AWS Security Specialty Exam Flashcards
Is AWS Config per region or globally enabled?
per region
How to determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it
use CloudTrail log file integrity validation
Sequence of log events from the same source/application
Log Streams
A collection of log streams with the same access control, monitoring and retention settings
Log Groups
Cloud Trail history length
90 DAYS
Maximum number of Trials in CloudTrial
5 per region
Default signed URL timeout
60 minutes
Can RTMP distribution use signed cookies?
No. Singed URLs only
Can Web distribution use both signed URL and signed cookies?
YES
Advantage of signed cookies over signed URLs?
Cookies can give access to an object type or are/folder and dont’ need a specifically formatted URL
Max number of CMK’s per region
1000 - in ANY state
Max number of KMS aliases
1100
S3 ACL use cases
- fine grained permissions on individual files/objects within S3
- bucket polices are limited to 20kb in size, consider using S3 ACL if bucket policy grows too large
Bucket policy max size
20kb
How to ensure the access to S3 is encrypted in transport?
S3 bucket policy with Condition aws:SecureTransport
Is S3 cross region replication secured?
yes - SSL by default
How many destinations can you set replicate S3 bucket?
only ONE
Does versioning has to be enabled when using cross region replication?
YES
Does cross region replication work Cross Accounts?
YES
How often AWS rotates KMS keys?
every 3 years
Automatic Key Rotation for Customer Managed Keys
Automatic rotation every 365 days (disabled by default)
Automatic Key Rotation for Customer Managed Keys, imported key material
No automatic rotation
Two ways of viewing EC2 SSH keys
- list /home/ec2-user/.ssh/authorized_keys
- curl http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
Can you have multiple key-pairs attached to the EC2 instance?
YES
Will deleting EC2 Key Pair in the console delete it from instance?
NO
How to recover EC2 from lost Key Pair?
Take snaphot of the EC2 instance and deploy it as new instance (with new key pairs).
Condition key which can allow or deny access to our CMK depending on which service originated the request
kms:ViaService
4 Main User Types in CloudHSM
- Precrypto Officer (PRECO)
- Crypto Officer (CO)
- Crypto Users (CU)
- Appliance User (AU)
A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS account.
Which 2 solutions will provide the Lambda function this access?
- Create an IAM role for the Lambda function. Attach an IAM policy that allows access to the S3 bucket
- Create an IAM role for the Lambda function. Attach a bucket policy to the S3 bucket to allow access. Specify the function’s IAM role as the principal
A security engineer is configuring a new website that is named example.com. The security engineer wants to secure communications with the website by requiring users to connect to example.com through HTTPS.
What is a valid option for storing SSL/TLS certificates?
Custom SSL certificate that is stored in AWS Certificate Manager (ACM)
A security engineer needs to develop a process to investigate and respond to potential security events on a company’s Amazon EC2 instances. All the EC2 instances are backed by Amazon Elastic Block Store (Amazon EBS). The company uses AWS Systems Manager to manage all the EC2 instances and has installed Systems Manager Agent (SSM Agent) on all the EC2 instances.
The process that the security engineer is developing must comply with AWS security best practices and must meet the following requirements:
A compromised EC2 instance’s volatile memory and non-volatile memory must be preserved for forensic purposes.
A compromised EC2 instance’s metadata must be updated with corresponding incident ticket information.
A compromised EC2 instance must remain online during the investigation but must be isolated to prevent the spread of malware.
Any investigative activity during the collection of volatile data must be captured as part of the process.
Which combination of steps should the security engineer take to meet these requirements with the LEAST operational overhead?
- Gather any relevant metadata for the compromised EC2 instance. Enable termination protection. Isolate the instance by updating the instance’s security groups to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
- Use Systems Manager Run Command to invoke scripts that collect volatile data
- Create a snapshot of the compromised EC2 instance’s EBS volume for follow-up investigations. Tag the instance with any relevant metadata and incident ticket information
A company has an organization in AWS Organizations. The company wants to use AWS CloudFormation StackSets in the organization to deploy various AWS design patterns into environments. These patterns consist of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, Amazon RDS databases, and Amazon Elastic Kubernetes Service (Amazon EKS) clusters or Amazon Elastic Container Service (Amazon ECS) clusters.
Currently, the company’s developers can create their own CloudFormation stacks to increase the overall speed of delivery. A centralized CI/CD pipeline in a shared services AWS account deploys each CloudFormation stack.
The company’s security team has already provided requirements for each service in accordance with internal standards. If there are any resources that do not comply with the internal standards, the security team must receive notification to take appropriate action. The security team must implement a notification solution that gives developers the ability to maintain the same overall delivery speed that they currently have.
Which solution will meet these requirements in the MOST operationally efficient way?
Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team’s email addresses to the SNS topic. Create custom rules in CloudFormation Guard for each resource configuration. In the CI/CD pipeline, before the build stage, configure a Docker image to run the cfn-guard command on the CloudFormation template. Configure the CI/CD pipeline to publish a notification to the SNS topic if any issues are found
The Security team believes that a former employee may have gained unauthorized access to AWS resources sometime in the past 3 months by using an identified access key.
What approach would enable the Security team to find out what the former employee may have done within AWS?
Use the AWS CloudTrail console to search for user activity.
A company is storing data in Amazon S3 Glacier. The security engineer implemented a new vault lock policy for 10TB of data and called initiate-vault-lock operation 12 hours ago. The audit team identified a typo in the policy that is allowing unintended access to the vault.
What is the MOST cost-effective way to correct this?
Call the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again.
A company wants to control access to its AWS resources by using identities and groups that are defined in its existing Microsoft Active Directory.
What must the company create in its AWS account to map permissions for AWS services to Active Directory user attributes?
AWS IAM roles
A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The Auditor is having trouble accessing some of the accounts.
What 3 options might be causing this problem?
- The external ID used by the Auditor is missing or incorrect
- The Auditor has not been granted sts:AssumeRole for the role in the destination account
- The role ARN used by the Auditor is missing or incorrect
Compliance requirements state that all communications between company on-premises hosts and EC2 instances be encrypted in transit. Hosts use custom proprietary protocols for their communication, and EC2 instances need to be fronted by a load balancer for increased availability.
Which solution will meet these requirements?
Route all traffic through a TCP listener on a Classic Load Balancer, and terminate the TLS connection on the EC2 instances.
An application is currently secured using network access control lists and security groups. Web servers are located in public subnets behind an Application Load Balancer (ALB); Application servers are located in private subnets.
How can edge security be enhanced to safeguard the Amazon EC2 instances against attack?
- Move the web servers to private subnets without public IP addresses.
- Configure AWS WAF to provide DDoS attack protection for the ALB
A Security Administrator is restricting the capabilities of company root user accounts. The company uses AWS Organizations and has enabled it for all feature sets, including consolidated billing. The top-level account is used for billing and administrative purposes, not for operational AWS resource purposes.
How can the Administrator restrict usage of member root user accounts across the organization?
Create an organizational unit (OU) in Organizations with a service control policy that controls usage of the root user. Add all operational accounts to the new OU.
A Systems Engineer has been tasked with configuring outbound mail through Simple Email Service (SES) and requires compliance with current TLS standards.
The mail application should be configured to connect to which endpoint and corresponding port?
email-smtp.us-east-1.amazonaws.com over port 587
A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises data center for compliance reasons. The database is sensitive to network latency. Additionally, the data that travels between the on-premises data center and AWS must have IPsec encryption.
Which combination of 2 AWS solutions will meet these requirements?
- AWS Site-to-Site VPN
- AWS Direct Connect
A company has an application that uses dozens of Amazon DynamoDB tables to store data. Auditors find that the tables do not comply with the company’s data protection policy.
The company’s retention policy states that all data must be backed up twice each month: once at midnight on the 15th day of the month and again at midnight on the 25th day of the month. The company must retain the backups for 3 months.
Which combination of 2 steps should a security engineer take to meet these requirements?
- Use AWS Backup to create a backup plan. Add a backup rule that includes a retention period of 3 months.
- Set the backup frequency by using a cron schedule expression. Assign each DynamoDB table to the backup plan.
A company needs a security engineer to implement a scalable solution for multi-account authentication and authorization. The solution should not introduce additional user-managed architectural components. Native AWS features should be used as much as possible. The security engineer has set up AWS Organizations with all features activated and AWS IAM Identity Center (AWS Single Sign-On) enabled.
Which additional steps should the security engineer take to complete the task?
Use an IAM Identity Center default directory to create users and groups for all employees that require access to AWS accounts. Assign groups to AWS accounts and link to permission sets in accordance with the employees’ job functions and access requirements. Instruct employees to access AWS accounts by using the IAM Identity Center user portal.
A company has deployed Amazon GuardDuty and now wants to implement automation for potential threats. The company has decided to start with RDP brute force attacks that come from Amazon EC2 instances in the company’s AWS environment. A security engineer needs to implement a solution that blocks the detected communication from a suspicious instance until investigation and potential remediation can occur.
Which solution will meet these requirements?
Enable AWS Security Hub to ingest GuardDuty findings and send the event to Amazon EventBridge. Deploy AWS Network Firewall. Process the event with an AWS Lambda function that adds a rule to a Network Firewall firewall policy to block traffic to and from the suspicious instance.
Company A has an AWS account that is named Account A. Company A recently acquired Company B, which has an AWS account that is named Account B. Company B stores its files in an Amazon S3 bucket. The administrators need to give a user from Account A full access to the S3 bucket in Account B.
After the administrators adjust the IAM permissions for the user in Account A to access the S3 bucket in Account B, the user still cannot access any files in the S3 bucket.
Which solution will resolve this issue?
In Account B, create a bucket policy to allow the user from Account A to access the S3 bucket in Account B.
A company wants to receive an email notification about critical findings in AWS Security Hub. The company does not have an existing architecture that supports this functionality.
Which solution will meet the requirement?
Create an Amazon EventBridge rule to detect critical Security Hub findings. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target of the EventBridge rule. Subscribe an email endpoint to the SNS topic to receive published messages.
An international company has established a new business entity in South Korea. The company also has established a new AWS account to contain the workload for the South Korean region. The company has set up the workload in the new account in the ap-northeast-2 Region. The workload consists of three Auto Scaling groups of Amazon EC2 instances. All workloads that operate in this Region must keep system logs and application logs for 7 years.
A security engineer must implement a solution to ensure that no logging data is lost for each instance during scaling activities. The solution also must keep the logs for only the required period of 7 years.
Which combination of 3 steps should the security engineer take to meet these requirements?
- Ensure that the Amazon CloudWatch agent is installed on all the EC2 instances that the Auto Scaling groups launch. Generate a CloudWatch agent configuration file to forward the required logs to Amazon CloudWatch Logs.
- Set the log retention for desired log groups to 7 years.
- Attach an IAM role to the launch configuration or launch template that the Auto Scaling groups use. Configure the role to provide the necessary permissions to forward logs to Amazon CloudWatch Logs.
What is a Field-level encryption
Field-level encryption allows you to enable your users to securely upload sensitive information to your web servers. The sensitive information provided by your users is encrypted at the edge, close to the user, and remains encrypted throughout your entire application stack. This encryption ensures that only applications that need the data—and have the credentials to decrypt it—are able to do so
A security engineer is designing an IAM policy to protect AWS API operations. The policy must enforce multi-factor authentication (MFA) for IAM users to access certain services in the AWS production account. Each session must remain valid for only 2 hours. The current version of the IAM policy is as follows
Which combination of 2 conditions must the security engineer add to the IAM policy to meet these requirements?
- “Bool”: {“aws:MultiFactorAuthPresent”: “true”}
- “NumericLessThan”: {“aws:MultiFactorAuthAge”: “7200”}
A company uses AWS Organizations and has production workloads across multiple AWS accounts. A security engineer needs to design a solution that will proactively monitor for suspicious behavior across all the accounts that contain production workloads.
The solution must automate remediation of incidents across the production accounts. The solution also must publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when a critical security finding is detected. In addition, the solution must send all security incident logs to a dedicated account.
Which solution will meet these requirements?
Activate Amazon GuardDuty in each production account. In a dedicated logging account, aggregate all GuardDuty logs from each production account. Remediate incidents by using Amazon EventBridge to invoke a custom AWS Lambda function from the GuardDuty findings. Configure the Lambda function to also publish notifications to the SNS topic.
A company is designing a multi-account structure for its development teams. The company is using AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On). The company must implement a solution so that the development teams can use only specific AWS Regions and so that each AWS account allows access to only specific AWS services.
Which solution will meet these requirements with the LEAST operational overhead?
Create SCPs that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed
A company is developing an ecommerce application. The application uses Amazon EC2 instances and an Amazon RDS MySQL database. For compliance reasons, data must be secured in transit and at rest. The company needs a solution that minimizes operational overhead and minimizes cost.
Which solution meets these requirements?
Use TLS certificates from AWS Certificate Manager (ACM) with an Application Load Balancer. Deploy self-signed certificates on the EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Enable encryption of the RDS DB instance. Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that support the EC2 instances
A company used a lift-and-shift approach to migrate from its on-premises data centers to the AWS Cloud. The company migrated on-premises VMs to Amazon EC2 instances. Now the company wants to replace some of components that are running on the EC2 instances with managed AWS services that provide similar functionality.
Initially, the company will transition from load balancer software that runs on EC2 instances to AWS Elastic Load Balancers. A security engineer must ensure that after this transition, all the load balancer logs are centralized and searchable for auditing. The security engineer must also ensure that metrics are generated to show which ciphers are in use.
Which solution will meet these requirements?
Create an Amazon S3 bucket. Configure the load balancers to send logs to the S3 bucket. Use Amazon Athena to search the logs that are in the S3 bucket. Create Athena queries for the required metrics. Publish the metrics to Amazon CloudWatch.
A company has a legacy application that runs on a single Amazon EC2 instance. A security audit shows that the application has been using an IAM access key within its code to access an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET1 in the same AWS account. This access key pair has the s3:GetObject permission to all objects in only this S3 bucket. The company takes the application offline because the application is not compliant with the company’s security policies for accessing other AWS resources from Amazon EC2.
A security engineer validates that AWS CloudTrail is turned on in all AWS Regions. CloudTrail is sending logs to an S3 bucket that is named DOC-EXAMPLE-BUCKET2. This S3 bucket is in the same AWS account as DOC-EXAMPLE-BUCKET1. However, CloudTrail has not been configured to send logs to Amazon CloudWatch Logs.
The company wants to know if any objects in DOC-EXAMPLE-BUCKET1 were accessed with the IAM access key in the past 60 days. If any objects were accessed, the company wants to know if any of the objects that are text files (.txt extension) contained personally identifiable information (PII).
Which combination of 2 steps should the security engineer take to gather this information?
- Use Amazon Athena to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for any API calls that used the access key to access an object that contained PII
- Configure Amazon Macie to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII and that were available to the access key.
A security engineer creates an Amazon S3 bucket policy that denies access to all users. A few days later, the security engineer adds an additional statement to the bucket policy to allow read-only access to one other employee. Even after updating the policy, the employee sill receives an access denied message.
What is the likely cause of this access denial?
The allow permission is being overridden by the deny.
Explicit deny statements cannot be overridden by allow statements
A company is using Amazon Macie, AWS Firewall Manager, Amazon Inspector, and AWS Shield Advanced in its AWS account. The company wants to receive alerts if a DDoS attack occurs against the account.
Which solution will meet this requirement?
Create an Amazon CloudWatch alarm that monitors Shield Advanced metrics for an active DDoS event
A company hosts a web application on an Apache web server. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The company configured the EC2 instances to send the Apache web server logs to an Amazon CloudWatch Logs group that the company has configured to expire after 1 year.
Recently, the company discovered in the Apache web server logs that a specific IP address is sending suspicious requests to the web application. A security engineer wants to analyze the past week of Apache web server logs to determine how many requests that the IP address sent and the corresponding URLs that the IP address requested.
What should the security engineer do to meet these requirements with the LEAST effort?
Use CloudWatch Logs Insights and a custom query syntax to analyze the CloudWatch logs for the specific IP address and the requested URLs.
A company developed an application by using AWS Lambda, Amazon S3, Amazon Simple Notification Service (Amazon SNS), and Amazon DynamoDB. An external application puts objects into the company’s S3 bucket and tags the objects with date and time. A Lambda function periodically pulls data from the company’s S3 bucket based on date and time tags and inserts specific values into a DynamoDB table for further processing.
The data includes personally identifiable information (PII). The company must remove data that is older than 30 days from the S3 bucket and the DynamoDB table.
Which solution will meet this requirement with the MOST operational efficiency?
Create an S3 Lifecycle policy to expire objects that are older than 30 days. Update the Lambda function to add the TTL attribute in the DynamoDB table. Enable TTL on the DynamoDB table to expire entries that are older than 30 days based on the TTL attribute
What are 2 the MOST secure ways to protect the AWS account root user of a recently opened AWS account?
- Do not create access keys for the AWS account root user; instead, create AWS IAM users
- Enable multi-factor authentication for the AWS account root user
A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store’s application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account. The company uses AWS Organizations and has an OU that is used only for these accounts.
The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company’s deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access. The security engineer already has created an AWS CloudFormation template that implements the deployment plan.
What should the security engineer do next to meet the requirements in the MOST secure way?
Create an AWS Service Catalog portfolio in the organization’s management account. Upload the CloudFormation template. Add the template to the portfolio’s product list. Share the portfolio with the OU
A company has launched a web application running on port 80 on Amazon EC2 instances. The instances have been launched in a private subnet. An Application Load Balancer (ALB) is configured in front of the instances with an HTTP listener.
The instances are assigned to a security group named WebAppSG and the ALB is assigned to a security group named ALB-SG. The security team requires that the security group rules are locked down according to best practice.
What 3 rules should be configured in the security groups?
- An inbound rule in WebAppSG allowing port 80 from source ALB-SG
- An inbound rule in ALB-SG allowing port 80 from source 0.0.0.0/0
- An outbound rule in ALB-SG allowing port 80 to WebAppSG
A security engineer created an Amazon S3 bucket and attached the following bucket policy.
What is the effect of this bucket policy?
The specified users are not denied S3 permissions but must be granted permissions through IAM user policies or ACLs
A multinational enterprise uses AWS Organizations to manage several AWS accounts spread across different regions. The company’s IT department centrally manages the creation of IAM roles. Recently, the company decided to delegate the IAM role creation to various regional teams to speed up the process and reduce the IT department’s workload. However, it is critical to prevent privilege escalation and ensure the scope of IAM roles remains within the defined limits.
Which solution will meet these requirements with the LEAST operational overhead?
Establish an SCP and a permissions boundary for IAM roles. Apply the SCP to the root OU so that only roles with the attached permissions boundary can create any new IAM roles
A solutions architect is designing a secure, distributed application that will run on Amazon EC2 instances across multiple Availability Zones and AWS Regions and on-premises servers. The has asked a security engineer how encryption will be applied between the EC2 instances and on-premises servers.
Which 2 statements are correct about encryption in transit?
- All inter-region traffic over the AWS global network is automatically encrypted
- All traffic between Availability Zones is encrypted by default
Due to compliance requirements, a company must rotate encryption keys every year. An AWS KMS key was created using imported key material. A security engineer needs a process to rotate the KMS key.
Which key rotation process is MOST efficient?
Create a new KMS key and update the existing Key Alias to point to the new KMS key
An application is being deployed on Amazon EC2 instances behind a Network Load Balancer (NLB). The EC2 instances are failing health checks and are not entering the InService state.
What could be the cause of this issue?
- The EC2 instance security group does not allow inbound traffic from the NLB IP addresses
- The network ACL associated with the instance subnets does not allow traffic from the NLB
A security team is concerned about a possible vulnerability affecting the instance metadata service. The team requires that all existing and new Amazon EC2 instances must use version 2 of the instance metadata service (IMDSV2).
Which combination of steps should the security team take to complete the migration to IMDSV2 in the AWS environment?
- When using the ec2:runinstances API action set the “–metadata-options HttpTokens” option to “required”
- Update existing instances using the “ec2 modify-instance-metadata-options” commands from the AWS CLI with the “HttpTokens required” option
You can access instance metadata from a running instance using one of the following methods:
Instance Metadata Service Version 1 (IMDSv1) – a request/response method
Instance Metadata Service Version 2 (IMDSv2) – a session-oriented method
By default, you can use either IMDSv1 or IMDSv2, or both. The instance metadata service distinguishes between IMDSv1 and IMDSv2 requests based on whether, for any given request, either the PUT or GET headers, which are unique to IMDSv2, are present in that request.
You can configure the instance metadata service on each instance such that local code or users must use IMDSv2. When you specify that IMDSv2 must be used, IMDSv1 no longer works.
IMDSv2 uses session-oriented requests. With session-oriented requests, you create a session token that defines the session duration, which can be a minimum of one second and a maximum of six hours.
A company is deploying Amazon EC2 instances into a new VPC. The instances must be scanned to detect any known software vulnerabilities. The instances should also be checked for compliance with CIS benchmarks.
Which solution addresses these requirements?
Use Amazon Inspector and run the “Common vulnerabilities and exposures” assessment and the “Center for Internet Security (CIS) Benchmarks” assessment
A company uses AWS Organizations and federation between and on-premises identity provider (IdP). Users authenticate to AWS using credentials in the IdP. A security engineer needs to audit requests to AWS Organizations for creating new AWS accounts.
What should the engineer review to determine who made the request?
AWS CloudTrail for the federated identity user name
A company has several microservices running on Amazon EC2 instances in multiple AWS accounts. Each microservice generates logs containing performance and utilization data. The company wants to centralize the logs in one account for further analysis and detection of unusual patterns. A solutions architect is assigned to ensure that logs from all the company’s AWS accounts are aggregated and ingested in real-time into a data processing system for anomaly detection.
Which solution will meet this requirement?
Set up CloudWatch Logs subscription filters in each account. Use the subscription filters to stream the logs to an Amazon Kinesis Data Firehose stream in the central account, which then forwards the logs to the data processing system
An administrative user accidentally exposed an access key ID and secret access key to a public support forum. The user notified the security team about the incident after removing the exposed credentials from the forum.
Which initial 2 steps should a security engineer take to mitigate the exposure without interrupting operations?
- Invalidate any temporary security credentials
- Delete the access key ID and secret access key
A developer recently left a company, and the company wants to ensure that any code the developer wrote cannot be deployed to AWS Lambda functions. The company uses AWS Signer for all Lambda functions.
Which solution will meet this requirement?
Revoke all versions of the signing profile assigned to the developer
An attack left several Amazon EC2 Windows instances unresponsive. A security engineer has been asked to collect any memory dumps that may exist on the EC2 instances attached Amazon EBS volumes.
How should the security collect memory dumps for forensic analysis?
Run the EC2Rescue CLI using the /offline mode and specify the device ID
A university is using AWS Organizations to manage several AWS accounts for different departments. Recently, there was an incident of misuse with one of the departmental accounts. To prevent any misuse or accidental changes, the university wants to limit the access level of the AWS root account across all member accounts.
Which solution will help meet this requirement?
Use Service Control Policies (SCPs) to limit root account permissions
Service Control Policies (SCPs) can limit the maximum permission level for all AWS accounts in an organization, including the root user. By implementing SCPs, the university can prevent the root user in any account from exceeding the permissions defined in the SCP.
A company uses AWS across multiple Regions. A security audit highlighted some issues that must be addressed. The company must track all configuration changes affecting AWS resources and have detailed records of who has accessed the AWS environment. The data should include information such as which user has logged in and which API calls they made
What actions should be taken to meet these requirements?
Use AWS Config to track configuration changes and AWS CloudTrail to record API calls and track access patterns in the AWS Cloud
Amazon S3 is used for storing sensitive data that is generated by a serverless application. The data must be encrypted, and the company plans to use the AWS Key Management Service (KMS) to create and manage the encryption keys. The company’s security policies require that the company’s own key material is imported, and custom expiration dates are configured.
How should the company configure AWS KMS?
Use the default key store and import the company’s keys into a customer managed KMS key
A security engineer has deployed a virtual security appliance inline. The virtual security appliance will be used to inspect traffic that is forwarded between subnets.
What configuration is necessary to allow the virtual security appliance to route the traffic?
Disable the Network Source/Destination check on the security appliance’s elastic network interface
A company has a multi-account setup in AWS Organizations with 50 member accounts. The company uses AWS Security Hub to aggregate security findings across all accounts, with one account acting as a Security Hub administrator. The company’s security operations team wants to receive real-time email alerts whenever there’s a high-priority AWS Inspector finding across any of the accounts.
Which solution will fulfill these requirements?
In the Security Hub administrator account, create an Amazon EventBridge rule to react to AWS Inspector findings with a high priority level. Configure the rule to target an Amazon SNS topic and subscribe the security operations team’s email addresses to the SNS topic
A company has a range of highly sensitive data stored in an Amazon S3 bucket in the eu-west-1 Region. Certain objects in this S3 bucket are protected with server-side encryption using AWS KMS keys (SSE-KMS). To enable disaster recovery, a security architect sets up an additional S3 bucket in the eu-central-1 Region within the same AWS account.
A customer-managed key is established in the eu-central-1 region to ensure the encryption at rest of objects in the backup S3 bucket. The replication configuration is configured to utilize this key for encryption in the destination bucket. An IAM role has been granted to the S3 replication configuration to execute replication actions.
However, after some time, the security architect notices that the encrypted objects from the source S3 bucket are not being replicated to the destination S3 bucket, while the unencrypted objects are replicated without issue.
What sequence of 3 steps should the security architect take to resolve this issue?
- Grant the IAM role the s3:GetObjectVersionForReplication permission for the objects in the source S3 bucket
- Give the IAM role the kms:Decrypt permission for the eu-west-1 key encrypting the source objects
- Assign the IAM role the kms:Encrypt permission for the key in the eu-central-1 region that encrypts objects in the destination S3 bucket
A security engineer must identify any Amazon EC2 instances that are running a vulnerable version of a common web framework. The security team need to quickly identify all compute resources running the specific version so they can install patches.
Which approach should the team take to accomplish this task?
Scan all the EC2 instances with AWS Systems Manager to identify the vulnerable version of the web framework
AWS Systems Manager Patch Manager can be used to scan systems and identify vulnerable versions of software and then install the patches on the systems. Patch Manager provides options to scan your instances and report compliance on a schedule, install available patches on a schedule, and patch or scan instances on demand whenever you need to.
A company is implementing an application that will use AWS KMS encryption keys. The company plans to create customer managed KMS keys within KMS and will not import any key material. The encryption keys should be rotated every 12 months.
Which solution will meet these requirements?
Enable the option to automatically rotate each KMS key every year
When you enable automatic key rotation for a customer managed key, AWS KMS generates new cryptographic material for the KMS key every year. You can enable or disable automatic key rotation for customer managed KMS keys at any time. You cannot modify the rotation configuration for AWS managed KMS keys which are automatically rotated every year.
Key rotation changes only the KMS key’s key material, which is the cryptographic material that is used in encryption operations. The KMS key is the same logical resource, regardless of whether or how many times its key material changes.
An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). Amazon CloudFront is used as the front-end of the application an AWS WAF is used to protect the front-end with the AWS Managed Rules rule group.
A security architect is concerned that the infrastructure is vulnerable to layer 7 DDoS attacks. What improvements can be made to the solution to protect against this type of attack?
Configure a rate-based rule on AWS WAF that puts a temporary block on requests from IP addresses that send excessive requests
A company is deploying a solution that includes an Application Load Balancer in front of many Amazon EC2 instances. A caching and distribution solution is required for the content. Customers will connect to the application using a custom domain name and subdomains and must be secured with TLS encryption.
Which combination of 2 actions will achieve the requirements?
- Create an Amazon CloudFront distribution, configure the alternate domain name and subdomains, and select a certificate from AWS Certificate Manager (ACM)
- Create a certificate in AWS Certificate Manager (ACM) and add the domain name and subdomains. Create Alias records for the distribution in Amazon Route 53
An application running in a private subnet needs outbound connectivity to an internet service using the IPv6 protocol. A security engineer has created a separate route table for the private subnet.
The security engineer needs to enable outbound connectivity to the internet service. The solution should ensure inbound connections from the internet cannot be initiated.
Which actions should the network engineer take to meet this requirement?
Create an egress-only internet gateway and update the route table in the private subnet
A company is deploying an application on Amazon EC2 instances with an Amazon RDS MySQL database. The application will store sensitive data and a security engineer has been tasked with recommending measures to protect the sensitive data against security breaches. The solution must minimize operational overhead and credentials must be regularly and automatically rotated.
Which measures should the security engineer suggest?
Implement encryption at rest for the Amazon EBS volumes attached to EC2 instances. Encrypt the RDS database and use a TLS secured connection. Store the database credentials in AWS Secrets Manager and configure automatic rotation
A DevOps engineer has deployed several custom-built images provided by the development team using Amazon Elastic Container Service (ECS) with the Fargate launch type. The engineer now needs to aggregate the logs from all the containers into a pre-existing CloudWatch log group.
Which solution will satisfy these requirements?
Enable the awslogs log driver by including awslogs-group and awslogs-region parameters in the LogConfiguration property
The Fargate launch type supports the awslogs log driver. You need to specify the awslogs-group (CloudWatch log group name) and awslogs-region (AWS Region of the log group) parameters in the LogConfiguration property in the task definition for Amazon ECS.
A healthcare organization is using Amazon EC2 instances to host an application that stores sensitive patient records. In compliance with healthcare regulations, the organization must restrict access to these records. A system engineer needs to establish a secure connection to the EC2 instances without opening any inbound ports, managing SSH keys, or maintaining bastion hosts.
The organization also requires that all session activity logs are monitored, stored, and accessible in an encrypted format.
Which solution would satisfy these requirements?
Use AWS Systems Manager Session Manager to access the EC2 instances. Set up Amazon CloudWatch Logs for session logging. Choose the option to upload session logs and ensure that only encrypted CloudWatch Logs log groups are allowed
A company is extending a secure development environment from an on-premises data center into AWS. They have secured the VPC by removing the Internet Gateway and configuring security groups and network ACLs. An AWS Direct Connect connection has been established between the data center and the Amazon VPC.
What else needs to be done to add encryption in transit?
Setup a Virtual Private Gateway (VGW)
A company has deployed an organization in AWS Organizations with several member accounts. The security team requires that there is at least on AWS CloudTrail trail configured for all existing accounts and any accounts that are created in the future. The logs should be sent to a single centralized Amazon S3 bucket and administrators in member accounts should not be able to modify the configuration.
Which actions should be taken to accomplish this?
Create an organization trail in the management account and specify a central S3 bucket
A financial services company has an organization in AWS organizations with several member accounts. Amazon S3 buckets are used to store sensitive data backups from common applications within each AWS account. The company needs to restrict users from deleting any S3 buckets or objects across the organization.
What is the MOST scalable solution that meets these requirements?
Service Control Policies (SCPs)
A financial firm receives a warning from the AWS Trust and Safety team about a potential security threat. An IAM access key linked to an IT administrator seems to have been compromised. This key is employed in an automated process that uses AWS Lambda functions to launch AWS Elastic Beanstalk environments.
The firm’s security engineer is tasked with addressing this security issue, preventing further use of the exposed access key, and bolstering security practices.
Which steps would be the most appropriate in this scenario?
Disable or delete the compromised IAM access key. Stop using static IAM access keys and instead, create a new IAM role for the Lambda automation process. Assign this role to the AWS Lambda functions. Respond to the AWS Trust and Safety team detailing the remediation actions
A developer who was recently fired by a company has a personal laptop that contains the SSH keys used to access multiple Amazon EC2 instances. The security team need to ensure the developer is unable to access the EC2 instances.
How can a security engineer protect the running EC2 instances?
Connect to each EC2 instance and replace the public key information in the authorized_keys file
A company has several AWS accounts that use a combination of the following identity provider:
· Users in AWS Identity and Access Management (IAM)
· Federated sign-in with Active Directory and IAM
· Users in Amazon Cognito user pools
The company security team requires that password policies are configured for all identity providers to require a minimum password length and password complexity.
Which 3 configuration settings should the company update?
- Configure a password policy in Active Directory for the federation scenario
- Configure an IAM password policy for the IAM user scenario
- Configure a password policy in the Amazon Cognito user pool
A company requires that all traffic to a specific application is captured and inspected for network and security anomalies. The application runs on several Amazon EC2 instances. The detection software has been installed on an intrusion detection instance running on EC2.
What should a security engineer do next to route traffic to the intrusion detection instance?
Configure VPC traffic mirroring to send traffic to the intrusion detection EC2 instance using a Network Load Balancer
A company is archiving sensitive data to Amazon S3 Glacier. A security engineer has created a new vault lock policy for 1 TB of data and called the initiate-vault-lock operation 8 hours ago. When reviewing the policy the security engineer noticed and error that should be corrected.
What is the MOST cost-effective method of correcting the error?
Call the AbortVaultLock operation. Update the policy. Call the initiate-vault-lock operation again
A company manages all access to Amazon S3 buckets using identity-based policies. A security engineer needs to receive an alert if any user adds a bucket policy to any Amazon S3 bucket.
Which approach meets the requirements MOST efficiently?
Create an Amazon EventBridge rule uses the “AWS API Call via CloudTrail” event source and the “s3:PutBucketPolicy” event pattern. Generate an alert using Amazon SNS
A company runs an application behind an Application Load Balancer (ALB). A security engineer has noticed many suspicious HTTP requests hitting the ALB. There is an Amazon CloudFront distribution in front of the ALB. Users are reporting performance problems.
A security engineer discovers that the website is receiving a high rate of unwanted requests to the CloudFront distribution originating from a series of source IP addresses.
How should the security engineer address this problem with the LEAST effort?
Create an AWS WAF rate-based rule to block this traffic when it exceeds a defined threshold
A company has four private subnets within a VPC. Two of the subnets are used for running database instances and the other two are used for application instances. Separate route tables are used for the database and application subnets. A NAT gateway is defined in the route tables to provide internet connectivity for the subnets.
The security team requires that the database subnets should not have internet access. A security engineer must remove internet connectivity for the database subnets without affecting the application subnets.
Which approach should the security engineer take?
Modify the route table of the database subnets to remove the default route to the NAT gateway
A new application requires an AWS KMS key for encrypting sensitive data. The security policy requires that separate keys are used for different AWS services.
How can the AWS KMS key be constrained to work with only Amazon S3?
Configure the key policy with a kms:ViaService condition key that limits use of the KMS key to the Amazon S3 service name
In response to an incident a security engineer locked down an Amazon S3 bucket with a policy that denies access to all users. Subsequently, the engineer attempted to grant access to a forensic analyst. After updating the bucket policy the forensic analyst still cannot access the bucket and is receiving access denied messages.
What is the most likely explanation for the denial?
An explicit deny will always override an explicit allow.
There is an explicit deny in the bucket policy that denies all users. Explicit denies will always override any explicit allow statements so the new update to the policy does not grant access to the forensic analyst
A developer is deploying a website hosted in an Amazon S3 bucket. An Amazon CloudFront distribution will be deployed in front of the S3 bucket to cache the content. The developer requires that users may only access the website using the CloudFront distribution and should not be able to access the website directly by using the S3 URL.
Which 2 configurations should a security engineer make to support these requirements?
- Create an origin access identity (OAI) and associate it with the CloudFront distribution
- Configure the S3 bucket permissions so that only the origin access identity can access the bucket contents
A company has multiple accounts that are managed using AWS Organizations. A security engineer must setup a shared S3 bucket in a central account and grant read-only access for all users in any account within the AWS Organization. There should be no public access to the S3 bucket data.
Which parameters should the security engineer use to accomplish this goal MOST efficiently?
Specify ‘*’ as the principal and aws:PrincipalOrgld as a condition.
You can use a condition key, aws:PrincipalOrgID, in policies to require all principals accessing the resource to be from an account (including the master account) in the organization. To set this up for this scenario you must specify ‘*’ as the principal, to allow any user access, and then restrict only to users within the AWS Organization using the condition key. The aws:PrincipalOrgId condition key should be used with the organization ID value specified.
A company requires data encryption for sensitive data. The security has requested that the solution must allow cryptographic erasure of all resources protected by the encryption key within 15 minutes.
Which AWS Key Management Service (AWS KMS) key solution will allow the security engineer to meet these requirements?
Use imported key material with an AWS KMS key
Cryptographic erasure is when the encryption material used to encrypt the data is deleted. This results in the data being unrecoverable as it cannot be decrypted. A security team may use this technique if the encryption keys used to encrypt data have been compromised. Of course, you would want to ensure that the key materials are backed up offline so you can perform a restore of the data.
In this case the only option available that will meet the requirements is to import key material into an AWS KMS key. You cannot immediately delete a KMS key; you must schedule it for deletion with a waiting period of a minimum of 7 days. With imported key material you can speed up the process by deleting the key material which renders the KMS key unusable. This effect is immediate.
A security team has requested that all existing and new Amazon RDS databases are encrypted at rest using AWS Key Management Service (KMS) encryption keys. A security engineer must identify which RDS databases are currently unencrypted and devise a plan for enabling encryption.
Which combination of 2 steps should the security engineer take to accomplish this?
- Create a snapshot of unencrypted databases. Copy the unencrypted snapshots to created encrypted snapshots. Restore the databases from the encrypted snapshots
- Use AWS Config to detect any existing and new unencrypted databases. Configure an Amazon SNS notification to alert the security team
A static website runs on an Amazon EC2 instance. The security engineer has been asked to suggest improvements to mitigate the risk of DDoS attacks.
Which 2 options assist with this goal?
- Migrate the static content to an Amazon S3 bucket and create an Amazon CloudFront distribution
- Use the AWS Web Application Firewall (WAF) service to inspect and manage web requests
A fintech company has an application that relies on AWS Systems Manager Parameter Store for managing secure string parameters. This is done using the standard tier and an AWS Key Management Service (AWS KMS) custom-managed key for encryption and decryption.
Upon attempting to modify a parameter, the team has been encountering a series of error messages.
What might be the causes of these error messages?
- The application lacks the kms:Encrypt permission for the custom-managed key
- The state of the customer-managed key specified within the application is set to ‘Disabled’
A security engineer is attempting to setup automatic notifications that alert administrators about any changes that are made to an Amazon S3 bucket. The engineer has configured AWS Config and created an SNS topic. Changes have been made to the S3 bucket, but the SNS notifications have not been sent.
Which combination of 3 steps should the security engineer take to resolve the issue?
- Configure the trust policy on the IAM role AWS Config uses to allow “config.amazonaws.com” to assume the role
- Configure the role policy on the IAM role AWS Config uses to allow write access to the Amazon S3 bucket
- Configure the access policy for the Amazon SNS topic to allow “sns:publish” access to “config.amazonaws.com
A company has thousands of employees that use a single Microsoft Active Directory on-premises identity provider. The company is deploying several dozen AWS accounts and needs to provide its employees with access to the AWS accounts. The solution should maximize scalability and operational efficiency.
Which solution meets these requirements?
Create a landing zone using AWS Control Tower. Integrate AWS Single Sign-On (SSO) with the company’s existing identity provider. Grant Active Directory users access to accounts and applications
A bespoke application consisting of three tiers is being deployed in a VPC. You need to create three security groups. You have configured the WebSG (web server) security group and now need to configure the AppSG (application tier) and DBSG (database tier). The application runs on port 1030 and the database runs on 3306.
Which rules should be created according to security best practice?
- On the DBSG security group, create a custom TCP rule for TCP 3306 and configure the AppSG security group as the source
- On the AppSG security group, create a custom TCP rule for TCP 1030 and configure the WebSG security group as the source
A financial institution uses Amazon API Gateway to provide REST APIs for their mobile application. A data analyst wants to study the usage patterns of the APIs without having to sift through log files.
Which pair of actions will fulfill these requirements with minimal effort?
- Enable access logging for the appropriate API stage
- Use Amazon CloudWatch Logs Insights for analyzing API usage data
A FinTech company wants to shield its online banking portal from man-in-the-middle attacks, and it’s using Amazon CloudFront for content delivery.
What would be the most effective method to accomplish this goal with minimal administrative intervention?
Use the SecurityHeadersPolicy managed response headers policy
A company has a critical web application running on a fleet of auto scaling Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is associated with an AWS WAF web ACL. The security team has identified suspicious port scans coming from a specific range of internet IP addresses. A security engineer needs to block access from the identified addresses.
Which solution meets these requirements?
Modify the web ACL with an IP set match rule statement and a block action to deny incoming requests from the IP address range
A financial institution employs an on-premises hardware security module (HSM) to generate and administer its encryption keys, according to its stringent security policies. Their transaction processing application uses Amazon RDS to store data, and all data must be encrypted at rest.
A security specialist has generated an encryption key using the on-premises HSM.
What should the security specialist do next to adhere to these requirements?
Create a new customer-managed key in AWS KMS and import the new key material. Provide Amazon RDS permissions to use the key. Create a new RDS instance and choose the new key as the encryption key. Migrate the data into RDS
A security engineer received a notification that an administrative user account may have been compromised. The engineer wants to immediately rotate the access key for the user whilst ensuring that applications that use the access key are not affected.
What is the BEST approach in this situation?
Create a second access key and modify applications to use the new key. Disable the old access key and check applications are working correctly before deleting the old access key
A company requires that only trusted code can be deployed to AWS Lambda functions. A method of validating the integrity of the code should be implemented and developers should not be able to bypass the solution.
Which combination of 2 steps should a security engineer take to meet these requirements?
- Use AWS Signer to verify code integrity when code packages are deployed to Lambda
- Use IAM policies to enforce that developers can only create functions that have code signing enabled
A company is using AWS CloudTrail is being used to monitor API calls. An audit revealed that CloudTrail is failing to deliver events to Amazon S3 as expected. A security engineer is attempting to resolve the issue. What initial actions should be taken to allow delivery of CloudTrail events to S3?
- Verify that the S3 bucket policy grants CloudTrail the s3:PutObject permission
- Verify that the S3 bucket and prefix defined in CloudTrail exists
A security engineer has been asked to review an Amazon S3 bucket policy to determine if the data is properly secured against public access. The policy statement is as follows:
What should the response be from the security engineer?
Is this bucket policy sufficient to ensure that the data is not publicly accessible?
The S3 bucket ACL and object ACLs will need to be checked to determine if public access is possible
A security engineer is troubleshooting a connectivity issue with an Amazon EC2 Linux instance. The engineer is trying to connect from the internet, but the connection attempt times out. Other instances in the VPC are contactable over the internet.
Which 3 option might cause this issue?
- The route table of the subnet is missing a route to the internet gateway
- The network ACL denies outbound traffic on ephemeral ports
- The host-based firewall of the instance operating system is denying traffic
A developer who recently left a company was found to have published many access keys IDs to a public source code repository. A list of the exposed access key IDs has been created. A security engineer needs to quickly identify which users the access key IDs belong to so the credentials can be immediately rotated. The company uses multiple accounts in an AWS Organization.
Which approach should the security engineer take?
Generate a credential report in each account in the Organization. Consolidate the reports and identify the users the access key IDs belong to. Rotate the access key IDs
An e-commerce company receives an AWS Abuse notification stating that an IAM user’s access key, used by an inventory management system, may have been compromised. The security manager needs to address the potential security breach while ensuring minimal service interruption to the inventory system.
What would be the optimal strategy to address this situation?
Generate a new access key for the IAM user. Update the inventory management system to utilize the new access key. Subsequently, deactivate the compromised access key
new employee is joining a security team. The employee initially requires access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. All security team members are added to the security team IAM group that provides additional permissions to manage all other AWS services.
The team lead wants to limit the permissions the new employee has access to until the employee takes on additional responsibilities, and then be able to easily add permissions as required, eventually providing the same access as all other security team employees.
How can the team lead limit the permissions assigned to the new user account whilst minimizing complexity?
Create an IAM account for the new employee and add the account to the security team IAM group. Set a permissions boundary that grants access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add the additional services to the permissions boundary IAM policy
A security engineer needs to automate SSH key pair management for many Amazon EC2 instances. The security engineer must create a solution that automatically stores and rotates SSH key pairs that are more than 90 days old. There must also be an audit trail of the rotation recorded in an Amazon S3 bucket.
Which solution that meets these requirements?
Use AWS Secrets Manager to store the SSH key pairs. Create an AWS Lambda function that rotates the SSH keys every 90 days. Create an AWS CloudTrail trail that logs to an S3 bucket
A website runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) which serves as an origin for an Amazon CloudFront distribution. An AWS WAF is being used to protect against SQL injection attacks. A review of security logs revealed an external malicious IP that needs to be blocked from accessing the website.
What steps should be taken to protect the application?
Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address
A multinational corporation has a diversified range of services deployed on Amazon EC2 instances. The company has AWS Systems Manager Agent (SSM Agent) installed on their EC2 instances and utilizes AWS Security Hub for consolidating their security alerts and findings.
The company uses AWS Organizations with numerous managed AWS accounts. They wish to regularly monitor their workloads for potential software vulnerabilities and unexpected network exposure.
The company seeks a solution that will seamlessly deploy across all member accounts, including any future accounts, and will automatically scan new workloads as they become operational.
What solution would fulfill these requirements?
Designate a delegated administrator for Amazon Inspector for the entire organization. Set up automatic scanning for all existing and new member accounts
A healthcare institution has developed a cloud-based application that collects and stores confidential patient records in an Amazon DynamoDB table. They need to adopt a solution that ensures end-to-end data protection and the ability to identify any unauthorized changes to the data.
What solution would cater to these needs?
Use the DynamoDB Encryption Client for client-side encryption and to digitally sign the table items
A security team are designing a plan to respond to incidents of compromised Amazon EC2 instances. The incident response plan should include the automated provisioning of a secure forensic environment and orchestration of incident response processes.
Which AWS services should be included in the plan?
- AWS CloudFormation
- AWS Step Functions
An application running on Amazon EC2 instances reads secrets stored in AWS Systems Manager Parameter Store. The application issued GetParameter API calls for secure string parameters and the calls failed.
Which 2 factors could be the cause of this failure?
- The IAM role assigned to the EC2 instance profile does not have decrypt permissions on the AWS KMS key used to encrypt the parameter
- The IAM role assigned to the EC2 instance profile does not have permissions to retrieve parameters in Systems Manager Parameter Store
A company is experiencing a layer 3 and layer 4 DDoS attack on its web servers running on AWS.
Which combination of 3 AWS services and features will provide protection in this scenario?
- Amazon Route 53
- AWS Shield
- Elastic Load Balancer
A security engineer requires a solution for allowing employees to connect to a command line interface on Amazon EC2 Linux instances without using SSH keys or ports.
Which solutions meets these requirements?
Use AWS Systems Manager Session Manager. Grant the IAM user accounts permissions to use Systems Manager Session Manager
An application runs on Amazon EC2 instances that use an Amazon SQS queue and an Amazon DynamoDB table. The application processes highly confidential information and the connectivity between these AWS services should be private.
Which combination of steps should the security engineer take to meet this requirement?
- Create an interface VPC endpoint for Amazon SQS
- Create a gateway VPC endpoint for Amazon DynamoDB
- Modify the endpoint policies on all VPC endpoints. Specify the SQS and DynamoDB resources that the application uses
An Amazon EC2 instance requires permissions to read and write data in an Amazon S3 bucket. A security engineer is creating an IAM role that will be assumed by the EC2 instance.
When creating the role using the AWS CLI create-role command, which policy must be added to allow the instance to assume the role?
Trust policy
A company has a serverless application that is accessed by internal users. The application consists of an AWS Lambda function that accesses an Amazon DynamoDB table. The security team are concerned that the Lambda function has internet access and the endpoints for Lambda and DynamoDB are both public.
How can a security engineer improve the security of the application?
- Configure the Lambda function to connect to private subnets in an Amazon VPC
- Configure a VPC endpoint for accessing the DynamoDB table using private addresses
A security engineer is tasked with securing the network access for an application that uses an AWS Lambda function and an Amazon RDS database. The Lambda function and database both run in the same AWS account.
Which network configuration is the MOST secure?
Connect the Lambda function to a private subnet within the VPC. Attach a security group to the function that allows outbound access to the VPC CIDR block only. Update the DB instance security group to allow traffic from the Lambda security group
security engineer must implement a solution to allow the company’s SysOps team to have interactive command line access to Amazon EC2 Linux instances using the AWS Management Console. The solution should minimize the attack surface of the EC2 instances.
Which 2 steps should the security engineer take to satisfy this requirement while maintaining least privilege?
- Install the Systems Manager SSM Agent on the EC2 Linux instances and attach an IAM role that grants permissions
- Create an IAM user policy for Session Manager access granting the SysOps team access to the EC2 Linux instances
An operations engineer plans to launch a collection of Amazon EC2 instances. The instances will run a custom application which will be managed by operations users who are members of a group. The operations users should be granted access only to the custom application instances.
Which actions should a security engineer take to control access?
- Add specific tags to the Amazon EC2 instances
- Attach an IAM policy to the operations users that grants access to the instances with the specific tag using the Condition element
A company has configured federation between an on-premises identity provider (IdP) and AWS. Developers authenticate into an identity account and assume an IAM role named IdPUsersRole. The developers then access a production account by assuming a role named ProdDevRole in the production account.
Developers are unable to assume the IAM role in the production account. The policy attached to the role in the identity account is:
What needs to be done to enable the developers to assume the appropriate role in the production account?
Update the trust policy on the role in the production account to allow the “sts: AssumeRole” API action for the IdPUsersRole principal in the identity account
A fintech company offers a web application that stores files on Amazon S3 and processes transactions on Amazon EC2. Users are complaining about slow response times, and recent cybersecurity audits have raised concerns about web content security.
The company needs to accelerate content delivery while enhancing security and privacy, without altering the application code.
What combination of 2 actions should the company undertake to meet these requirements?
- Configure Amazon CloudFront and set up a distribution for the S3 and EC2 origins to accelerate content delivery
- Use an AWS Lambda function configured with CloudFront (Lambda@Edge) to add HTTP security headers on origin responses
A company has created an organization within AWS Organizations that has all features enabled. Several resource accounts have been added to the organization. The security team requires that the privileges of root user accounts within the member accounts are restricted.
How can the security administrator restrict usage of member root user accounts across the organization?
Create an OU in AWS Organizations and add all the member accounts. Attach an SCP that controls the permissions available for the root user
A streaming media company is using an Application Load Balancer (ALB) to manage the traffic of its on-demand video service. Recently, they deployed Amazon CloudFront to accelerate content delivery. Despite this, the company noticed that some requests are still bypassing CloudFront and reaching the ALB directly.
The company needs to ensure that its Amazon EC2 instances, which are behind the ALB, only process traffic coming from CloudFront.
Which combination of 2 steps should the company undertake to fulfill these requirements?
- Configure CloudFront to add a custom HTTP header to requests that CloudFront sends to the ALB
- Configure the ALB to deny requests that do not contain the custom HTTP header
A company uses Microsoft Active Directory (AD) for access management for on-premises resources. They wish to use the same Microsoft AD for authenticating to AWS including accessing the AWS Management Console. All identity data must remain on-premises
Which solution meets these requirements?
Set up federated sign-in to AWS through ADFS and SAML
A company needs a solution for running analytics on the log files generated by hundreds of applications running on Amazon EC2. The solution must offer real-time analytics, support the replay of messages, and store the logs persistently.
Which AWS services can be used to meet these requirements?
- Amazon Kinesis
- Amazon OpenSearch
A company has created an organization in AWS Organizations. The company has several accounts and OUs and uses the default FullAWSAccess SCP. A security engineer needs to ensure that no one in member accounts can disable specific AWS services. The security engineer must ensure that permissions granted by IAM policies defined in member accounts are not overridden.
What will be the effect of adding the following SCP to the root of the organization?
All users in member accounts will not be able to disable AWS SecurityHub or delete or modify the Amazon GuardDuty configuration. IAM policies defined in member accounts will not be overridden
A company has two AWS accounts: A production account and a development account. Developers with user accounts in the production account need to be able to access artifacts stored in an Amazon S3 bucket in the development account when deploying resources.
A cross-account role has been created in the development account with access to the S3 bucket. The security team requires that the users can assume the role only if they are authenticated with multi-factor authentication (MFA).
Which step should the security engineer take to meet these requirements?
Add an aws:MultiFactorAuthPresent : true condition to the role’s trust policy
An online fitness platform based in Germany uses Amazon Cognito with the Cognito Hosted UI to manage user registrations and sign-ins. Recently, the platform’s security team has noticed an unusual number of fraudulent sign-ups originating from outside Germany.
The security team wants to implement a mechanism that can add a layer of custom validation during the registration process that checks the location of the customer. The mechanism should be able to accept or reject user registration requests based on the outcome of the validation process.
Which solution should the security team implement to fulfill these requirements?
Configure a Pre Sign-Up AWS Lambda trigger and associate it with the Amazon Cognito user pool to execute custom validation during sign-up
AWS Lambda triggers for Amazon Cognito can add custom validation to user pool workflows. A Pre sign-up Lambda trigger can perform custom validation during sign-up, such as checking the geographical origin of the registration request.
A security engineer needs to access log files generated by AWS CloudTrail. The trail stores log files in an Amazon S3 bucket that is encrypted with AWS KMS managed keys (SSE-KMS). The logs should be accessed by assuming an IAM role. When attempting to access the log files the security engineer experienced an access denied error.
What is the MOST likely cause of this issue?
The KMS key policy does not grant the IAM role permissions to use the key for decryption
An application runs on Amazon EC2 instances. Two instances were launched and each instance runs in a separate Availability Zone within an Amazon VPC. Each instance must communicate with the Elastic IP address of the other instance. The instances can connect using private IP addresses and can access external internet addresses. However, they are unable to communicate with each other using public IP addresses.
How can this issue be resolved?
Add the Elastic IP addresses to the ingress rules of the instance security groups
A business is developing a cloud-native application on AWS and has selected AWS CodeBuild for automating the process of building, testing, and packaging their software code. To meet their security requirements, the company needs to ensure that all CodeBuild API operations executed within the VPC do not traverse the public internet.
What should a security engineer do to meet this requirement?
Deploy an interface VPC endpoint for CodeBuild API operations
A security engineer is attempts to encrypt a secure string parameter value in AWS Systems Manager Parameter Store with an AWS KMS key and receives an InvalidKeyId error message.
Why was this error message generated?
The KMS key specified is not enabled
A security vulnerability has been discovered that could lead to sensitive data being leaked on TCP port 5601. The development team is working on updating the code, but it could take several days. A security engineer must identify any hosts attempting to send data over port 5601 and prevent the traffic leaving the network.
How can the security engineer accomplish this goal?
Capture IP traffic using VPC Flow Logs and create a metric filter with an alarm that notifies the security team if connection attempts are made. Then, update NACLs to block the traffic
Temporary security credentials that were issued by the AWS Security Token Service (STS) may have been compromised. A security engineer needs to immediately revoke the credentials so they cannot be used with any AWS service.
Which action should the security engineer take?
Use the AWS management console to revoke active sessions for the IAM role
We can determine that the credentials were issued to a role rather than a user as users will use access keys rather than obtaining the credentials from AWS STS. When a role needs permissions to access an AWS service it must call the AWS STS service to obtain temporary security credentials.
A security engineer was reviewing AWS KMS key policies and found this statement in several key policies within the AWS account.
Enables IAM policies in the 554422336677 account to allow access to the key
By default, a policy statement like this one in this question is present in the key policy document when you create a new KMS key with the AWS Management Console. It is also present when you create a new KMS key programmatically but do not provide a key policy
A security engineer is building an application that is running on Amazon EC2. The application communicates with an Amazon RDS MySQL instance and authenticates with a user name and password. The credentials should be encrypted and rotated every 60 days.
Which steps should the engineer take to protect the credentials and ensure they can be automatically rotated?
Store the credentials in AWS Secrets Manager and choose an AWS KMS key. Enable automatic rotation every 60 days and configure the application to retrieve the secret programmatically
A multinational corporation uses Amazon S3 for storing various types of files across a multitude of S3 buckets, each of which contains an extensive number of objects. The company’s security team is keen on analyzing object access patterns, such as pinpointing the top 50 most accessed objects, the 20 largest downloaded files, and the objects with the lengthiest download time.
The team intends to display this information in an intuitive, interactive dashboard, utilizing SQL queries for efficient analysis.
Which combination of AWS services should a security engineer use to fulfill these requirements?
- Enable Amazon S3 server access logging to monitor and record detailed logs of the requests made to the S3 buckets
- Use Amazon Athena to perform SQL queries on the server access logs in S3 and employ Amazon QuickSight for visualizing the analyzed data in an interactive dashboard
A company has as an AWS Organization for developers. The organization includes several accounts and SCPs are used to control access to AWS services. A single SCP exists at the root of the organization and has the following policy statements:
A group of developers are working on a project that requires an Amazon RDS database. These developers use an account that is in a child OU with an SCP attached that allows all Amazon RDS API actions. The developers have full IAM permissions for RDS but are unable to launch RDS database instances.
Which change must a security engineer implement so that the developers can access Amazon RDS?
Remove the deny statement for Amazon RDS from the root SCP
A security engineer was asked to configure an automated alert that notifies the security team when configuration changes occur on security groups. The engineer has created an AWS CloudTrail trail, specified a log group, and assigned appropriate IAM permissions to CloudTrail. The solution must be simple and cost-effective.
Which additional 2 actions should the security engineer take?
- Create a metric filter and define a metric pattern that matches security group changes
- Create an alarm that sends an Amazon SNS notification if security group changes are identified
A security engineer is working with the development team to design an application that encrypts data using an AWS KMS key. Various users with accounts in AWS IAM will need to be provided with temporary access to decrypt data using the KMS key.
What is the MOST efficient way to manage access control for the KMS key?
Use KMS grants. Programmatically create and revoke grants to manage access
A company has several AWS Lambda functions. While reviewing the Lambda functions a security engineer discovers that sensitive information is being stored in environment variables and is viewable as plaintext in the Lambda console. The values of the sensitive information are 8 KB in size and there are over 10,000 values stored across the functions.
What is the MOST cost-effective way to address this security issue?
Store the environment variables in AWS Secrets Manager and access them at runtime. Use IAM permissions to restrict access to the secrets to only the Lambda functions that require access
AWS Secrets Manager is well suited to this use case. Secrets can be stored with values up to 10KB in size and the maximum number of secrets within a Region is 500,000.
A company is deploying a web application that runs in an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB will be configured to terminate a TLS connection from clients. Security requirements mandate that all TLS traffic to the ALB must remain secure even if the certificate private key is compromised.
How can a security engineer meet this requirement?
Create an HTTPS listener that uses a predefined security policy that supports forward secrecy (FS)
A company has on on-premises corporate identity provider (IdP) with thousands of corporate users. The company needs to allow the users to access a set of AWS services from the corporate network. The security engineer has been instructed that the company would prefer to avoid having multiple sets of identities and credentials to manage for each user.
Which actions will meet the requirements?
Enable federated access between the corporate IdP and the AWS account using IAM. Use IAM roles to provide access to AWS resources
A company has a group of Amazon EC2 instances in a private subnet that does not have a NAT gateway attached. A security engineer needs to capture logs from an application and collect the log files in Amazon CloudWatch Logs.
Which 2 steps should the security engineer take to securely meet the requirements?
Create an interface VPC endpoint for CloudWatch Logs. Configure the endpoint policy to allow the EC2 instances to use the endpoint
A company runs a hybrid cloud with on-premises network that is connected to AWS using an AWS Direct Connect connection. The company also has an internet connection with significant bandwidth available. An application that runs on-premises needs to stream data to Amazon Kinesis Data Streams. The company’s security policy requires that data be encrypted in transit using a private network.
How should the company meet these requirements?
Create an interface VPC endpoint for Kinesis Data Streams. Configure the application to connect to the VPC endpoint
Kinesis Data Streams uses TLS for all connections, so the data is encrypted in transit by default
A security engineer is deploying an application that will read and write data to an Amazon S3 bucket. The application data must be encrypted both in transit and at rest.
Which of the following actions should the security engineer take to enforce the encryption requirements?
- Add a condition to the S3 bucket policy that allows actions if the request meets the condition “aws:SecureTransport”: “true”
- Configure default encryption for the S3 bucket. Add a condition to the S3 bucket policy that denies PUT requests that don’t include the “x-amz-server-side-encryption” header
A security engineer needs to secure an Amazon S3 bucket that will be used by many internal users who have AWS accounts. The security engineer enabled default encryption on the S3 bucket and needs to limit access to user-specific folders. Each user should only be able to access their own folder.
What should the security engineer configure?
Update the relevant IAM policy to grant access to the resource “arn:aws:s3:::examplebucket/${aws:username}/*
An AWS Lambda function has started to cause errors in an application and a security engineer must check the output of the function. The engineer checked Amazon CloudWatch Logs but could not find any log files for the Lambda function.
What is the best explanation for why the logs are not available?
The Lambda function execution role does not have permissions to write to CloudWatch Logs
A company’s security team wants to use Amazon Detective to generate visualizations that help with security investigations. The company has enabled AWS CloudTrail and VPC Flow Logs. The security team cannot enable Detective.
Which steps should be taken to enable Amazon Detective?
Enable Amazon GuardDuty. After 48 hours, enable Amazon Detective
When you try to enable Detective, Detective checks whether GuardDuty has been enabled for your account for at least 48 hours. If you are not a GuardDuty customer or have been a GuardDuty customer for less than 48 hours, you cannot enable Detective. You must either enable GuardDuty or wait for 48 hours. This allows GuardDuty to assess the data volume that your account produces.
A security engineer has created an AWS Lambda function that checks AWS CloudTrail logs in an Amazon S3 bucket for security related issues. The Lambda function should record results in Amazon CloudWatch Logs. The security engineer has sufficient permissions to execute the function. Upon testing the function the execution fails.
The Lambda function execution role has the following permissions:
What is the most likely cause of the issue?
The Lambda function does not have permissions to access the S3 bucket
A company must ensure that AWS CloudTrail is recording API activity across all AWS Regions within their account. An automated solution is required to check that CloudTrail is enabled and to turn it back on if it has been turned off.
What is the MOST efficient way to implement this solution?
Use AWS Config with the managed rule cloudtrail-enabled to check that CloudTrail is enabled. If the rule is NON_COMPLIANT use Systems Manager Automation to automatically remediate the issue”
A company runs many Amazon EC2 Linux instances. Communications between the instances are complex and rules governing ingress, egress, and inter-instance communications are beyond the limits of security groups and network ACLs.
What mechanism will allow the company to implement all required network rules without incurring additional cost?
Configure the host-based firewall within the operating system
A company plans to migrate some confidential data to Amazon S3. A security engineer must ensure that the data is encrypted at rest. The encryption solution must enable the company to generate its own keys without needing to manage key storage or the encryption process.
What should the security engineer use to accomplish this?
Server-side encryption with AWS KMS-managed keys (SSE-KMS)
A company is deploying a solution that will allow users to encrypt Amazon S3 objects seamlessly. The solution must be cost effective, highly scalable, and use a managed service. The company must also be able to immediately delete the encryption keys if necessary.
Which solution is suitable and will allow immediate deletion of encryption keys?
Use AWS KMS with AWS imported key material and then use the DeletelmportedKeyMaterial API to remove the key material
A company’s security engineer receives an abuse notification from AWS. The notification indicates that malware is being hosted in the AWS account. The security engineer investigated the issue and found an unauthorized Amazon S3 bucket.
Which combination of 3 steps should the security engineer take to MINIMIZE the consequences of this compromise?
- Rotate and delete all root and IAM access keys
- Delete any unauthorized IAM users
- Delete any unauthorized resources
A new application runs on Amazon EC2 instances behind an Application Load Balancer. Some of the company’s other applications have recently seen attacks with high rates of requests from single IP addresses. A security engineer wants to ensure the new application is protected from such attacks.
How can the security engineer add protection to the application without permanently blocking the IP address?
Use AWS WAF to create a rate-based rule
A company is building an application that uses Amazon EC2 instances and an Amazon RDS database. The solution must be highly secure, and encryption will be implemented within the application and database using an AWS KMS customer managed KMS key. The security team wants to prevent any other services from using the KMS key.
Which solution will meet these requirements?
Create a custom key policy for the KMS key. Use the kms:ViaService condition key to allow the KMS key to be used only when the request comes from Amazon EC2 or Amazon RDS
The kms:ViaService condition key limits use of an AWS KMS key to requests from specified AWS services. You can specify one or more services in each kms:ViaService condition key
An organization has a SAML 2.0-compliant corporate identity provider (IdP) that is federated with AWS IAM. Users from the corporate IdP can use the AWS management console. A security engineer has been asked to identify which federated user terminated an Amazon EC2 instance a few days ago.
What is the FASTEST method of identifying the federated user who terminated the instance?
Search CloudTrail event logs for the TerminateInstances event and identify the assumed IAM role ARN. Then, search CloudTrail event logs for the AssumeRoleWithSAML event that includes the role ARN and note the federated username
A company is implementing a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company requires that all traffic must be over HTTPS and any connections made to the HTTP port should be redirected to HTTPS.
Which solution meets these requirements?
Add an HTTP listener with a rule that redirects HTTP requests to HTTPS. Add an HTTPS listener and choose an AWS Certificate Manager (ACM) certificate
A retail company is using Amazon S3 to store its sales data that is encrypted with an AWS Key Management Service (AWS KMS) customer-managed key. The company uses several AWS Lambda functions, each needing to access the sales data in the S3 bucket independently.
A security engineer needs to ensure that each Lambda function has individual and restricted access permissions to the KMS key.
Which solution should the security engineer implement to fulfill this requirement?
Assign a distinct Lambda execution role with specific KMS key access permissions to each Lambda function
A software development firm operates a multi-account AWS environment managed by AWS Organizations and AWS IAM Identity Center. The firm needs to ensure that each development team can operate only within assigned AWS Regions and specific AWS services. The solution should aim to minimize management overhead.
Which solution will best meet these requirements?
Utilize Service Control Policies (SCPs) in AWS Organizations to limit each team’s access to only their assigned Regions and services
Several AWS accounts belonging to different business units are used for development purposes. An additional account is used by the security team. To ensure security best practices are being followed, the security team requires access to review the configuration of the Amazon EC2 instances in the development accounts.
Which solution will meet these requirements in the MOST secure manner?
Create an IAM policy in each development account that has read-only access to Amazon EC2 resources. Assign the policy to a cross-account IAM role. Ask the security team members to assume the role from their account
An application runs on a fleet of Amazon EC2 instances in a private subnet. The EC2 instances read and write data to an Amazon S3 bucket. The data is highly confidential and a private and secure connection is required between the EC2 instances and the S3 bucket.
Which solution meets these requirements?
Set up S3 bucket policies to allow access from a VPC endpoint
A fintech company operates a suite of applications on Amazon EC2. The applications have intricate security needs, governed by a set of security groups. After an unintended modification in a security group disrupted the connectivity of some applications, the company wants to be alerted via a designated email whenever changes are made to these security groups.
Which solution can fulfill this requirement most efficiently?
Use AWS CloudTrail. Enable forwarding to Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter to match patterns indicating security group changes. Configure a CloudWatch alarm to send alerts to an Amazon SNS topic
An online gaming company has a network of Amazon EC2 instances that are frequently targeted by rogue bots. The security team needs to implement an automated system to block traffic from identified malicious sources. The system needs to respond in near real-time and the security team decided to use AWS Step Functions to orchestrate this solution.
Which solution should the security engineer implement to meet these requirements?
Use Amazon GuardDuty to identify malicious traffic. Store the identified IP addresses in a DynamoDB table. Use Lambda to update the DynamoDB table and modify an AWS Network Firewall rule group to block the traffic
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity. It can identify potentially harmful behavior, such as traffic from a botnet.
The suspicious IP addresses can be stored in a DynamoDB table.
Lambda can be used to update the DynamoDB table and to automatically update an AWS Network Firewall rule group to block traffic from these IP addresses
A large enterprise has an AWS setup which contains multiple accounts managed through AWS Organizations. The accounts are categorized into several OUs based on the company’s departmental structure. The security team now wants to enforce a policy to prevent any accidental deletion of S3 buckets across all accounts.
Which solution should the security team implement to meet this requirement?
Create an SCP that includes a Deny rule for the s3:DeleteBucket action. Apply this SCP to all the OUs in the organization
A media company is streaming their content globally via AWS, but due to legal constraints, it needs to restrict data storage to a specific AWS region using AWS Organizations. A security engineer is tasked with preventing users from storing data in any other region.
Which approach will allow the security engineer to implement these requirements with the MINIMUM operational overhead?
Implement an SCP that uses the “aws:RequestedRegion” condition to deny actions outside the approved region. Attach the SCP to the AWS account under AWS Organizations
n Amazon EC2 web server has been deployed into Subnet B within a VPC. An EC2 instance in Subnet A within the same VPC must be able to connect to the web service. A network administrator has created a security group and added both instances to it. Subnet A uses a default Network ACL. A custom Network ACL has been created and attached to Subnet B.
Which 2 rules must be created to successfully connect to the web server?
- Security group TCP port 80 inbound and TCP port 80 outbound
- Network ACL: TCP port 80 inbound and TCP ports 1024-65535 outbound
A company currently manages Amazon EC2 instances running Windows and Linux in public and private subnets. The operations team currently connects over the Internet to manage the instances as there is no private connection to the corporate network.
Security groups have been updated to allow the RDP and SSH protocols from any source IPv4 address. There have been reports of malicious attempts to access the resources and the company wishes to implement the most secure solution for managing the instances.
Which strategy should a security engineer recommend?
Deploy the AWS Systems Manager Agent on the EC2 instances. Access the EC2 instances using Session Manager restricting access to users with permission to manage the instances
An application runs across multiple Amazon EC2 instances in multiple Availability Zones behind an Application Load Balancer (ALB). The application is experiencing a DDoS attack from malicious software that is distributed across hosts around the world. The software can be identified in the User-Agent field of the request header.
A security engineer needs to mitigate the attack. Which actions should be taken?
Create a Web ACL with a string match condition that matches the value in the User-Agent header. Configure WAF to block requests that match the condition
A company stores highly confidential information in an Amazon S3 bucket. The security team requires that any changes to the bucket policy are automatically remediated, and alerts of these changes are sent to their team members.
Which actions should a security engineer take to meet these requirements with the LEAST effort?
Use AWS Config with Auto Remediation to remediate any changes to S3 bucket policies. Configure alerting with AWS Config and Amazon SNS
The security department in a company requires automatic discovery of any security groups that allow unrestricted inbound traffic on port 22 (SSH). The security administrators should be notified of any violations
Which solution meets these requirements with the MOST operational efficiency?
Configure the restricted-ssh managed rule in AWS Config. When the rule is NON_COMPLIANT, use the AWS Config remediation feature to publish a notification to an Amazon SNS topic
A company hosts video files for a website in an Amazon S3 bucket that is configured as an origin for an Amazon CloudFront distribution. The company was recently notified that the videos were being accessed from unauthorized countries.
Which 2 actions should a security engineer take the limit the distribution of the video files?
- Create an origin access identity (OAI) for the CloudFront distribution and update the S3 bucket policy to restrict access to the OAI
- Update the distribution settings in CloudFront and configure restrictions based on the geography of the request
A security engineer is deploying a proxy server solution in an Amazon VPC. The engineer has deployed proxy software on multiple EC2 instances across Availability Zones. Route tables have been configured to forward traffic to the proxy instances. The proxy instance security groups have been configured to allow ports 80 and 443 inbound and outbound.
Upon testing the solution the engineer has discovered that the proxy instances are not forwarding traffic to the internet.
What else needs to be done for this solution to work?
Disable source/destination checks on the EC2 proxy instances
A company manages an application that runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The NLB has access logs enabled which are being stored in an Amazon S3 bucket. A security engineer requires a solution to run ad hoc queries against the access logs to identify application access patterns.
How should the security engineer accomplish this task with the least amount of administrative overhead?
Create an Amazon Athena table that uses the S3 bucket containing the access logs. Run SQL queries using Athena
A company has started to deploy resources to the AWS cloud. Initial resources have been deployed in the US West (Oregon) Region and an AWS CloudTrail trail has been created to record API activity in a bucket in the same Region.
The security team requires that API activity is captured from all Regions and stored in a central Region.
What is the SIMPLEST way to meet these requirements?
Change the existing single-region trail to log all regions and capture API activity in a single central Amazon S3 bucket
A company has deployed an application on Amazon EC2 instances with an Amazon RDS database. A security architect needs a secure solution for storing the database credentials and enabling automatic rotation on a regular basis. The credentials must be encrypted both in transit and at rest.
Which solution meets these requirements?
Use AWS Secrets Manager and configure automatic rotation of the credentials
A company runs an ecommerce website and is concerned about the risk of DDoS attacks. The company needs to identify methods to minimize the downtime associated with any attacks that might happen in the future.
Which 2 steps would help achieve this?
- Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack
- Create rule statements in AWS WAF web ACLs to block matching requests relating to the attack traffic
A security team has mandated that only approved Amazon Machine Images (AMIs) can be used for launching Amazon EC2 instances. The security team requires a method of automatically validating compliance with the new mandate.
Which solution can the security team use to find unapproved AMIs for new and existing Amazon EC2 instances?
Deploy the AWS Config rule “approved_ami_by_id” and specify the approved AMI IDs
An enterprise has two VPCs in the ap-south-1 Region: vpc-alpha and vpc-beta. The enterprise has recently created an Amazon API Gateway REST API with the endpoint type set to PRIVATE. It also created a VPC endpoint for the REST API in vpc-alpha, providing the resources in vpc-alpha successful access to the REST API.
The enterprise wants to allow resources in vpc-beta to access the REST API. A VPC endpoint for the REST API was created in vpc-beta, but the resources in vpc-beta still can’t access the REST API.
A security engineer must enable access to the REST API for resources in vpc-beta while adhering to the principle of least privilege.
What solution will achieve these requirements?
Maintain the API endpoint type as PRIVATE. Attach a resource policy to the REST API permitting access from vpc-beta
developer is attempting to access an Amazon S3 bucket in a member account in AWS Organizations. The developer is logged in to the account with user credentials and has received an access denied error with no bucket listed. The developer should have read-only access to all buckets in the account.
A security engineer has reviewed the permissions and found that the developer’s IAM user has been granted read-only access to all S3 buckets in the account.
Which additional 2 steps should the security engineer take to troubleshoot the issue?
- Check the SCPs set at the organizational units (OUs)
- Check for the permissions boundaries set for the IAM user
A company uses an Amazon RDS MySQL database instance to store customer order data. The security team have requested that SSL/TLS encryption in transit must be used for encrypting connections to the database from application servers. The data in the database is currently encrypted at rest using an AWS KMS key.
How can a security engineer enable encryption in transit?
Download the AWS-provided root certificates. Use the certificates when connecting to the RDS DB instance
An application uses Amazon EC2 instances to retrieve messages from an Amazon SQS queue. The EC2 instances have an instance profile assigned that uses an IAM role to provide permissions to the queue. A security engineer has been asked to investigate why the instances are not able to retrieve messages. The solution should follow the principle of least privilege.
What 2 actions should be taken to identify the cause of the?
- Check the configuration of the IAM role attached to the instance profile to ensure it has sufficient permissions
- Check if an Amazon SQS policy explicitly denies access to the IAM role used by the instances
A multinational company is operating a global web application on AWS behind a CloudFront distribution. As part of their security enhancement, the company has enabled AWS WAF on the CloudFront distribution with a Web ACL.
For compliance purposes, the company requires comprehensive logging of all requests hitting the web ACL. They have already prepared an Amazon S3 bucket for storing these logs.
Which combination of 2 steps should the company take to meet this requirement?
- Enable logging in AWS WAF settings, associate the web ACL with an Amazon Kinesis Data Firehose delivery stream
- Create an Amazon Kinesis Data Firehose delivery stream in the same AWS Region as the web ACL. Specify the S3 bucket as the destination for the delivery stream
A company created an AWS KMS key in the AWS Key Management Service (KMS) with imported key materials. The company policy requires that all encryption keys must be rotated every 365 days.
What must be done to implement policy requirements?
Create a new KMS key, import new key material, and point the key alias to the new KMS key
An application running on Amazon EC2 instances generates log files in a folder on the Linux file system. The security team requires that the logs are collected and centrally stored using an AWS managed service. Automatic monitoring should be possible, and an interface must be available for analyzing the log files.
Which approach meets the stated requirements with the minimum effort?
Install the unified Amazon CloudWatch agent on the EC2 instances. Configure the agent to collect the application log files and send them to Amazon CloudWatch Logs
A company is running a batch data processing application in an Amazon EC2 instance, which requires frequent access to an Amazon DynamoDB table. The company’s security policies mandate that all connections to DynamoDB should be private and secure.
The company has set up a Gateway VPC Endpoint for DynamoDB in the VPC where the EC2 instance resides. Even though the EC2 instance is configured to be within a private subnet with a NAT gateway for internet access, the traffic from the EC2 to DynamoDB goes through the NAT gateway instead of the Gateway VPC endpoint.
What action can a security engineer take to ensure the EC2 instance uses the Gateway VPC Endpoint for DynamoDB?
Associate the Gateway VPC Endpoint with the route table of the private subnet, where the EC2 instance resides
A security engineer must configure AWS WAF to store logs in a central location for later analysis.
What is the MOST operationally efficient solution that meets this requirement?
Configure AWS WAF to send its log files directly to an Amazon S3 bucket for later analysis
A company has created an AWS account structure with a centralized management account and several child accounts. An AWS Organization has been created to manage this configuration. The security team require API auditing using AWS CloudTrail for all accounts. Administrators in child accounts should not have privileges to modify the CloudTrail trail configuration.
How should AWS CloudTrail be configured with the LEAST operational overhead?
Create an Amazon S3 bucket in the management account and create an Organization trail in the management account that logs to the S3 bucket
A team is using AWS Secrets Manager to store an application database password. Only a limited number of IAM principals within the account can have access to the secret. The principals who require access to the secret change frequently. A security engineer must create a solution that maximizes flexibility and scalability.
Which solution will meet these requirements?
Use a tag-based approach by attaching a resource policy to the secret. Apply tags to the secret and the IAM principals. Use the aws:PrincipalTag and aws:ResourceTag IAM condition keys to control access.
A company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application has become the target of a DoS attack. Application logging shows that requests are coming from a small number of client IP addresses, but the addresses change regularly.
The company needs to block the malicious traffic with a solution that requires the least amount of ongoing effort.
Which solution meets these requirements?
Create an AWS WAF rate-based rule, and attach it to the ALB
A company has hundreds of AWS accounts in an organization in AWS Organizations. The company operates out of a single AWS Region. The company has a dedicated security tooling AWS account in the organization. The security tooling account is configured as the organization’s delegated administrator for Amazon GuardDuty and AWS Security Hub. The company has configured the environment to automatically enable GuardDuty and Security Hub for existing AWS accounts and new AWS accounts.
The company is performing control tests on specific GuardDuty findings to make sure that the company’s security team can detect and respond to security events. The security team launched an Amazon EC2 instance and attempted to run DNS requests against a test domain, example.com, to generate a DNS finding. However, the GuardDuty finding was never created in the Security Hub delegated administrator account.
Why was the finding was not created in the Security Hub delegated administrator account?
The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver
An ecommerce company has a web application architecture that runs primarily on containers. The application containers are deployed on Amazon Elastic Container Service (Amazon ECS). The container images for the application are stored in Amazon Elastic Container Registry (Amazon ECR).
The company’s security team is performing an audit of components of the application architecture. The security team identifies issues with some container images that are stored in the container repositories.
The security team wants to address these issues by implementing continual scanning and on-push scanning of the container images. The security team needs to implement a solution that makes any findings from these scans visible in a centralized dashboard. The security team plans to use the dashboard to view these findings along with other security-related findings that they intend to generate in the future. There are specific repositories that the security team needs to exclude from the scanning process.
Which solution will meet these requirements?
Use Amazon Inspector. Create inclusion rules in Amazon ECR to match repositories that need to be scanned. Push Amazon Inspector findings to AWS Security Hub
A company has a single AWS account and uses an Amazon EC2 instance to test application code. The company recently discovered that the instance was compromised. The instance was serving up malware. The analysis of the instance showed that the instance was compromised 35 days ago.
A security engineer must implement a continuous monitoring solution that automatically notifies the company’s security team about compromised instances through an email distribution list for high severity findings. The security engineer must implement the solution as soon as possible.
Which combination of 3 steps should the security engineer take to meet these requirements?
- Enable Amazon GuardDuty in the AWS account.
- Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team’s email distribution list to the topic.
- Create an Amazon EventBridge rule for GuardDuty findings of high severity. Configure the rule to publish a message to the topic.
A company uses identity federation to authenticate users into an identity account (987654321987) where the users assume an IAM role named IdentityRole. The users then assume an IAM role named JobFunctionRole in the target AWS account (123456789123) to perform their job functions.
A user is unable to assume the IAM role in the target account. The policy attached to the role in the identity account is:
What should be done to enable the user to assume the appropriate role in the target account?
Update the trust policy on the role in the target account to be:
A company is using AWS Organizations to manage multiple AWS accounts for its human resources, finance, software development, and production departments. All the company’s developers are part of the software development AWS account.
The company discovers that developers have launched Amazon EC2 instances that were preconfigured with software that the company has not approved for use. The company wants to implement a solution to ensure that developers can launch EC2 instances with only approved software applications and only in the software development AWS account.
Which solution will meet these requirements?
Use an AWS Service Catalog portfolio that contains EC2 products with appropriate AMIs that include only approved software. Grant the developers permission to access only the Service Catalog portfolio to launch a product in the software development account.
A company has enabled Amazon GuardDuty in all AWS Regions as part of its security monitoring strategy. In one of its VPCs, the company hosts an Amazon EC2 instance that works as an FTP server. A high number of clients from multiple locations contact the FTP server. GuardDuty identifies this activity as a brute force attack because of the high number of connections that happen every hour.
The company has flagged the finding as a false positive, but GuardDuty continues to raise the issue. A security engineer must improve the signal-to-noise ratio without compromising the company’s visibility of potential anomalous behavior.
Which solution will meet these requirements?
Create a suppression rule in GuardDuty to filter findings by automatically archiving new findings that match the specified criteria.
A suppression rule is a set of criteria, consisting of a filter attribute paired with a value, used to filter findings by automatically archiving new findings that match the specified criteria.
A company is running internal microservices on Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type. The company is using Amazon Elastic Container Registry (Amazon ECR) private repositories.
A security engineer needs to encrypt the private repositories by using AWS Key Management Service (AWS KMS). The security engineer also needs to analyze the container images for any common vulnerabilities and exposures (CVEs).
Which solution will meet these requirements?
Recreate the ECR repositories with KMS encryption and ECR scanning enabled. Analyze the scan report after the next push of images.
A company’s security engineer has been tasked with restricting a contractor’s IAM account access to the company’s Amazon EC2 console without providing access to any other AWS services. The contractor’s IAM account must not be able to gain access to any other AWS service, even if the IAM account is assigned additional permissions based on IAM group membership.
What should the security engineer do to meet these requirements?
Create an IAM permissions boundary policy that allows Amazon EC2 access. Associate the contractor’s IAM account with the IAM permissions boundary policy.
A company manages multiple AWS accounts using AWS Organizations. The company’s security team notices that some member accounts are not sending AWS CloudTrail logs to a centralized Amazon S3 logging bucket. The security team wants to ensure there is at least one trail configured for all existing accounts and for any account that is created in the future.
Which set of actions should the security team implement to accomplish this?
Edit the existing trail in the Organizations management account and apply it to the organization
A company recently had a security audit in which the auditors identified multiple potential threats. These potential threats can cause usage pattern changes such as DNS access peak, abnormal instance traffic, abnormal network interface traffic, and unusual Amazon S3 API calls. The threats can come from different sources and can occur at any time. The company needs to implement a solution to continuously monitor its system and identify all these incoming threats in near-real time.
Which solution will meet these requirements?
Enable Amazon GuardDuty from a centralized account. Use GuardDuty to manage AWS CloudTrail logs, VPC flow logs, and DNS logs.
A Security Engineer has been informed that a user’s access key has been found on GitHub. The Engineer must ensure that this access key cannot continue to be used, and must assess whether the access key was used to perform any unauthorized activities.
Which steps must be taken to perform these tasks?
Delete or rotate the user’s key, review the AWS CloudTrail logs in all regions, and delete any unrecognized or unauthorized resources.
A corporate cloud security policy states that communication between the company’s VPC and KMS must travel entirely within the AWS network and not use public service endpoints.
Which combination of 2 actions MOST satisfies this requirement?
- Create a VPC endpoint for AWS KMS with private DNS enabled
- add the aws:sourceVpce condition to the AWS KMS key policy referencing the company’s VPC endpoint ID
When testing a new AWS Lambda function that retrieves items from an Amazon DynamoDB table, the Security Engineer notices that the function was not logging any data to Amazon CloudWatch Logs.
The following policy was assigned to the role assumed by the Lambda function:
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Sid”: “Dynamo-1234567”,
“Action”: [
“dynamodb:GetItem”
],
“Effect”: “Allow”,
“Resource”: “*”
}
}
Which least-privilege policy addition would allow this function to log properly?
{
“Sid”: “Logging-12345”,
“Resource”: “*”,
“Action”: [
“logs:CreateLogGroup”,
“logs:CreateLogStream”,
“logs:PutLogEvents”
],
“Effect”: “Allow”
}
A company is building a data lake on Amazon S3. The data consists of millions of small files containing sensitive information.
The Security team has the following requirements for the architecture:
- Data must be encrypted in transit.
- Data must be encrypted at rest.
- The bucket must be private, but if the bucket is accidentally made public, the data must remain confidential.
Which combination of steps would meet the requirements?
- Enable default encryption with server-side encryption with AWS KMS-managed keys (SSE-KMS) on the S3 bucket.
- Add a bucket policy that includes a deny if a PutObject request does not include aws:SecureTransport
A Security Engineer must ensure that all API calls are collected across all company accounts, and that they are preserved online and are instantly available for analysis for 90 days. For compliance reasons, this data must be restorable for 7 years.
Which steps must be taken to meet the retention needs in a scalable, cost-effective way?
Enable AWS CloudTrail logging across all accounts to a centralized Amazon S3 bucket. Set a lifecycle policy to move the data to Amazon Glacier after 90 days, and expire the data after 7 years
A company decides to place database hosts in its own VPC, and to set up VPC peering to different VPCs containing the application and web tiers. The application servers are unable to connect to the database.
Which 2 network troubleshooting steps should be taken to resolve the issue?
- Check the route tables for the application server subnets for routes to the VPC peering connection
- Check the database security groups for rules that allow traffic from the application servers
Why is it important to scan network logs?
To be alerted to unusual traffic entering and exiting your network as a potential security event
During monitoring, it has been identified that port scans are coming from specific outside IP addresses into the VPC hosting various applications. In order to stop the port scans the internal security team requests that all identified IP addresses be blocked for the upcoming 24 hours. What can be used to deny access from these specific IPs?
Modify the web ACL to deny requests from the IP addresses.
A company developed an incident response plan 18 months ago and has completed regular implementations of it since then without any modifications. What is correct statement about the plan?
- the response plan doesn’t cater to new services as the plan us not updated for 18 months
You have lost the administrator password for a Windows Server EC2 instance that is backed by EBS and SSM agent installed. To regain access to the instance, what is the simplest way to solve the problem?
Use Systems Manager Run Command to run AWSSupprt-RunEC2RescueForWindowsTool command document.
A company requires a method to be alerted if the number of attempts to connect via SSH to its bastion host exceeds 10 within an one-hour time window What solution can the business employ to meet this requirement?
Configure a VPC flow log with CloudWatch as the destination. Create a CloudWatch metric filter for destination port 22. Create a CloudWatch alarm trigger
As an AWS security specialist, you need to implement an AWS Config rule that will inspect EC2 resources to ensure they meet specific security requirements including having the appropriate Tags. An existing AWS Config rule called ‘required-tags’ does not meet your needs as the rule does not allow you to tailor specific resource types and availability zones. How should you implement the Config rule to carry out custom checks?
Create an AWS Lambda function to perform the custom checks. Then configure a custom AWS Config rule to invoke the Lambda function.
Your company has an EC2 instance that is hosted in an AWS VPC. There is a need to securely store log files from the EC2 Instance and limit access to only those files. How can this be accomplished?
- Create an IAM policy that gives the desired level of access to the CloudWatch Log group
- Stream the log files to a separate CloudWatch group
You work in a large organization as an AWS engineer and you need quickly manage certificates issued from the private Certificate Authority in ACM. You need to have access to details including the ARN, subject name and expiration date. Which option is the easiest one?
Create an audit report to list all of the certificates that the private CA has issued or revoked. Download the JSON-formatted report from the S3 bucket.
An organization wants to guarantee the the objects stored in an AWS bucket remain confidential at all times. How could they ensure this on an ongoing basis?
- Use AWS lambda function to change the S3 bucket policy
- Use AWS Config to monitor changes to the S3 bucket
A company is looking for a solution to establish secure private connections between their on-prem Infrastructure and the AWS Cloud while maintaining low latency. Which approach would help them achieve this goal?
- AWS VPN
- AWS Direct Connect
Which solutions can help guarantee that al of your EC2 Instances are free of significant security vulnerabilities
- use AWS SSM to patch the servers
- use AWS Inspector to ensure that the servers have no critical flaws
You are using Systems Manager to patch a group of EC2 systems, but some of them are not being patched. Which 3 options can you use to find out why this is happening?
- check the instance status by using the Health API
- check to see if the right role has been assigned to the EC2 instances
- ensure that the agent is running on the instances
How can a security team member best provide the auditors with the necessary information to evaluate and verify the security and compliance of the organizations AWS infrastructure?
Download reports from the AWS Artifact console and provide them to the auditors
What is the simplest way to meet the requirement that all data stored on AWS EBS volumes must be encrypted at rest?
Enable EBS encryption during launch
You have established multiple AWS infrastructure components in your AWS account, such as EC2, RDS MySQL, DynamoDB, etc. You have been alerted of an unusually large AWS expenditure, as well as notification from AWS that there might be an issue with your AWS account security . What measures should you take right away as an AWS Administrator?
- respond to any notifications you received from AWS Support
- Change your AWS account root user password
- rotate access keys if they were authorised and are still needed, otherwise delete them
You have an S3 bucket defined in IAM. You want to ensure that you encrypt the data before sending it
across the wire. What is the best way to achieve this?
Use the IAM Encryption CLI to encrypt the data first
A security engineer is using AWS Organizations and wants to optimize SCPs. The security engineer needs to ensure that the SCPs conform to best practices.
Which approach should the security engineer take to meet this requirement?
Use AWS IAM Access Analyzer to analyze the polices. View the findings from policy validation checks.
A company has implemented IAM WAF and Amazon CloudFront for an application. The application runs on Amazon EC2 instances that are part of an Auto Scaling group. The Auto Scaling group is behind an Application Load Balancer (ALB).
The IAM WAF web ACL uses an IAM Managed Rules rule group and is associated with the CloudFront distribution. CloudFront receives the request from IAM WAF and then uses the ALB as the distribution’s origin.
During a security review, a security engineer discovers that the infrastructure is susceptible to a large, layer 7 DDoS attack.
How can the security engineer improve the security at the edge of the solution to defend against this type of attack?
Configure IAM WAF with a rate-based rule that imposes a rate limit that automatically blocks requests when the rate limit is exceeded.
A company uses HTTP Live Streaming (HL’S) to stream live video content to paying subscribers by using Amazon CloudFront. HLS splits the video content into chunks so that the user can request the right chunk based on different conditions. Because the video events last for several hours, the total video is made up of thousands of chunks.
The origin URL is not disclosed, and every user is forced to access the CloudFront URL. The company has a web application that authenticates the paying users against an internal repository and a CloudFront key pair that is already issued.
What is the simplest and MOST effective way to protect the content?
Develop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content.
Utilizing CloudFront signed cookies is the simplest and most effective way to protect HLS video content for paying subscribers. Signed cookies provide access control for multiple files, such as video chunks in HLS streaming, without the need to generate a signed URL for each video chunk. This method simplifies the process for long video events with thousands of chunks, enhancing user experience while ensuring content protection.
A company is storing data in Amazon S3 Glacier. A security engineer implemented a new vault lock policy for 10 TB of data and called the initiate-vault-lock operation 12 hours ago. The audit team identified a typo in the policy that is allowing unintended access to the vault.
What is the MOST cost-effective way to correct this error?
Call the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again.
A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets.
The company needs to replicate the S3 objects from the company’s primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region.
Which solution will meet these requirements?
Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
Implementing S3 Object Lock in compliance mode on the primary Region and configuring S3 replication to a secondary Region ensures the immutability of S3 objects, preventing them from being deleted or altered. This setup meets the requirement of protecting critical data from permanent deletion, even by users with administrative access. The replicated objects in the secondary Region inherit the Object Lock from the primary, ensuring consistent protection across Regions and aligning with disaster recovery requirements.
A company used AWS Organizations to set up an environment with multiple AWS accounts. The company’s organization currently has two AWS accounts, and the company expects to add more than 50 AWS accounts during the next 12 months The company will require all existing and future AWS accounts to use Amazon GuardDuty. Each existing AWS account has GuardDuty active. The company reviews GuardDuty findings by logging into each AWS account individually.
The company wants a centralized view of the GuardDuty findings for the existing AWS accounts and any future AWS accounts. The company also must ensure that any new AWS account has GuardDuty automatically turned on.
Which solution will meet these requirements?
Create a new AWS account in the organization. Enable GuardDuty in the new account. Designate the new account as the delegated administrator account for GuardDuty. Configure GuardDuty to add existing accounts as member accounts. Select the option to automatically add new AWS accounts to the organization
A company uses AWS Organizations to manage a multi-account AWS environment in a single AWS Region. The organization’s management account is named management-01. The company has turned on AWS Config in all accounts in the organization. The company has designated an account named security-01 as the delegated administrator for AWS Config.
All accounts report the compliance status of each account’s rules to the AWS Config delegated administrator account by using an AWS Config aggregator. Each account administrator can configure and manage the account’s own AWS Config rules to handle each account’s unique compliance requirements.
A security engineer needs to implement a solution to automatically deploy a set of 10 AWS Config rules to all existing and future AWS accounts in the organization. The solution must turn on AWS Config automatically during account creation.
Which combination of 2 steps will meet these requirements?
- Create a conformance pack that contains the 10 required AWS Config rules. Deploy the conformance pack from the security-01 account
- Create an AWS CloudFormation template that will activate AWS Config. Deploy the template by using CloudFormation StackSets in the management-01 account
A company used AWS Organizations to set up an environment with multiple AWS accounts. The company’s organization currently has two AWS accounts, and the company expects to add more than 50 AWS accounts during the next 12 months The company will require all existing and future AWS accounts to use Amazon GuardDuty. Each existing AWS account has GuardDuty active. The company reviews GuardDuty findings by logging into each AWS account individually.
The company wants a centralized view of the GuardDuty findings for the existing AWS accounts and any future AWS accounts. The company also must ensure that any new AWS account has GuardDuty automatically turned on.
Which solution will meet these requirements?
Create a new AWS account in the organization. Enable GuardDuty in the new account. Designate the new account as the delegated administrator account for GuardDuty. Configure GuardDuty to add existing accounts as member accounts. Select the option to automatically add new AWS accounts to the organization
A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator.
A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application.
Which solution will meet these requirements?
Create an AWS WAF web ACL for the ALB. Create a custom rule that blocks requests that contain the user agent string of the device emulator.
To mitigate a credential stuffing attack against a web-based application behind an Application Load Balancer (ALB), creating an AWS WAF web ACL with a custom rule to block requests containing the known malicious user agent string is an effective solution. This approach allows for precise targeting of the attack vector (the user agent string of the device emulator) without impacting legitimate users. AWS WAF provides the capability to inspect HTTP(S) requests and block those that match defined criteria, such as specific strings in the user agent header, thereby preventing malicious requests from reaching the application.
An Amazon API Gateway API invokes an AWS Lambda function that needs to interact with a software-as-a-service (SaaS) platform. A unique client token is generated in the SaaS platform to grant access to the Lambda function. A security engineer needs to design a solution to encrypt the access token at rest and pass the token to the Lambda function at runtime.
Which solution will meet these requirements MOST cost-effectively?
Store the client token as a SecureString parameter in AWS Systems Manager Parameter Store. Use the AWS SDK to retrieve the value of the SecureString parameter in the Lambda function.
A security analyst attempted to troubleshoot the monitoring of suspicious security group changes. The analyst was told that there is an Amazon CloudWatch alarm in place for these AWS CloudTrail log events. The analyst tested the monitoring setup by making a configuration change to the security group but did not receive any alerts.
Which troubleshooting steps should the analyst perform?
Verify that a metric filter was created and then mapped to an alarm. Check the alarm notification action.
TPT Limited hosts multiple resources using AWS service. Robert is working as a security administrator notices an incident of a suspicious API activity which occurred 11 days ago.
How should Robert get the API activity from that point in time?
Search the Cloudtrail event history on the API events which occurred 11 days ago.
A corporation X is looking for a solution that provides automatic scanning of operating system and programming language package vulnerabilities for all its container images stored on Amazon Elastic Container Registry (Amazon ECR). The images should only be scanned once when they are pushed onto the repository.
Which option is the right fit for the given requirements?
Opt for enhanced scanning and specify a filter for a scan on push
With enhanced scanning, Amazon ECR integrates with Amazon Inspector to provide automated, continuous scanning of your repositories. Your container images are scanned for both operating systems and programming language package vulnerabilities. As new vulnerabilities appear, the scan results are updated and Amazon Inspector emits an event to EventBridge to notify you.
The security team at a retail company utilizes Amazon EventBridge to monitor Amazon S3 objects, aiming to detect public access and any other changes in S3 bucket policies/settings that result in public access. They configure EventBridge to watch specific CloudTrail API calls (s3:PutObjectAcl, s3:DeleteBucketPolicy, and s3:PutBucketPolicy) and use Amazon SNS for immediate email notifications.
However, during development, the team finds that s3:PutObjectAcl doesn’t trigger an EventBridge event, while the other two do. CloudTrail for AWS management events is enabled with a basic configuration in the relevant region, and EventBridge pattern verification is correct.
The team needs a solution to ensure s3:PutObjectAcl triggers an EventBridge event without generating false notifications. What is the appropriate solution for this scenario?
Enable CloudTrail to monitor data events for read and write operations for S3 buckets
A video processing application uses an AWS Lambda function to create image thumbnails from larger images. The AWS Lambda function needs read and write access to an Amazon S3 bucket configured in the same AWS account.
Which is the most efficient solution to provide the necessary access permissions to the AWS Lambda function?
Create an AWS Identity and Access Management (IAM) role for the Lambda function that also grants access to the S3 bucket. Configure the IAM role as the Lambda functions execution role. Verify that the S3 bucket policy doesn’t explicitly deny access to your Lambda function or its execution role
A data analytics company wants to move all its clients belonging to the regulated and security-sensitive industries such as financial services and healthcare to the AWS Cloud as it wants to leverage the out-of-box security-specific capabilities offered by AWS. The Security team at the company is developing a framework to validate the adoption of AWS best practices and industry-recognized compliance standards. The AWS Management Console is the preferred method for the in-house teams wanting to provision resources. You have been hired as an AWS Certified Security Specialist to spearhead this strategic initiative.
Which of 2 strategies would you adopt to address these business requirements for continuously assessing, auditing, and monitoring the configurations of AWS resources?
- Enable trails and set up CloudTrail events to review and monitor management activities of all AWS accounts by logging these activities into CloudWatch Logs using a KMS key. Ensure that CloudTrail is enabled for all accounts as well as all available AWS services
- Leverage Config rules to audit changes to AWS resources and monitor the compliance of the configuration by running the evaluations for the rule at a frequency that you choose. Develop AWS Config custom rules to establish a test-driven development approach by triggering the evaluation when any resource that matches the rule’s scope changes in configuration
A company has two VPCs (VPC1 and VPC2) configured in two different AWS Regions that are part of the same AWS account. There is an active VPC peering connection between the VPCs that has been configured in the route tables for both VPCs.
The database is present in VPC1 and the access to the database instance is controlled through a security group defined in VPC1. VPC2 consists of an Auto Scaling group that scales in/out any Amazon EC2 instances based on the CPU usage. Each instance launched as part of the Auto Scaling group belongs to a security group defined specifically for the Auto Scaling group. The launched instances need seamless access to the database instance present in VPC1.
Which additional step is needed for the solution to work if the route tables are already configured for VPC peering?
Add an inbound rule to the security group of the database instance in VPC1, with the source as the CIDR block of VPC2 (VPC for the instances launched by the Auto Scaling Group)
The development team at a company deploys to their AWS production environment through a continuous integration/continuous deployment (CI/CD) pipeline. The pipeline itself has broad access to create AWS resources needed to run the application. The company’s security team wants to allow the development team to deploy their own IAM principals and policies for their application. However, the security team also needs a control mechanism that requires all resources created by the pipeline to have minimum privileges that comply with the security guidelines. All teams at the company are only allowed to modify the AWS production environment through their CI/CD pipeline.
Which 2 options will you combine to address this use case?
- Create an IAM role for the CI/CD pipeline to be used for deploying application resources
- The security team should create a permissions boundary policy and attach it to the IAM role used by the CI/CD pipeline
As per the latest security guidelines of a company, root user login access should be intimated to the security team every time it is used.
How will you create a solution for this requirement in the most efficient way?
Create an Amazon Simple Notification Service (Amazon SNS) topic and configure the users of the security team as subscribers to the topic. Create an Amazon EventBridge event rule to monitor userIdentity root logins from the AWS Management Console and trigger notifications to the SNS topic when root user login activity is detected
A company uses AWS CloudFormation templates to provision all of its AWS infrastructure resources. One such CloudFormation template needs to provide the username and password as credentials to the newly created Amazon Redshift database.
Which is the optimal way to configure the database credentials during the stack creation without compromising these credentials?
First create a secret with a password generated by Secrets Manager. Then use a dynamic reference in the CloudFormation template to retrieve the username and password from the secret to use as credentials for the new database created
A Security Engineer has been tasked to evaluate the outcome of different policies, including but not limited to identity-based policies, resource-based policies, IAM permissions boundaries, session policies, and AWS Organizations service control policies (SCPs) of an AWS account.
What are 2 valid statements regarding the aforementioned policy evaluations?
- Resource-based policies that grant permissions to an IAM role ARN are limited by an implicit deny in a permissions boundary or session policy
- If a resource-based policy grants permission directly to the IAM user or the session principal that is making the request, then an implicit deny in an identity-based policy, a permissions boundary, or a session policy does not impact the final decision
A Security Engineer has been tasked with the job of configuring access control and authentication for the AWS KMS keys of a particular AWS account.
Which 2 options would you identify as valid points of consideration for configuring the requirement correctly?
- The IAM identity that creates a KMS key is not considered to be the key owner. Like any other identity, the key creator needs to get permission through a key policy, IAM policy, or grant
- AWS identities that have the kms:CreateKey permission can set the initial key policy and give themselves permission to use or manage the key
KMS keys belong to the AWS account in which they were created. However, no identity or principal, including the AWS account root user, has permission to use or manage a KMS key unless that permission is explicitly provided in a key policy, IAM policy, or grant. The IAM identity that creates a KMS key is not considered to be the key owner and they don’t automatically have permission to use or manage the KMS key that they created. Like any other identity, the key creator needs to get permission through a key policy, IAM policy, or grant.
A procurement application connects to Amazon API Gateway REST API for its core functionality needs. The development team at the company wants to restrict the access to allow only specific public IP address ranges of the company’s selected vendor systems to access this public API Gateway REST API.
What configuration is needed to restrict access to the API Gateway REST API?
Create a resource policy for your REST API that denies access to any IP address that isn’t specifically allowed. In the resource policy, for aws:SourceIp, give the value of the specific public IP address ranges that you want to grant access to
After the resource policy is attached to your REST API, users who call the API from specified IP addresses (allowed users) can access the API. Calls from any other IP address are denied access and receive an HTTP 403 Forbidden error.
The aws:SourceIp condition value works only for public IP address ranges.
To allow access to private IP address ranges, use the condition value aws:VpcSourceIp and enter the private IP address of your HTTP client that’s invoking your private API endpoint through the interface VPC endpoint. This configuration is not correct for public IPs.
The security team at a company needs to follow the security requirements:
Monitor all traffic leaving a particular VPC
Monitor all traffic whose source is outside of the VPC
The purpose of this traffic monitoring is to put in place a proper content inspection, troubleshooting, and threat monitoring solution.
Which option represents the best solution for the given requirement?
Configure a traffic mirror target for the monitoring appliance. Create a traffic mirror filter with a rule for outbound traffic to reject all packets that have a destination IP in the VPC CIDR block and accept all other outbound packets. Also, create another rule for inbound traffic to reject all packets that have a source IP in the VPC CIDR block and accept all other inbound packets
A company has decided to revamp the security for its IT infrastructure and tighten rules for access to AWS resources across the organization. In this context, a Security Engineer has been tasked with creating optimal access credentials/permissions for the company’s applications to access the required resources. Some of these applications will run on EC2 instances and need cross-account access privileges for resources present in another AWS account. The company also maintains a few mobile applications that need to access AWS resources.
As an AWS Certified Security Specialist, which 3 options would you recommend as the best practices to configure access credentials/permissions for these applications?
- Use Amazon Cognito to manage user identities in your mobile application. You can then use the Amazon Cognito credentials provider to manage credentials that your application uses to make requests to access AWS resources
- Define an IAM role that has appropriate permissions for the application and launch the Amazon EC2 instance with this role associated with the instance
- Use an IAM role to establish trust between accounts, and then grant users in one account limited permissions to access the trusted account
An AWS root user has logged in to the AWS account and realized that there is no access to an Amazon S3 bucket under the given AWS account.
What is the reason for this behavior and how will you fix the issue?
- Modify the bucket policy to allow root user access from the Amazon S3 console or the AWS CLI
- If there is a bucket policy on the Amazon S3 bucket that doesn’t specify the AWS account root user as a principal, the root user is denied access to that bucket
A company wants to secure the objects in S3 using server-side encryption, subject to the constraint that the key material must be generated and stored in a certified FIPS 140-2 Level 3 hardware service modules (HSM) that the company manages itself. In addition, the key material must be available in multiple Regions. The size of objects in S3 ranges from 15 KB to 5 MB.
As an AWS Certified Security Specialist, what do you recommend?
Leverage an AWS KMS custom key store backed by AWS CloudHSM clusters. Copy backups across Regions
A company has created trails in CloudTrail for all its AWS accounts as a security best practice. Recently, the company’s security team has highlighted increased user login failures for a particular AWS account and asked for an immediate fix. The solution should send notifications to the concerned manager if a user login fails for three consecutive attempts within a span of five minutes.
As an AWS Certified Security Specialist, how will you implement a solution for this requirement?
- Configure AWS CloudTrail to send trail events to Amazon CloudWatch Logs. Create a metric filter for the relevant log group with a filter pattern having eventName as ConsoleLogin and errorMessage as Failed authentication
- Create a CloudWatch alarm with the threshold parameter set to 3 and the period parameter set to 5 minutes. The alarm action is a notification sent to an Amazon Simple Notification Service (Amazon SNS) topic subscribed by the concerned manager(s)
The security team at a company is working to create VPC endpoints so that the AWS Systems Manager can be used to manage private EC2 instances without internet access.
As an AWS Certified Security Specialist, which 3 options will you combine to build a solution to meet the given requirements?
- Verify that SSM Agent is installed on the instance
- Create an AWS Identity and Access Management (IAM) instance profile for Systems Manager. Attach the IAM role to your private EC2 instance
- Create three virtual private cloud (VPC) endpoints for Systems Manager with service names: com.amazonaws.[region].ssm, com.amazonaws.[region].ec2messages, com.amazonaws.[region].ssmmessages
A rapidly growing e-commerce company stores all of its sensitive customer data in an Amazon S3 bucket. To ensure the safety and security of this data, the company has chosen to encrypt it using an AWS Key Management Service (AWS KMS) customer managed key. The company also uses AWS Lambda functions to perform various tasks within the same account as the S3 bucket. The Lambda functions need to access the data in the S3 bucket but the company must ensure that each Lambda function has its own programmatic access control permissions to use the KMS key.
Which of the following options would you recommend?
Establish a Lambda execution role that provides access to the KMS key for each Lambda function
A company stores its critical business data on Amazon S3 buckets. A customer does not use TLS versions 1.2 or higher and hence is unable to access content stored in Amazon Simple Storage Service (Amazon S3) buckets.
As a Security Engineer, how will you set up a solution to allow the customers to access content in the Amazon S3 buckets using TLS 1.0 or 1.1 while keeping the communication channel secure?
Create a CloudFront distribution with Origin Access Control (OAC). Make your S3 bucket private and configure access through Amazon CloudFront only by using signed requests to access the S3 bucket
A company has meticulously strengthened its AWS Cloud security solution to detect and respond to the organization’s security requirements by using AWS Firewall Manager, Amazon Inspector, and AWS Shield Advanced services in its AWS accounts. The company has recently added the Amazon Macie data security service to discover and help protect sensitive data. The company wants to implement a solution (using data from these security services) that can initiate alerts if a DDoS attack happens on the company’s AWS resources.
Which solution will implement this requirement?
Create an Amazon CloudWatch alarm that monitors AWS Shield Advanced CloudWatch metrics for an active DDoS event
AWS Shield Advanced reports metrics to Amazon CloudWatch on an AWS resource more frequently during DDoS events than when no events are underway. Shield Advanced reports metrics once a minute during an event, and then once right after the event ends. While no events are underway, Shield Advanced reports metrics once a day, at a time assigned to the resource. This periodic report keeps the metrics active and available for use in custom CloudWatch alarms.
An e-commerce company is designing a multi-account structure for its Finance and Operations teams using AWS Organizations and AWS Single Sign-On (AWS SSO). The teams should only be able to access specific AWS services in the designated AWS Regions.
Which solution will implement these requirements with the LEAST operational overhead?
Create Service control policies (SCPs) that deny access to any operations outside of the designated AWS Regions. Apart from the Condition and Resource elements, configure the NotAction element to allow access to the required AWS services
A financial services company manages its IT infrastructure on AWS. The security team at the company has been tasked to monitor and report all the root user activities of the AWS account.
Which options should be combined as a solution so that the security team can meet these requirements?
- Set up a CloudWatch Events rule that is triggered on any API call from the root user
- Using Amazon SNS as a target of the trigger that further notifies the security team
A company wants to allow its developers to create temporary environments to test their code using the latest Amazon Linux distribution. To control costs, the company wants the teams to create Amazon EC2 instances using only small instance types while also restricting the size of the attached EBS volumes. To comply with security requirements, the developers are expected to create only encrypted volumes and use a non-standard port for secure shell access to the instances.
What is the most optimal way to proactively evaluate resource configurations in CloudFormation templates without writing custom code in Python or other languages?
Use AWS CloudFormation Guard (cfn-guard), an open-source tool that helps you write compliance rules and validate the CloudFormation templates against those rules
A business maintains its business-critical customer data on an on-premises system in an encrypted format. Over the years, the business has moved from using a single encryption key to multiple encryption keys by dividing the data into logical chunks. With the decision to move all data to the Amazon S3 bucket, the business is looking for a technique to encrypt each file with a different encryption key to provide maximum security to the migrated on-premises data.
How will you implement this requirement without adding the overhead of splitting the data into logical groups?
Configure a single Amazon S3 bucket to hold all data. Use server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data
A Security Engineer has been asked to create an identity-based policy that allows access to add objects to an Amazon S3 bucket. But, the access should be given from April 1, 2023, through April 30, 2023 (UTC) inclusive.
How will you define this identity-based policy?
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: “s3:PutObject”,
“Resource”: “*”,
“Condition”: {
“DateGreaterThan”: {“aws:CurrentTime”: “2023-04-01T00:00:00Z”},
“DateLessThan”: {“aws:CurrentTime”: “2023-04-30T23:59:59Z”}
}
}
]
}
A retail company has a three-tier web application with separate subnets for Web, Application, and Database tiers. The CTO at the company wants to monitor any malicious activity targeting the web application running on EC2 instances. You have been tasked with developing a solution to notify the security team in case the network exposure of EC2 instances on specific ports violates the security policies of the company.
Which 2 AWS Services would you use to build an automated notification system to meet these requirements with the least development effort?
- Amazon Inspector
- Amazon SNS
A security engineer has deployed an AWS Config rule that detects changes to a security group and sends notifications when the rule is non-compliant. However, recent changes to the security group, which were compliant with the AWS Config rule, went unnoticed till connectivity issues were noticed by the users. Now, the company needs a solution that can initiate an alert to a specified email address when ANY changes are made to the security groups.
What do you recommend?
Enable AWS CloudTrail and configure the trail to send the logs to Amazon CloudWatch Logs. Configure a CloudWatch metric filter for the log group with a filter pattern on all security group changes. Create a CloudWatch alarm based on the log group-metric filter to publish notifications to an Amazon SNS topic
A company maintains a robust security posture by use of AWS services like AWS Config, AWS Firewall Manager, Amazon GuardDuty, Amazon Inspector, Amazon Detective, and AWS Trusted Advisor. Earlier, the company was using a custom dashboard to aggregate information about its security footprint, the company has now decided to use AWS Security Hub to help assess its AWS environment vis-a-vis the security best practices.
Which 2 statements are correct about Security Hub integration with other AWS services?
- AWS Security Hub sends the Amazon GuardDuty findings to Amazon Detective to visualize and investigate the findings
- AWS Firewall Manager sends findings to Security Hub when AWS Shield Advanced is not protecting the resources
A hybrid AWS network is configured to route internet traffic such that it egresses from an on-premises gateway rather than from a VPC Internet Gateway (IGW). Since enabling Amazon GuardDuty, an error has been repeatedly seen in the GuardDuty findings: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS. This finding informs you that a host outside of AWS has attempted to run AWS API operations using temporary AWS credentials that were created on an EC2 instance in your AWS environment. The listed EC2 instance might be compromised, and the temporary credentials from this instance might have been exfiltrated to a remote host outside of AWS.
As a Security engineer, what steps would you take to address this issue, so that the VPC’s internet traffic that egresses from an on-premises gateway does not trigger the given error?
- Use suppression rules and create a rule that consists of two filter criteria. The first criterion is finding type, which should be UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS
- The second filter criterion is API caller IPv4 address with the IP address or CIDR range of the on-premises internet gateway
A company uses Amazon EC2 instances (fronted by an Application Load Balancer) with Amazon RDS MySQL as the database. Now, the company wants to store sensitive client data and needs to follow strict security and compliance guidelines. Data must be end-to-end secured while in-transit, as well as, at-rest. The company needs a solution that can implement strict security guidelines while keeping the cost and operational overhead to a minimum.
Which combination of 3 steps will meet all the requirements?
- Ensure that the database client software uses a TLS connection to Amazon RDS. Enable encryption of the Amazon RDS DB instance
- Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that support the Amazon EC2 instances
- Use TLS certificates from AWS Certificate Manager (ACM) with an Application Load Balancer. Deploy self-signed certificates on the EC2 instances
A company has migrated most of its legacy applications to AWS Cloud. Compliance guidelines mandate that the company must keep its data center on-premises and it must implement IPsec encryption for all network communications outside the premises. The workloads are sensitive to network latency vis-a-vis the data center.
Which of the following would you suggest to implement a solution for AWS applications to connect to the data center?
Combine AWS Direct Connect with AWS Site-to-Site VPN
social media company runs all its workloads on AWS and it uses AWS Organizations to implement a multi-account strategy. The company currently has multiple AWS member accounts for its departments. The company anticipates that it will not have more than a total of 15 AWS accounts at any time in the future.
The company wants to enforce a new security policy with the following requirements:
The company should use a centrally managed VPC that all departmental AWS accounts can access to launch workloads in subnets The centrally managed VPC should reside in an existing AWS account (Account X) within the organization No departmental AWS account should use a VPC within its own account for workloads No departmental AWS account should be able to modify another department’s AWS account-specific application resources within the centrally managed VPC
Which solution will facilitate the security setup to address these requirements?
Use AWS Resource Access Manager (AWS RAM) to share the subnets in Account X’s centrally managed VPC with the other member accounts. Configure the member accounts to use the shared subnets to launch workloads
To improve the security of private APIs, a Security Engineer has been tasked to configure API Gateway to use an interface VPC endpoint. The VPC endpoint policy should only allow full access to two specific private APIs through the endpoint.
Which policy should be attached to the VPC endpoint to meet the given requirements?
{
“Statement”: [
{
“Principal”: “”,
“Action”: [
“execute-api:Invoke”
],
“Effect”: “Allow”,
“Resource”: [
“arn:aws:execute-api:us-east-1:123412341234:a1b2c3d4e5/”,
“arn:aws:execute-api:us-east-1:123412341234:aaaaa11111/*”
]
}
]
}
A company is planning to launch a mobile application for its business critical functions. Mobile users should have access to AWS resources without having to define an AWS identity for each of them. Guest user access is a necessity for the application.
As a Security Engineer, which of the following would you suggest as the most optimal way of configuring the security credentials for mobile users?
Use Amazon Cognito with AWS SDKs for mobile development to create unique identities for the users
A financial services company is running an Amazon RDS for MySQL DB instance in a virtual private cloud (VPC) to store sensitive customer data. Due to strict security policies, the company has implemented a VPC that does not allow any network traffic to or from the internet. A security engineer at the company wants to use AWS Secrets Manager to automatically rotate the DB instance credentials for increased security. However, due to the company’s security policy, the engineer is not allowed to use the standard AWS Lambda function provided by Secrets Manager to rotate the credentials.
To address this issue, the security engineer deploys a custom Lambda function within the VPC. This function is responsible for rotating the secret in Secrets Manager. The security engineer also edits the DB instance’s security group to allow connections from this custom Lambda function. However, when the function is invoked, it is unable to communicate with Secrets Manager and cannot rotate the secret.
Which of the following options will address the given scenario?
Add a VPC Interface Endpoint for Secrets Manager and configure the Lambda function’s subnet to use it
A company has recently set up AWS Organizations to get all its AWS accounts under one organization to standardize the monitoring and compliance needs of the company. The company has the following requirements:
a) All user actions have to be logged. b) Based on the company’s security needs, define alarms that respond to specific user actions. c) Send real-time alerts for the alarms raised.
Which 2 options can be combined to create an optimal solution for the given requirements?
- Implement an AWS CloudTrail trail as an organizational trail. Configure the trail to forward the trail data to an Amazon CloudWatch Logs log group
- In CloudWatch Logs, set a metric filter for any user action event the company needs to track. Create an Amazon CloudWatch alarm against the metric. When triggered, the alarm sends notifications to the subscribed users through an Amazon Simple Notification Service (Amazon SNS) topic
At XYZ Corporation, the IT team had recently discovered a security loophole that could potentially allow unauthorized access to sensitive data. To fix the issue and ensure the protection of their company’s information, the team wants to establish the ability to delete an AWS KMS Customer Master Key (CMK) within a 24-hour timeframe. This would prevent the key from being used for encrypt or decrypt operations and keep their data secure.
Which of the following solutions will address the given use case?
Implement the KMS import key function to perform an immediate delete operation
As a Security Specialist, you have received an alert from a log analyzer about the suspicious increase in traffic to your application’s login page probably indicating a potential brute force or credential-stuffing attack against the application. The application under attack is configured behind a Web Application Firewall (WAF) using Amazon CloudFront and Amazon S3.
What should be the initial response to this probable attack?
Create a URI-specific rate-based WAF rule to prevent a single source IP address from connecting to the login page more than a defined threshold number of times, over a given period
A cybersecurity company is using AWS Systems Manager Session Manager to manage Amazon EC2 instances in the us-east-1 AWS Region. A user is unable to connect to a new EC2 instance that runs Amazon Linux 2 in a private subnet in a newly created VPC. The systems administrator has confirmed that the new EC2 instance has the correct IAM instance profile attached.
As an AWS Certified Security Specialist, what would you attribute as the root cause behind this issue?
The EC2 instance is in a private subnet and it does not have the com.amazonaws.us-east-1.ssmmessages VPC endpoint for Session Manager
A user is trying to upload a large file to an Amazon S3 bucket present in a given AWS account. In the upload request, the user is passing the encryption information using an AWS Key Management Service (AWS KMS) key, also present in the same account. However, the user is getting an Access Denied error. Meanwhile, when the user uploads a smaller file with encryption information, the upload succeeds.
As a Security Engineer, how will you fix this issue?
Verify that kms:Decrypt permissions are specified in the key policy, otherwise, they need to be added to the policy
The AWS CLI (aws s3 commands), AWS SDKs, and many third-party programs automatically perform a multipart upload when the file is large. To perform a multipart upload with encryption using an AWS KMS key, the requester must have kms:GenerateDataKey and kms:Decrypt permissions. The kms:GenerateDataKey permissions allow the requester to initiate the upload. With kms:Decrypt permissions, newly uploaded parts can be encrypted with the same key used for previous parts of the same object.
A Security Engineer has been asked to configure an interface VPC endpoint to access an Amazon API Gateway private REST API that is in another AWS account.
What are the 2 key points of consideration while creating an interface endpoint in the Amazon VPC account for the given requirement?
- When you activate private DNS for an interface VPC endpoint, you can no longer access API Gateway public APIs from your Amazon VPC
- The security groups that you choose must have a rule that allows TCP Port 443 inbound HTTPS traffic from an IP address range in your Amazon VPC
A company has moved its business-critical data to an Amazon EFS file system which will be accessed by multiple EC2 instances.
Which 2 options would you recommend to exercise access control such that only the permitted EC2 instances can read from the EFS file system?
- Use VPC security groups to control the network traffic to and from your file system
- Use an IAM policy to control access for clients who can mount your file system with the required permissions
A company has decided to enable AWS Security Hub to help assess its growing AWS environment against security industry standards and best practices.
Which of the following represents true statements for the AWS Security Hub service?
- When you enable both GuardDuty and Security Hub, the mutual integration is enabled automatically. GuardDuty immediately begins to send findings to Security Hub
- AWS Config must be enabled as a pre-requisite for using Security Hub
A company maintains independent AWS accounts for its departments. For a specific requirement, a user in the Finance account needs full access to an Amazon S3 bucket in the Audit account. The security administrator has attached the necessary IAM permissions to the user of the Finance account. But, the user still has no access to the S3 bucket.
Which additional configuration is needed for the given requirement?
Create an S3 bucket policy in the Audit account that allows access to the S3 bucket for the user from the Finance account
A large company that uses AWS recently received an email from the AWS Abuse team. The email informed them that an IAM user associated with the company’s AWS account had their access key and secret access key pair published in public code repositories, although there are no signs yet of any compromise within the company’s AWS account. The IAM user in question is designated as a service account and is used in a critical customer-facing production application with hard-coded credentials. To address this situation and minimize application downtime, you have been tasked as an AWS Certified Security Specialist for implementing a solution that protects the AWS account from any unauthorized access.
Which of the following steps would you suggest?
- Inactivate the publicly exposed IAM access key
- Create a new access key and secret access key pair for the IAM user
- Update the application to use the new credentials
- Revoke any temporary AWS Security Token Service (AWS STS) credentials associated with the IAM user
- Delete AWS Management Console credentials associated with the IAM user
For a threat alert raised by the security team, a company needs content inspection of the traffic passing through an Amazon Route 53 resolver outbound endpoint.
As A Security Specialist, how will you implement a solution for this requirement?
To view traffic passing through Route 53 resolver endpoints, configure Amazon Virtual Private Cloud (Amazon VPC) Traffic Mirroring
Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of type interface. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring and troubleshooting.
A company operates a global data analytics website hosted on AWS. The website relies on Amazon CloudFront to deliver content to its customers. Recently, the company is facing new data regulation policies and is required to block inbound traffic from a specific set of countries. The company needs to find a solution to comply with the new data regulation policies while maintaining the cost-effectiveness of its infrastructure.
What do you recommend?
Leverage geographic restrictions in CloudFront to deny traffic from a specific set of countries
A financial services company recently faced a security event resulting in an S3 bucket with sensitive data containing Personally Identifiable Information (PII) for customers being made public. The company policy mandates never to have public S3 objects so the Governance and Compliance team must be notified immediately as soon as any public objects are identified. The company has hired you as an AWS Certified Security Specialist to help build a solution that detects the presence of a public S3 object, which in turn sets off an alarm to trigger notifications and then automatically remediate the said object.
Which 2 solutions would you combine to address the requirements of the given use case?
- Enable object-level logging for S3. Set up an EventBridge event pattern when a PutObject API call with public-read permission is detected in the AWS CloudTrail logs and set the target as an SNS topic for downstream notifications
- Configure a Lambda function as one of the SNS topic subscribers, which is invoked to secure the objects in the S3 bucket
media company uses S3 to store artifacts that may only be accessible to EC2 instances running in a private VPC. The security team at the company is apprehensive about an attack vector wherein any team member with access to this instance could also set up an EC2 instance in another VPC to access these artifacts.
As an AWS Certified Security Specialist, which of the following solutions will you recommend to prevent such unauthorized access to the artifacts in S3?
Configure an S3 VPC endpoint and create an S3 bucket policy to allow access only from this VPC endpoint
The development team at a company accesses resources across all AWS Regions. The management wants only the security team to have access to resources from all AWS Regions. Any access to members of the development team needs to be restricted to the resources in a single AWS Region (us-west-2) except for the global AWS services. The development team is sized at 40 members, with all members being part of the developers IAM group. The company needs to implement this access restriction immediately.
What is the optimal way to meet this requirement?
Create an identity-based policy with the IAM aws:RequestedRegion condition key that denies access to all actions outside the specified Region, except for actions related to the global AWS services specified using NotAction. Attach the policy to the developers IAM group
A security engineer must ensure that all certificates imported into AWS Certificate Manager (ACM) in all AWS Regions, must be notified of expiry, 30 days before their actual expiry via a single notification to the security administrator. The notification along with the certificate information should be sent to the security administrator and the Security Hub for centralized management.
Which steps must be taken to perform these tasks optimally?
Configure the DaysToExpiry CloudWatch metric to schedule a batch search of expiring ACM certificates and trigger an AWS Lambda function to send the certificates-to-be-expired notification to an SNS topic. This Lambda function can also be configured to log all the expiring certificates as findings in Security Hub
A company exposes most of its business functions as container applications and utilizes Amazon Elastic Container Registry (Amazon ECR) service for managing the container images. To strengthen the security backbone of its AWS architecture, the company is looking for a solution that provides automatic scanning of operating systems and programming language package vulnerabilities. All the images pushed to Amazon ECR should be continuously scanned and the updates of the scan should be notified to specified teams.
Which solution is the right fit for this requirement?
Turn on enhanced scanning for your Amazon ECR registry. By default, the duration of the scans is set to Lifetime. When enhanced scanning is turned on, Amazon ECR sends scan events to EventBridge which can be configured for further notifications to specified teams
A Network Load Balancer (NLB) was recently set up in a company’s AWS infrastructure, but the target instances are not entering the InService state. The security engineer was called upon to investigate the issue. After conducting a thorough investigation, the engineer determined that the health checks were failing.
Which 3 options could cause the health checks to fail?
- The target instance’s security group has rules that are not using the correct IP addresses to allow traffic from the NLB
- The target instance’s security group has no rules that allow traffic from the NLB’s IP Addresses
- The target instance’s subnet network ACL does not allow traffic from the NLB’s IP Addresses
The security team at a company has been assigned the responsibility of configuring outgoing email using Simple Email Service (SES) that leverages the Amazon SES API with mandatory TLS for the secure transfer of data.
Which configuration should the engineer choose to make TLS mandatory for SES API?
Change the behavior of SES by using configuration sets. Set the TlsPolicy property for a configuration set to Require
An e-commerce company’s security team needs to receive a notification whenever an AWS access key has not been rotated in 30 or more days. You have been hired as an AWS Certified Security Specialist to develop a solution that provides these notifications automatically.
Which solution will you recommend to address these requirements with the LEAST effort?
Enable the AWS Config access-keys-rotated managed rule and configure the maxAccessKeyAge parameter to 30 days. Have AWS Config apply remediation using AWS Systems Manager Automation document for every non-compliant resource. The Automation document, in turn, publishes a customized message to an SNS topic
A mid-sized company recently deployed Amazon GuardDuty to monitor their AWS environment for potential security threats. The security team noticed a high number of RDP brute force attacks originating from an Amazon EC2 instance and decided to take action to prevent any issues. The company’s security engineer was tasked with implementing an automated solution that could block the suspicious instance until the issue could be investigated and remediated.
Which of the following solutions should the security engineer implement?
Have Security Hub ingest GuardDuty findings and send events to Kinesis Data Streams via EventBridge. Configure a Lambda function to process the data stream and block traffic to/from the suspicious instance by updating the security group so that it has no inbound and outbound rules
The security team at an e-commerce company wants to ensure that none of the AWS accounts for its multiple IT teams can delete the AWS KMS keys.
What represent the most operationally efficient solution?
Use AWS Organizations to set a service control policy that denies the kms:Delete* and kms:ScheduleKeyDeletion actions for all accounts within the organization
An AWS service present in AWS Account 1 is exposed to AWS Account 2 using VPC private link. The Network Load Balancer (NLB) in Account 1 is configured and has accepted the connection. While data is seen leaving from the NLB, the client side is not getting the transmitted data.
What steps should be undertaken to troubleshoot this issue?
Ensure that the Security Groups and Network Access Control Lists (NACLs) in both VPCs allow traffic
During regular maintenance tasks, an application support team noticed an abnormal activity on an Amazon EC2 instance that is configured with an EBS volume. The team immediately informed a Security Engineer of the anomaly. The instance is part of an Auto Scaling Group fronted by an Elastic Load Balancer.
What immediate steps should the Security Engineer take for preventing any further attacks to secure the connecting systems and understand the root cause?
Remove the instance from the Auto Scaling group and deregister the instance from the Elastic Load Balancer. Place the instance within an isolation security group and snapshot the Amazon EBS data volumes that are attached to the EC2 instance. Launch an EC2 instance with a forensic toolkit and attach an EBS volume created from the snapshot of the suspicious EBS volume
A data analytics company uses Amazon GuardDuty to identify unexpected, potentially unauthorized, and malicious activity within its AWS environment. The security team at the company wants all Medium/High Severity findings to automatically generate a ticket in a third-party ticketing system through email integration.
As an AWS Certified Security Specialist, what would you suggest as the most optimal solution?
Create an Amazon EventBridge rule that includes an event pattern that matches Medium/High severity GuardDuty findings. Set up an Amazon Simple Notification Service (Amazon SNS) topic. Configure the third-party ticketing email system as a subscriber to the SNS topic. Set the SNS topic as the target for the EventBridge rule
An open banking system enables secure open API integrations for financial institutions. The banking system needs mutual TLS (mTLS) authentication as part of its security standards. The application will be hosted on an Amazon EC2 server. The system has specific security compliance rules that need the server to terminate the client’s TLS connection.
As a Security Engineer, how will you configure this requirement to support mTLS if a load balancing service is needed for the instances?
Create a TCP listener using a Network Load Balancer and implement mTLS on the target
A mid-sized company stores sensitive data on an Amazon Elastic Block Store (EBS) volume attached to an Amazon Elastic Compute Cloud (EC2) instance. To ensure data durability, the company also replicates this sensitive data to an Amazon Simple Storage Service (S3) bucket. Both the EBS volume and S3 bucket are encrypted using the same AWS Key Management Service (KMS) Customer Master Key (CMK). The security team at the company has noticed that the CMK has been deleted as a former employee had set the key for deletion before leaving the company.
As a Security Specialist, what do you suggest to access the data?
Copy the data directly from the EBS encrypted volume before the volume is detached from the EC2 instance
An application deployed on an Amazon Elastic Compute Cloud (Amazon EC2) instance needs to read from and write files to an S3 bucket in the same AWS account (Account A1). The application also reads (but doesn’t write) files from an S3 bucket in another AWS Account (Account A2). The company uses a multi-account strategy and each application has its own AWS account.
Three teams access the company’s data: the Central Cloud Team, the Application Team, and the Data Lake Team. The Central Cloud Team is responsible for the overall security and governance of the AWS environment across all AWS accounts. The Application Team is responsible for building, deploying, and running their application within the application account (Account A1) that they own and manage. Likewise, the Data Lake Team owns and manages the Data Lake account (Account A2). The Central Cloud Team has two security requirements that they want to apply:
a) All AWS API calls across all accounts must be encrypted in transit and accounts can’t leave the organization on their own.
b) Least privilege policy/permissions should be configured for the application in Account A1 to access files from the S3 bucket in Account A2.
As an AWS Certified Security Specialist, which of the following options would you combine to implement a solution for the given security and access requirements?
- Create a Service Control Policy (SCP) that denies all requests that are not sent using SSL (TLS) and also prevents an account from leaving the organization. Apply the SCP to the root of the organization
- The application team has to create an IAM role in Account A1, that the application running on the EC2 instance will use to get objects from the S3 bucket in Account A2. A resource-based policy has to be attached to the bucket in the data lake account (Account A2) that grants read access to the role in the application account (Account A1)
The origin of an Amazon CloudFront distribution requires that all requests must include the Authorization header. This mandates the CloudFront distribution to forward the Authorization headers to the origin.
As a Security Engineer, how will you configure a solution to address this use case?
Create a cache policy. Then, associate the cache policy with the cache behavior that must forward the Authorization header
An e-commerce company recently saw a huge spike in its monthly AWS spend. Upon further investigation, it was found that some developers had accidentally launched Amazon RDS instances in unexpected Regions. The company has hired you as an AWS Certified Security Specialist to establish best practices around the least privileges for developers and control access to on-premises as well as AWS Cloud resources using Active Directory. The company has mandated that you institute a mechanism to control costs by restricting the level of access that developers have to the AWS Management Console without impacting their productivity. The company would also like to allow developers to launch RDS instances only in us-east-1 Region without limiting access to other services in any Region.
How can you help the company achieve the new security mandate while minimizing the operational burden on the systems administration team?
Configure SAML-based authentication tied to an IAM role that has the PowerUserAccess managed policy attached to it. Attach a customer-managed policy that denies access to RDS in any AWS Region except us-east-1
The security team at a company needs to analyze the AWS Web Application Firewall (AWS WAF) logs quickly and it wants to build multiple dashboards using a serverless architecture. The logging process should be automated so that the log data for dashboards is available on a real-time or near-real-time basis.
Which option represent the most optimal solution for this requirement?
Configure AWS Web Application Firewall (AWS WAF) to feed logs to Amazon S3 bucket via Amazon Kinesis Data Firehose. Set up an AWS Glue crawler job and an Amazon Athena table to query for required data and create visualizations using Amazon QuickSight dashboards
A company has migrated most of its business to AWS Cloud using Amazon EC2 instances for Windows to host its applications. The domain services used by these applications are built on Active Directory servers which have been retained as on-premises servers. The company has issued guidelines to enable GuardDuty for all its applications.
While analyzing GuardDuty reports, the security team realized that DNS logs are not being tracked/reported by GuardDuty. How will you fix this issue?
If you use a custom DNS resolver, then GuardDuty cannot access and process data from this data source
If you use AWS DNS resolvers for your Amazon EC2 instances (the default setting), then GuardDuty can access and process your request and response DNS logs through the internal AWS DNS resolvers. If you use another DNS resolver, such as OpenDNS or GoogleDNS, or if you set up your own DNS resolvers, then GuardDuty cannot access and process data from this data source.
The security team at a company has recently decided that CloudTrail logs of each department will be prefixed with the department code. Currently, CloudTrail logs are created with similar names across the company with no immediate way of identifying the departments sending those logs. When the security team tried to add the prefix to the log files in the CloudTrail console, the following error popped up: ‘There is a problem with the bucket policy’.
How will you fix this issue?
Use the Amazon S3 console to update the prefix in the current bucket policy, and then use the CloudTrail console to specify the same prefix for the bucket in the trail
A web application is hosted on Amazon EC2 instances that are fronted by Application Load Balancer (ALB) configured with an Auto Scaling group (ASG). Enhanced security is provided to the ALB by AWS WAF web ACLs. As per the company’s security policy, AWS CloudTrail is activated and logs are configured to be stored on Amazon S3 and CloudWatch Logs.
A discount sales offer was run on the application for a week. The support team has noticed that a few of the instances have rebooted taking down the log files and all temporary data with them. Initial analysis has confirmed that the incident took place during off-peak hours. Even though the incident did not cause any sales or revenue loss, the CTO has asked the security team to fix the security error that has allowed the incident to go unnoticed and eventually untraceable.
As Security Engineer, which series of steps will you implement to permanently record all traffic coming into the application?
Configure the WAF web ACL to deliver logs to Amazon Kinesis Data Firehose, which should be configured to eventually store the logs in an Amazon S3 bucket. Use Athena to query the logs for errors and tracking
A healthcare company has recently completed a security review that has highlighted several gaps in the security standards mandated by the company while using the AWS Key Management Service (AWS KMS) keys. As an initial step to address the gap, the security team has decided that access to AWS KMS keys should be restricted to only the principals belonging to their AWS Organizations.
How will you implement this requirement?
The aws:PrincipalOrgID global condition key can be used with the Principal element in a resource-based policy with AWS KMS. You need to specify the Organization ID in the Condition element
A project manager has connected with you for a security requirement from the client. The client wants to ensure that the authenticated encryption with associated data encryption is used when calling AWS Key Management Service (AWS KMS) Encrypt, Decrypt, and ReEncrypt APIs.
As an AWS Certified Security Specialist, what would you recommend to address this requirement?
Use encryption context that you can use to verify the authenticity of AWS KMS API calls and the integrity of the ciphertext returned by the AWS Decrypt API
All AWS KMS cryptographic operations with symmetric encryption KMS keys accept an encryption context, an optional set of key–value pairs that can contain additional contextual information about the data. AWS KMS uses the encryption context as additional authenticated data (AAD) to support authenticated encryption.
As a Security Specialist, you have been asked to create an AWS Identity and Access Management (IAM) policy that explicitly grants permissions to an IAM role for creating and managing Amazon Elastic Compute Cloud (Amazon EC2) instances in a specified VPC. The policy must limit permissions so that the IAM role can only create EC2 instances with specific tags and then manage those EC2 instances in a VPC by using those tags.
Which of the following solutions will meet this requirement?
Apply a custom IAM policy to restrict the permissions of the IAM role for creating EC2 instances in a specified VPC with tags using the policy condition ec2:ResourceTags to limit control to instances
A security specialist with administrator permissions is using the AWS management console to access the CloudWatch logs for a Lambda function named “myFunc”. However, upon choosing the option to view the logs in the AWS Lambda console, the specialist encountered an error message reading “error loading Log Streams”. The specialist was unable to retrieve the logs as desired and must now find a solution to this issue.
Following is an example IAM policy for the Lambda function’s execution role:
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: “logs:CreateLogGroup”,
“Resource”: “arn:aws:logs:<region>:<accountId>:*"
},
{
"Effect": "Allow",
"Action": [
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:<region>:<accountId>:log-group:/aws/lambda/myFunc:*"
]
}
]
}
What solution would you suggest to the specialist for addressing the issue?</accountId></region></accountId></region>
Add the logs:CreateLogStream action to the second Allow statement
The development team at a company is moving the static content from the company’s e-commerce website hosted on EC2 instances to an S3 bucket. The team wants to use a CloudFront distribution to deliver the static content. The security group used by the EC2 instances allows the website to be accessed by a limited set of IP ranges from the company’s suppliers. Post the migration to CloudFront, access to the static content should only be allowed from the aforementioned IP addresses.
Which options would you combine to build a solution to meet these requirements?
- Create an AWS WAF ACL and use an IP match condition to allow traffic only from those IPs that are allowed in the EC2 security group. Associate this new WAF ACL with the CloudFront distribution
- Configure an origin access identity (OAI) and associate it with the CloudFront distribution. Set up the permissions in the S3 bucket policy so that only the OAI can read the objects
A Security Engineer noticed that an application layer (layer 7) DDoS attack is underway on one of the critical systems.
What should the immediate response of the engineer be to control the damage?
- You can contact the AWS Support Center to get help with mitigations if you’re a Shield Advanced customer
- Create your own AWS WAF rules in your web ACL to mitigate the attack
For application layer (layer 7) DDoS attacks, AWS attempts to detect and notify AWS Shield Advanced customers through CloudWatch alarms. By default, it doesn’t automatically apply mitigations, to avoid inadvertently blocking valid user traffic.
For application layer (layer 7) resources, you have the following options available for responding to an attack. 1. Provide your own mitigations – You can investigate and mitigate the attack on your own. To manually mitigate a potential application layer DDoS attack you can create your own AWS WAF rules in your web ACL to mitigate the attack. This is the only option available if you aren’t a Shield Advanced customer.
A Security Engineer has followed the best practices to set up a trusted IP address list for Amazon GuardDuty. However, GuardDuty is generating alert findings for the configured trusted IP addresses.
Which 2 checks will you perform to ensure GuardDuty works as expected?
- Ensure that IP addresses added in the trusted IP list are publicly routable IPv4 addresses
- Ensure that the trusted IP lists are uploaded in the same AWS Region as your GuardDuty findings
Trusted IP lists and threat lists are account and Region-specific. At any given time, you can have only one uploaded trusted IP list per AWS account per Region. Whereas, you can have up to six uploaded threat lists per AWS account per Region.
A standard three-tier application is hosted on Amazon EC2 instances that are fronted by an Application Load Balancer. The application maintenance team has reported several small-scale malicious attacks on the application. The project manager has decided to ramp up the security of the application.
As an AWS Certified Security Specialist, what would you recommend as part of the best practices to scan and mitigate the known vulnerabilities?
Configure the application security groups to ensure that only the necessary ports are open. Use Amazon Inspector to periodically scan the EC2 instances for vulnerabilities
To scan for known vulnerabilities, use Amazon Inspector. Amazon Inspector is an automated vulnerability management service that continually scans Amazon Elastic Compute Cloud (EC2) and container workloads for software vulnerabilities and unintended network exposure.
You can enable Amazon Inspector for your entire organization or an individual account with a few clicks in the AWS Management Console. Once enabled, Amazon Inspector automatically discovers running Amazon EC2 instances and Amazon ECR repositories and immediately starts continually scanning workloads for software vulnerabilities and unintended network exposure
A security engineer has been asked to enable AWS CloudTrail trail to log data events on an S3 bucket with an empty object prefix. The S3 bucket is owned by the Owner user. Another user Bob has a separate account that has been granted access to the S3 bucket. Bob also wants to log data events for all objects in the same S3 bucket, so Bob configures a trail and specifies the same S3 bucket with an empty object prefix.
Consider the following events:
Bob uploads an object to the S3 bucket with the PutObject API operation.
Owner uploads an object to the S3 bucket.
What will be the outcome of the two events defined above?
- When the Owner uploaded the object, the upload event occurs in Owner’s account and it matches the settings for Owner’s trail. The trail processes and logs the event in Owner’s account
- When Bob uploaded the object, the upload event occurred in Bob’s account and it matches the settings for Bob’s trail. Bob’s trail processes and logs the event. The Owner’s trail settings also match the event, so the event is logged in Owner’s trail too
The security team at a financial services company has received a notification that the resources in the company’s AWS account might be compromised.
What 3 actions would you recommend to handle this issue?
- Rotate and delete all root and AWS Identity and Access Management (IAM) access keys
- Check your AWS account bill to know the charged resources
- Use AWS Git projects to scan for evidence of unauthorized use
For auditing purposes, a company needs to showcase a report of changes made to the security group(s) for an Amazon Virtual Private Cloud (Amazon VPC).
What are the 3 different ways to review security group changes in an AWS account?
- Use AWS CloudTrail Event history to review security group changes in your AWS account
- Use AWS Config to view configuration history for security groups. You must have the AWS Config configuration recorder turned on
- Create an AWS CloudTrail trail configured to log to an Amazon Simple Storage Service (Amazon S3) bucket. Use Athena to query CloudTrail Logs over the last 30-45 days
A security engineer has configured trusted IP lists and threat lists on Amazon GuardDuty to monitor the security of the AWS environment. Consider the following scenarios:
a) While configuring the lists the engineer mistakenly added the same IP to both lists. What is the outcome of this configuration?
b) To grant the identities full access (such as renaming, deactivating, uploading, activating, deleting) for working with trusted IP lists and threat lists, which managed policy needs to be added?
- The IP will be processed by the trusted IP list first, and will not generate a finding
- Attach AmazonGuardDutyFullAccess managed policy to provide full access privileges to an identity to work with trusted IP lists and threat lists. You also need to add the following privileges { “Effect”: “Allow”, “Action”: [ “iam:PutRolePolicy”, “iam:DeleteRolePolicy” ], “Resource”: “arn:aws:iam::123456789123:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty” }
A pharmaceutical company is showcasing its new business lines and is promoting them to its partner organizations. These flagship applications are hosted on Amazon EC2 instances. The technology teams at the partner organizations are expected to access these instances for a first-hand understanding of these applications. The EC2 instances will be shared, and non-root SSH access is needed for the teams.
As a Security Engineer, how will you block the EC2 instance metadata service for the given use case to avoid an assault on other AWS account resources?
- Implement local firewall rules using iptables based restrictions on the instances
iptables is a command line interface used to set up and maintain tables for the Netfilter firewall for IPv4, included in the Linux kernel. The firewall matches packets with rules defined in these tables and then takes the specified action on a possible match.
During an internal IT Audit, the security team realized that AWS CloudTrail was disabled for a few AWS Regions leading to security and audit lapses. Now, the management wants to tighten the security measures across the company. As an AWS Certified Security Specialist, you have been tasked to build a solution for automatic re-enabling of AWS CloudTrail in any AWS Region if it happens to be turned off.
What is the most optimal way of addressing this requirement?
Use AWS Config with a managed rule cloudtrail-enabled to trigger a remediation action to fix the non-compliant status using AWS Systems Manager Automation documents
A healthcare company only operates in the us-east-1 region and stores encrypted data in S3 using SSE-KMS. Since the company wants to improve the backup and recovery architecture, it wants the encrypted data in S3 to be replicated into the us-west-1 AWS region. The security policies mandate that the data must be encrypted and decrypted using the same key in both AWS regions.
Which of the following represents the best solution to address these requirements?
Set up a new S3 bucket in the us-east-1 region with replication enabled from this new bucket into another bucket in us-west-1 region. Enable SSE-KMS encryption on the new bucket in us-east-1 region by using an AWS KMS multi-region key. Copy the existing data from the current S3 bucket in us-east-1 region into this new S3 bucket in us-east-1 region
AWS KMS supports multi-region keys, which are AWS KMS keys in different AWS regions that can be used interchangeably – as though you had the same key in multiple regions. Each set of related multi-region keys has the same key material and key ID, so you can encrypt data in one AWS region and decrypt it in a different AWS region without re-encrypting or making a cross-region call to AWS KMS.
A Security Engineer has created a web ACL using an AWS Firewall Manager AWS WAF policy. Still, the web ACL isn’t correctly associated with its in-scope resources.
What could be the underlying reason for this issue?
If auto remediate any non-compliant resources isn’t turned on, then the Firewall Manager created web ACL won’t be associated with in-scope resources
A fault management application at a company connects to several other systems to monitor the status of the systems hosting the suite of flagship applications for the company. As per the security policy of the company, Cloudtrail and VPC flow logs have been enabled for all AWS resources. A recent internal error from the support team led to several minutes of outage on the fault management application and a few hours of analysis to understand the root cause of the error.
The company is now looking for a solution that can analyze data from various logs as well as security findings to quickly triage the root-cause linked to the security issues. What is the best-fit solution for the company’s requirements?
Use Amazon Detective in conjunction with Amazon GuardDuty to monitor malicious activity and unauthorized behavior on the AWS resources and quickly identify the root cause of potential security issues through linked datasets
A financial services company is revamping its technology solutions on AWS to meet the company’s new security guidelines that mandate the use of the company’s own imported key material to create Customer Master keys (CMKs) to be used with AWS services. All encryption keys must also be rotated annually.
How will you implement this requirement?
Create a new CMK and import the new key material into it. Point the key alias of the older CMK to the new CMK created
The IT Security team at a financial services firm has informed that a user’s AWS access key has been found on the internet. As a security engineer, you must ensure that the access key is immediately disabled and the user’s activities must be assessed for a potential breach.
Which steps must be taken to meet the above needs?
Delete or rotate the user’s key. Review the AWS CloudTrail logs in all AWS regions and delete any unauthorized resources created or updated
A company manages separate AWS accounts for each of its business units. An enhanced monitoring solution has been proposed by the security team that mandates tracking all the API calls using CloudTrail for all the AWS accounts. The centralized monitoring logs will be available in a new AWS account created for security and audit purposes. Logs of one business unit should be distinguishable from others via its own top-level prefix. Also, any updates to the log files should be traceable.
As a Security Engineer, which of the following options will you combine to implement this requirement?
- Create a new Amazon S3 bucket in the centralized account to store all the CloudTrail log files. Enable log file validation on all Trails in AWS accounts of all business units. Use unique log file prefixes for trails in each AWS account
- Apply a bucket policy to the new centralized S3 bucket that permits the CloudTrail service to use the s3 PutObject action and the s3 GetBucketACL action, and specify the appropriate resource ARNs for the CloudTrail trails
A company maintains separate AWS accounts for its various lines of business. All the accounts are configured with Amazon GuardDuty to detect threats and malicious activities. A partner security firm generates a common threat list quarterly and shares it with all the business lines.
As a Security Engineer, how will you configure the threat list across all AWS accounts with minimum effort?
- Specify an administrator account in GuardDuty and then use the administrator account to invite other AWS accounts to become member accounts. Add the threat list to the administrator account by referencing the S3 object that contains the threat list
- Upload the threat list to an Amazon S3 bucket and share the access with the administrator account
A retail company recently faced a cyber attack and lost all its data stored in the EBS volumes for the EC2 instances. However, the EBS snapshots were not manipulated. The company could restore the data from the EBS snapshots. However, the incident highlighted the security gaps in the current security plan. An immediate need is to protect the EBS snapshots from any manipulation or deletion.
As a Security Engineer, what measures will you take to protect these AWS KMS Customer Master Keys (CMKs) encrypted snapshots?
Create a new AWS account with limited privileges. Allow the newly created account to access the AWS KMS CMK key used to encrypt the EBS snapshots. Copy the encrypted snapshots to the new account on a regular basis
financial services company is evaluating storage options on Amazon S3 standard storage to meet regulatory guidelines. The data should be stored in such a way on S3 that it cannot be deleted until the regulatory period has expired.
As an AWS Certified Security Specialist, which of the following would you recommend for the given requirement?
Use S3 Object Lock
Amazon S3 Object Lock is an Amazon S3 feature that allows you to store objects using a write once, read many (WORM) model. You can use WORM protection for scenarios where it is imperative that data is not changed or deleted after it has been written. Whether your business has a requirement to satisfy compliance regulations in the financial or healthcare sector, or you simply want to capture a golden copy of business records for later auditing and reconciliation, S3 Object Lock is the right tool for you. Object Lock can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely.
The security team at an e-commerce company has noticed that several Amazon Elastic Block Store (Amazon EBS) volumes are not encrypted. These unencrypted EBS volumes are attached to Amazon EC2 instances that are provisioned with an Auto Scaling group and a launch template. You have been hired as an AWS Certified Security Specialist to implement a solution that ensures all EBS volumes are encrypted both now and in the future.
What would you recommend?
Leverage the Amazon EC2 console to enable encryption of new EBS volumes by default. Leverage the Auto Scaling group’s instance refresh feature to replace existing instances with new instances
A company uses an Amazon S3 bucket to store its business-critical data. Recently, all the members of the development team, that access the given S3 bucket, have been given MFA devices. A security engineer must configure permissions such that access to the given S3 bucket is allowed only after MFA authentication.
How will you implement this requirement?
Create an IAM group having the development team users. Add a customer-managed policy with Deny Effect to the group for all s3:*actions with the condition defined as “Condition” : { “BoolIfExists” : { “aws:MultiFactorAuthPresent” : “false” } }
AWS recommends the use of BoolIfExists operator to check whether a request is authenticated using MFA. The aws:MultiFactorAuthPresent key is not present when an API or CLI command is called with long-term credentials, such as user access key pairs. Therefore AWS recommends that when you check for this key that you use the IfExists versions of the condition operators
A Systems Administrator is no longer able to access the Windows Amazon EC2 instance because the Windows administrator password is lost. As a Security Engineer, you have been tasked with the job of resetting the password of the instance.
Which 3 steps would you suggest to reset the password using EC2Launch v2?
- Launch a temporary instance and attach the volume to it as a secondary volume. Delete the .run-once file from the instance, located at %ProgramData%/Amazon/EC2Launch/state/.run-once
- Verify that the EC2Launch v2 service is running. Detach the EBS root volume from the instance
- Reattach the volume to the original instance as the root volume and connect to the instance using its key pair to retrieve the administrator password. Connect to the instance using its current public DNS name
The latest guidelines issued by the security team at a company mandate an application to block HTTP requests that don’t have a User-Agent header or have a specific User-Agent in the request.
How will you block these requests using AWS WAF?
Block requests that contain a specific User-Agent in the request using custom Rules. Block requests that don’t contain a User-Agent header using either AWS Managed Rules or custom rules
web application is deployed on EC2 instances running under an Auto Scaling Group. The application needs to be accessible from an Application Load Balancer that provides HTTPS termination, and accesses a PostgreSQL database managed by RDS.
As an AWS Certified Security Specialist, how would you configure the security groups?
- The security group of the ALB should have an inbound rule from anywhere on port 443
- The security group of RDS should have an inbound rule from the security group of the EC2 instances in the ASG on port 5432
- The security group of the EC2 instances should have an inbound rule from the security group of the ALB on port 80
An organization has added virtual machine images, software, and a few databases to its AWS Service Catalog. These will be used by multiple development teams to build their business workloads. The organization does not want the end users to launch and manage products using their own IAM credentials.
How will you address this requirement and implement it in the least possible time?
Add launch constraint(s) to each product in the service catalog portfolio
A launch constraint specifies the AWS Identity and Access Management (IAM) role that Service Catalog assumes when an end user launches, updates, or terminates a product. An IAM role is a collection of permissions that an IAM user or AWS service can assume temporarily to use AWS services.
A Security Engineer is planning for a DDoS-resilient architecture for a three-tier web application. What are the 3 best practices to consider for DDoS mitigation?
- The security groups assigned to Application Load Balancers should be configured to not use connection tracking
- If you are subscribed to AWS Shield Advanced, you can register Elastic IP addresses as Protected Resources
- When using Amazon CloudFront and AWS WAF with Amazon API Gateway, configure the cache behavior for your distributions to forward all headers to the API Gateway regional endpoint
A media company stores all of its business data on Amazon S3 buckets. Since a massive growth in the number of customers has resulted in complicated bucket policies, the company has now hired you as an AWS Certified Security Specialist for simplifying the company’s S3 buckets configuration to facilitate access for the company’s customers as well as other connected applications.
What are the 3 important configuration characteristics to consider while defining access points for the S3 buckets?
- The cross-account access points don’t grant access to data until you are granted permissions from the bucket owner
- You can’t configure Cross-Region Replication to operate through an access point
- You can only use access points to perform operations on objects. You can’t use access points to perform Amazon S3 operations, such as modifying or deleting buckets
A media company uses Amazon S3 to store the images uploaded by the users. These images are kept encrypted in S3 by using AWS-KMS and the company manages its own Customer Master Key (CMK) for encryption. A member of the security team accidentally deleted the CMK a day ago, thereby rendering the user’s photo data unrecoverable. As an AWS Certified Security Specialist, you have been tasked by the company to provide a solution for this issue.
What step would you recommend to solve this issue?
As the CMK was deleted a day ago, it must be in the ‘pending deletion’ status and hence you can just cancel the CMK deletion and recover the key
A company’s security policy mandates enforcing VPC Flow Logs for all the VPCs defined on AWS. A Security Engineer has been tasked to automate this compliance check and subsequently inform the governance teams if any VPC is found to be non-compliant.
Which steps will you combine for automating the process to meet the compliance guidelines?
- Create a Lambda function that polls Config to detect non-compliant resources daily and send notifications via Amazon SNS
- Create a Lambda function containing the logic to determine if a resource is compliant or non-compliant. Create a custom Config rule that uses this Lambda function as its source
A retail company has its flagship application hosted on Amazon EC2 instances that are configured in an Auto Scaling group behind a public-facing Application Load Balancer (ALB). The application should only be accessible to users from a specific country. The company also needs the ability to monitor any prohibited requests for further analysis by the security team.
What will you suggest as the most optimal and low-maintenance solution for the given use case?
Set up an AWS Web Application Firewall (WAF) web ACL. Create a rule to deny any requests that do not originate from the specified country. Attach the rule with the web ACL. Attach the web ACL with the ALB
A financial services company wants to develop a solution called Financial Information System (FIS) on AWS Cloud that would allow the financial institutions and government agencies to collaborate, anticipate and navigate the changing finance landscape. While pursuing this endeavor, the company would like to decrease its IT operational overhead. The solution should help the company eliminate the bottleneck created by manual provisioning of development pipelines while adhering to crucial governance and control requirements. As a means to this end, the company has set up “AWS Organizations” to manage several of these scenarios and would like to use Service Control Policies (SCP) for central control over the maximum available permissions for the various accounts in their organization. This allows the organization to ensure that all accounts stay within the organization’s access control guidelines.
Which 3 scenarios would you identify as correct regarding the given use-case?
- If a user or role has an IAM permission policy that grants access to an action that is either not allowed or explicitly denied by the applicable SCPs, the user or role can’t perform that action
- SCPs do not affect service-linked role
- SCPs affect all users and roles in attached accounts, including the root user
A Security Engineer received a GuardDuty security alert pertaining to one of the Amazon EC2 instances that is attempting to communicate with the IP address of a remote host known to hold credentials and stolen data captured by malware. The Security Engineer immediately tried to isolate the instance by activating the isolation security group on the instance. However, within a few minutes, the engineer received a similar alert again.
What represent the underlying reason for this behavior and what is the solution to remediate the issue?
When you change a security group rule, its tracked connections are not immediately interrupted. The tracked connections need to be configured to change to untracked connections and then apply the isolation security group to isolate the compromised instance
A data analytics company processes the sensitive data of several financial institutions across the country. The company needs an automated and efficient way to identify sensitive information and operationalize security for its customers while keeping costs low. The solution should also have a security dashboard that aggregates alerts and facilitates automated remediation of security issues while having a complete view of the security architecture of the systems. A high-performing interactive query service is also needed for business purposes.
As a Security Engineer, which 3 options will you combine to implement a cost-optimal and high-performance solution for the given requirements?
- Configure AWS Security Hub to have a central dashboard for higher visibility of the environment and remediate issues quickly
- Use Amazon Athena to analyze data in Amazon Simple Storage Service (Amazon S3) to retrieve any amount of data from anywhere—using standard SQL
- Store the data cost-effectively on Amazon S3 buckets and use Amazon Macie to automatically discover, classify and protect the highly sensitive data
An AWS organization manages its security and compliance units through two different AWS accounts. Both the accounts need AWS Config configuration and compliance data from multiple AWS accounts and Regions to get a centralized view of the resource inventory. Currently, the teams use shared access to the management account to fetch the required data.
To enforce enhanced security measures, the company is looking at eliminating the need to share management account credentials with the team. As a Security Engineer, how will you implement this requirement with the least time and effort?
Use the aggregator feature of AWS Config to provide access to AWS Config data to both accounts without the need to share the management account details
An aggregator is an AWS Config resource type that collects AWS Config configuration and compliance data from multiple AWS accounts and Regions into a single account and Region to get a centralized view of your resource inventory and compliance.
A social media company wants to block access to its application from specific countries; however, the company wants to allow its remote development team (from one of the blocked countries) to have access to the application. The application is deployed on EC2 instances running under an Application Load Balancer (ALB) with AWS WAF.
As an AWS Certified Security Specialist, which 2 solutions will you combine to address the given use case?
- Use WAF IP set statement that specifies the IP addresses that you want to allow through
- Use WAF geo match statement listing the countries that you want to block
The security team at an IT company has recently migrated to AWS and they are configuring security groups for their two-tier application with public web servers and private database servers. The team wants to understand the allowed configuration options for an inbound rule for a security group.
As an AWS Certified Security Specialist, what would you identify as an INVALID option for setting up such a configuration?
You can use an Internet Gateway ID as the custom source for the inbound rule
A Security Engineer has configured an AWS Web Application Firewall (WAF) for all the Application Load Balancers (ALBs) after getting a possible threat alert from the company’s IT security department.
How can the Engineer validate if the AWS WAF rules are working?
Enable WAF comprehensive logs that are delivered through Amazon Kinesis Firehose to a destination of your choice
AWS WAF supports full logging of all web requests inspected by the service. Customers can store these logs in Amazon S3 for compliance and auditing needs as well as use them for debugging and additional forensics. The logs will help customers understand why certain rules are triggered and why certain web requests are blocked. Customers can also integrate the logs with their SIEM and log analysis tools.
The security team at a company has set up an IAM user with full permissions for the EC2 service, yet the user is unable to start an Amazon EC2 instance after it was stopped for maintenance purposes. The instance would change its state to “Pending” but would eventually switch back to “Stopped” with the error “client error on launch”. Upon investigating the issue, it was discovered that the EC2 instance had attached Amazon EBS volumes that were encrypted using a Customer Master Key (CMK). Detaching the encrypted volumes from the EC2 instance resolved the issue and allowed the user to start the instance successfully.
Following is a snippet of the existing IAM user policy:
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: [
<action>
],
"Resource": "arn:aws:kms:<region>:<accountId>:key/kms-encryption-key-for-ebs",
"Condition": <condition>
}
]
}
You have been tasked to build a solution to fix this issue. What do you recommend?</condition></accountId></region></action>
- Add the condition as { “Bool”: { “kms:GrantIsForAWSResource”: true } to the IAM user policy
- Add the <action> as kms:CreateGrant to the IAM user policy</action>
A financial services company wants to share sensitive accounting data that is stored in an Amazon RDS DB instance with an external auditor. The auditor has another AWS account and must own a copy of the database.
What would you recommend to securely share the database with the auditor?
Create an encrypted snapshot of the database, share the snapshot, and allow access to the AWS Key Management Service (AWS KMS) encryption key
The security team at a company needs to implement a client-side encryption mechanism for objects that will be stored in a new Amazon S3 bucket. The team created a CMK that is stored in AWS Key Management Service (AWS KMS) for this purpose. The team created the following IAM policy and attached it to an IAM role:
{
“Version”: “2012-10-17”,
“Id”: “key-policy-1”,
“Statement”: [
{
“Sid”: “GetPut”,
“Effect”: “Allow”,
“Action”: [
“s3:GetObject”,
“s3:PutObject”
],
“Resource”: “arn:aws:s3:::ExampleBucket/*”
},
{
“Sid”: “KMS”,
“Effect”: “Allow”,
“Action”: [
“kms:Decrypt”,
“kms:Encrypt”
],
“Resource”: “arn:aws:kms:us-west-1:111122223333:key/keyid-12345”
}
]
}
The team was able to successfully get existing objects from the S3 bucket while testing. But any attempts to upload a new object resulted in an error. The error message stated that the action was forbidden.
Which IAM policy action should be added to the IAM policy to resolve the error?
kms:GenerateDataKey
An Amazon EC2 instance connects to an Amazon S3 bucket using an IAM role with necessary permissions. While analyzing the logs, a security engineer raised the possibility of the instance being compromised. The instance hosts a critical application and cannot be immediately terminated.
As an AWS Certified Security Specialist, what will you suggest as the fastest way to block further access to sensitive data from the compromised instance?
Revoke all active sessions for the IAM role. Update the S3 bucket policy to deny access to the IAM role. Remove the IAM role from the EC2 instance profile
A project manager has connected with you for the resolution of an issue. Although an AWS Identity and Access Management (IAM) entity has admin permissions, it has received an access denied error.
As an AWS Certified Security Specialist, how will you troubleshoot and resolve this issue?
- If the requests are routed through a VPC endpoint, then check for any restrictions coming from the associated VPC endpoint policy
- A session policy is in place and is causing an authorization issue
As a Security Engineer, you have been tasked with the job of automating the detection and remediation of threats against your AWS environments using Amazon GuardDuty findings.
Which steps will you follow to implement this solution most efficiently?
- Configure CloudWatch Event to filter GuardDuty findings when a malicious activity is suspected. Configure the CloudWatch Event to invoke a Lambda function to parse the GuardDuty finding and store it in the Amazon DynamoDB table, if required
- After checking the existing entries in the Amazon DynamoDB table, AWS Lambda function creates a Rule inside AWS WAF and in a VPC NACL, and a notification email is sent via Amazon Simple Notification Service (SNS)
A Security Engineer is designing a solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls. Since the individual developers will have AWS account root user-level access to their own accounts, the engineer wants to ensure that the mandatory AWS CloudTrail configuration that is applied to new developer accounts is not modified.
Which of the following actions meets the given requirements?
Set up a service control policy (SCP) that prohibits changes to CloudTrail, and attach it to the developer accounts
As a Security Engineer, you received a notification from AWS about suspicious activity in your account. What are the 3 security checks/actions that you will need to perform before responding to the AWS Support Center?
- In the IAM console, under the Permissions tab, look for a policy named AWSExposedCredentialPolicy_DO_NOT_REMOVE. If the user has this policy attached, then rotate the access keys for the user
- Create new access keys and modify the application to use new ones. Deactivate the exposed account access keys immediately. Subsequently, delete the exposed keys only when you have verified the proper functioning of the application
- If you must retain an EC2 instance for regulatory, compliance, or legal reasons, then create an Amazon EBS snapshot before terminating the instance
The development team at an e-commerce company has recently migrated to AWS Cloud from its on-premises data center. The team is evaluating CloudFront to be used as a CDN for its flagship application. The team has hired you as an AWS Certified Security Specialist to advise on CloudFront capabilities on routing and security.
Which 3 would you identify as correct regarding CloudFront?
- Use an origin group with primary and secondary origins to configure CloudFront for high-availability and failover
- CloudFront can route to multiple origins based on the content type
- Use field-level encryption in CloudFront to protect sensitive data for specific content
Field-level encryption allows you to enable your users to securely upload sensitive information to your web servers. The sensitive information provided by your users is encrypted at the edge, close to the user, and remains encrypted throughout your entire application stack. This encryption ensures that only applications that need the data—and have the credentials to decrypt it—can do so.
As a security engineer for an IT company, you have received a notice from AWS that the resources for your company’s AWS account were reported for abusive activity.
What should be your course of action after receiving the notice?
Review the abuse notice and reply explaining how you will prevent the abusive activity from recurring in the future
A security engineer has attached an AWS Identity and Access Management (IAM) role to an Amazon Elastic Compute Cloud (Amazon EC2) instance. Upon testing, the engineer realized that the Amazon EC2 instance makes API calls with an IAM user instead of the attached IAM role.
What is the issue and how will you fix it?
Check if the IAM user credentials are stored in the .aws/credentials file. Because these credentials have higher precedence over role credentials, IAM user credentials will be used to make the API calls. Delete the credentials file
An AWS Firewall Manager policy scope has been defined for all resources of an AWS Organization. Due to a recent organization-wide resource optimization effort, a Security Engineer is reviewing the status of several out-of-scope resources that were earlier covered under the policy.
What correctly outlines the default behavior of AWS Firewall Manager for the given context?
The associated AWS Config managed rules are deleted. Any associated AWS WAF web access control lists (web ACLs) that don’t contain any resources are deleted
An e-commerce company is using Amazon Macie, AWS Shield Advanced, Amazon Inspector and AWS Firewall Manager in its AWS account. The company wants to receive alerts in case a DDoS attack occurs against the account.
As an AWS Certified Security Specialist, what would you recommend?
Set up an Amazon CloudWatch alarm that monitors Shield Advanced metrics for an active DDoS event
While consolidating logs for the weekly reporting, a development team at a retail company realized that an unusually large number of illegal AWS API queries were made sometime during the week. Due to the off-season, there was no visible impact on the systems. However, this event led the management team to seek an automated solution that can trigger near-real-time warnings in case such an event recurs.
Which of the following represents the best solution for the given scenario?
Create an Amazon CloudWatch metric filter that processes CloudTrail logs having API call details and looks at any errors by factoring in all the error codes that need to be tracked. Create an alarm based on this metric’s rate to send an SNS notification to the required team
An application hosted on an Amazon EC2 instance writes its request logs, availability logs, and threat logs to a text file. This file is read by a custom program to track and process any security issues inferred from the logs. An increase in log data has resulted in the malfunctioning of the custom program. The company is looking at a scalable solution to collect and analyze log files.
Which design will ensure that the aforementioned criteria are met with the LEAST amount of effort?
Install and configure the unified CloudWatch agent on the application’s EC2 instance. Create a CloudWatch metric filter to monitor the application logs. Configure CloudWatch alerts based on these metrics
A security engineer has configured a unified CloudWatch agent to push Amazon EC2 logs to Amazon CloudWatch Logs. However, the security team can’t see any logs in the CloudWatch Logs console.
Why isn’t the unified CloudWatch agent pushing log events?
- IAM user or IAM role policy should include the following IAM permissions:
“logs:CreateLogGroup”,
“logs:CreateLogStream”,
“logs:PutLogEvents”,
“logs:DescribeLogStreams” - Creating an Amazon Machine Image (AMI) after the CloudWatch agent is installed can lead to errors in the CloudWatch agent
It’s a best practice to install the CloudWatch agent at launch using AWS CloudFormation, AWS Systems Manager Agent (SSM Agent), user data scripts, or the AWS CLI. It is also a best practice to create an AMI before installing the CloudWatch agent. AMIs typically capture unique information from the original instance. Metadata becomes out of sync, and this state can lead to the CloudWatch agent not working as intended. Out-of-sync metadata is the reason that many Windows instances require Sysprep when working with AMI.
A security team configured an Amazon CloudWatch alarm to notify one of the team members when a metric breaches a defined threshold for multiple periods in a row. But, the CloudWatch alarm is notifying the team after just one breach of the threshold.
What is the issue and how will you fix the CloudWatch alarm to behave as expected?
CloudWatch alarm might be configured to treat a missing data point the same way as a breaching data point. Configure the alarm to evaluate missing data points as NOT BREACHING
After a recent DDoS assault, the IT security team of a media company has asked the Security Engineer to revamp the security of the application to prevent future attacks. The website is hosted on an Amazon EC2 instance and data is maintained on Amazon RDS. A large part of the application data is static and this data is in the form of images.
Which 2 steps can be combined to constitute the revamped security model?
- Use Amazon Route 53 to distribute traffic
- Move the static content to Amazon S3, and front this with an Amazon CloudFront distribution. Configure another layer of protection by adding AWS Web Application Firewall (AWS WAF) to the CloudFront distribution
A junior developer has been asked to configure access to an Amazon EC2 instance hosting a web application. The developer has configured a new security group to permit incoming HTTP traffic from 0.0.0.0/0 and retained any default outbound rules. A custom Network Access Control List (NACL) connected with the instance’s subnet is configured to permit incoming HTTP traffic from 0.0.0.0/0 and retained any default outbound rules.
As a Security Engineer, which of the following solutions would you suggest if the EC2 instance needs to accept and respond to requests from the internet?
- An outbound rule must be added to the Network ACL (NACL) to allow the response to be sent to the client on the ephemeral port range
Security groups are stateful, so allowing inbound traffic to the necessary ports enables the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic. By default, each custom Network ACL denies all inbound and outbound traffic until you add rules.
As part of the organization-wide security best practices, a company has mandated that all software installed on the EC2 instances should be upgraded to its most recent authorized version every 30 days. For this requirement, the Security Administrator has to provide a weekly report that lists all the instances that do not have the latest software updates deployed.
What is the most optimal way to implement this requirement?
Use Patch Manager, a capability of AWS Systems Manager to automatically scan your instances and report compliance on a schedule, install available software updates on a schedule, and scan targets on demand
An international media company has recently migrated their operations to AWS, operating across multiple accounts within AWS Organizations. They have a critical need to log all user actions across these accounts for audit purposes. For certain key actions, they want to be immediately notified through an email list.
Which solution best fits their needs?
Configure an organizational trail with AWS CloudTrail, forwarding logs to CloudWatch Logs. Set a metric filter within CloudWatch Logs to catch specific actions and create a CloudWatch alarm to send messages to an SNS topic upon these actions
A security architect is designing a highly secure application and must determine the best solution for storage of encryption keys. The encryption keys must be accessible only from within a VPC on single-tenant hardware security modules (HSMs). The solution must also include access logging and high availability.
Which service meet these requirements?
AWS CloudHSM
A company enforces encryption for all Amazon EBS volumes. Following security incidents, EBS snapshots sometimes need to be shared with a forensics account for analysis. The security team must ensure the volumes remain encrypted as much as possible throughout the process.
Which steps are required to share the encrypted snapshots with least privilege?
Share an encrypted snapshot, use a customer managed KMS key, and allow the Decrypt and CreateGrant actions for the target account in the key policy
A security engineer is working with a company to design an ecommerce application. The application will run on Amazon EC2 instances that run in an Auto Scaling group behind an Application Load Balancer (ALB). The application will use an Amazon RDS DB instance for its database.
The only required connectivity from the internet is for HTTP and HTTPS traffic to the application. The application must communicate with an external payment provider that allows traffic only from a preconfigured allow list of IP addresses. The company must ensure that communications with the external payment provider are not interrupted as the environment scales.
Which combination of 3 actions should the security engineer recommend to meet these requirements?
- Deploy a NAT gateway in each private subnet for every Availability Zone that is in use
- Place the DB instance in a private subnet
- Configure the Auto Scaling group to place the EC2 instances in a private subnet
