AWS Certified Security - Specialty

• #1

  A company uses AWS Organizations to manage a small number of AWS accounts. However, the company plans to add 1 000 more accounts soon. The company allows only a centralized security team to create IAM roles for all AWS accounts and teams. Application teams submit requests for IAM roles to the security team. The security team has a backlog of IAM role requests and cannot review and provision the IAM roles quickly. The security team must create a process that will allow application teams to provision their own IAM roles. The process must also limit the scope of IAM roles and prevent privilege escalation. Which solution will meet these requirements with the LEAST operational overhead?

  • ACreate an IAM group for each application team. Associate policies with each IAM group. Provision IAM users for each application team member. Add the new IAM users to the appropriate IAM group by using role-based access control (RBAC).
  • BDelegate application team leads to provision IAM rotes for each team. Conduct a quarterly review of the IAM rotes the team leads have provisioned. Ensure that the application team leads have the appropriate training to review IAM roles.
  • CPut each AWS account in its own OU. Add an SCP to each OU to grant access to only the AWS services that the teams plan to use. Include conditions tn the AWS account of each team.
  • DCreate an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that only roles that have the permissions boundary attached can create any new IAM roles.
  解答を表示
• #2

  A company is using Amazon Macie, AWS Firewall Manager, Amazon Inspector, and AWS Shield Advanced in its AWS account. The company wants to receive alerts if a DDoS attack occurs against the account. Which solution will meet this requirement?

  • AUse Macie to detect an active DDoS event. Create Amazon CloudWatch alarms that respond to Macie findings.
  • BUse Amazon Inspector to review resources and to invoke Amazon CloudWatch alarms for any resources that are vulnerable to DDoS attacks.
  • CCreate an Amazon CloudWatch alarm that monitors Firewall Manager metrics for an active DDoS event.
  • DCreate an Amazon CloudWatch alarm that monitors Shield Advanced metrics for an active DDoS event.
  解答を表示
• #32 つ選択

  A security engineer is configuring AWS Config for an AWS account that uses a new IAM entity. When the security engineer tries to configure AWS Config rules and automatic remediation options, errors occur. In the AWS CloudTrail logs, the security engineer sees the following error message: Insufficient delivery policy to s3 bucket: DOC-EXAMPLE-BUCKET, unable to write to bucket, provided s3 key prefix is 'null'. Which combination of steps should the security engineer take to remediate this issue? (Choose TWO)

  • ACheck the Amazon S3 bucket policy. Verify that the policy allows the config amazonaws,com service to write to the target bucket.
  • BVerify that the IAM entity has the permissions necessary to perform the s3:GetBucketAcl and s3:PutObject operations to write to the target bucket.
  • CVerify that the Amazon S3 bucket policy has the permissions necessary to perform the s3:GetBucketAcl and s3:PutObject operations to write to the target bucket.
  • DCheck the policy that is associated with the IAM entity. Verify that the policy allows the config.amazonaws.com service to write to the target bucket.
  • EVerify that the AWS Config service role has permissions to invoke the BatchGetResourceConfig action instead of the GetResourceConfigHistory action and s3:PutObject operation.
  解答を表示
• #42 つ選択

  Amazon CloudWatch Logs agent is successfully delivering logs to the CloudWatch Logs service. However, logs stop being delivered after the associated log stream has been active for a specific number of hours. What steps are necessary to identify the cause of this phenomenon? (Choose TWO)

  • AEnsure that file permissions for monitored files that allow the CloudWatch Logs agent to read the file have not been modified.
  • BVerify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming.
  • CConfigure an Amazon Kinesis producer to first put the logs into Amazon Kinesis Streams.
  • DCreate a CloudWatch Logs metric to isolate a value that changes at least once during the period before logging stops.
  • EUse AWS CloudFormation to dynamically create and maintain the configuration file for the CloudWatch Logs agent.
  解答を表示
• #5

  A company recently experienced a DDoS attack that prevented its web server from serving content. The website is static and hosts only HTML, CSS, and PDF files that users download. Based on the architecture shown in the image, what is the BEST way to protect the site against future attacks while minimizing the ongoing operational overhead?

  • AMove all the files to an Amazon S3 bucket. Have the web server serve the files from the S3 bucket.
  • BLaunch a second Amazon EC2 instance in a new subnet. Launch an Application Load Balancer in front of both instances.
  • CLaunch an Application Load Balancer in front of the EC2 instance. Create an Amazon CloudFront distribution in front of the Application Load Balancer.
  • DMove all the files to an S3 bucket. Create a CloudFront distribution in front of the bucket and terminate the web server.
  解答を表示
• #6

  A security engineer is responsible for providing secure access to AWS resources for thousands of developer in a company's corporate identity provider (idp). The developers access a set of AWS services from the corporate premises using IAM credential. Due to the velum of require for provisioning new IAM users, it is taking a long time to grant access permissions. The security engineer receives reports that developer are sharing their IAM credentials with others to avoid provisioning delays. The causes concern about overall security for the security engineer. Which actions will meet the program requirements that address security?

  • ACreate an Amazon CloudWatch alarm for AWS CloudTrail Events. Create a metric filter to send a notification when me same set of IAM credentials is used by multiple developer.
  • BCreate a federation between AWS and the existing corporate IdP. Leverage IAM roles to provide federated access to AWS resources
  • CCreate a VPN tunnel between the corporate premises and the VPC. Allow permissions to all AWS services only if it originates from corporate premises.
  • DCreate multiple IAM rotes for each IAM user. Ensure that users who use the same IAM credentials cannot assume the same IAM role at the same time.
  解答を表示
• #7

  There is a requirement for a company to transfer large amounts of data between IAM and an on-premise location. There is an additional requirement for low latency and high consistency traffic to IAM. Given these requirements how would you design a hybrid architecture?

  • AProvision a Direct Connect connection to an IAM region using a Direct Connect partner.
  • BCreate a VPN tunnel for private connectivity, which increases network consistency and reduces latency.
  • CCreate an IPsec tunnel for private connectivity, which increases network consistency and reduces latency.
  • DCreate a VPC peering connection between IAM and the Customer gateway.
  解答を表示
• #8

  A company's on-premises networks are connected to VPCs using an IAM Direct Connect gateway. The company's on-premises application needs to stream data using an existing Amazon Kinesis Data Firehose delivery stream. The company's security policy requires that data be encrypted in transit using a private network. How should the company meet these requirements?

  • ACreate a VPC endpoint for Kinesis Data Firehose. Configure the application to connect to the VPC endpoint.
  • BConfigure an IAM policy to restrict access to Kinesis Data Firehose using a source IP condition. Configure the application to connect to the existing Firehose delivery stream.
  • CCreate a new TLS certificate in IAM Certificate Manager (ACM). Create a public-facing Network Load Balancer (NLB) and select the newly created TLS certificate. Configure the NLB to forward all traffic to Kinesis Data Firehose. Configure the application to connect to the NLB.
  • DPeer the on-premises network with the Kinesis Data Firehose VPC using Direct Connect. Configure the application to connect to the existing Firehose delivery stream.
  解答を表示
• #92 つ選択

  A development team is attempting to encrypt and decode a secure string parameter from the IAM Systems Manager Parameter Store using an IAM Key Management Service (AWS KMS) CMK. However, each attempt results in an error message being sent to the development team. Which CMK-related problems possibly account for the error? (Select TWO)

  • AThe CMK is used in the attempt does not exist.
  • BThe CMK is used in the attempt needs to be rotated.
  • CThe CMK is used in the attempt is using the CMKs key ID instead of the CMK ARN.
  • DThe CMK is used in the attempt is not enabled.
  • EThe CMK is used in the attempt is using an alias.
  解答を表示
• #10

  A Security Engineer has launched multiple Amazon EC2 instances from a private AMI using an AWS CloudFormation template. The Engineer notices instances terminating right after they are launched. What could be causing these terminations?

  • AThe IAM user launching those instances is missing ec2:Runinstances permission.
  • BThe AMI used as encrypted and the IAM does not have the required AWS KMS permissions.
  • CThe instance profile used with the EC2 instances in unable to query instance metadata.
  • DAWS currently does not have sufficient capacity in the Region.
  解答を表示
• #11

  A company has an encrypted Amazon S3 bucket. An Application Developer has an IAM policy that allows access to the S3 bucket, but the Application Developer is unable to access objects within the bucket. What is a possible cause of the issue?

  • AThe S3 ACL for the S3 bucket fails to explicitly grant access to the Application Developer.
  • BThe AWS KMS key for the S3 bucket fails to list the Application Developer as an administrator.
  • CThe S3 bucket policy fails to explicitly grant access to the Application Developer.
  • DThe S3 bucket policy explicitly denies access to the Application Developer.
  解答を表示
• #12

  An AWS Lambda function was misused to alter data, and a Security Engineer must identify who invoked the function and what output was produced. The Engineer cannot find any logs created by the Lambda function in Amazon CloudWatch Logs. Which of the following explains why the logs are not available?

  • AThe execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.
  • BThe Lambda function was executed by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs.
  • CThe execution role for the Lambda function did not grant permissions to write to the Amazon S3 bucket where CloudWatch Logs stores the logs.
  • DThe version of the Lambda function that was executed was not current.
  解答を表示
• #133 つ選択

  A company's security engineer receives an abuse notification from AWS. The notification indicates that someone is hosting malware from the company's AWS account. After investigation, the security engineer finds a new Amazon S3 bucket that an IAM user created without authorization. Which combination of steps should the security engineer take to MINIMIZE the consequences of this compromise? (Choose THREE)

  • AEncrypt all AWS CloudTrail logs.
  • BTurn on Amazon GuardDuty.
  • CChange the password for all IAM users.
  • DRotate or delete all AWS access keys.
  • ETake snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
  • FDelete any resources that are unrecognized or unauthorized.
  解答を表示
• #14

  A company deployed Amazon GuardDuty in the us-east-1 Region. The company wants all DNS logs that relate to the company's Amazon EC2 instances to be inspected. What should a security engineer do to ensure that the EC2 instances are logged?

  • AUse IPv6 addresses that are configured for hostnames.
  • BConfigure external DNS resolvers as internal resolvers that are visible only to IAM.
  • CUse IAM DNS resolvers for all EC2 instances.
  • DConfigure a third-party DNS resolver with logging for all EC2 instances.
  解答を表示
• #15

  A company wants to encrypt the private network between its orvpremises environment and AWS. The company also wants a consistent network experience for its employees. What should the company do to meet these requirements?

  • AEstablish an AWS Direct Connect connection with AWS and set up a Direct Connect gateway. In the Direct Connect gateway configuration, enable IPsec and BGP, and then leverage native AWS network encryption between Availability Zones and Regions.
  • BEstablish an AWS Direct Connect connection with AWS and set up a Direct Connect gateway. Using the Direct Connect gateway, create a private virtual interface and advertise the customer gateway private IP addresses. Create a VPN connection using the customer gateway and the virtual private gateway.
  • CEstablish a VPN connection with the AWS virtual private cloud over the internet.
  • DEstablish an AWS Direct Connect connection with AWS and establish a public virtual interface. For prefixes that need to be advertised, enter the customer gateway public IP addresses. Create a VPN connection over Direct Connect using the customer gateway and the virtual private gateway.
  解答を表示
• #16

  Compliance requirements state that all communications between company on-premises hosts and EC2 instances be encrypted in transit. Hosts use custom proprietary protocols for their communication, and EC2 instances need to be fronted by a load balancer for increased availability. Which of the following solutions will meet these requirements?

  • AOffload SSL termination onto an SSL listener on a Classic Load Balancer, and use a TCP connection between the load balancer and the EC2 instances.
  • BRoute all traffic through a TCP listener on a Classic Load Balancer, and terminate the TLS connection on the EC2 instances.
  • CCreate an HTTPS listener using an Application Load Balancer, and route all of the communication through that load balancer.
  • DOffload SSL termination onto an SSL listener using an Application Load Balancer, and re-spawn and SSL connection between the load balancer and the EC2 instances.
  解答を表示
• #17

  A company uses identity federation to authenticate users into an identity account (987654321987) where the users assume an IAM role named IdentityRole. The users then assume an IAM role named JobFunctionRole in the target IAM account (123456789123) to perform their job functions. A user is unable to assume the IAM role in the target account. The policy attached to the role in the identity account is. What should be done to enable the user to assume the appropriate role in the target account?

  • AOption A: Update the IAM policy attached to the role in the identity account to be.
  • BOption B: Update the trust policy on the role in the target account to be.
  • COption C: Update the trust policy on the role in the identity account to be.
  • DOption D: Update the IAM policy attached to the role in the target account to be.
  解答を表示
• #18

  A company has enabled Amazon GuardDuty in all Regions as part of its security monitoring strategy. In one of the VPCs, the company hosts an Amazon EC2 instance working as an FTP server that is contacted by a high number of clients from multiple locations. This is identified by GuardDuty as a brute force attack due to the high number of connections that happen every hour. The finding has been flagged as a false positive. However, GuardDuty keeps raising the issue. A Security Engineer has been asked to improve the signal-to-noise ratio. The Engineer needs to ensure that changes do not compromise the visibility of potential anomalous behavior. How can the Security Engineer address the issue?

  • ADisable the FTP rule in GuardDuty in the Region where the FTP server is deployed.
  • BAdd the FTP server to a trusted IP list and deploy it to GuardDuty to stop receiving the notifications.
  • CUse GuardDuty filters with auto archiving enabled to close the findings.
  • DCreate an AWS Lambda function that closes the finding whenever a new occurrence is reported.
  解答を表示
• #19

  An application has been written that publishes custom metrics to Amazon CloudWatch. Recently, IAM changes have been made on the account and the metrics are no longer being reported. Which of the following is the LEAST permissive solution that will allow the metrics to be delivered?

  • AAdd a statement to the IAM policy used by the application to allow logs:putLogEvents and logs:createLogStream.
  • BModify the IAM role used by the application by adding the CloudWatchFullAccess managed policy.
  • CAdd a statement to the IAM policy used by the application to allow cloudwatch:putMetricData.
  • DAdd a trust relationship to the IAM role used by the application for cloudwatch.amazonaws.com.
  解答を表示
• #20

  A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots. After performing a gap analysis of its disaster recovery procedures and backup strategies, the company is concerned that, next time, it will not be able to recover the EC2 instances if the AWS account was compromised and Amazon EBS snapshots were deleted. All EBS snapshots are encrypted using an AWS KMS CMK. Which solution would solve this problem?

  • ACreate a new Amazon S3 bucket Use EBS lifecycle policies to move EBS snapshots to the new S3 bucket. Move snapshots to Amazon S3 Glacier using lifecycle policies, and apply Glacier Vault Lock policies to prevent deletion
  • BUse AWS Systems Manager to distribute a configuration that performs local backups of all attached disks to Amazon S3.
  • CCreate a new AWS account with limited privileges. Allow the new account to access the AWS KMS key used to encrypt the EBS snapshots, and copy the encrypted snapshots to the new account on a recuning basis.
  • DUse AWS Backup to copy EBS snapshots to Amazon S3.
  解答を表示

スコアの記録、時間制限付き模擬試験、AI解説をご利用になりますか？ 無料アカウントを作成