schedule expression. Assign each DynamoDB table to the backup plan.
  Tampilkan jawaban

Ingin melacak skor, mengikuti ujian simulasi berwaktu, dan mendapat penjelasan AI? Buat akun gratis