A company has AWS accounts in an organization in AWS Organizations. The company requires a specific software application to be installed on all new and existing Amazon EC2 instances in the organization AWS Systems Manager Agent (SSM Agent) is installed and active on all the instances. How can the company continuously monitor the deployment status of the software application on all the instances?
-
A
Enable AWS Config for the entire organization. For all accounts, set up the ec2-managedinstance- applications-required AWS. Config managed rule and specify the application name.
-
B
Enable AWS Config for the entire organization Provide new AMIs that have the required software application pre-installed Set up the approved-amis-by-id AWS Config managed rule for all accounts.
-
C
Create a Systems Manager Distributor package for the required software application for the entire organization Install the Distributor package by using Systems Manager Run Command Review the output.
-
D
Configure Systems Manager Application Manager to collect a current list of installed software applications in the entire organization Filter for the required application by software status.
Reveal answer details
Close answer details
An audit determined that a company's Amazon EC2 instance security group violated company policy by allowing unrestricted incoming SSH traffic. A security engineer must implement a near-real-time monitoring and alerting solution that will notify administrators of such violations. Which solution meets these requirements with the MOST operational efficiency?
-
A
Create a recurring Amazon Inspector assessment run that runs every day and uses the Network Reachability package. Create an Amazon CloudWatch rule that invokes an IAM Lambda function when an assessment run starts. Configure the Lambda function to retrieve and evaluate the assessment run report when it completes. Configure the Lambda function also to publish an Amazon Simple Notification Service (Amazon SNS) notification if there are any violations for unrestricted incoming SSH traffic.
-
B
Use the restricted-ssh IAM Config managed rule that is invoked by security group configuration changes that are not compliant. Use the IAM Config remediation feature to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.
-
C
Configure VPC Flow Logs for the VPC. and specify an Amazon CloudWatch Logs group. Subscribe the CloudWatch Logs group to an IAM Lambda function that parses new log entries, detects successful connections on port 22, and publishes a notification through Amazon Simple Notification Service (Amazon SNS).
-
D
Create a recurring Amazon Inspector assessment run that runs every day and uses the Security Best Practices package. Create an Amazon CloudWatch rule that invokes an IAM Lambda function when an assessment run starts.
Configure the Lambda function to retrieve and evaluate the assessment run report when it completes.
Configure the Lambda function also to publish an Amazon Simple Notification Service (Amazon SNS) notification if there are any violations for unrestricted incoming SSH traffic.
Reveal answer details
Close answer details
Question 3
Multiple choice
A security engineer needs to develop a process to investigate and respond to po-tential security events on a company's Amazon EC2 instances. All the EC2 in-stances are backed by Amazon Elastic Block Store (Amazon EBS). The company uses AWS Systems Manager to manage all the EC2 instances and has installed Systems Manager Agent (SSM Agent) on all the EC2 instances. The process that the security engineer is developing must comply with AWS secu-rity best practices and must meet the following requirements: 1. A compromised EC2 instance's volatile memory and non-volatile memory must be preserved for forensic purposes.
2. A compromised EC2 instance's metadata must be updated with corresponding inci-dent ticket information.
3. A compromised EC2 instance must remain online during the investigation but must be isolated to prevent the spread of malware.
4. Any investigative activity during the collection of volatile data must be cap-tured as part of the process. Which combination of steps should the security engineer take to meet these re-quirements with the LEAST operational overhead? (Select THREE.)
-
A
Gather any relevant metadata for the compromised EC2 instance. Enable ter-mination protection.
Isolate the instance by updating the instance's secu-rity groups to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
-
B
Gather any relevant metadata for the compromised EC2 instance. Enable ter-mination protection. Move the instance to an isolation subnet that denies all source and destination traffic. Associate the instance with the subnet to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
-
C
Use Systems Manager Run Command to invoke scripts that collect volatile data.
-
D
Establish a Linux SSH or Windows Remote Desktop Protocol (RDP) session to the compromised EC2 instance to invoke scripts that collect volatile data.
-
E
Create a snapshot of the compromised EC2 instance's EBS volume for follow-up investigations. Tag the instance with any relevant metadata and inci-dent ticket information.
-
F
Create a Systems Manager State Manager association to generate an EBS vol-ume snapshot of the compromised EC2 instance. Tag the instance with any relevant metadata and incident ticket information.
Reveal answer details
Close answer details
To meet regulatory requirements, a Security Engineer needs to implement an IAM policy that restricts the use of AWS services to the us-east-1 Region. What policy should the Engineer implement?    
-
A
Option A
-
B
-
C
-
D
Reveal answer details
Close answer details
Question 5
Multiple choice
A medical company recently completed an acquisition and inherited an existing AWS environment. The company has an upcoming audit and is concerned about the compliance posture of its acquisition. The company must identify personal health information inside Amazon S3 buckets and must identify S3 buckets that are publicly accessible. The company needs to prepare for the audit by collecting evidence in the environment. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)
-
A
Enable Amazon Macie. Run an on-demand sensitive data discovery job that uses the PERSONAL_INFORMATION managed data identifier.
-
B
Use AWS Glue with the Detect PII transform to identify sensitive data and to mask the sensitive data.
-
C
Enable AWS Audit Manager. Create an assessment by using a supported framework.
-
D
Enable Amazon GuardDuty S3 Protection. Document any findings that are related to suspicious access of S3 buckets.
-
E
Enable AWS Security Hub. Use the AWS Foundational Security Best Practices standard. Review the controls dashboard for evidence of failed S3 Block Public Access controls.
-
F
Enable AWS Config. Set up the s3-bucket-public-write-prohibited AWS Config managed rule.
Reveal answer details
Close answer details
Correct answersA, E, F
ExplanationEnable Amazon Macie. Run an on-demand sensitive data discovery job that uses the PERSONAL_INFORMATION managed data identifier.
Amazon Macie is designed to automatically discover and classify sensitive data, including personal health information (PHI), in Amazon S3. Running a sensitive data discovery job will allow the company to identify PHI with minimal operational overhead Enable AWS Security Hub. Use the AWS Foundational Security Best Practices standard. Review the controls dashboard for evidence of failed S3 Block Public Access controls. AWS Security Hub integrates with other AWS security services and provides a comprehensive view of the security posture, including public access to S3 buckets. It helps in identifying potential compliance issues related to public access.
Enable AWS Config. Set up the s3-bucket-public-write-prohibited AWS Config managed rule.
AWS Config can be used to monitor and enforce compliance rules, such as preventing public write access to S3 buckets. This helps in identifying S3 buckets that are publicly accessible and collecting evidence for the audit. These steps collectively allow the company to identify PHI, review public accessibility of S3 buckets, and gather compliance evidence with minimal operational effort.
Your CTO is very worried about the security of your IAM account. How best can you prevent hackers from completely hijacking your account?
-
A
Use short but complex password on the root account and any administrators.
-
B
Use IAM IAM Geo-Lock and disallow anyone from logging in except for in your city.
-
C
Use MFA on all users and accounts, especially on the root account.
-
D
Don't write down or remember the root account password after creating the IAM account.
Reveal answer details
Close answer details
Correct answerC
ExplanationMulti-factor authentication can add one more layer of security to your IAM account Even when you go to your Security Credentials dashboard one of the items is to enable MFA on your root account  Option A is invalid because you need to have a good password policy
Option B is invalid because there is no IAM Geo-Lock
Option D is invalid because this is not a recommended practices For more information on MFA, please visit the below URL http://docs.IAM.amazon.com/IAM/latest/UserGuide/id credentials mfa.htmll The correct answer is: Use MFA on all users and accounts, especially on the root account.SubmityourFeedback/QueriestoourExperts
A company's IAM account consists of approximately 300 IAM users. Now there is a mandate that an access change is required for 100 IAM users to have unlimited privileges to S3.
As a system administrator, how can you implement this effectively so that there is no need to apply the policy at the individual user level?
-
A
Create a new role and add each user to the IAM role
-
B
Use the IAM groups and add users, based upon their role, to different groups and apply the policy to group
-
C
Create a policy and apply it to multiple users using a JSON script
-
D
Create an S3 bucket policy with unlimited access which includes each user's IAM account ID
Reveal answer details
Close answer details
Correct answerB
ExplanationOption A is incorrect since you don't add a user to the IAM Role
Option C is incorrect since you don't assign multiple users to a policy
Option D is incorrect since this is not an ideal approach An IAM group is used to collectively manage users who need the same set of permissions. By having groups, it becomes easier to manage permissions. So if you change the permissions on the group scale, it will affect all the users in that group For more information on IAM Groups, just browse to the below URL:
https://docs.IAM.amazon.com/IAM/latest/UserGuide/id_eroups.html
The correct answer is: Use the IAMgroupsandaddusers,basedupontheirrole,todifferentgroupsandapplythepolicytogroupSubmityourFeedback/QueriestoourExperts
A company hosts a web-based application that captures and stores sensitive data in an Amazon DynamoDB table. A security audit reveals that the application does not provide end-to-end data protection or the ability to detect unauthorized data changes The software engineering team needs to make changes that will address the audit findings. Which set of steps should the software engineering team take?
-
A
Use an IAM Key Management Service (IAM KMS) CMK. Encrypt the data at rest.
-
B
Use IAM Certificate Manager (ACM) Private Certificate Authority Encrypt the data in transit.
-
C
Use a DynamoDB encryption client. Use client-side encryption and sign the table items
-
D
Use the IAM Encryption SDK. Use client-side encryption and sign the table items.
Reveal answer details
Close answer details
A company uses AWS Organizations. The company has more than 100 AWS accounts and will increase the number of accounts. The company also uses an external corporate identity provider (IdP). The company needs to provide users with role-based access to the accounts. The solution must maximize scalability and operational efficiency. Which solution will meet these requirements?
-
A
In each account, create a set of dedicated IAM users. Ensure that all users assume these IAM users through federation with the existing IdP.
-
B
Deploy an IAM role in a central identity account. Allow users to assume the role through federation with the existing IdP. In each account, deploy a set of IAM roles that match the desired access patterns.
Include a trust policy that allows access from the central identity account. Edit the permissions policy for the role in each account to match user access requirements.
-
C
Enable AWS IAM Identity Center. Integrate IAM Identity Center with the company's existing IdP. Create permission sets that match the desired access patterns. Assign permissions to match user access requirements.
-
D
In each account, deploy a set of IAM roles that match the desired access patterns. Create a trust policy with the existing IdP. Update each role's permissions policy to use SAML-based IAM condition keys that are based on user access requirements.
Reveal answer details
Close answer details
Question 10
Single choice
In your LAMP application, you have some developers that say they would like access to your logs.
However, since you are using an IAM Auto Scaling group, your instances are constantly being re-created. What would you do to make sure that these developers can access these log files? Choose the correct answer from the options below
-
A
Give only the necessary access to the Apache servers so that the developers can gain access to the log files.
-
B
Give root access to your Apache servers to the developers.
-
C
Give read-only access to your developers to the Apache servers.
-
D
Set up a central logging server that you can use to archive your logs; archive these logs to an S3
bucket for developer-access.
Reveal answer details
Close answer details
Correct answerD
ExplanationOne important security aspect is to never give access to actual servers, hence Option A.B and C are just totally wrong from a security perspective. The best option is to have a central logging server that can be used to archive logs. These logs can then be stored in S3.
Options A,B and C are all invalid because you should not give access to the developers on the Apache se
For more information on S3, please refer to the below link
https://IAM.amazon.com/documentation/s3j
The correct answer is: Set up a central logging server that you can use to archive your logs; archive these logs to an S3 bucket for developer-access.
Submit vour Feedback/Queries to our Experts
Question 11
Single choice
A company has configured a gateway VPC endpoint in a VPC. Only Amazon EC2 instances that reside in a single subnet in the VPC can use the endpoint. The company has modified the route table for this single subnet to route traffic to Amazon S3 through the gateway VPC endpoint. The VPC provides internet access through an internet gateway. A security engineer attempts to use instance profile credentials from an EC2 instance to retrieve an object from the S3 bucket, but the attempt fails. The security engineer verifies that the EC2 instance has an IAM instance profile with the correct permissions to access the S3 bucket and to retrieve objects. The security engineer also verifies that the S3 bucket policy is allowing access properly. Additionally, the security engineer verifies that the EC2 instance's security group and the subnet's network ACLs allow the communication. What else should the security engineer check to determine why the request from the EC2 instance is failing?
-
A
Verify that the EC2 instance's security group does not have an implicit inbound deny rule for Amazon
S3.
-
B
Verify that the VPC endpoint's security group does not have an explicit inbound deny rule for the EC2 instance.
-
C
Verify that the internet gateway is allowing traffic to Amazon S3.
-
D
Verify that the VPC endpoint policy is allowing access to Amazon S3.
Reveal answer details
Close answer details
Correct answerB
ExplanationThe VPC endpoint for Amazon S3 can have an associated VPC endpoint policy that controls what actions are allowed through the endpoint. Even though the instance profile, security group, and network ACLs are correctly configured, if the VPC endpoint policy is too restrictive or incorrectly configured, it could block access to S3. The security engineer should verify that the VPC endpoint policy allows the necessary actions for the EC2 instance to access the S3 bucket.
Question 12
Single choice
Auditors for a health care company have mandated that all data volumes be encrypted at rest Infrastructure is deployed mainly via IAM CloudFormation however third-party frameworks and manual deployment are required on some legacy systems What is the BEST way to monitor, on a recurring basis, whether all EBS volumes are encrypted?
-
A
On a recurring basis, update an IAM user policies to require that EC2 instances are created with an encrypted volume
-
B
Configure an IAM Config rule lo run on a recurring basis 'or volume encryption
-
C
Set up Amazon Inspector rules tor volume encryption to run on a recurring schedule
-
D
Use CloudWatch Logs to determine whether instances were created with an encrypted volume
Reveal answer details
Close answer details
Correct answerB
ExplanationTo support answer B, use the reference
https://d1.IAMstatic.com/whitepapers/IAM-security-whitepaper.pdf
"For example, IAM Config provides a managed IAM Config Rules to ensure that encryption is turned on for all EBS volumes in your account."
Question 13
Single choice
An organization receives an alert that indicates that an EC2 instance behind an ELB Classic Load Balancer has been compromised. What techniques will limit lateral movement and allow evidence gathering?
-
A
Remove the instance from the load balancer and terminate it.
-
B
Remove the instance from the load balancer, and shut down access to the instance by tightening the security group.
-
C
Reboot the instance and check for any Amazon CloudWatch alarms.
-
D
Stop the instance and make a snapshot of the root EBS volume.
Reveal answer details
Close answer details
Correct answerB
Explanationhttps://d1.IAMstatic.com/whitepapers/IAM_security_incident_response.pdf
Question 14
Multiple choice
What are the MOST secure ways to protect the IAM account root user of a recently opened IAM account? (Choose two.)
-
A
Use the IAM account root user access keys instead of the IAM Management Console
-
B
Enable multi-factor authentication for the IAM IAM users with the AdministratorAccess managed policy attached to them
-
C
Enable multi-factor authentication for the IAM account root user
-
D
Use IAM KMS to encrypt all IAM account root user and IAM IAM access keys and set automatic rotation to 30 days
-
E
Do not create access keys for the IAM account root user; instead, create IAM IAM users
Reveal answer details
Close answer details
Question 15
Single choice
A company wants to establish separate IAM Key Management Service (IAM KMS) keys to use for different IAM services. The company's security engineer created the following key policy lo allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructureDeployment IAM role:  The security engineer recently discovered that IAM roles other than the InfrastructureDeployment role used this key (or other services. Which change to the policy should the security engineer make to resolve these issues?
-
A
In the statement block that contains the Sid "Allow use of the key", under the "Condition" block, change StringEquals to StringLike.
-
B
In the policy document, remove the statement Dlock that contains the Sid "Enable IAM User Permissions". Add key management policies to the KMS policy.
-
C
In the statement block that contains the Sid "Allow use of the Key", under the "Condition" block, change the Kms:ViaService value to ec2.us-east-1 .amazonIAM com.
-
D
In the policy document, add a new statement block that grants the kms:Disable' permission to the
security engineer's IAM role.
Reveal answer details
Close answer details
Correct answerB
ExplanationFirst block of policy grants 'admin' permissions to users. IAM root indicates all users in the account. Refer below:
A key policy document with a statement that allows access to the AWS account (root user) enables IAM policies in the account to allow access to the KMS key. This means that IAM users and roles in the account might have access to the KMS key even if they are not explicitly listed as principals in the key policy document. https://docs.aws.amazon.com/kms/latest/developerguide/determining-access-key-policy.html
Question 16
Single choice
A company uses Amazon GuardDuty. The company's security team wants all High severity findings to automatically generate a ticket in a third-party ticketing system through email integration. Which solution will meet this requirement?
-
A
Create a verified identity for the third-party ticketing email system in Amazon Simple Email Service (Amazon SES). Create an Amazon EventBridge rule that includes an event pattern that matches High severity GuardDuty findings. Specify the SES identity as the target for the EventBridge rule.
-
B
Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the third-party ticketing email system to the SNS topic. Create an Amazon EventBridge rule that includes an event pattern that matches High severity GuardDuty findings. Specify the SNS topic as the target for the EventBridge rule.
-
C
Use the GuardDuty CreateFilter API operation to build a filter in GuardDuty to monitor for High severity findings. Export the results of the filter to an Amazon Simple Notification Service (Amazon SNS) topic.
Subscribe the third-party ticketing email system to the SNS topic.
-
D
Use the GuardDuty CreateFilter API operation to build a filter in GuardDuty to monitor for High severity findings. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the third-party ticketing email system to the SNS topic. Create an Amazon EventBridge rule that includes an event pattern that matches GuardDuty findings that are selected by the filter. Specify the SNS topic as the target for the EventBridge rule.
Reveal answer details
Close answer details
Correct answerB
ExplanationThe correct answer is B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the third-party ticketing email system to the SNS topic. Create an Amazon EventBridge rule that includes an event pattern that matches High severity GuardDuty findings. Specify the SNS topic as the target for the Event-Bridge rule. According to the AWS documentation1, you can use Amazon EventBridge to create rules that match events from GuardDuty and route them to targets such as Amazon SNS topics. You can use event patterns to filter events based on criteria such as severity, type, or resource. For example, you can create a rule that matches only High severity findings and sends them to an SNS topic that is subscribed by a third-party ticketing email system. This way, you can automate the creation of tickets for High severity findings and notify the security team.
Question 17
Multiple choice
A security engineer needs to configure monitoring and auditing for IAM Lambda. Which combination of actions using IAM services should the security engineer take to accomplish this goal? (Select TWO.)
-
A
Use IAM Config to track configuration changes to Lambda functions, runtime environments, tags, handler names, code sizes, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations.
-
B
Use IAM CloudTrail to implement governance, compliance, operational, and risk auditing for Lambda.
-
C
Use Amazon Inspector to automatically monitor for vulnerabilities and perform governance, compliance, operational, and risk auditing for Lambda.
-
D
Use IAM Resource Access Manager to track configuration changes to Lambda functions, runtime environments, tags, handler names, code sizes, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations.
-
E
Use Amazon Macie to discover, classify, and protect sensitive data being executed inside the Lambda function.
Reveal answer details
Close answer details
Question 18
Single choice
Example.com is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). Third-party host intrusion detection system (HIDS) agents that capture the traffic of the EC2 instance are running on each host. The company must ensure they are using privacy enhancing technologies for users, without losing the assurance the third-party solution offers. What is the MOST secure way to meet these requirements?
-
A
Enable TLS pass through on the ALB, and handle decryption at the server using Elliptic Curve Diffie-
Hellman (ECDHE) cipher suites.
-
B
Create a listener on the ALB that uses encrypted connections with Elliptic Curve Diffie-Hellman (ECDHE) cipher suites, and pass the traffic in the clear to the server.
-
C
Create a listener on the ALB that uses encrypted connections with Elliptic Curve Diffie-Hellman (ECDHE) cipher suites, and use encrypted connections to the servers that do not enable Perfect Forward Secrecy (PFS).
-
D
Create a listener on the ALB that does not enable Perfect Forward Secrecy (PFS) cipher suites, and use encrypted connections to the servers using Elliptic Curve Diffie-Hellman (ECDHE) cipher suites.
Reveal answer details
Close answer details
Question 19
Single choice
A company has an AWS account that hosts a production application. The company receives an email notification that Amazon GuardDuty has detected an Impact:lAMUser/AnomalousBehavior finding in the account. A security engineer needs to run the investigation playbook for this security incident and must collect and analyze the information without affecting the application. Which solution will meet these requirements MOST quickly?
-
A
Log in to the AWS account by using read-only credentials. Review the GuardDuty finding for details about the IAM credentials that were used. Use the IAM console to add a DenyAll policy to the IAM principal.
-
B
Log in to the AWS account by using read-only credentials. Review the GuardDuty finding to determine which API calls initiated the finding. Use Amazon Detective to review the API calls in context.
-
C
Log in to the AWS account by using administrator credentials. Review the GuardDuty finding for details about the IAM credentials that were used. Use the IAM console to add a DenyAll policy to the IAM principal.
-
D
Log in to the AWS account by using read-only credentials. Review the GuardDuty finding to determine which API calls initiated the finding. Use AWS CloudTrail Insights and AWS CloudTrail Lake to review the API calls in context.
Reveal answer details
Close answer details
Correct answerB
ExplanationThis answer is correct because logging in with read-only credentials minimizes the risk of accidental or malicious changes to the AWS account. Reviewing the GuardDuty finding can help identify which API calls initiated the finding and which IAM principal was involved. Using Amazon Detective can help analyze and visualize the API calls in context, such as which resources were affected, which IP addresses were used, and how the activity deviated from normal patterns. Amazon Detective can also help identify related findings from other sources, such as AWS Config or AWS Audit Manager.
Question 20
Multiple choice
A company uses SAML federation with AWS Identity and Access Management (IAM) to provide internal users with SSO for their AWS accounts. The company's identity provider certificate was rotated as part of its normal lifecycle Shortly after users started receiving the following error when attempting to log in: "Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code:
InvalidIdentityToken)" A security engineer needs to address the immediate issue and ensure that it will not occur again. Which combination of steps should the security engineer take to accomplish this? (Choose two.)
-
A
Download a new copy of the SAML metadata file from the identity provider Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.
-
B
During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
-
C
Download a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question.
-
D
During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new copy of the metadata file and create a new IAM identity provider entity.
Upload the metadata file to the new IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
-
E
Download a new copy of the SAML metadata file from the identity provider Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity. Update the identity provider configurations to pass a new IAM identity provider entity name in the SAML assertion.
Reveal answer details
Close answer details
Question 21
Single choice
A company's network security policy requires encryption for all data in transit. The company must encrypt data that is sent between Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes. Which solution will meet this requirement?
-
A
Configure Amazon EC2 to enable encryption in the EC2 network interface properties.
-
B
Configure Amazon EBS to enable volume encryption with AWS Key Management Service (AWS KMS) for data at rest.
-
C
Configure Amazon EBS to enable TLS encryption in the volume configuration properties.
-
D
Configure Amazon EC2 to enable TLS encryption with certificates that are stored in AWS Certificate Manager (ACM).
Reveal answer details
Close answer details
Correct answerD
ExplanationComprehensive Detailed Explanation with all AWS References To ensure encryption for all data in transit between EC2 instances and EBS volumes, TLS encryption must be implemented. While EBS volume encryption secures data at rest, the requirement here is to secure data in transit.
TLS Encryption with ACM Certificates:
References:
AWS TLS Encryption Documentation
Incorrect Options:
Option A: Encryption in the EC2 network interface properties is not a valid configuration.
Option B: EBS volume encryption secures data at rest, not in transit.
Option C: TLS encryption cannot be configured in EBS volume properties.
Question 22
Single choice
A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making connections to known malicious addresses. The instance is in a development account within a VPC that is in the us-east-1 Region. The VPC contains an internet gateway and has a subnet in us-east-1a and us-east-1b. Each subnet is associate with a route table that uses the internet gateway as a default route. Each subnet also uses the default network ACL.
The suspicious EC2 instance runs within the us-east-1b subnet. During an initial investigation, a security engineer discovers that the suspicious instance is the only instance that runs in the subnet. Which response will immediately mitigate the attack and help investigate the root cause?
-
A
Log in to the suspicious instance and use the netstat command to identify remote connections. Use the IP addresses from these remote connections to create deny rules in the security group of the instance.
Install diagnostic tools on the instance for investigation. Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule during the investigation of the instance.
-
B
Update the outbound network ACL for the subnet in us-east-1 b to explicitly deny all connections as the first rule. Replace the security group with a new security group that allows connections only from a diagnostics security group. Update the outbound network ACL for the us-east-1 b subnet to remove the deny all rule. Launch a new EC2 instance that has diagnostic tools. Assign the new security group to the new EC2 instance. Use the new EC2 instance to investigate the suspicious instance.
-
C
Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination. Terminate the instance. Launch a new EC2 instance in us-east-1a that has diagnostic tools. Mount the EBS volumes from the terminated instance for investigation.
-
D
Create an AWS WAF web ACL that denies traffic to and from the suspicious instance. Attach the AWS WAF web ACL to the instance to mitigate the attack. Log in to the instance and install diagnostic tools to investigate the instance.
Reveal answer details
Close answer details
Question 23
Single choice
Your company has been using IAM for hosting EC2 Instances for their web and database applications.
They want to have a compliance check to see the following Whether any ports are left open other than admin ones like SSH and RDP Whether any ports to the database server other than ones from the web server security group are open Which of the following can help achieve this in the easiest way possible.
You don't want to carry out an extra configuration changes?
-
A
-
B
-
C
IAM Inspector D.IAMGuardDuty
Reveal answer details
Close answer details
Correct answerB
ExplanationTrusted Advisor checks for compliance with the following security recommendations: Limited access to common administrative ports to only a small subset of addresses. This includes ports 22 (SSH), 23 (Telnet) 3389 (RDP), and 5500 (VNQ. Limited access to common database ports. This includes ports 1433 (MSSQL Server), 1434 (MSSQL Monitor), 3306 (MySQL), Oracle (1521) and 5432 (PostgreSQL). Option A is partially correct but then you would need to write custom rules for this. The IAM trusted advisor can give you all o these checks on its dashboard
Option C is incorrect. Amazon Inspector needs a software agent to be installed on all EC2 instances that are included in th. assessment target, the security of which you want to evaluate with Amazon Inspector. It monitors the behavior of the EC2 instance on which it is installed, including network, file system, and process activity, and collects a wide set of behavior and configuration data (telemetry), which it then passes to the Amazon Inspector service. Our question's requirement is to choose a choice that is easy to implement. Hence Trusted Advisor is more appropriate for this ) question.
Options D is invalid because this service dont provide these details. For more information on the Trusted Advisor, please visit the following URL
https://IAM.amazon.com/premiumsupport/trustedadvisor>Thecorrectansweris:IAMTrustedAdvisorSubmityourFeedback/QueriestoourExperts
Question 24
Single choice
A Security Engineer is implementing a solution to allow users to seamlessly encrypt Amazon S3 objects without having to touch the keys directly. The solution must be highly scalable without requiring continual management. Additionally, the organization must be able to immediately delete the encryption keys. Which solution meets these requirements?
-
A
Use IAM KMS with IAM managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.
-
B
Use KMS with IAM imported key material and then use the DeletelmportedKeyMaterial API to remove the key material if necessary.
-
C
Use IAM CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.
-
D
Use the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the key if necessary.
Reveal answer details
Close answer details
Correct answerB
Explanationhttps://docs.IAM.amazon.com/kms/latest/developerguide/importing-keys-
delete-key-material.html
Question 25
Multiple choice
Which of the following are valid event sources that are associated with web access control lists that trigger IAM WAF rules? (Choose two.)
-
A
Amazon S3 static web hosting
-
B
Amazon CloudFront distribution
-
C
Application Load Balancer
-
D
-
E
Reveal answer details
Close answer details
Correct answersB, C
ExplanationA web access control list (web ACL) gives you fine-grained control over the web requests that your Amazon API Gateway API, Amazon CloudFront distribution or Application Load Balancer responds to.
Question 26
Multiple choice
You currently have an S3 bucket hosted in an IAM Account. It holds information that needs be accessed by a partner account. Which is the MOST secure way to allow the partner account to access the S3 bucket in your account? Select 3 options.
-
A
Ensure an IAM role is created which can be assumed by the partner account.
-
B
Ensure an IAM user is created which can be assumed by the partner account.
-
C
Ensure the partner uses an external id when making the request
-
D
Provide the ARN for the role to the partner account
-
E
Provide the Account Id to the partner account
-
F
Provide access keys for your account to the partner account
Reveal answer details
Close answer details
Correct answersA, C, D
ExplanationOption B is invalid because Roles are assumed and not IAM users
Option E is invalid because you should not give the account ID to the partner
Option F is invalid because you should not give the access keys to the partner The below diagram from the IAM documentation showcases an example on this wherein an IAM role and external ID is us> access an IAM account resources  For more information on creating roles for external ID'S please visit the following URL: The correct answers are: Ensure an IAM role is created which can be assumed by the partner account.
Ensure the partner uses an external id when making the request Provide the ARN for the role to the partner account Submit your Feedback/Queries to our Experts
Question 27
Single choice
A Security Engineer discovers that developers have been adding rules to security groups that allow SSH and RDP traffic from 0.0.0.0/0 instead of the organization firewall IP. What is the most efficient way to remediate the risk of this activity?
-
A
Delete the internet gateway associated with the VPC.
-
B
Use network access control lists to block source IP addresses matching 0.0.0.0/0.
-
C
Use a host-based firewall to prevent access from all but the organization's firewall IP.
-
D
Use IAM Config rules to detect 0.0.0.0/0 and invoke an IAM Lambda function to update the security group with the organization's firewall IP.
Reveal answer details
Close answer details
Question 28
Multiple choice
An ecommerce website was down for 1 hour following a DDoS attack Users were unable to connect to the website during the attack period. The ecommerce company's security team is worried about future potential attacks and wants to prepare for such events The company needs to minimize downtime in its response to similar attacks in the future. Which steps would help achieve this? (Select TWO )
-
A
Enable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
-
B
Subscribe to IAM Shield Advanced and reach out to IAM Support in the event of an attack.
-
C
Use VPC Flow Logs to monitor network: traffic and an IAM Lambda function to automatically block an
attacker's IP using security groups.
-
D
Set up an Amazon CloudWatch Events rule to monitor the IAM CloudTrail events in real time use IAM Config rules to audit the configuration, and use IAM Systems Manager for remediation.
-
E
Use IAM WAF to create rules to respond to such attacks
Reveal answer details
Close answer details
Correct answersB, E
ExplanationSubscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack.
AWS Shield Advanced provides enhanced protection against DDoS attacks. It includes access to the DDoS Response Team (DRT), who can help mitigate attacks quickly and minimize downtime. This service also includes advanced metrics and protections for critical resources, helping the company respond efficiently to attacks. Use AWS WAF to create rules to respond to such attacks.
AWS WAF (Web Application Firewall) allows the company to create specific rules that can block malicious traffic, including traffic patterns typical of DDoS attacks. By using AWS WAF, the company can automate and respond to attacks by filtering traffic at the application level, reducing the chances of
downtime during future attacks. These solutions help the company reduce downtime by providing proactive protection (AWS WAF) and reactive expert support (AWS Shield Advanced).
Question 29
Single choice
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB).
The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent. A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The security engineer must implement a rule statement as part of the web ACL to block the requests. The rule statement must mitigate the current attack and future attacks from these IoT devices without blocking requests from customers. Which rule statement will meet these requirements?
-
A
Use an IP set match rule statement that includes the IP address for IoT devices from the user agent.
-
B
Use a geographic match rule statement. Configure the statement to block countries that the IoT devices are located in.
-
C
Use a rate-based rule statement. Set a rate limit that is equal to the number of requests that are coming from the IoT devices.
-
D
Use a string match rule statement that includes details of the IoT device brand from the user agent.
Reveal answer details
Close answer details
Correct answerD
ExplanationBy using a string match rule in AWS WAF that targets the unique user agent of the IoT device brand, the security engineer can specifically block requests from those devices while allowing legitimate customer traffic. This approach directly addresses the current DDoS attack by matching the user agent string, which is unique to the malicious devices, and ensures future attacks by the same type of IoT devices are blocked as well. This rule is precise and avoids affecting legitimate users.
Question 30
Single choice
An organization has three applications running on IAM, each accessing the same data on Amazon S3. The data on Amazon S3 is server-side encrypted by using an IAM KMS Customer Master Key (CMK). What is the recommended method to ensure that each application has its own programmatic access control permissions on the KMS CMK?
-
A
Change the key policy permissions associated with the KMS CMK for each application when it must access the data in Amazon S3.
-
B
Have each application assume an IAM role that provides permissions to use the IAM Certificate Manager CMK.
-
C
Have each application use a grant on the KMS CMK to add or remove specific access controls on the
KMS CMK.
-
D
Have each application use an IAM policy in a user context to have specific access permissions on the
KMS CMK.
Reveal answer details
Close answer details
Question 31
Single choice
A Systems Engineer is troubleshooting the connectivity of a test environment that includes a virtual security appliance deployed inline. In addition to using the virtual security appliance, the Development team wants to use security groups and network ACLs to accomplish various security requirements in the environment. What configuration is necessary to allow the virtual security appliance to route the traffic?
-
A
-
B
Configure the security appliance's elastic network interface for promiscuous mode.
-
C
Disable the Network Source/Destination check on the security appliance's elastic network interface
-
D
Place the security appliance in the public subnet with the internet gateway
Reveal answer details
Close answer details
Correct answerC
ExplanationEach EC2 instance performs source/destination checks by default. This means that the instance must be the source or destination of any traffic it sends or receives. In this case virtual security appliance instance must be able to send and receive traffic when the source or destination is not itself. Therefore, you must disable source/destination checks on the NAT instance."
Question 32
Multiple choice
Which of the following are valid configurations for using SSL certificates with Amazon CloudFront? (Select THREE )
-
A
Default AWS Certificate Manager certificate
-
B
Custom SSL certificate stored in AWS KMS
-
C
Default CloudFront certificate
-
D
Custom SSL certificate stored in AWS Certificate Manager
-
E
Default SSL certificate stored in AWS Secrets Manager
-
F
Custom SSL certificate stored in AWS IAM
Reveal answer details
Close answer details
Correct answersA, B, C
ExplanationThe key length for an RSA certificate that you use with CloudFront is 2048 bits, even though ACM supports larger keys. If you use an imported certificate with CloudFront, your key length must be 1024 or 2048 bits and cannot exceed 2048 bits. You must import the certificate in the US East (N. Virginia) Region. You must have permission to use and import the SSL/TLS certificate
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html
Question 33
Single choice
A company wants to monitor the deletion of AWS Key Management Service (AWS KMS) customer managed keys. A security engineer needs to create an alarm that will notify the company before a KMS key is deleted. The security engineer has configured the integration of AWS CloudTrail with Amazon CloudWatch. What should the security engineer do next to meet these requirements?
-
A
Specify the deletion time of the key material during KMS key creation. Create a custom AWS Config rule to assess the key's scheduled deletion. Configure the rule to trigger upon a configuration change.
Send a message to an Amazon Simple Notification Service (Amazon SNS) topic if the key is scheduled for deletion.
-
B
Create an Amazon EventBridge rule to detect KMS API calls of DeleteAlias. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the EventBridge rule.
-
C
Create an Amazon EventBridge rule to detect KMS API calls of DisableKey and ScheduleKeyDeletion.
Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the EventBridge rule.
-
D
Create an Amazon Simple Notification Service (Amazon SNS) policy to detect KMS API calls of RevokeGrant and ScheduleKeyDeletion.
Create an AWS Lambda function to generate the alarm and send the notification to the company. Add the Lambda function as the target of the SNS policy.
Reveal answer details
Close answer details
Correct answerC
ExplanationThe AWS documentation states that you can create an Amazon EventBridge rule to detect KMS API calls of DisableKey and ScheduleKeyDeletion. You can then create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. You can add the Lambda function as the target of the EventBridge rule. This method will meet the requirements.
References:
: AWS KMS Developer Guide
Question 34
Single choice
A developer operations team uses AWS Identity and Access Management (IAM) to manage user permissions. The team created an Amazon EC2 instance profile role that uses an AWS managed ReadOnlyAccess policy. When an application that is running on Amazon EC2 tries to read a file from an encrypted Amazon S3 bucket, the application receives an AccessDenied error. The team administrator has verified that the S3 bucket policy allows everyone in the account to access the S3 bucket. There is no object ACL that is attached to the file. What should the administrator do to fix the IAM access issue?
-
A
Edit the ReadOnlyAccess policy to add kms:Decrypt actions
-
B
Add the EC2 IAM role as the authorized Principal to the S3 bucket policy
-
C
Attach an inline policy with kms:Decrypt permissions to the IAM role
-
D
Attach an inline policy with S3:* permissions to the IAM role
Reveal answer details
Close answer details
Question 35
Single choice
Your company has a set of EC2 Instances defined in IAM. These Ec2 Instances have strict security groups attached to them. You need to ensure that changes to the Security groups are noted and acted on accordingly. How can you achieve this?
-
A
Use Cloudwatch logs to monitor the activity on the Security Groups. Use filters to search for the changes and use SNS for the notification.
-
B
Use Cloudwatch metrics to monitor the activity on the Security Groups. Use filters to search for the changes and use SNS for the notification.
-
C
Use IAM inspector to monitor the activity on the Security Groups. Use filters to search for the changes and use SNS f the notification.
-
D
Use Cloudwatch events to be triggered for any changes to the Security Groups.
Configure the Lambda function for email notification as well.
Reveal answer details
Close answer details
Correct answerD
ExplanationThe below diagram from an IAM blog shows how security groups can be monitored  Option A is invalid because you need to use Cloudwatch Events to check for chan, Option B is invalid because you need to use Cloudwatch Events to check for chang
Option C is invalid because IAM inspector is not used to monitor the activity on Security Groups
For more information on monitoring security groups, please visit the below URL: Ihttpsy/IAM.amazon.com/blogs/security/how-to-automatically-revert-and-receive-notifications-about-changes-to-your-amazonj 'pc-security-groups/ The correct answer is: Use Cloudwatch events to be triggered for any changes to the Security Groups. Configure the Lambda function for email notification as well.
Submit your Feedback/Queries to our Experts
Question 36
Multiple choice
An application makes calls to IAM services using the IAM SDK. The application runs on Amazon EC2 instances with an associated IAM role. When the application attempts to access an object within an Amazon S3 bucket; the Administrator receives the following error message: HTTP 403: Access Denied. Which combination of steps should the Administrator take to troubleshoot this issue? (Select three.)
-
A
Confirm that the EC2 instance's security group authorizes S3 access.
-
B
Verify that the KMS key policy allows decrypt access for the KMS key for this IAM principle.
-
C
Check the S3 bucket policy for statements that deny access to objects.
-
D
Confirm that the EC2 instance is using the correct key pair.
-
E
Confirm that the IAM role associated with the EC2 instance has the proper privileges.
-
F
Confirm that the instance and the S3 bucket are in the same Region.
Reveal answer details
Close answer details
Question 37
Multiple choice
A company's Security Team received an email notification from the Amazon EC2 Abuse team that one or more of the company's Amazon EC2 instances may have been compromised Which combination of actions should the Security team take to respond to (be current modem? (Select
TWO.)
-
A
Open a support case with the IAM Security team and ask them to remove the malicious code from the affected instance
-
B
Respond to the notification and list the actions that have been taken to address the incident
-
C
Delete all IAM users and resources in the account
-
D
Detach the internet gateway from the VPC remove aft rules that contain 0.0.0.0V0 from the security groups, and create a NACL rule to deny all traffic Inbound from the internet
-
E
Delete the identified compromised instances and delete any associated resources that the Security team did not create.
Reveal answer details
Close answer details
Question 38
Multiple choice
A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and download the toolset's code. The company discovers that the code contains an IAM access key and secret key that provide access to internal resources in the company's AWS environment A security engineer must implement a solution to identify whether unauthorized usage of the exposed credentials has occurred. The solution also must prevent any additional usage of the exposed credentials. Which combination of steps will meet these requirements? (Choose two.)
-
A
Use AWS Identity and Access Management Access Analyzer to determine which resources the exposed credentials accessed and who used them.
-
B
Deactivate the exposed IAM access key from the user's IAM account.
-
C
Create a rule in Amazon GuardDuty to block the access key in the source code from being used.
-
D
Create a new IAM access key and secret key for the user whose credentials were exposed.
-
E
Generate an IAM credential report. Check the report to determine when the user that owns the access key last logged in.
Reveal answer details
Close answer details
Question 39
Single choice
An Amazon EC2 instance is denied access to a newly created IAM KMS CMK used for decrypt actions.
The environment has the following configuration: 1. The instance is allowed the kms:Decrypt action in its IAM role for all resources.
The IAM KMS CMK status is set to enabled
2. The instance can communicate with the KMS API using a configured VPC endpoint What is causing the issue?
-
A
The kms:GenerateDataKey permission is missing from the EC2 instance's IAM role
-
B
The ARN tag on the CMK contains the EC2 instance's ID instead of the instance's ARN
-
C
The kms:Encrypt permission is missing from the EC2 IAM role
-
D
The KMS CMK key policy that enables IAM user permissions is missing
Reveal answer details
Close answer details
Correct answerD
ExplanationIn a key policy, you use "*" for the resource, which means "this CMK." A key policy applies only to the CMK it is attached to References:
Question 40
Single choice
You work at a company that makes use of IAM resources. One of the key security policies is to ensure that all data i encrypted both at rest and in transit. Which of the following is one of the right ways to implement this?
-
A
Use S3 SSE and use SSL for data in transit
-
B
SSL termination on the ELB
-
C
-
D
Enabling sticky sessions on your load balancer
Reveal answer details
Close answer details
Correct answerA
ExplanationBy disabling SSL termination, you are leaving an unsecure connection from the ELB to the back end instances. Hence this means that part of the data transit is not being encrypted.
Option B is incorrect because this would not guarantee complete encryption of data in transit
Option C and D are incorrect because these would not guarantee encryption For more information on SSL Listeners for your load balancer, please visit the below URL:
http://docs.IAM.amazon.com/elasticloadbalancine/latest/classic/elb-https-load-balancers.htmllThecorrectansweris:UseS3SSEanduseSSLfordataintransitSubmityourFeedback/QueriestoourExperts
Question 41
Single choice
A web application gives users the ability to log in verify their membership's validity and browse artifacts that are stored in an Amazon S3 bucket. When a user attempts to download an object, the application must verify the permission to access the object and allow the user to download the object from a custom domain name such as example com. What is the MOST secure way for a security engineer to implement this functionality?
-
A
Configure read-only access to the object by using a bucket ACL. Remove the access after a set time has elapsed.
-
B
Implement an IAM policy to give the user read access to the S3 bucket.
-
C
Create an S3 presigned URL Provide the S3 presigned URL to the user through the application.
-
D
Create an Amazon CloudFront signed URL. Provide the CloudFront signed URL to the user through the application.
Reveal answer details
Close answer details
Correct answerD
ExplanationFor this scenario you would need to set up static website hosting because a custom domain name is listed as a requirement. "Amazon S3 website endpoints do not support HTTPS or access points. If you want to use HTTPS, you can use Amazon CloudFront to serve a static website hosted on Amazon S3." This is not secure.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/website-hosting-custom-domain-
walkthrough.html CloudFront signed URLs allow much more fine-grained control as well as HTTPS access with custom domain names:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-
signed-urls.html
Question 42
Single choice
You have a requirement to serve up private content using the keys available with Cloudfront. How can this be achieved?
-
A
Add the keys to the backend distribution.
-
B
Add the keys to the S3 bucket
-
C
-
D
Reveal answer details
Close answer details
Correct answerC
ExplanationOption A and B are invalid because you will not add keys to either the backend distribution or the S3 bucket.
Option D is invalid because this is used for programmatic access to IAM resources You can use Cloudfront key pairs to create a trusted pre-signed URL which can be distributed to users Specifying the IAM Accounts.
That Can Create Signed URLs and Signed Cookies (Trusted Signers)
Topics
?Creating CloudFront Key Pairs for Your Trusted Signers ?Reformatting the CloudFront Private Key (.NET and Java Only) ?Adding Trusted Signers to Your Distribution ?Verifying that Trusted Signers Are Active (Optional) 1 Rotating CloudFront Key Pairs To create signed URLs or signed cookies, you need at least one IAM account that has an active CloudFront key pair. This accou is known as a trusted signer. The trusted signer has two purposes:
?As soon as you add the IAM account ID for your trusted signer to your distribution, CloudFront starts to require that users us signed URLs or signed cookies to access your objects. ' When you create signed URLs or signed cookies, you use the private key from the trusted signer's key pair to sign a portion of the URL or the cookie. When someone requests a restricted object CloudFront compares the signed portion of the URL or cookie with the unsigned portion to verify that the URL or cookie hasn't been tampered with.
CloudFront also verifies that the URL or cookie is valid, meaning, for example, that the expiration date and
time hasn't passed.
For more information on Cloudfront private trusted content please visit the following URL:
?
https://docs.IAM.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-sThecorrectansweris:Createpre-signedURL'sSubmityourFeedback/QueriestoourExperts
Question 43
Single choice
Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic. Which of the following troubleshooting steps should be performed?
-
A
Check inbound and outbound security groups, looking for DENY rules.
-
B
Check inbound and outbound Network ACL rules, looking for DENY rules.
-
C
Review the rejected packet reason codes in the VPC Flow Logs.
-
D
Use IAM X-Ray to trace the end-to-end application flow
Reveal answer details
Close answer details
Question 44
Single choice
A Security Architect has been asked to review an existing security architecture and identify why the application servers cannot successfully initiate a connection to the database servers. The following summary describes the architecture: 1 An Application Load Balancer, an internet gateway, and a NAT gateway are configured in the public subnet 2. Database, application, and web servers are configured on three different private subnets. 3 The VPC has two route tables: one for the public subnet and one for all other subnets The route table for the public subnet has a 0 0 0 0/0 route to the internet gateway The route table for all other subnets has a 0 0.0.0/0 route to the NAT gateway. All private subnets can route to each other 4 Each subnet has a network ACL implemented that limits all inbound and outbound connectivity to only the required ports and protocols 5 There are 3 Security Groups (SGs) database application and web Each group limits all inbound and outbound connectivity to the minimum required Which of the following accurately reflects the access control mechanisms the Architect should verify1?
-
A
Outbound SG configuration on database servers Inbound SG configuration on application servers inbound and outbound network ACL configuration on the database subnet Inbound and outbound network ACL configuration on the application server subnet
-
B
Inbound SG configuration on database servers Outbound SG configuration on application servers Inbound and outbound network ACL configuration on the database subnet Inbound and outbound network ACL configuration on the application server subnet
-
C
Inbound and outbound SG configuration on database servers Inbound and outbound SG configuration on application servers Inbound network ACL configuration on the database subnet Outbound network ACL configuration on the application server subnet
-
D
Inbound SG configuration on database servers Outbound SG configuration on application servers Inbound network ACL configuration on the database subnet Outbound network ACL configuration on the application server subnet.
Reveal answer details
Close answer details
Question 45
Single choice
A company has an application that is accessed through an Application Load Balancer (ALB). The application has run for more than 6 months in production and uses Amazon CloudWatch for metrics. A security engineer must implement a solution to detect surges in traffic. The solution must notify an existing Amazon Simple Notification Service (Amazon SNS) topic when these surges occur. Which solution will meet these requirements?
-
A
Enable CloudWatch Anomaly Detection for the appropriate ALB metrics Create alarms based on metric anomaly detection. Configure the alarms to notify the SNS topic when the alarms are in ALARM state.
-
B
Implement CloudWatch Contributor Insights Create a Contributor Insights rule that searches for values that are higher than normal for the appropriate metrics for the ALB Configure the rule to notify the SNS topic if the values are detected.
-
C
Create an AWS WAF web ACL for the ALB Include a rate-based rule that counts the requests and compares the number to the previous highest number of requests per second Configure the rate-based rule action to target the SNS topic when the rule is matched.
-
D
Enable Amazon GuardDuty Create an Amazon EventBridge rule that runs when GuardDuty detects a finding that the ALB has exceeded its normal traffic patterns Configure the SNS topic as the target of the rule.
Reveal answer details
Close answer details
Question 46
Single choice
A company has AWS accounts that are in an organization in AWS Organizations. An Amazon S3 bucket in one of the accounts is publicly accessible. A security engineer must change the configuration so that the S3 bucket is no longer publicly accessible.
The security engineer also must ensure that the S3 bucket cannot be made publicly accessible in the future. Which solution will meet these requirements?
-
A
Configure the S3 bucket to use an AWS Key Management Service (AWS KMS) key. Encrypt all objects in the S3 bucket by creating a bucket policy that enforces encryption. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account.
-
B
Enable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account.
-
C
Enable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account.
-
D
Configure the S3 bucket to use S3 Object Lock in governance mode. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account.
Reveal answer details
Close answer details
Question 47
Single choice
A company's application team needs to host a MySQL database on IAM. According to the company's security policy, all data that is stored on IAM must be encrypted at rest. In addition, all cryptographic material must be compliant with FIPS 140-2 Level 3 validation. The application team needs a solution that satisfies the company's security requirements and minimizes operational overhead. Which solution will meet these requirements?
-
A
Host the database on Amazon RDS. Use Amazon Elastic Block Store (Amazon EBS) for encryption.
Use an IAM Key Management Service (IAM KMS) custom key store that is backed by IAM CloudHSM for key management.
-
B
Host the database on Amazon RDS. Use Amazon Elastic Block Store (Amazon EBS) for encryption.
Use an IAM managed CMK in IAM Key Management Service (IAM KMS) for key management.
-
C
Host the database on an Amazon EC2 instance. Use Amazon Elastic Block Store (Amazon EBS) for encryption. Use a customer managed CMK in IAM Key Management Service (IAM KMS) for key management.
-
D
Host the database on an Amazon EC2 instance. Use Transparent Data Encryption (TDE) for encryption and key management.
Reveal answer details
Close answer details
Question 48
Single choice
A company is running an Amazon RDS for MySQL DB instance in a VPC. The VPC must not send or receive network traffic through the internet. A security engineer wants to use AWS Secrets Manager to rotate the DB instance credentials automatically. Because of a security policy, the security engineer cannot use the standard AWS Lambda function that Secrets Manager provides to rotate the credentials. The security engineer deploys a custom Lambda function in the VPC. The custom Lambda function will be responsible for rotating the secret in Secrets Manager. The security engineer edits the DB instance's security group to allow connections from this function. When the function is invoked, the function cannot communicate with Secrets Manager to rotate the secret properly. What should the security engineer do so that the function can rotate the secret?
-
A
Add an egress-only internet gateway to the VPC. Allow only the Lambda function's subnet to route traffic through the egress-only internet gateway.
-
B
Add a NAT gateway to the VPC. Configure only the Lambda function's subnet with a default route through the NAT gateway.
-
C
Configure a VPC peering connection to the default VPC for Secrets Manager. Configure the Lambda function's subnet to use the peering connection for routes.
-
D
Configure a Secrets Manager interface VPC endpoint. Include the Lambda function's private subnet during the configuration process.
Reveal answer details
Close answer details
Correct answerD
ExplanationYou can establish a private connection between your VPC and Secrets Manager by creating an interface VPC endpoint. Interface endpoints are powered by AWS PrivateLink, a technology that enables you to privately access Secrets Manager APIs without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.
References:
https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html
The correct answer is D. Configure a Secrets Manager interface VPC endpoint. Include the Lambda function's private subnet during the configuration process. A Secrets Manager interface VPC endpoint is a private connection between the VPC and Secrets Manager that does not require an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection1. By configuring a Secrets Manager interface VPC endpoint, the security engineer can enable the custom Lambda function to communicate with Secrets Manager without sending or receiving network traffic through the internet. The security engineer must include the Lambda function's private subnet during the configuration process to allow the function to use the endpoint2. The other options are incorrect for the following reasons:
A. An egress-only internet gateway is a VPC component that allows outbound communication over IPv6
from instances in the VPC to the internet, and prevents the internet from initiating an IPv6 connection with the instances 3. However, this option does not meet the requirement that the VPC must not send or receive network traffic through the internet. Moreover, an egress-only internet gateway is for use with IPv6 traffic only, and Secrets Manager does not support IPv6 addresses 2.
B. A NAT gateway is a VPC component that enables instances in a private subnet to connect to the
internet or other AWS services, but prevents the internet from initiating connections with those instances 4.
However, this option does not meet the requirement that the VPC must not send or receive network traffic through the internet. Additionally, a NAT gateway requires an elastic IP address, which is a public IPv4 address 4. C. A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses 5. However, this option does not work because Secrets Manager does not have a default VPC that can be peered with. Furthermore, a VPC peering connection does not provide a private connection to Secrets Manager APIs without an internet gateway or other devices 2.
Question 49
Single choice
A company is planning to create an organization by using AWS Organizations. The company needs to integrate user management with the company's external identity provider (IdP). The company also needs to centrally manage access to all of its AWS accounts and applications from the organization's management account. Which solution will meet these requirements?
-
A
Configure AWS Directory Service with the external IdP. Create IAM policies and associate them with users from the external IdP.
-
B
Enable AWS IAM Identity Center and use the external IdP as the identity source. Create permission sets and account assignments by using IAM Identity Center.
-
C
Configure AWS Identity and Access Management (IAM) to use the external IdP as an IdP. Create IAM policies and associate them with users from the external IdP.
-
D
Enable Amazon Cognito in the organization's management account. Create an identity pool and associate it with the external IdP. Create IAM roles and associate them with the identity pool.
Reveal answer details
Close answer details
Correct answerB
ExplanationAWS IAM Identity Center (formerly AWS Single Sign-On) allows integration with external identity providers (IdPs) for centralized user management across multiple AWS accounts. By configuring IAM Identity Center to use the external IdP as the identity source, the company can centrally manage user access and permissions through permission sets and account assignments, ensuring unified access management across all AWS accounts within the organization. This solution meets both requirements of integrating with the external IdP and managing access centrally.
Question 50
Multiple choice
A company has several production IAM accounts and a central security IAM account. The security account is used for centralized monitoring and has IAM privileges to all resources in every corporate account. All of the company's Amazon S3 buckets are tagged with a value denoting the data classification of their contents. A Security Engineer is deploying a monitoring solution in the security account that will enforce bucket policy compliance. The system must monitor S3 buckets in all production accounts and confirm that any
policy change is in accordance with the bucket's data classification. If any change is out of compliance; the
Security team must be notified quickly. Which combination of actions would build the required solution? (Choose three.)
-
A
Configure Amazon CloudWatch Events in the production accounts to send all S3 events to the security account event bus.
-
B
Enable Amazon GuardDuty in the security account. and join the production accounts as members.
-
C
Configure an Amazon CloudWatch Events rule in the security account to detect S3 bucket creation or modification events.
-
D
Enable IAM Trusted Advisor and activate email notifications for an email address assigned to the security contact.
-
E
Invoke an IAM Lambda function in the security account to analyze S3 bucket settings in response to S3 events, and send non-compliance notifications to the Security team.
-
F
Configure event notifications on S3 buckets for PUT; POST, and DELETE events.
Reveal answer details
Close answer details
Question 51
Multiple choice
A security engineer is creating an AWS Lambda function. The Lambda function needs to use a role that is named LambdaAuditRole to assume a role that is named AcmeAuditFactoryRole in a different AWS account. When the code is processed, the following error message appears: "An error oc-curred (AccessDenied) when calling the AssumeRole operation." Which combination of steps should the security engineer take to resolve this er-ror? (Select TWO.)
-
A
Ensure that LambdaAuditRole has the sts:AssumeRole permission for Ac-meAuditFactoryRole.
-
B
Ensure that LambdaAuditRole has the AWSLambdaBasicExecutionRole managed policy attached.
-
C
Ensure that the trust policy for AcmeAuditFactoryRole allows the sts:AssumeRole action from LambdaAuditRole.
-
D
Ensure that the trust policy for LambdaAuditRole allows the sts:AssumeRole action from the
lambda.amazonaws.com service.
-
E
Ensure that the sts:AssumeRole API call is being issued to the us-east-I Region endpoint.
Reveal answer details
Close answer details
Question 52
Single choice
A company is running an application in The eu-west-1 Region. The application uses an IAM Key Management Service (IAM KMS) CMK to encrypt sensitive data. The company plans to deploy the application in the eu-north-1 Region. A security engineer needs to implement a key management solution for the application deployment in the new Region. The security engineer must minimize changes to the application code. Which change should the security engineer make to the IAM KMS configuration to meet these requirements?
-
A
Update the key policies in eu-west-1. Point the application in eu-north-1 to use the same CMK as the application in eu-west-1.
-
B
Allocate a new CMK to eu-north-1 to be used by the application that is deployed in that Region.
-
C
Allocate a new CMK to eu-north-1. Create the same alias name for both keys. Configure the application deployment to use the key alias.
-
D
Allocate a new CMK to eu-north-1. Create an alias for eu-'-1. Change the application code to point to the alias for eu-'-1.
Reveal answer details
Close answer details
Question 53
Multiple choice
An online media company has an application that customers use to watch events around the world. The application is hosted on a fleet of Amazon EC2 instances that run Amazon Linux 2. The company uses AWS Systems Manager to manage the EC2 instances. The company applies patches and application updates by using the AWS-AmazonLinux2DefaultPatchBaseline patching baseline in Systems Manager Patch Manager. The company is concerned about potential attacks on the application during the week of an upcoming event. The company needs a solution that can immediately deploy patches to all the EC2 instances in response to a security incident or vulnerability. The solution also must provide centralized evidence that the patches were applied successfully. Which combination of steps will meet these requirements? (Choose two.)
-
A
Create a new patching baseline in Patch Manager. Specify Amazon Linux 2 as the product. Specify Security as the classification. Set the automatic approval for patches to 0 days. Ensure that the new patching baseline is the designated default for Amazon Linux 2.
-
B
Use the Patch Now option with the scan and install operation in the Patch Manager console to apply patches against the baseline to all nodes. Specify an Amazon S3 bucket as the patching log storage option.
-
C
Use the Clone function of Patch Manager to create a copy of the AWS-
AmazonLmux2DefaultPatchBaseline built-in baseline. Set the automatic approval for patches to 1 day.
-
D
Create a patch policy that patches all managed nodes and sends a patch operation log output to an Amazon S3 bucket. Use a custom scan schedule to set Patch Manager to check every hour for new patches. Assign the baseline to the patch policy.
-
E
Use Systems Manager Application Manager to inspect the package versions that were installed on the EC2 instances. Additionally use Application Manager to validate that the patches were correctly installed.
Reveal answer details
Close answer details
Question 54
Single choice
A security engineer is using AWS Organizations and wants to optimize SCPs. The security engineer needs to ensure that the SCPs conform to best practices. Which approach should the security engineer take to meet this requirement?
-
A
Use AWS IAM Access Analyzer to analyze the policies. View the findings from policy validation checks.
-
B
Review AWS Trusted Advisor checks for all accounts in the organization.
-
C
Set up AWS Audit Manager. Run an assessment for all AWS Regions for all accounts.
-
D
Ensure that Amazon Inspector agents are installed on all Amazon EC2 in-stances in all accounts.
Reveal answer details
Close answer details
Question 55
Single choice
A company is storing data in Amazon S3 Glacier. A security engineer implemented a new vault lock policy for 10 TB of data and called the initiate-vault-lock operation 12 hours ago. The audit team identified a typo in the policy that is allowing unintended access to the vault. What is the MOST cost-effective way to correct this error?
-
A
Call the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again.
-
B
Copy the vault data to a new S3 bucket. Delete the vault. Create a new vault with the data.
-
C
Update the policy to keep the vault lock in place
-
D
Update the policy. Call the initiate-vault-lock operation again to apply the new policy.
Reveal answer details
Close answer details
Correct answerA
ExplanationThe most cost-effective way to correct a typo in a vault lock policy during the 24-hour initiation period is to call the abort-vault-lock operation. This action stops the vault lock process, allowing the security engineer to correct the policy and re-initiate the vault lock with the corrected policy. This approach avoids the need for data transfer or creating a new vault, thus minimizing costs and operational overhead.
Question 56
Single choice
A company has AWS accounts in an organization in AWS Organizations. The company has enabled Amazon GuardDuty in its production, support, and test accounts. The company runs important workloads in the production account and centrally stores logs in an Amazon
S3 bucket in the support account. A security engineer must implement a solution to elevate security findings for the production account and the S3 bucket. The solution must automatically elevate findings of HIGH severity to CRITICAL severity. Which solution will meet these requirements?
-
A
Enable AWS Security Hub for all accounts. In the Security Hub administrator account, enable the GuardDuty integration. Create automation rules to elevate findings for the production account and the
S3 bucket.
-
B
Enable AWS Security Hub for all accounts. In the Security Hub administrator account, enable the GuardDuty integration. Use Amazon EventBridge to create a custom rule to elevate findings for the production account and the S3 bucket.
-
C
Use the GuardDuty administrator account to configure a threat list that includes the production account and the S3 bucket. Use Amazon EventBridge and Amazon Simple Notification Service (Amazon SNS) to elevate findings from the threat list.
-
D
Use the GuardDuty administrator account to enable S3 protection for the support account that contains the S3 bucket. Configure GuardDuty to elevate findings for the production account and the S3 bucket.
Reveal answer details
Close answer details
Question 57
Multiple choice
A company is designing a new application stack. The design includes web servers and backend servers that are hosted on Amazon EC2 instances. The design also includes an Amazon Aurora MySQL DB cluster. The EC2 instances are in an Auto Scaling group that uses launch templates. The EC2 instances for the web layer and the backend layer are backed by Amazon Elastic Block Store (Amazon EBS) volumes. No layers are encrypted at rest. A security engineer needs to implement encryption at rest. Which combination of steps will meet these requirements? (Select TWO.)
-
A
Modify EBS default encryption settings in the target AWS Region to enable encryption. Use an Auto Scaling group instance refresh.
-
B
Modify the launch templates for the web layer and the backend layer to add AWS Certificate Manager (ACM) encryption for the attached EBS volumes. Use an Auto Scaling group instance refresh.
-
C
Create a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster.
-
D
Apply AWS Key Management Service (AWS KMS) encryption to the existing DB cluster.
-
E
Apply AWS Certificate Manager (ACM) encryption to the existing DB cluster.
Reveal answer details
Close answer details
Correct answersA, C
Explanationhttps://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.html
https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/ To implement encryption at rest for both the EC2 instances and the Aurora DB cluster, the following steps are required: For the EC2 instances, modify the EBS default encryption settings in the target AWS Region to enable encryption. This will ensure that any new EBS volumes created in that Region are encrypted by default using an AWS managed key. Alternatively, you can specify a customer managed key when creating new EBS volumes. For more information, see Amazon EBS encryption. Use an Auto Scaling group instance refresh to replace the existing EC2 instances with new ones that have encrypted EBS volumes attached.
An instance refresh is a feature that helps you update all instances in an Auto Scaling group in a rolling fashion without the need to manage the instance replacement process manually. For more information, see Replacing Auto Scaling instances based on an instance refresh. For the Aurora DB cluster, create a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster. You can use either an AWS managed key or a customer managed key to encrypt the new DB cluster. You cannot enable or disable encryption for an existing DB cluster, so you have to create a new one from a snapshot. For more information, see Encrypting Amazon Aurora resources. The other options are incorrect because they either do not enable encryption at rest for the resources (B, D), or they use the wrong service for encryption (E).
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-instance-refresh.html
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.html
Question 58
Single choice
A company's on-premises data center forwards DNS logs to a third-party security incident events management (SIEM) solution that alerts on suspicious behavior. The company wants to introduce a similar capability to its IAM accounts that includes automatic remediation. The company expects to double in size within the next few months. Which solution meets the company's current and future logging requirements?
-
A
Enable Amazon GuardDuty and IAM Security Hub in all Regions and all accounts.
Designate a master security account to receive all alerts from the child accounts. Set up specific rules
within Amazon Even;Bridge to trigger an IAM Lambda function for remediation steps.
-
B
Ingest all IAM CloudTrail logs, VPC Flow Logs, and DNS logs into a single Amazon S3 bucket in a designated security account. Use the current on-premises SIEM to monitor the logs and send a notification to an Amazon SNS topic to alert the security team of remediation steps.
-
C
Ingest all IAM CloudTrail logs, VPC Flow Logs, and DNS logs into a single Amazon S3 bucket in a designated security account. Launch an Amazon EC2 instance and install the current SIEM to monitor the logs and send a notification to an Amazon SNS topic to alert the security team of remediation steps.
-
D
Enable Amazon GuardDuty and IAM Security Hub in all Regions and all accounts.
Designate a master security account to receive all alerts from the child accounts. Create an IAM Organizations SCP that denies access to certain API calls that are on an ignore list.
Reveal answer details
Close answer details
Question 59
Single choice
A company needs to retain tog data archives for several years to be compliant with regulations. The tog data is no longer used but It must be retained What Is the MOST secure and cost-effective solution to meet these requirements?
-
A
Archive the data to Amazon S3 and apply a restrictive bucket policy to deny the s3 DeleteOotect API
-
B
Archive the data to Amazon S3 Glacier and apply a Vault Lock policy
-
C
Archive the data to Amazon S3 and replicate it to a second bucket in a second IAM Region Choose the S3 Standard-Infrequent Access (S3 Standard-1A) storage class and apply a restrictive bucket policy to deny the s3 DeleteObject API
-
D
Migrate the log data to a 16 T8 Amazon Elastic Block Store (Amazon EBS) volume Create a snapshot of the EBS volume
Reveal answer details
Close answer details
Question 60
Single choice
A company has developed a new Amazon RDS database application. The company must secure the ROS database credentials for encryption in transit and encryption at rest. The company also must rotate the credentials automatically on a regular basis. Which solution meets these requirements?
-
A
Use IAM Systems Manager Parameter Store to store the database credentiais. Configure automatic rotation of the credentials.
-
B
Use IAM Secrets Manager to store the database credentials. Configure automat* rotation of the credentials
-
C
Store the database credentials in an Amazon S3 bucket that is configured with server-side encryption with S3 managed encryption keys (SSE-S3) Rotate the credentials with IAM database authentication.
-
D
Store the database credentials in Amazon S3 Glacier, and use S3 Glacier Vault Lock Configure an IAM Lambda function to rotate the credentials on a scheduled basts
Reveal answer details
Close answer details
Question 61
Single choice
You have an EBS volume attached to an EC2 Instance which uses KMS for Encryption. Someone has now gone ahead and deleted the Customer Key which was used for the EBS encryption. What should be done to ensure the data can be decrypted?
-
A
Create a new Customer Key using KMS and attach it to the existing volume
-
B
You cannot decrypt the data that was encrypted under the CMK, and the data is not recoverable.
-
C
Request IAM Support to recover the key
-
D
Use IAM Config to recover the key
Reveal answer details
Close answer details
Correct answerB
ExplanationDeleting a customer master key (CMK) in IAM Key Management Service (IAM KMS) is destructive and potentially dangerous. It deletes the key material and all metadata associated with the CMK, and is irreversible. After a CMK is deleted you can no longer decrypt the data that was encrypted under that CMK, which means that data becomes unrecoverable. You should delete a CMK only when you are sure that you don't need to use it anymore. If you are not sure, consider disabling the CMK instead of deleting it.
You can re-enable a disabled CMK if you need to use it again later, but you cannot recover a deleted CMK.
https://docs.IAM.amazon.com/kms/latest/developerguide/deleting-keys.html
A is incorrect because Creating a new CMK and attaching it to the exiting volume will not allow the data to be decrypted, you cannot attach customer master keys after the volume is encrypted Option C and D are invalid because once the key has been deleted, you cannot recover it For more information on EBS Encryption with KMS, please visit the following URL:
https://docs.IAM.amazon.com/kms/latest/developerguide/services-ebs.html
The correct answer is: YoucannotdecryptthedatathatwasencryptedundertheCMK,andthedataisnotrecoverable.SubmityourFeedback/QueriestoourExperts
Question 62
Multiple choice
An organization is using Amazon CloudWatch Logs with agents deployed on its Linux Amazon EC2 instances. The agent configuration files have been checked and the application log files to be pushed are configured correctly. A review has identified that logging from specific instances is missing. Which steps should be taken to troubleshoot the issue? (Choose two.)
-
A
Use an EC2 run command to confirm that the "IAMlogs" service is running on all instances.
-
B
Verify that the permissions used by the agent allow creation of log groups/streams and to put log events.
-
C
Check whether any application log entries were rejected because of invalid time stamps by reviewing /
var/cwlogs/rejects.log.
-
D
Check that the trust relationship grants the service "cwlogs.amazonIAM.com" permission to write objects to the Amazon S3 staging bucket.
-
E
Verify that the time zone on the application servers is in UTC.
Reveal answer details
Close answer details
Correct answersA, B
ExplanationEC2 run command - can run scripts, install software, collect metrics and log files, manage patches and more. Bringing these two services together - can create CloudWatch Events rules that use EC2 Run Command to perform actions on EC2 instances or on-premises servers.
Question 63
Single choice
Your company makes use of S3 buckets for storing data. There is a company policy that all services should have logging enabled. How can you ensure that logging is always enabled for created S3 buckets in the IAM Account?
-
A
Use IAM Inspector to inspect all S3 buckets and enable logging for those where it is not enabled
-
B
Use IAM Config Rules to check whether logging is enabled for buckets
-
C
Use IAM Cloudwatch metrics to check whether logging is enabled for buckets
-
D
Use IAM Cloudwatch logs to check whether logging is enabled for buckets
Reveal answer details
Close answer details
Correct answerB
ExplanationThis is given in the IAM Documentation as an example rule in IAM Config Example rules with triggers Example rule with configuration change trigger 1. You add the IAM Config managed rule, S3_BUCKET_LOGGING_ENABLED, to your account to check whether your Amazon S3 buckets have logging enabled.
2. The trigger type for the rule is configuration changes. IAM Config runs the evaluations for the rule when an Amazon S3 bucket is created, changed, or deleted.
3. When a bucket is updated, the configuration change triggers the rule and IAM Config evaluates whether the bucket is compliant against the rule.
Option A is invalid because IAM Inspector cannot be used to scan all buckets
Option C and D are invalid because Cloudwatch cannot be used to check for logging enablement for buckets.
For more information on Config Rules please see the below Link:
https://docs.IAM.amazon.com/config/latest/developerguide/evaluate-config-rules.htmlThecorrectansweris:UseIAMConfigRulestocheckwhetherloggingisenabledforbucketsSubmityourFeedback/QueriestoourExperts
Question 64
Multiple choice
Your company has an EC2 Instance that is hosted in an IAM VPC. There is a requirement to ensure that logs files from the EC2 Instance are stored accordingly. The access should also be limited for the destination of the log files. How can this be accomplished? Choose 2 answers from the options given below. Each answer forms part of the solution Please select:
-
A
Stream the log files to a separate Cloudtrail trail
-
B
Stream the log files to a separate Cloudwatch Log group
-
C
Create an IAM policy that gives the desired level of access to the Cloudtrail trail
-
D
Create an IAM policy that gives the desired level of access to the Cloudwatch Log group
Reveal answer details
Close answer details
Correct answersB, D
ExplanationYou can create a Log group and send all logs from the EC2 Instance to that group. You can then limit the access to the Log groups via an IAM policy.
Option A is invalid because Cloudtrail is used to record API activity and not for storing log files
Option C is invalid because Cloudtrail is the wrong service to be used for this requirement For more information on Log Groups and Log Streams, please visit the following URL:
*
https://docs.IAM.amazon.com/AmazonCloudWatch/latest/logs/Workinj
For more information on Access to Cloudwatch logs, please visit the following URL:
*
https://docs.IAM.amazon.com/AmazonCloudWatch/latest/logs/auth-and-access-control-cwl.htmlThecorrectanswersare:StreamthelogfilestoaseparateCloudwatchLoggroup.CreateanIAMpolicythatgivesthedesiredlevelofaccesstotheCloudwatchLoggroupSubmityourFeedback/QueriestoourExperts
Question 65
Single choice
A company is using Amazon Route 53 Resolver for its hybrid DNS infrastructure. The company has set up
Route 53 Resolver forwarding rules for authoritative domains that are hosted on on-premises DNS servers. A new security mandate requires the company to implement a solution to log and query DNS traffic that goes to the on-premises DNS servers. The logs must show details of the source IP address of the instance from which the query originated. The logs also must show the DNS name that was requested in Route 53
Resolver. Which solution will meet these requirements?
-
A
Use VPC Traffic Mirroring. Configure all relevant elastic network interfaces as the traffic source, include amazon-dns in the mirror filter, and set Amazon CloudWatch Logs as the mirror target. Use CloudWatch Insights on the mirror session logs to run queries on the source IP address and DNS name.
-
B
Configure VPC flow logs on all relevant VPCs. Send the logs to an Amazon S3 bucket. Use Amazon Athena to run SQL queries on the source IP address and DNS name.
-
C
Configure Route 53 Resolver query logging on all relevant VPCs. Send the logs to Amazon CloudWatch Logs. Use CloudWatch Insights to run queries on the source IP address and DNS name.
-
D
Modify the Route 53 Resolver rules on the authoritative domains that forward to the on-premises DNS servers. Send the logs to an Amazon S3 bucket. Use Amazon Athena to run SQL queries on the source IP address and DNS name.
Reveal answer details
Close answer details
Correct answerC
ExplanationThe correct answer is C. Configure Route 53 Resolver query logging on all relevant VPCs. Send the logs to Amazon CloudWatch Logs. Use CloudWatch Insights to run queries on the source IP address and DNS name. According to the AWS documentation, Route 53 Resolver query logging lets you log the DNS queries that Route 53 Resolver handles for your VPCs. You can send the logs to CloudWatch Logs, Amazon S3, or Kinesis Data Firehose. The logs include information such as the following: The AWS Region where the VPC was created
The ID of the VPC that the query originated from The IP address of the instance that the query originated from The instance ID of the resource that the query originated from The date and time that the query was first made The DNS name requested (such as prod.example.com) The DNS record type (such as A or AAAA)
The DNS response code, such as NoError or ServFail.
The DNS response data, such as the IP address that is returned in response to the DNS query You can use CloudWatch Insights to run queries on your log data and analyze the results using graphs and statistics 2. You can filter and aggregate the log data based on any field, and use operators and functions to perform calculations and transformations. For example, you can use CloudWatch Insights to find out how many queries were made for a specific domain name, or which instances made the most queries. Therefore, this solution meets the requirements of logging and querying DNS traffic that goes to the on-premises DNS servers, showing details of the source IP address of the instance from which the query originated, and the DNS name that was requested in Route 53
Resolver.
The other options are incorrect because:
A. Using VPC Traffic Mirroring would not capture the DNS queries that go to the on-premises DNS servers,
because Traffic Mirroring only copies network traffic from an elastic network interface of an EC2 instance to a target for analysis 3. Traffic Mirroring does not include traffic that goes through a Route 53 Resolver outbound endpoint, which is used to forward queries to on-premises DNS servers 4. Therefore, this solution would not meet the requirements.
B. Configuring VPC flow logs on all relevant VPCs would not capture the DNS name that was requested in Route 53 Resolver, because flow logs only record information about the IP traffic going to and from network interfaces in a VPC5. Flow logs do not include any information about the content or payload of a packet, such as a DNS query or response. Therefore, this solution would not meet the requirements.
D. Modifying the Route 53 Resolver rules on the authoritative domains that forward to the on-premises DNS servers would not enable logging of DNS queries, because Resolver rules only specify how to forward queries for specified domain names to your network6. Resolver rules do not have any logging functionality by themselves. Therefore, this solution would not meet the requirements. References:
1: Resolver query logging - Amazon Route 53
2: Analyzing log data with CloudWatch Logs Insights - Amazon CloudWatch
3: What is Traffic Mirroring - Amazon Virtual Private Cloud
4: Outbound Resolver endpoints - Amazon Route 53
5: Logging IP traffic using VPC Flow Logs - Amazon Virtual Private Cloud
6: Managing forwarding rules - Amazon Route 53
Question 66
Single choice
A company uses Amazon Cognito as an OAuth 2.0 identity platform for its web and mobile applications.
The company needs to capture successful and unsuccessful login attempts. The company also needs to query the data about the login attempts. Which solution will meet these requirements?
-
A
Configure Cognito to send logs of user activity to Amazon CloudWatch. Configure Amazon EventBridge to invoke an AWS Lambda function to export the logs to an Amazon S3 bucket. Use Amazon Athena to query the logs for event names of SignUp with event sources of cognito-idp.amazonaws.com.
-
B
Enable AWS CloudTrail to deliver logs to an Amazon S3 bucket. Use Amazon Athena to query the logs for event names of InitiateAuth with event sources of cognito-idp.amazonaws.com.
-
C
Configure AWS CloudTrail to send Cognito CloudTrail events to Amazon CloudWatch for monitoring.
Query the event logs for event names of SignUp with event sources of cognito-idp.amazonaws.com.
-
D
Configure Amazon CloudWatch metrics to monitor and report Cognito events. Create a CloudWatch dashboard for the provided metrics. Display the Cognito user pools for event names of InitiateAuth with
event sources of cognito-idp.amazonaws.com.
Reveal answer details
Close answer details
Correct answerB
ExplanationAWS CloudTrail logs all API activity related to AWS services, including Amazon Cognito, and can capture login attempts (both successful and unsuccessful). By enabling CloudTrail, the logs can be delivered to an S3 bucket for storage, and Amazon Athena can be used to query those logs. The event name InitiateAuth corresponds to login attempts, and the event source cognito-idp.amazonaws.com refers to the Cognito identity service. This solution allows querying the logs for login attempts while meeting the requirement to capture both successful and unsuccessful attempts.
Question 67
Single choice
A company has thousands of AWS Lambda functions. While reviewing the Lambda functions, a security engineer discovers that sensitive information is being stored in environment variables and is viewable as plaintext in the Lambda console. The values of the sensitive information are only a few characters long. What is the MOST cost-effective way to address this security issue?
-
A
Set up IAM policies from the Lambda console to hide access to the environment variables.
-
B
Use AWS Step Functions to store the environment variables. Access the environment variables at runtime. Use IAM permissions to restrict access to the environment variables to only the Lambda functions that require access.
-
C
Store the environment variables in AWS Secrets Manager, and access them at runtime.
Use IAM permissions to restrict access to the secrets to only the Lambda functions that require access.
-
D
Store the environment variables in AWS Systems Manager Parameter Store as secure string parameters, and access them at runtime. Use IAM permissions to restrict access to the parameters to only the Lambda functions that require access.
Reveal answer details
Close answer details
Correct answerD
ExplanationStoring sensitive information in environment variables is not a secure practice, as anyone who has access to the Lambda console or the Lambda function code can view them as plaintext. To address this security issue, the security engineer needs to use a service that can store and encrypt the environment variables, and access them at runtime using IAM permissions. The most cost-effective way to do this is to use AWS Systems Manager Parameter Store, which is a service that provides secure, hierarchical storage for configuration data management and secrets management. Parameter Store allows you to store values as standard parameters (plaintext) or secure string parameters (encrypted). Secure string parameters use a AWS Key Management Service (AWS KMS) customer master key (CMK) to encrypt the parameter value.
To access the parameter value at runtime, the Lambda function needs to have IAM permissions to decrypt the parameter using the KMS CMK.
The other options are incorrect because: Option A is incorrect because setting up IAM policies from the Lambda console to hide access to the environment variables will not prevent someone who has access to the Lambda function code from viewing them as plaintext. IAM policies can only control who can perform actions on AWS resources, not what they can see in the code or the console.
Option B is incorrect because using AWS Step Functions to store the environment variables is not a secure or cost-effective solution. AWS Step Functions is a service that lets you coordinate multiple AWS services into serverless workflows. Step Functions does not provide any encryption or secrets management capabilities, and it will incur additional charges for each state transition in the workflow.
Moreover, storing environment variables in Step Functions will make them visible in the execution history of the workflow, which can be accessed by anyone who has permission to view the Step Functions console or API. Option C is incorrect because storing the environment variables in AWS Secrets Manager and accessing them at runtime is not a cost-effective solution. AWS Secrets Manager is a service that helps you protect secrets needed to access your applications, services, and IT resources. Secrets Manager enables you to rotate, manage, and retrieve secrets throughout their lifecycle. While Secrets Manager can securely store and encrypt environment variables using KMS CMKs, it will incur higher charges than Parameter Store for storing and retrieving secrets. Unless the security engineer needs the advanced features of Secrets Manager, such as automatic rotation of secrets or integration with other AWS services, Parameter Store is a cheaper and simpler option.
Question 68
Single choice
A company hosts an end user application on AWS Currently the company deploys the application on Amazon EC2 instances behind an Elastic Load Balancer.
The company wants to configure end-to-end encryption between the Elastic Load Balancer and the EC2 instances. Which solution will meet this requirement with the LEAST operational effort?
-
A
Use Amazon issued AWS Certificate Manager (ACM) certificates on the EC2 instances and the Elastic Load Balancer to configure end-to-end encryption
-
B
Import a third-party SSL certificate to AWS Certificate Manager (ACM) Install the third-party certificate on the EC2 instances Associate the ACM imported third-party certificate with the Elastic Load Balancer
-
C
Deploy AWS CloudHSM Import a third-party certificate Configure the EC2 instances and the Elastic Load Balancer to use the CloudHSM imported certificate
-
D
Import a third-party certificate bundle to AWS Certificate Manager (ACM) Install the third-party certificate on the EC2 instances Associate the ACM imported third-party certificate with the Elastic Load Balancer.
Reveal answer details
Close answer details
Correct answerA
ExplanationTo configure end-to-end encryption between the Elastic Load Balancer and the EC2 instances with the least operational effort, the most appropriate solution would be to use Amazon issued AWS Certificate Manager (ACM) certificates on the EC2 instances and the Elastic Load Balancer to configure end-to-end encryption. AWS Certificate Manager - Amazon Web Services : Elastic Load Balancing - Amazon Web
Services : Amazon Elastic Compute Cloud - Amazon Web Services : AWS Certificate Manager - Amazon
Web Services
Question 69
Single choice
You are planning to use IAM Configto check the configuration of the resources in your IAM account. You are planning on using an existing IAM role and using it for the IAM Config resource. Which of the following is required to ensure the IAM config service can work as required?
-
A
Ensure that there is a trust policy in place for the IAM Config service within the role
-
B
Ensure that there is a grant policy in place for the IAM Config service within the role
-
C
Ensure that there is a user policy in place for the IAM Config service within the role
-
D
Ensure that there is a group policy in place for the IAM Config service within the role
Reveal answer details
Close answer details
Correct answerA
Explanation Options B,C and D are invalid because you need to ensure a trust policy is in place and not a grant, user or group policy or more information on the IAM role permissions please visit the below Link:
https://docs.IAM.amazon.com/config/latest/developerguide/iamrole-permissions.htmll
The correct answeris:EnsurethatthereisatrustpolicyinplacefortheIAMConfigservicewithintheroleSubmityourFeedback/QueriestoourExperts
Question 70
Single choice
You need to establish a secure backup and archiving solution for your company, using IAM. Documents should be immediately accessible for three months and available for five years for compliance reasons. Which IAM service fulfills these requirements in the most cost-effective way? Choose the correct answer:
-
A
Upload data to S3 and use lifecycle policies to move the data into Glacier for long-term archiving.
-
B
Upload the data on EBS, use lifecycle policies to move EBS snapshots into S3 and later into Glacier for long-term archiving.
-
C
Use Direct Connect to upload data to S3 and use IAM policies to move the data into Glacier for long-term archiving.
-
D
Use Storage Gateway to store data to S3 and use lifecycle policies to move the data into Redshift for long-term archiving.
Reveal answer details
Close answer details
Correct answerA
Explanationamazon Glacier is a secure, durable, and extremely low-cost cloud storage service for data archiving and long-term backup. Customers can reliably store large or small amounts of data for as little as $0,004 per gigabyte per month, a significant savings compared to on-premises solutions.
With Amazon lifecycle policies you can create transition actions in which you define when objects transition to another Amazon S3 storage class. For example, you may choose to transition objects to the STANDARDJA (IA, for infrequent access) storage class 30 days after creation, or archive objects to the GLACIER storage class one year after creation.
Option B is invalid because lifecycle policies are not available for EBS volumes
Option C is invalid because IAM policies cannot be used to move data to Glacier
Option D is invalid because lifecycle policies is not used to move data to Redshif For more information on S3 lifecycle policies, please visit the URL:
http://docs.IAM.amazon.com/AmazonS3/latest/dev/obiect-lifecycle-mgmt.html
The correct answer is:
Upload data to S3 and use lifecycle policies to move the data into Glacier for long-term archiving.
Submit your Feedback/Queries to our Experts
Question 71
Single choice
An IAM account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication:  After implementing the policy, the administrator receives reports that users are unable to perform Amazon
EC2 commands using the IAM CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication?
-
A
Change the value of IAM MultiFactorAuthPresent to true.
-
B
Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/
CLI calls
-
C
Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
-
D
Create a role and enforce multi-factor authentication in the role trust policy Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters Store the resulting values in environment variables.
Add sts:AssumeRole to NotAction in the policy.
Reveal answer details
Close answer details
Question 72
Multiple choice
A company's public Application Load Balancer (ALB) recently experienced a DDoS attack. To mitigate this issue. the company deployed Amazon CloudFront in front of the ALB so that users would not directly access the Amazon EC2 instances behind the ALB. The company discovers that some traffic is still coming directly into the ALB and is still being handled by the EC2 instances. Which combination of steps should the company take to ensure that the EC2 instances will receive traffic only from CloudFront? (Choose two.)
-
A
Configure CloudFront to add a cache key policy to allow a custom HTTP header that CloudFront sends to the ALB.
-
B
Configure CloudFront to add a custom: HTTP header to requests that CloudFront sends to the ALB.
-
C
Configure the ALB to forward only requests that contain the custom HTTP header.
-
D
Configure the ALB and CloudFront to use the X-Forwarded-For header to check client IP addresses.
-
E
Configure the ALB and CloudFront to use the same X.509 certificate that is generated by AWS Certificate Manager (ACM).
Reveal answer details
Close answer details
Correct answersB, C
ExplanationTo prevent users from directly accessing an Application Load Balancer and allow access only through CloudFront, complete these high-level steps: Configure CloudFront to add a custom HTTP header to requests that it sends to the Application Load Balancer. Configure the Application Load Balancer to only forward requests that contain the custom HTTP header. (Optional) Require HTTPS to improve the security of this solution.
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/restrict-access-to-load-balancer.html
Question 73
Single choice
A company hosts an application on Amazon EC2 that is subject to specific rules for regulatory compliance.
One rule states that traffic to and from the workload must be inspected for network-level attacks. This involves inspecting the whole packet. To comply with this regulatory rule, a security engineer must install intrusion detection software on a c5n.4xlarge EC2 instance. The engineer must then configure the software to monitor traffic to and from the application instances. What should the security engineer do next?
-
A
Place the network interface in promiscuous mode to capture the traffic.
-
B
Configure VPC Flow Logs to send traffic to the monitoring EC2 instance using a Network Load Balancer.
-
C
Configure VPC traffic mirroring to send traffic to the monitoring EC2 instance using a Network Load Balancer.
-
D
Use Amazon Inspector to detect network-level attacks and trigger an IAM Lambda function to send the suspicious packets to the EC2 instance.
Reveal answer details
Close answer details
Question 74
Single choice
A company is designing a multi-account structure for its development teams. The company is using AWS Organizations and AWS Single Sign-On (AWS SSO). The company must implement a solution so that the development teams can use only specific AWS Regions and so that each AWS account allows access to
only specific AWS services. Which solution will meet these requirements with the LEAST operational overhead?
-
A
Use AWS SSO to set up service-linked roles with IAM policy statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
-
B
Deactivate AWS Security Token Service (AWS STS) in Regions that the developers are not allowed to use.
-
C
Create SCPs that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
-
D
For each AWS account, create tailored identity-based policies for AWS SSO. Use statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
Reveal answer details
Close answer details
Correct answerC
Explanationhttps://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_syntax.html#scp-elements-table
Question 75
Multiple choice
A Security Engineer is building a Java application that is running on Amazon EC2. The application communicates with an Amazon RDS instance and authenticates with a user name and password. Which combination of steps can the Engineer take to protect the credentials and minimize downtime when the credentials are rotated? (Choose two.)
-
A
Have a Database Administrator encrypt the credentials and store the ciphertext in Amazon S3. Grant permission to the instance role associated with the EC2 instance to read the object and decrypt the ciphertext.
-
B
Configure a scheduled job that updates the credential in IAM Systems Manager Parameter Store and notifies the Engineer that the application needs to be restarted.
-
C
Configure automatic rotation of credentials in IAM Secrets Manager.
-
D
Store the credential in an encrypted string parameter in IAM Systems Manager Parameter Store. Grant permission to the instance role associated with the EC2 instance to access the parameter and the IAM KMS key that is used to encrypt it.
-
E
Configure the Java application to catch a connection failure and make a call to IAM Secrets Manager to retrieve updated credentials when the password is rotated. Grant permission to the instance role associated with the EC2 instance to access Secrets Manager.
Reveal answer details
Close answer details
Question 76
Single choice
A Software Engineer wrote a customized reporting service that will run on a fleet of Amazon EC2 instances. The company security policy states that application logs for the reporting service must be centrally collected. What is the MOST efficient way to meet these requirements?
-
A
Write an IAM Lambda function that logs into the EC2 instance to pull the application logs from the EC2 instance and persists them into an Amazon S3 bucket.
-
B
Enable IAM CloudTrail logging for the IAM account, create a new Amazon S3 bucket, and then configure Amazon CloudWatch Logs to receive the application logs from CloudTrail.
-
C
Create a simple cron job on the EC2 instances that synchronizes the application logs to an Amazon S3 bucket by using rsync.
-
D
Install the Amazon CloudWatch Logs Agent on the EC2 instances, and configure it to send the application logs to CloudWatch Logs.
Reveal answer details
Close answer details
Correct answerD
Explanationhttps://IAM.amazon.com/blogs/IAM/cloudwatch-log-service/
Question 77
Single choice
A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off. What is the MOST efficient way to implement this solution?
-
A
Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.
-
B
Create an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging API.
-
C
Create an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLoggmg event name to invoke an AWS Lambda function to call the StartLogging API.
-
D
Monitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.
Reveal answer details
Close answer details
Question 78
Single choice
A security team is working on a solution that will use Amazon EventBridge (Amazon CloudWatch Events) to monitor new Amazon S3 objects. The solution will monitor for public access and for changes to any S3 bucket policy or setting that result in public access. The security team configures EventBridge to watch for specific API calls that are logged from AWS CloudTrail. EventBridge has an action to send an email notification through Amazon Simple Notification Service (Amazon SNS) to the security team immediately with details of the API call. Specifically, the security team wants EventBridge to watch for the s3:PutObjectAcl, s3:DeleteBucketPolicy, and s3:PutBucketPolicy API invocation logs from CloudTrail. While developing the solution in a single account, the security team discovers that the s3:PutObjectAcl API call does not invoke an EventBridge
event However, the s3:DeleteBucketPolicy API call and the s3:PutBucketPolicy API call do invoke an
event. The security team has enabled CloudTrail for AWS management events with a basic configuration in the AWS Region in which EventBridge is being tested. Verification of the EventBridge event pattern indicates that the pattern is set up correctly. The security team must implement a solution so that the s3:PutObjectAcl API call will invoke an EventBridge event. The solution must not generate false notifications. Which solution will meet these requirements?
-
A
Modify the EventBridge event pattern by selecting Amazon S3. Select All Events as the event type.
-
B
Modify the EventBridge event pattern by selecting Amazon S3. Select Bucket Level Operations as the
event type.
-
C
Enable CloudTrail Insights to identify unusual API activity.
-
D
Enable CloudTrail to monitor data events for read and write operations to S3 buckets.
Reveal answer details
Close answer details
Correct answerD
ExplanationAccording to the AWS documentation1, CloudTrail data events are the resource operations performed on or within a resource. These are also known as data plane operations. Data events are often high-volume activities. For example, Amazon S3 object-level API activity (such as GetObject, DeleteObject, and PutObject) is a data event. By default, trails do not log data events. To record CloudTrail data events, you must explicitly add the supported resources or resource types for which you want to collect activity. For more information, see Logging data events in the Amazon S3 User Guide2. In this case, the security team wants EventBridge to watch for the s3:PutObjectAcl API invocation logs from CloudTrail. This API uses the acl subresource to set the access control list (ACL) permissions for a new or existing object in an S3 bucket 3. This is a data event that affects the S3 object resource type. Therefore, the security team must enable CloudTrail to monitor data events for read and write operations to S3 buckets in order to invoke an EventBridge event for this API call. The other options are incorrect because:
A. Modifying the EventBridge event pattern by selecting Amazon S3 and All Events as the event type will
not capture the s3:PutObjectAcl API call, because this is a data event and not a management event.
Management events provide information about management operations that are performed on resources in your AWS account. These are also known as control plane operations. B. Modifying the EventBridge event pattern by selecting Amazon S3 and Bucket Level Operations as the event type will not capture the
s3:PutObjectAcl API call, because this is a data event that affects the S3 object resource type and not the S3 bucket resource type. Bucket level operations are management events that affect the configuration or metadata of an S3 bucket 5. C. Enabling CloudTrail Insights to identify unusual API activity will not help the security team monitor new S3 objects or changes to any S3 bucket policy or setting that result in public access. CloudTrail Insights helps AWS users identify and respond to unusual activity associated with API calls and API error rates by continuously analyzing CloudTrail management events 6. It does not analyze data events or generate EventBridge events. References:
1: CloudTrail log event reference - AWS CloudTrail
2: Logging data events - AWS CloudTrail
3: PutObjectAcl - Amazon Simple Storage Service
4: [Logging management events - AWS CloudTrail]
5: [Amazon S3 Event Types - Amazon Simple Storage Service]
6: Logging Insights events for trails - AWS CloudTrail
Question 79
Multiple choice
A company has a requirement that none of its Amazon RDS resources can be publicly accessible. A security engineer needs to set up monitoring for this requirement and must receive a near-real-time notification if any RDS resource is noncompliant. Which combination of steps should the security engineer take to meet these requirements? (Select THREE.)
-
A
Configure RDS event notifications on each RDS resource. Target an AWS Lambda function that notifies AWS Config of a change to the RDS public access setting
-
B
Configure the rds-instance-public-access-check AWS Config managed rule to monitor the RDS resources.
-
C
Configure the Amazon EventBridge (Amazon CloudWatch Events) rule to target an Amazon Simple Notification Service (Amazon SNS) topic to provide a notification to the security engineer.
-
D
Configure RDS event notifications to post events to an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the SQS queue to an Amazon Simple Notification Service (Amazon SNS) topic to provide a notification to the security engineer.
-
E
Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that is invoked by a compliance change event from the rds-instance-public-access-check rule.
-
F
Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that is invoked when the AWS Lambda function notifies AWS Config of an RDS event change.
Reveal answer details
Close answer details
Question 80
Single choice
The Security Engineer implemented a new vault lock policy for 10TB of data and called initiate-vault-lock 12 hours ago. The Audit team identified a typo that is allowing incorrect access to the vault. What is the MOST cost-effective way to correct this?
-
A
Call the abort-vault-lock operation, fix the typo, and call the initiate-vault-lock again.
-
B
Copy the vault data to Amazon S3, delete the vault, and create a new vault with the data.
-
C
Update the policy, keeping the vault lock in place.
-
D
Update the policy and call initiate-vault-lock again to apply the new policy.
Reveal answer details
Close answer details
Correct answerA
ExplanationInitiate the lock by attaching a vault lock policy to your vault, which sets the lock to an in-progress state and returns a lock ID. While in the in-progress state, you have 24 hours to validate your vault lock policy before the lock ID expires. Use the lock ID to complete the lock process. If the vault lock policy doesn't work as expected, you can abort the lock and restart from the beginning. For information on how to use the S3 Glacier API to lock a vault, see Locking a Vault by Using the Amazon S3 Glacier API.
https://docs.IAM.amazon.com/amazonglacier/latest/dev/vault-lock-policy.html
Question 81
Single choice
A security engineer is responsible for providing secure access to IAM resources for thousands of developer in a company's corporate identity provider (idp). The developers access a set of IAM services from the corporate premises using IAM credential. Due to the velum of require for provisioning new IAM users, it is taking a long time to grant access permissions. The security engineer receives reports that developer are sharing their IAM credentials with others to avoid provisioning delays. The causes concern about overall security for the security engineer. Which actions will meet the program requirements that address security?
-
A
Create an Amazon CloudWatch alarm for IAM CloudTrail Events Create a metric filter to send a notification when me same set of IAM credentials is used by multiple developer
-
B
Create a federation between IAM and the existing corporate IdP Leverage IAM roles to provide federated access to IAM resources
-
C
Create a VPN tunnel between the corporate premises and the VPC Allow permissions to all IAM services only if it originates from corporate premises.
-
D
Create multiple IAM rotes for each IAM user Ensure that users who use the same IAM credentials cannot assume the same IAM role at the same time.
Reveal answer details
Close answer details
Question 82
Single choice
A company is planning to deploy a new log analysis environment. The company needs to implement a solution to analyze logs from multiple AWS services in near real time. The solution must provide the ability to search the logs. The solution also must send alerts to an existing Amazon Simple Notification Service (Amazon SNS) topic when specific logs match detection rules. Which solution will meet these requirements?
-
A
Analyze the logs by using Amazon OpenSearch Service. Search the logs from the OpenSearch API.
Use OpenSearch Service Security Analytics to match logs with detection rules and to send alerts to the
SNS topic.
-
B
Analyze the logs by using AWS Security Hub. Search the logs from the Findings page in Security Hub.
Create custom actions to match logs with detection rules and to send alerts to the SNS topic.
-
C
Analyze the logs by using Amazon CloudWatch Logs. Use a subscription filter to match logs with detection rules and to send alerts to the SNS topic. Search the logs manually by using CloudWatch Logs Insights.
-
D
Analyze the logs by using Amazon QuickSight. Search the logs by listing the query results in a dashboard. Run queries to match logs with detection rules and to send alerts to the SNS topic.
Reveal answer details
Close answer details
Question 83
Single choice
A company needs to encrypt all of its data stored in Amazon S3. The company wants to use IAM Key Management Service (IAM KMS) to create and manage its encryption keys. The company's security policies require the ability to Import the company's own key material for the keys, set an expiration date on the keys, and delete keys immediately, if needed. How should a security engineer set up IAM KMS to meet these requirements?
-
A
Configure IAM KMS and use a custom key store. Create a customer managed CMK with no key material Import the company's keys and key material into the CMK
-
B
Configure IAM KMS and use the default Key store Create an IAM managed CMK with no key material Import the company's key material into the CMK
-
C
Configure IAM KMS and use the default key store Create a customer managed CMK with no key material import the company's key material into the CMK
-
D
Configure IAM KMS and use a custom key store. Create an IAM managed CMK with no key material.
Import the company's key material into the CMK.
Reveal answer details
Close answer details
Question 84
Single choice
A company wants to deploy a distributed web application on a fleet of EC2 instances. The fleet will be fronted by a Classic Load Balancer that will be configured to terminate the TLS connection.
The company wants to make sure that all past and current TLS traffic to the Classic Load Balancer stays secure even if the certificate private key is leaked. To ensure the company meets these requirements, a Security Engineer can configure a Classic Load Balancer with:
-
A
An HTTPS listener that uses a certificate that is managed by Amazon Certification Manager.
-
B
An HTTPS listener that uses a custom security policy that allows only perfect forward secrecy cipher suites
-
C
An HTTPS listener that uses the latest IAM predefined ELBSecuntyPolicy-TLS-1 -2- 2017-01 security policy
-
D
A TCP listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.
Reveal answer details
Close answer details
Question 85
Multiple choice
A company Is trying to replace its on-premises bastion hosts used to access on-premises Linux servers with IAM Systems Manager Session Manager. A security engineer has installed the Systems Manager Agent on all servers. The security engineer verifies that the agent is running on all the servers, but Session Manager cannot connect to them. The security engineer needs to perform verification steps before Session Manager will work on the servers. Which combination of steps should the security engineer perform? (Select THREE.)
-
A
Open inbound port 22 to 0 0.0.0/0 on all Linux servers.
-
B
Enable the advanced-instances tier in Systems Manager.
-
C
Create a managed-instance activation for the on-premises servers.
-
D
Reconfigure the Systems Manager Agent with the activation code and ID.
-
E
Assign an IAM role to all of the on-premises servers.
-
F
Initiate an inventory collection with Systems Manager on the on-premises servers
Reveal answer details
Close answer details
Question 86
Single choice
While analyzing a company's security solution, a Security Engineer wants to secure the IAM account root user. What should the Security Engineer do to provide the highest level of security for the account?
-
A
Create a new IAM user that has administrator permissions in the IAM account. Delete the password for the IAM account root user.
-
B
Create a new IAM user that has administrator permissions in the IAM account. Modify the permissions for the existing IAM users.
-
C
Replace the access key for the IAM account root user. Delete the password for the IAM account root user.
-
D
Create a new IAM user that has administrator permissions in the IAM account. Enable multi-factor authentication for the IAM account root user.
Reveal answer details
Close answer details
Correct answerD
ExplanationIf you continue to use the root user credentials, we recommend that you follow the security best practice to enable multi-factor authentication (MFA) for your account. Because your root user can perform sensitive operations in your account, adding an additional layer of authentication helps you to better secure your account. Multiple types of MFA are available.
Question 87
Single choice
A company has hundreds of AWS accounts in an organization in AWS Organizations. The company operates out of a single AWS Region. The company has a dedicated security tooling AWS account in the organization. The security tooling account is configured as the organization's delegated administrator for Amazon GuardDuty and AWS Security Hub. The company has configured the environment to automatically enable GuardDuty and Security Hub for existing AWS accounts and new AWS accounts. The company is performing control tests on specific GuardDuty findings to make sure that the company's security team can detect and respond to security events. The security team launched an Amazon EC2 instance and attempted to run DNS requests against a test domain, example.com, to generate a DNS finding. However, the GuardDuty finding was never created in the Security Hub delegated administrator account. Why was the finding was not created in the Security Hub delegated administrator account?
-
A
VPC flow logs were not turned on for the VPC where the EC2 instance was launched.
-
B
The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver.
-
C
The GuardDuty integration with Security Hub was never activated in the AWS account where the finding was generated.
-
D
Cross-Region aggregation in Security Hub was not configured.
Reveal answer details
Close answer details
Question 88
Multiple choice
A recent security audit found that IAM CloudTrail logs are insufficiently protected from tampering and unauthorized access Which actions must the Security Engineer take to address these audit findings? (Select THREE )
-
A
Ensure CloudTrail log file validation is turned on
-
B
Configure an S3 lifecycle rule to periodically archive CloudTrail logs into Glacier for long-term storage
-
C
Use an S3 bucket with tight access controls that exists in a separate account
-
D
Use Amazon Inspector to monitor the file integrity of CloudTrail log files.
-
E
Request a certificate through ACM and use a generated certificate private key to encrypt CloudTrail log files
-
F
Encrypt the CloudTrail log files with server-side encryption with IAM KMS-managed keys (SSE-KMS)
Reveal answer details
Close answer details
Question 89
Multiple choice
A company has contracted with a third party to audit several IAM accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The Auditor is having trouble accessing some of the accounts. Which of the following may be causing this problem? (Choose three.)
-
A
The external ID used by the Auditor is missing or incorrect.
-
B
The Auditor is using the incorrect password.
-
C
The Auditor has not been granted sts:AssumeRole for the role in the destination account.
-
D
The Amazon EC2 role used by the Auditor must be set to the destination account role.
-
E
The secret key used by the Auditor is missing or incorrect.
-
F
The role ARN used by the Auditor is missing or incorrect.
Reveal answer details
Close answer details
Correct answersA, C, F
ExplanationUsing IAM to grant access to a Third-Party Account 1) Create a role to provide access to the require resources 1.1) Create a role policy that specifies the IAM Account ID to be accessed, "sts:AssumeRole" as action, and "sts:ExternalID" as condition 1.2) Create a role using the role policy just created 1.3) Assign a resouce policy to the role. This will provide permission to access resource ARNs to the auditor 2) Repeat steps 1 and 2 on all IAM accounts 3) The auditor connects to the IAM account IAM Security Token Service (STS). The auditor must provide its ExternalID from step 1.2, the ARN of the role he is trying to assume from step 1.3, sts:ExternalID 4) STS provide the auditor with temporary credentials that provides the role access from step 1
https://docs.IAM.amazon.com/IAM/latest/UserGuide/id_roles_create_for-
user_externalid.html
https://IAM.amazon.com/blogs/security/how-to-audit-cross-account-roles-using-IAM-cloudtrail-and-amazon-cloudwatch-events/
Question 90
Single choice
A security engineer must develop an encryption tool for a company. The company requires a cryptographic solution that supports the ability to perform cryptographic erasure on all resources protected by the key material in 15 minutes or less Which IAM Key Management Service (IAM KMS) key solution will allow the security engineer to meet these requirements?
-
A
Use Imported key material with CMK
-
B
-
C
-
D
Use an IAM KMS customer managed CMK
Reveal answer details
Close answer details
Question 91
Multiple choice
A company is hosting a website that must be accessible to users for HTTPS traffic. Also port 22 should be open for administrative purposes. The administrator's workstation has a static IP address of
203.0.113.1/32. Which of the following security group configurations are the MOST secure but still functional to support these requirements? Choose 2 answers from the options given below
-
A
Port 443 coming from 0.0.0.0/0
-
B
Port 443 coming from 10.0.0.0/16
-
C
Port 22 coming from 0.0.0.0/0
-
D
Port 22 coming from 203.0.113.1/32
Reveal answer details
Close answer details
Correct answersA, D
ExplanationSince HTTPS traffic is required for all users on the Internet, Port 443 should be open on all IP addresses.
For port 22, the traffic should be restricted to an internal subnet.
Option B is invalid, because this only allow traffic from a particular CIDR block and not from the internet
Option C is invalid because allowing port 22 from the internet is a security risk For more information on IAM Security Groups, please visit the following UR
https://docs.IAM.amazon.com/IAMEC2/latest/UserGuide/usins-network-secunty.htmllThecorrectanswersare:Port443comingfrom0.0.0.0/0,Port22comingfrom203.0.113.1/32SubmityourFeedback/QueriestoourExperts
Question 92
Single choice
A company has configured an organization in AWS Organizations for its AWS accounts. AWS CloudTrail is enabled in all AWS Regions. A security engineer must implement a solution to prevent CloudTrail from being disabled. Which solution will meet this requirement?
-
A
Enable CloudTrail log file integrity validation from the organization's management account.
-
B
Enable server-side encryption with AWS KMS keys (SSE-KMS) for CloudTrail logs. Create a KMS key.
Attach a policy to the key to prevent decryption of the logs.
-
C
Create an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail action. Attach the SCP to the root OU.
-
D
Create IAM policies for all the company's users to prevent the users from performing the DescribeTrails action and the GetTrailStatus action.
Reveal answer details
Close answer details
Correct answerC
ExplanationService Control Policies (SCPs) in AWS Organizations allow you to set permissions guardrails for accounts within an organization. By creating an SCP with an explicit Deny rule for the StopLogging and DeleteTrail actions, the security engineer can ensure that no one in the organization, regardless of their individual permissions, can stop or delete CloudTrail logs. Attaching this SCP to the root Organizational Unit (OU) will apply this restriction across all accounts, thereby preventing CloudTrail from being disabled.
Question 93
Multiple choice
A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually. The company often needs to query the logs to produce results about application sessions and user issues.
The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in. Which combination of steps should a security engineer take to meet these requirements MOST cost-effectively? (Choose two.)
-
A
Configure a cron job on the instances to forward the log files to Amazon S3 periodically.
-
B
Configure AWS Glue and Amazon Athena to query the log files.
-
C
Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs.
-
D
Configure Amazon CloudWatch Logs Insights to query the log files.
-
E
Configure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume.
Reveal answer details
Close answer details
Question 94
Single choice
A company is investigating an increase in its AWS monthly bill. The company discovers that bad actors compromised some Amazon EC2 instances and served webpages for a large email phishing campaign. A security engineer must implement a solution to monitor for cost increases in the future to help detect malicious activity. Which solution will offer the company the EARLIEST detection of cost increases?
-
A
Create an Amazon EventBridge rule that invokes an AWS Lambda function hourly.
Program the Lambda function to download an AWS usage report from AWS Data Exports about usage of all services. Program the Lambda function to analyze the report and to send a notification when anomalies are detected.
-
B
Create a cost monitor in AWS Cost Anomaly Detection. Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage above the expected cost exceeds a threshold.
-
C
Review AWS Cost Explorer daily to detect anomalies in cost from prior months Review the usage of any services that experience a significant cost increase from prior months.
-
D
Capture VPC flow logs from the VPC where the EC2 instances run. Use a third-party network analysis tool to analyze the flow logs and to detect anomalies in network traffic that might increase cost.
Reveal answer details
Close answer details
Correct answerB
ExplanationAWS Cost Anomaly Detection:
Steps to Implement:
Advantages:
Other Options:
References:
AWS Cost Anomaly Detection Documentation
Creating SNS Alerts for Cost Anomalies
Question 95
Single choice
A company needs to retain data that is stored in Amazon CloudWatch Logs log groups. The company must retain this data for 90 days. The company must receive notification in AWS Security Hub when log group retention is not compliant with this requirement. Which solution will provide the appropriate notification?
-
A
Create a Security Hub custom action to assess the log group retention period.
-
B
Create a data protection policy in CloudWatch Logs to assess the log group retention period.
-
C
Create a Security Hub automation rule. Configure the automation rule to assess the log group retention period.
-
D
Use the AWS Config managed rule that assesses the log group retention period. Ensure that AWS Config integration is enabled in Security Hub.
Reveal answer details
Close answer details
Correct answerD
ExplanationAWS Config provides managed rules that can assess various configurations, including the retention period of CloudWatch Logs log groups. By enabling the appropriate AWS Config managed rule to check if the log groups have a retention period of 90 days, the company can automatically monitor compliance with this requirement. Integrating AWS Config with AWS Security Hub allows non-compliant findings to be sent to Security Hub, providing the necessary notifications when the retention period is not compliant.
Question 96
Single choice
An organization policy states that all encryption keys must be automatically rotated every 12 months. Which IAM Key Management Service (KMS) key type should be used to meet this requirement?
-
A
IAM managed Customer Master Key (CMK)
-
B
Customer managed CMK with IAM generated key material
-
C
Customer managed CMK with imported key material
-
D
Reveal answer details
Close answer details
Question 97
Single choice
A company wants to monitor the deletion of customer managed CMKs A security engineer must create an alarm that will notify the company before a CMK is deleted The security engineer has configured the integration of IAM CloudTrail with Amazon CloudWatch What should the security engineer do next to meet this requirement?
-
A
Use inbound rule 100 to allow traffic on TCP port 443 Use inbound rule 200 to deny traffic on TCP port 3306 Use outbound rule 100 to allow traffic on TCP port 443
-
B
Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port
-
C
Use inbound rule 100 to allow traffic on TCP port range 1024-65535 Use inbound rule 200 to deny traffic on TCP port 3306 Use outbound rule 100 to allow traffic on TCP port
-
D
Use inbound rule 100 to deny traffic on TCP port 3306 Use inbound rule 200 to allow traffic on TCP port 443 Use outbound rule 100 to allow traffic on TCP port 443
Reveal answer details
Close answer details
Question 98
Single choice
A company's engineering team is developing a new application that creates IAM Key Management Service (IAM KMS) CMK grants for users immediately after a grant IS created users must be able to use the CMK
tu encrypt a 512-byte payload. During load testing, a bug appears |intermittently where
AccessDeniedExceptions are occasionally triggered when a user rst attempts to encrypt using the CMK Which solution should the company's security specialist recommend?
-
A
Instruct users to implement a retry mechanism every 2 minutes until the call succeeds.
-
B
Instruct the engineering team to consume a random grant token from users, and to call the CreateGrant operation, passing it the grant token. Instruct use to use that grant token in their call to encrypt.
-
C
Instruct the engineering team to create a random name for the grant when calling the CreateGrant operation. Return the name to the users and instruct them to provide the name as the grant token in the call to encrypt.
-
D
Instruct the engineering team to pass the grant token returned in the CreateGrant response to users.
Instruct users to use that grant token in their call to encrypt.
Reveal answer details
Close answer details
Correct answerD
ExplanationWhen creating a grant in AWS KMS, the operation returns a grant token that can be used immediately to make API calls with the newly created grant. Without using the grant token, there can be a delay before the grant is fully available for use, which can result in AccessDeniedException errors. By passing the grant token to users and instructing them to use it in their encrypt requests, they can use the grant immediately without waiting for full grant propagation, eliminating the error.
Question 99
Single choice
There is a set of Ec2 Instances in a private subnet. The application hosted on these EC2 Instances need to access a DynamoDB table. It needs to be ensured that traffic does not flow out to the internet. How can this be achieved?
-
A
Use a VPC endpoint to the DynamoDB table
-
B
Use a VPN connection from the VPC
-
C
Use a VPC gateway from the VPC
-
D
Use a VPC Peering connection to the DynamoDB table
Reveal answer details
Close answer details
Correct answerA
ExplanationThe following diagram from the IAM Documentation shows how you can access the DynamoDB service from within a V without going to the Internet.
This can be done with the help of a VPC endpoint  Option B is invalid because this is used for connection between an on-premise solution and IAM
Option C is invalid because there is no such option
Option D is invalid because this is used to connect 2 VPCs For more information on VPC endpointsfor DynamoDB, please visit the URL: The correct answer is: Use a VPC endpoint to the DynamoDB table Submit your Feedback/Queries to our Experts
Question 100
Multiple choice
A Web Administrator for the website example.com has created an Amazon CloudFront distribution for dev.example.com, with a requirement to configure HTTPS using a custom TLS certificate imported to IAM Certificate Manager. Which combination of steps is required to ensure availability of the certificate in the CloudFront console? (Choose two.)
-
A
Call UploadServerCertificate with /cloudfront/dev/ in the path parameter.
-
B
Import the certificate with a 4,096-bit RSA public key.
-
C
Ensure that the certificate, private key, and certificate chain are PKCS #12-encoded.
-
D
Import the certificate in the us-east-1 (N. Virginia) Region.
-
E
Ensure that the certificate, private key, and certificate chain are PEM-encoded.
Reveal answer details
Close answer details
|