Security Flashcards
A security engineer is designing an incident response plan to address the risk of a compromised Amazon EC2 instance. The plan must recommend a solution to meet the following requirements:
- A trusted forensic environment must be provisioned
- Automated response processes must be orchestrated
Which AWS services should be included in the plan? {Select TWO)
A. AWS CloudFormation
B. Amazon GuardDuty
C. Amazon Inspector
D. Amazon Macie
E. AWS Step Functions
A. AWS CloudFormation
E. AWS Step Functions
A security engineer has been tasked with implementing a solution that allows the company’s development team to have interactive command-line access to Amazon EC2 Linux instances using the AWS Management Console. Which steps should the security engineer take to satisfy this requirement while maintaining least privilege? A. Enable AWS Systems Manager in the AWS Management Console and configure for access to EC2 instances using the default AmazonEC2RoleforSSM role. Install the Systems Manager Agent on all EC2 Linux instances that need interactive access. Configure IAM user policies to allow development team access to the Systems Manager Session Manager and attach to the team’s IAM users. B. Enable console SSH access in the EC2 console. Configure IAM user policies to allow development team access to the AWS Systems Manager Session Manager and attach to the development team’s IAM users. C. Enable AWS Systems Manager in the AWS Management Console and configure to access EC2 instances using the default AmazonEC2RoleforSSM role. Install the Systems Manager Agent on all EC2 Linux instances that need interactive access. Configure a security group that allows SSH port 22 from all published IP addresses. Configure IAM user policies to allow development team access to the AWS Systems Manager Session Manager and attach to the team’s IAM users. D. Enable AWS Systems Manager in the AWS Management Console and configure to access EC2 instances using the default AmazonEC2RoleforSSM role Install the Systems Manager Agent on all EC2 Linux instances that need interactive access. Configure IAM policies to allow the development team access to the EC2 console and attach to the teams IAM users.”
A. Enable AWS Systems Manager in the AWS Management Console and configure for access to EC2 instances using the default AmazonEC2RoleforSSM role. Install the Systems Manager Agent on all EC2 Linux instances that need interactive access. Configure IAM user policies to allow development team access to the Systems Manager Session Manager and attach to the team’s IAM users.
“A large government organization is moving to the cloud and has specific encryption requirements. The first workload to move requires that a customer’s data be immediately destroyed when the customer makes that request. Management has asked the security team to provide a solution that will securely store the data, allow only authorized applications to perform encryption and decryption and allow for immediate destruction of the data Which solution will meet these requirements? A. Use AWS Secrets Manager and an AWS SDK to create a unique secret for the customer-specific data B. Use AWS Key Management Service (AWS KMS) and the AWS Encryption SDK to generate and store a data encryption key for each customer. C. Use AWS Key Management Service (AWS KMS) with service-managed keys to generate and store customer-specific data encryption keys D. Use AWS Key Management Service (AWS KMS) and create an AWS CloudHSM custom key store Use CloudHSM to generate and store a new CMK for each customer. “
“A. Use AWS Secrets Manager and an AWS SDK to create a unique secret for the customer-specific data “
“Unapproved changes were previously made to a company’s Amazon S3 bucket. A security engineer configured AWS Config to record configuration changes made to the company’s S3 buckets. The engineer discovers there are S3 configuration changes being made, but no Amazon SNS notifications are being sent. The engineer has already checked the configuration of the SNS topic and has confirmed the configuration is valid. Which combination of steps should the security engineer take to resolve the issue? (Select TWO.) A. Configure the S3 bucket ACLs to allow AWS Config to record changes to the buckets. B. Configure policies attached to S3 buckets to allow AWS Config to record changes to the buckets. C. Attach the AmazonS3ReadOnryAccess managed policy to the IAM user. D. Verify the security engineer’s IAM user has an attached policy that allows all AWS Config actions. E. Assign the AWSConfigRole managed policy to the AWS Config role “
“B. Configure policies attached to S3 buckets to allow AWS Config to record changes to the buckets. E. Assign the AWSConfigRole managed policy to the AWS Config role “
“A company is operating an open-source software platform that is internet facing. The legacy software platform no longer receives security updates. The software platform operates using Amazon route 53 weighted load balancing to send traffic to two Amazon EC2 instances that connect to an Amazon POS cluster a recent report suggests this software platform is vulnerable to SQL injection attacks. with samples of attacks provided. The company’s security engineer must secure this system against SQL injection attacks within 24 hours. The secure, engineer’s solution involve the least amount of effort and maintain normal operations during implementation. What should the security engineer do to meet these requirements? A. Create an Application Load Balancer with the existing EC2 instances as a target group Create an AWS WAF web ACL containing rules mat protect the application from this attach. then apply it to the ALB Test to ensure me vulnerability has been mitigated, then redirect thee Route 53 records to point to the ALB Update security groups on the EC 2 instances to prevent direct access from the internet B. Create an Amazon CloudFront distribution specifying one EC2 instance as an origin Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to me distribution Test to ensure the vulnerability has mitigated, then redirect the Route 53 records to point to CloudFront C. Obtain me latest source code for the platform and make ire necessary updates Test me updated code to ensure that the vulnerability has been irrigated, then deploy me patched version of the platform to the EC2 instances D. Update the security group mat is attached to the EC2 instances, removing access from the internet to the TCP port used by the SQL database Create an AWS WAF web ACL containing rules mat protect me application from this attack, men apply it to the EC2 instances Test to ensure me vulnerability has been mitigated. then restore the security group to me onginal setting “
“A. Create an Application Load Balancer with the existing EC2 instances as a target group Create an AWS WAF web ACL containing rules mat protect the application from this attach. then apply it to the ALB Test to ensure me vulnerability has been mitigated, then redirect thee Route 53 records to point to the ALB Update security groups on the EC 2 instances to prevent direct access from the internet “
“A company is using AWS Organizations to manage multiple AWS accounts. The company has an application that allows users to assume the AppUser IAM role to download files from an Amazon S3 bucket that is encrypted with an AWS KMS CMK However when users try to access the files in the S3 bucket they get an access denied error. What should a Security Engineer do to troubleshoot this error? (Select THREE ) A. Ensure the KMS policy allows the AppUser role to have permission to decrypt for the CMK B. Ensure the S3 bucket policy allows the AppUser role to have permission to get objects for the S3 bucket C. Ensure the CMK was created before the S3 bucket. D. Ensure the S3 block public access feature is enabled for the S3 bucket. E. Ensure that automatic key rotation is disabled for the CMK F. Ensure the SCPs within Organizations allow access to the S3 bucket. “
“A. Ensure the KMS policy allows the AppUser role to have permission to decrypt for the CMK B. Ensure the S3 bucket policy allows the AppUser role to have permission to get objects for the S3 bucket F. Ensure the SCPs within Organizations allow access to the S3 bucket. “
“A security engineer has noticed that VPC Flow Logs are getting a lot REJECT traffic originating from a single Amazon EC2 instance in an Auto Scaling group. The security engineer is concerned that this EC2 instance may be compromised. What immediate action should the security engineer take? What immediate action should the security engineer take? A. Remove me instance from the Auto Seating group Close me security group mm ingress only from a single forensic P address to perform an analysis. B. Remove me instance from the Auto Seating group Change me network ACL rules to allow traffic only from a single forensic IP address to perform en analysis Add a rule to deny all other traffic. C. Remove the instance from the Auto Scaling group Enable Amazon GuardDuty in that AWS account Install the Amazon Inspector agent cm the suspicious EC 2 instance to perform a scan. D. Take a snapshot of the suspicious EC2 instance. Create a new EC2 instance from me snapshot in a closed security group with ingress only from a single forensic IP address to perform an analysis “
“B. Remove me instance from the Auto Seating group Change me network ACL rules to allow traffic only from a single forensic IP address to perform en analysis Add a rule to deny all other traffic. “
“A company is collecting AWS CloudTrail log data from multiple AWS accounts by managing individual trails in each account and forwarding log data to a centralized Amazon S3 bucket residing in a log archive account. After CloudTrail introduced support for AWS Organizations trails, the company decided to further centralize management and automate deployment of the CloudTrail logging capability across all of its AWS accounts. The company’s security engineer created an AWS Organizations trail in the master account, enabled server-side encryption with AWS KMS managed keys (SSE-KMS) for the log files, and specified the same bucket as the storage location. However, the engineer noticed that logs recorded by the new trail were not delivered to the bucket. Which factors could cause this issue? (Select TWO.) A. The CMK key policy does not allow CloudTrail to make encrypt and decrypt API calls against the key. B. The CMK key policy does not allow CloudTrail to make GenerateDataKey API calls against the key. C. The IAM role used by the CloudTrail trail does not have permissions to make PutObject API calls against a folder created for the Organizations trail. D. The S3 bucket policy does not allow CloudTrail to make PutObject API calls against a folder created for the Organizations trail. E. The CMK key policy does not allow the IAM role used by the CloudTrail trail to use the key for crypto graphicaI operations. “
“A. The CMK key policy does not allow CloudTrail to make encrypt and decrypt API calls against the key. D. The S3 bucket policy does not allow CloudTrail to make PutObject API calls against a folder created for the Organizations trail. “
“Which of the following are valid configurations for using SSL certificates with Amazon CloudFront? (Select THREE ) A. Default AWS Certificate Manager certificate B. Custom SSL certificate stored in AWS KMS C. Default CloudFront certificate D. Custom SSL certificate stored in AWS Certificate Manager E. Default SSL certificate stored in AWS Secrets Manager F. Custom SSL certificate stored in AWS IAM “
?
“A company has implemented centralized logging and monitoring of AWS CloudTrail logs from all Regions in an Amazon S3 bucket. The log Hies are encrypted using AWS KMS. A Security Engineer is attempting to review the log files using a third-party tool hosted on an Amazon EC2 instance The Security Engineer is unable to access the logs in the S3 bucket and receives an access denied error message What should the Security Engineer do to fix this issue? A. Check that the role the Security Engineer uses grants permission to decrypt objects using the KMS CMK. B. Check that the role the Security Engineer uses grants permission to decrypt objects using the KMS CMK and gives access to the S3 bucket and objects C. Check that the role the EC2 instance profile uses grants permission lo decrypt objects using the KMS CMK and gives access to the S3 bucket and objects D. Check that the role the EC2 instance profile uses grants permission to decrypt objects using the KMS CMK “
“C. Check that the role the EC2 instance profile uses grants permission lo decrypt objects using the KMS CMK and gives access to the S3 bucket and objects “
“A company has a VPC with several Amazon EC2 instances behind a NAT gateway. The company’s security policy states that all network traffic must be logged and must include the original source and destination IP addresses. The existing VPC Flow Logs do not include this information. A security engineer needs to recommend a solution. Which combination of steps should the security engineer recommend? (Select TWO ) A. Edit the existing VPC Flow Logs. Change the log format of the VPC Flow Logs from the Amazon default format to a custom format. B. Delete and recreate the existing VPC Flow Logs. Change the log format of the VPC Flow Logs from the Amazon default format to a custom format. C. Change the destination to Amazon CloudWatch Logs. D. Include the pkt-srcaddr and pkt-dstaddr fields in the log format. E. Include the subnet-id and instance-id fields in the log format. “
“A. Edit the existing VPC Flow Logs. Change the log format of the VPC Flow Logs from the Amazon default format to a custom format. E. Include the subnet-id and instance-id fields in the log format. “
“A company recently performed an annual security assessment of its AWS environment. The assessment showed that audit logs are not available beyond 90 days and that unauthorized changes to IAM policies are made without detection. How should a security engineer resolve these issues? A. Create an Amazon S3 lifecycle policy that archives AWS CloudTrail trail logs to Amazon S3 Glacier after 90 days. Configure Amazon Inspector to provide a notification when a policy change is made to resources. B. Configure AWS Artifact to archive AWS CloudTrail logs Configure AWS Trusted Advisor to provide a notification when a policy change is made to resources C. Configure Amazon CloudWatch to export log groups to Amazon S3. Configure AWS CloudTrail to provide a notification when a policy change is made to resources. D. Create an AWS CloudTrail trail that stores audit logs in Amazon S3. Configure an AWS Config rule to provide a notif cation when a policy change is made to resources. “
?
“A company has several critical applications running on a large fleet of Amazon EC2 instances. As part of a security operations review, the company needs to apply a critical operating system patch to EC2 instances within 24 hours of the patch becoming available from the operating system vendor. The company does not have a patching solution deployed on AWS, but does have AWS Systems Manager configured. The solution must also minimize administrative overhead. What should a security engineer recommend to meet these requirements? A. Create an AWS Config rule defining the patch as a required configuration for EC2 instances. B. Use the AWS Systems Manager Run Command to patch affected instances. C. Use an AWS Systems Manager Patch Manager predefined baseline to patch affected instances. D. Use AWS Systems Manager Session Manager to log in to each affected instance and apply the patch. “
“B. Use the AWS Systems Manager Run Command to patch affected instances. “
“A security engineer is asked to update an AW3 CoudTrail log file prefix for an existing trail. When attempting to save the change in the CloudTrail console, the security engineer receives the following error message. ““There is a problem with the bucket policy’’ What will enable the security engineer to saw the change? A. Create a new trail with the updated log file prefix, and then delete the original nail Update the existing bucket policy in the Amazon S3 console with the new log the prefix, and then update the log file prefix in the CloudTrail console B. Update the existing bucket policy in the Amazon S3 console to allow the security engineers principal to perform PutBucketPolicy. and then update the log file prefix in the CloudTrail console C. Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail console. D. Update the existing bucket policy in the Amazon S3 console to allow the security engineers principal to perform GetBucketPolicy, and then update the log file prefix in the CloudTrail console “
“B. Update the existing bucket policy in the Amazon S3 console to allow the security engineers principal to perform PutBucketPolicy. and then update the log file prefix in the CloudTrail console “
“A Security Engineer has been asked to troubleshoot inbound connectivity to a web server. This single web server is not receiving inbound connections from the internet, whereas all other web servers are functioning properly. The architecture includes network ACLs, security groups, and a virtual security appliance. In addition, the Development team has implemented Application Load Balancers (ALBs) to distribute the load across all web servers. It is a requirement that traffic between the web servers and the internet flow through the virtual security appliance. The Security Engineer has verified the following: 1. The rule set in the Security Groups is correct 2. The rule set in the network ACLs is correct 3. The rule set in the virtual appliance is correct Which of the following are other valid items to troubleshoot in this scenario? (Choose two.) A. Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to a NAT gateway. B. Verify which Security Group is applied to the particular web server’s elastic network interface (ENI). C. Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to the virtual security appliance. D. Verify the registered targets in the ALB. E. Verify that the 0.0.0.0/0 route in the public subnet points to a NAT gateway. “
“C. Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to the virtual security appliance. D. Verify the registered targets in the ALB. “
“A Web Administrator for the website example.com has created an Amazon CloudFront distribution for dev.example.com, with a requirement to configure HTTPS using a custom TLS certificate imported to AWS Certificate Manager. Which combination of steps is required to ensure availability of the certificate in the CloudFront console? (Choose two.) A. Call UploadServerCertificate with /cloudfront/dev/ in the path parameter. B. Import the certificate with a 4,096-bit RSA public key. C. Ensure that the certificate, private key, and certificate chain are PKCS #12-encoded. D. Import the certificate in the us-east-1 (N. Virginia) Region. E. Ensure that the certificate, private key, and certificate chain are PEM-encoded. “
“D. Import the certificate in the us-east-1 (N. Virginia) Region. E. Ensure that the certificate, private key, and certificate chain are PEM-encoded. “
“A company’s Security Engineer has been asked to monitor and report all AWS account root user activities. Which of the following would enable the Security Engineer to monitor and report all root user activities? (Select TWO) A. Configuring AWS Organizations to monitor root user API calls on the paying account B. Creating an Amazon CloudWatch Events rule that will trigger when any API call from the root user is reported C. Configuring Amazon Inspector to scan the AWS account for any root user activity D. Configuring AWS Trusted Advisor to send an email to the Security team when the root user logs in to the console E. Using Amazon SNS to notify the target group “
“B. Creating an Amazon CloudWatch Events rule that will trigger when any API call from the root user is reported E. Using Amazon SNS to notify the target group “
“A company Is building a data lake on Amazon S3. The data consists of millions of small files containing sensitive information. The security team has the following requirements for the architecture: • Data must be encrypted in transit. • Data must be encrypted at rest. • The bucket must be private, but if the bucket is accidentally made public, the data mustremain confidential. Which combination of steps would meet the requirements? (Select THREE.) A. Enable AES-256 encryption using server-side encryption with Amazon S3-managed encryption keys (SSE-S3) on the S3 bucket B. Enable default encryption with server-side encryption with AWS KMS-managed keys (SSE-KMS) on the S3 bucket. C. Add a bucket policy that includes a deny if a PutObject request does not include awsiSecureTcanspoct. D. Add a bucket policy with ws: Sourcelpto Allow uploads and downloads from the corporate intranet only. E. Add a bucket policy that includes a deny if a PutObject request does not include s3:xamz-sairv9r-side-enctyption: ““aws: kms””. F. Enable Amazon Macie to monitor and act on changes to the data lake’s S3 bucket. “
“B. Enable default encryption with server-side encryption with AWS KMS-managed keys (SSE-KMS) on the S3 bucket. D. Add a bucket policy with ws: Sourcelpto Allow uploads and downloads from the corporate intranet only. F. Enable Amazon Macie to monitor and act on changes to the data lake’s S3 bucket. “
“A recent security audit identified that a company’s application team injects database credentials into the environment variables of an AWS Fargate task. The company’s security policy mandates that all sensitive data be encrypted at rest and in transit. When combination of actions should the security team take to make the application compliant within the security policy? (Select THREE) A. Store the credentials securely in a file in an Amazon S3 bucket with restricted access to the application team IAM role Ask the application team to read the credentials from the S3 object instead B. Create an AWS Secrets Manager secret and specify the key/value pairs to be stored in this secret C. Modify the application to pull credentials from the AWS Secrets Manager secret instead of the environment variables. D. Add the following statement to the container instance IAM role policy E. Log in to the AWS Fargate instance, create a script to read the secret value from AWS Secret Manager, and inject the environment variables. Ask the application team to redeploy the application. F. Option A G. Option B H. Option C I. Option D J. Option E K. Option F “
“B. Create an AWS Secrets Manager secret and specify the key/value pairs to be stored in this secret E. Log in to the AWS Fargate instance, create a script to read the secret value from AWS Secret Manager, and inject the environment variables. Ask the application team to redeploy the application. F. Option A “
“A company is designing the securely architecture (or a global latency-sensitive web application it plans to deploy to AWS. A Security Engineer needs to configure a highly available and secure two-tier architecture. The security design must include controls to prevent common attacks such as DDoS, cross-site scripting, and SQL injection. Which solution meets these requirements? A. Create an Application Load Balancer (ALB) that uses public subnets across multiple Availability Zones within a single Region. Point the ALB to an Auto Scaling group with Amazon EC2 instances in private subnets across multiple Availability Zones within the same Region. Create an Amazon CloudFront distribution that uses the ALB as its origin. Create appropriate AWS WAF ACLs and enable them on the CloudFront distribution. B. Create an Application Load Balancer (ALB) that uses private subnets across multiple Availability Zones within a single Region. Point the ALB to an Auto Scaling group with Amazon EC2 instances in private subnets across multiple Availability Zones within the same Region. Create an Amazon CloudFront distribution that uses the ALB as its origin. Create appropriate AWS WAF ACLs and enable them on the CloudFront distribution. C. Create an Application Load Balancer (ALB) that uses public subnets across multiple Availability Zones within a single Region. Point the ALB to an Auto Scaling group with Amazon EC2 instances in private subnets across multiple Availability Zones within the same Region. Create appropriate AWS WAF ACLs and enable them on the ALB. D. Create an Application Load Balancer (ALB) that uses private subnets across multiple Availability Zones within a single Region. Point the ALB to an Auto Scaling group with Amazon EC2 instances in private subnets across multiple Availability Zones within the same Region. Create appropriate AWS WAF ACLs and enable them on the ALB. “
“A. Create an Application Load Balancer (ALB) that uses public subnets across multiple”
“A company is running an application on Amazon EC2 instances in an Auto Scaling group. The application stores logs locally A security engineer noticed that logs were lost after a scale-in event. The security engineer needs to recommend a solution to ensure the durability and availability of log data All logs must be kept for a minimum of 1 year for auditing purposes What should the security engineer recommend? A. Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review. B. Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system. C. Build the Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review. D. Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon Simple Notification Service (Amazon SNS). Configure the hook to remain in the Terminating:Wait state for 1 hour to allow manual review of the security logs prior to instance termination. “
“B. Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system. “
“A company has multiple production AWS accounts. Each account has AWS CloudTrail configured to log to a single Amazon S3 bucket in a central account. Two of the production accounts have trails that are not logging anything to the S3 bucket. Which steps should be taken to troubleshoot the issue? (Choose three.) A. Verify that the log file prefix is set to the name of the S3 bucket where the logs should go. B. Verify that the S3 bucket policy allows access for CloudTrail from the production AWS account IDs. C. Create a new CloudTrail configuration in the account, and configure it to log to the account’s S3 bucket. D. Confirm in the CloudTrail Console that each trail is active and healthy. E. Open the global CloudTrail configuration in the master account, and verify that the storage location is set to the correct S3 bucket. F. Confirm in the CloudTrail Console that the S3 bucket name is set correctly. “
“B. Verify that the S3 bucket policy allows access for CloudTrail from the production AWS account IDs. D. Confirm in the CloudTrail Console that each trail is active and healthy. F. Confirm in the CloudTrail Console that the S3 bucket name is set correctly. “
“A company has several workloads running on AWS Employees are required to authenticate using on-premises ADFS and SSO to access the AWS Management Console Developers migrated an existing legacy web application to an Amazon EC2 instance Employees need to access this application from anywhere on the internet but currently, mere is no authentication system but into the application. How should the Security Engineer implement employee-only access to this system without changing the application? A. Place the application behind an Application Load Balancer (ALB) Use Amazon Cognito as authentication (or the ALB Define a SAML-based Amazon Cognito user pool and connect it to ADFS implement AWS SSO in the master account and link it to ADFS as an identity provider - Define the EC2 instance as a managed resource, then apply an IAM policy on the resource B. Define an Amazon Cognito identity pool then install the connector on the Active Directory server Use the Amazon Cognito SDK on the application instance to authenticate the employees using their C. Active Directory user names and passwords C. Create an AWS Lambda custom authorizer as the authenticator for a reverse proxy on Amazon EC2 Ensure the security group on Amazon EC2 only allows access from the Lambda function”
“A. Place the application behind an Application Load Balancer (ALB) Use Amazon Cognito as authentication (or the ALB Define a SAML-based Amazon Cognito user pool and connect it to ADFS implement AWS SSO in the master account and link it to ADFS as an identity provider - Define the EC2 instance as a managed resource, then apply an IAM policy on the resource “
“A company has a website with an Amazon CloudFront HTTPS distribution, an Application Load Balancer (ALB) with multiple web instances for dynamic website content, and an Amazon S3 bucket for static website content. The company’s security engineer recently updated the website security requirements: • HTTPS needs to be enforced for all data in transit with specific ciphers. • The CloudFront distribution needs to be accessible from the internet only. Which solution will meet these requirements? A. Set up an S3 bucket policy with the awssecuretransport key Configure the CloudFront origin access identity (OAI) with the S3 bucket Configure CloudFront to use specific ciphers. Enforce the ALB with an HTTPS listener only and select the appropriate security policy for the ciphers Link the ALB with AWS WAF to allow access from the CloudFront IP ranges. B. Set up an S3 bucket policy with the aws:securetransport key. Configure the CloudFront origin access identity (OAI) with the S3 bucket. Enforce the ALB with an HTTPS listener only and select the appropriate security policy for the ciphers. C. Modify the CloudFront distribution to use AWS WAF. Force HTTPS on the S3 bucket with specific ciphers in the bucket policy. Configure an HTTPS listener only for the ALB. Set up a security group to limit access to the ALB from the CloudFront IP ranges D. Modify the CloudFront distribution to use the ALB as the origin. Enforce an HTTPS listener on the ALB. Create a path-based routing rule on the ALB with proxies that connect lo Amazon S3. Create a bucket policy to allow access from these proxies only. “
?
“A company Is trying to replace its on-premises bastion hosts used to access on-premises Linux servers with AWS Systems Manager Session Manager. A security engineer has installed the Systems Manager Agent on all servers. The security engineer verifies that the agent is running on all the servers, but Session Manager cannot connect to them. The security engineer needs to perform verification steps before Session Manager will work on the servers. Which combination of steps should the security engineer perform? (Select THREE.) A. Open inbound port 22 to 0 0.0.0/0 on all Linux servers. B. Enable the advanced-instances tier in Systems Manager. C. Create a managed-instance activation for the on-premises servers. D. Reconfigure the Systems Manager Agent with the activation code and ID. E. Assign an IAM role to all of the on-premises servers. F. Initiate an inventory collection with Systems Manager on the on-premises servers “
“C. Create a managed-instance activation for the on-premises servers. E. Assign an IAM role to all of the on-premises servers. F. Initiate an inventory collection with Systems Manager on the on-premises servers “
“A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots. After performing a gap analysis of its disaster recovery procedures and backup strategies, the company is concerned that, next time, it will not be able to recover the EC2 instances if the AWS account was compromised and Amazon EBS snapshots were deleted. All EBS snapshots are encrypted using an AWS KMS CMK. Which solution would solve this problem? A. Create a new Amazon S3 bucket Use EBS lifecycle policies to move EBS snapshots to the new S3 bucket. Move snapshots to Amazon S3 Glacier using lifecycle policies, and apply Glacier Vault Lock policies to prevent deletion B. Use AWS Systems Manager to distribute a configuration that performs local backups of all attached disks to Amazon S3. C. Create a new AWS account with limited privileges. Allow the new account to access the AWS KMS key used to encrypt the EBS snapshots, and copy the encrypted snapshots to the new account on a recuning basis D. Use AWS Backup to copy EBS snapshots to Amazon S3. “
“A. Create a new Amazon S3 bucket Use EBS lifecycle policies to move EBS snapshots to the new S3 bucket. Move snapshots to Amazon S3 Glacier using lifecycle policies, and apply Glacier Vault Lock policies to prevent deletion “
“A Security Engineer manages AWS Organizations for a company. The Engineer would like to restrict AWS usage to allow Amazon S3 only in one of the organizational units (OUs). The Engineer adds the following SCP to the OU: The next day. API calls to AWS IAM appear in AWS CloudTrail logs In an account under that OU. How should the Security Engineer resolve this issue? A. Move the account to a new OU and deny IAM:* permissions. B. Add a Deny policy for all non-S3 services at the account level. C. Change the policy to: { “Version”: “2012-10-17”, “Statement”: [{ “Sid”: “AllowS3”, ““Effect””: ““Allow””, ““Action””: ““s3:*””, ““Resource””: “”*/*» }] } D. Detach the default FullAWSAccess SCP “
“C. Change the policy to: { “Version”: “2012-10-17”, “Statement”: [{ “Sid”: “AllowS3”, ““Effect””: ““Allow””, ““Action””: ““s3:*””, ““Resource””: “”*/*» }] } “
“A company has a serverless application for internal users deployed on AWS. The application uses AWS Lambda for the front end and for business logic. The Lambda function accesses an Amazon RDS database inside a VPC The company uses AWS Systems Manager Parameter Store for storing database credentials. A recent security review highlighted the following issues ? The Lambda function has internet access. ? The relational database is publicly accessible. ? The database credentials are not stored in an encrypted state. Which combination of steps should the company take to resolve these security issues? (Select THREE) A. Disable public access to the RDS database inside the VPC B. Move all the Lambda functions inside the VPC. C. Edit the IAM role used by Lambda to restrict internet access. D. Create a VPC endpoint for Systems Manager. Store the credentials as a string parameter. Change the parameter type to an advanced parameter. E. Edit the IAM role used by RDS to restrict internet access. F. Create a VPC endpoint for Systems Manager. Store the credentials as a SecureString parameter. “
“A. Disable public access to the RDS database inside the VPC B. Move all the Lambda functions inside the VPC. E. Edit the IAM role used by RDS to restrict internet access. “
“A company has decided to migrate sensitive documents from on-premises data centers to Amazon S3. Currently, the hard drives are encrypted to meet a compliance requirement regarding data encryption. The CISO wants to improve security by encrypting each file using a different key instead of a single key. Using a different key would limit the security impact of a single exposed key. Which of the following requires the LEAST amount of configuration when implementing this approach? A. Place each file into a different S3 bucket. Set the default encryption of each bucket to use a different AWS KMS customer managed key. B. Put all the files in the same S3 bucket. Using S3 events as a trigger, write an AWS Lambda function to encrypt each file as it is added using different AWS KMS data keys. C. Use the S3 encryption client to encrypt each file individually using S3-generated data keys D. Place all the files in the same S3 bucket. Use server-side encryption with AWS KMSmanaged keys (SSE-KMS) to encrypt the data “
“A. Place each file into a different S3 bucket. Set the default encryption of each bucket to use a different AWS KMS customer managed key. “
“A company hosts a web-based application that captures and stores sensitive data in an Amazon DynamoDB table. A security audit reveals that the application does not provide end-to-end data protection or the ability to detect unauthorized data changes The software engineering team needs to make changes that will address the audit findings. Which set of steps should the software engineering team take? A. Use an AWS Key Management Service (AWS KMS) CMK. Encrypt the data at rest. B. Use AWS Certificate Manager (ACM) Private Certificate Authority Encrypt the data in transit. C. Use a DynamoDB encryption client. Use client-side encryption and sign the table items D. Use the AWS Encryption SDK. Use client-side encryption and sign the table items. “
“A. Use an AWS Key Management Service (AWS KMS) CMK. Encrypt the data at rest. “
“A company uses a third-party identity provider and SAML-based SSO for its AWS accounts After the third-party identity provider renewed an expired signing certificate users saw the following message when trying to log in: A security engineer needs to provide a solution that corrects the error and minimizes operational overhead Which solution meets these requirements? A. Upload the third-party signing certificate’s new private key to the AWS identity provider entity defined in AWS identity and Access Management (IAM) by using the AWS Management Console B. Sign the identity provider’s metadata file with the new public key Upload the signature to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI. C. Download the updated SAML metadata tile from the identity service provider Update the file in the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI D. Configure the AWS identity provider entity defined in AWS Identity and Access Management (IAM) to synchronously fetch the new public key by using the AWS Management Console. “
“C. Download the updated SAML metadata tile from the identity service provider Update the file in the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI “
“A company has a compliance requirement to rotate its encryption keys on an annual basis. A Security Engineer needs a process to rotate the KMS Customer Master Keys (CMKs) that were created using imported key material. How can the Engineer perform the key rotation process MOST efficiently? A. Create a new CMK, and redirect the existing Key Alias to the new CMK B. Select the option to auto-rotate the key C. Upload new key material into the existing CMK. D. Create a new CMK, and change the application to point to the new CMK “
“A. Create a new CMK, and redirect the existing Key Alias to the new CMK “
“A company’s Developers plan to migrate their on-premises applications to Amazon EC2 instances running Amazon Linux AMIs. The applications are accessed by a group of partner companies The Security Engineer needs to implement the following host-based security measures for these instances: • Block traffic from documented known bad IP addresses * Detect known software vulnerabilities and CIS Benchmarks compliance. Which solution addresses these requirements? A. Launch the EC2 instances with an IAM role attached. Include a user data script that uses the AWS CLI to retrieve the list of bad IP addresses from AWS Secrets Manager and uploads it as a threat list in Amazon GuardDuty Use Amazon Inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance B. Launch the EC2 instances with an IAM role attached Include a user data script that uses the AWS CLl to create NACLs blocking ingress traffic from the known bad IP addresses in the EC2 instance’s subnets Use AWS Systems Manager to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance C. Launch the EC2 instances with an IAM role attached Include a user data script that uses the AWS CLl to create and attach security groups that only allow an allow listed source IP address range inbound. Use Amazon Inspector to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance D. Launch the EC2 instances with an IAM role attached Include a user data script that creates a cron job to periodically retrieve the list of bad IP addresses from Amazon S3, and configures iptabies on the instances blocking the list of bad IP addresses Use Amazon inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance. “
“D. Launch the EC2 instances with an IAM role attached Include a user data script that creates a cron job to periodically retrieve the list of bad IP addresses from Amazon S3, and configures iptabies on the instances blocking the list of bad IP addresses Use Amazon inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance. “
“A Security Engineer noticed an anomaly within a company EC2 instance as shown in the image. The Engineer must now investigate what e causing the anomaly. What are the MOST effective steps to take lo ensure that the instance is not further manipulated while allowing the Engineer to understand what happened? A. Remove the instance from the Auto Scaling group Place the instance within an isolation security group, detach the EBS volume launch an EC2 instance with a forensic toolkit and attach the E8S volume to investigate B. Remove the instance from the Auto Scaling group and the Elastic Load Balancer Place the instance within an isolation security group, launch an EC2 instance with a forensic toolkit, and allow the forensic toolkit image to connect to the suspicious Instance to perform the Investigation. C. Remove the instance from the Auto Scaling group Place the Instance within an isolation security group, launch an EC2 Instance with a forensic toolkit and use the forensic toolkit imago to deploy an ENI as a network span port to inspect all traffic coming from the suspicious instance. D. Remove the instance from the Auto Scaling group and the Elastic Load Balancer Place the instance within an isolation security group, make a copy of the EBS volume from a new snapshot, launch an EC2 Instance with a forensic toolkit and attach the copy of the EBS volume to investigate. “
“B. Remove the instance from the Auto Scaling group and the Elastic Load Balancer Place the instance within an isolation security group, launch an EC2 instance with a forensic toolkit, and allow the forensic toolkit image to connect to the suspicious Instance to perform the Investigation.”
“A security engineer needs to configure monitoring and auditing for AWS Lambda. Which combination of actions using AWS services should the security engineer take to accomplish this goal? (Select TWO.) A. Use AWS Config to track configuration changes to Lambda functions, runtime environments, tags, handler names, code sizes, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations. B. Use AWS CloudTrail to implement governance, compliance, operational, and risk auditing for Lambda. C. Use Amazon Inspector to automatically monitor for vulnerabilities and perform governance, compliance, operational, and risk auditing for Lambda. D. Use AWS Resource Access Manager to track configuration changes to Lambda functions, runtime environments, tags, handler names, code sizes, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations. E. Use Amazon Macie to discover, classify, and protect sensitive data being executed inside the Lambda function. “
“A. Use AWS Config to track configuration changes to Lambda functions, runtime environments, tags, handler names, code sizes, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations. B. Use AWS CloudTrail to implement governance, compliance, operational, and risk auditing for Lambda. “
“A company has an AWS account and allows a third-party contractor who uses another AWS account, to assume certain IAM roles. The company wants to ensure that IAM roles can be assumed by the contractor only if the contractor has multi-factor authentication enabled on their IAM user accounts What should the company do to accomplish this? A. Option A B. Option B C. Option C D. Option D “
“A. Option A “
“A company uses Microsoft Active Directory for access management for on-premises resources and wants to use the same mechanism for accessing its AWS accounts. Additionally, the development team plans to launch a public-facing application for which they need a separate authentication solution. When coma nation of the following would satisfy these requirements? (Select TWO) A. Set up domain controllers on Amazon EC2 to extend the on-premises directory to AWS B. Establish network connectivity between on-premises and the user’s VPC C. Use Amazon Cognito user pools for application authentication D. Use AD Connector tor application authentication. E. Set up federated sign-in to AWS through ADFS and SAML. “
“C. Use Amazon Cognito user pools for application authentication D. Use AD Connector tor application authentication. “
“A company wants to encrypt data locally while meeting regulatory requirements related to key exhaustion. The encryption key can be no more than 10 days old or encrypt more than 2”” 16 objects Any encryption key must be generated on a FlPS-validated hardware security module (HSM). The company is cost-conscious, as plans to upload an average of 100 objects to Amazon S3 each second for sustained operations across 5 data producers When approach MOST efficiently meets the company’s needs? A. Use the AWS Encryption SDK and set the maximum age to 10 days and the minimum number of messages encrypted to 3”” 16. Use AWS Key Management Service (AWS KMS) to generate the master key and data key Use data key caching with the Encryption SDk during the encryption process. B. Use AWS Key Management Service (AWS KMS) to generate an AWS managed CMK. Then use Amazon S3 client-side encryption configured to automatically rotate with every object C. Use AWS CloudHSM to generate the master key and data keys. Then use Boto 3 and Python to locally encrypt data before uploading the object Rotate the data key every 10 days or after 2”” 16 objects have been Uploaded to Amazon 33 D. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) and set the master key to automatically rotate. “
“A. Use the AWS Encryption SDK and set the maximum age to 10 days and the minimum number of messages encrypted to 3”” 16. Use AWS Key Management Service (AWS KMS) to generate the master key and data key Use data key caching with the Encryption SDk during the encryption process. “
“A company plans to use custom AMIs to launch Amazon EC2 instances across multiple AWS accounts in a single Region to perform security monitoring and analytics tasks. The EC2 instances are launched in EC2 Auto Scaling groups. To increase the security of the solution, a Security Engineer will manage the lifecycle of the custom AMIs in a centralized account and will encrypt them with a centrally managed AWS KMS CMK. The Security Engineer configured the KMS key policy to allow cross-account access. However, the EC2 instances are still not being properly launched by the EC2 Auto Scaling groups. Which combination of configuration steps should the Security Engineer take to ensure the EC2 Auto Scaling groups have been granted the proper permissions to execute tasks? A. Create a customer-managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Create an IAM role in all applicable accounts and configure its access policy to allow the use of the centrally managed CMK for cryptographical operations. Configure EC2 Auto Scaling groups within each applicable account to use the created IAM role to launch EC2 instances. B. Create a customer-managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Create an IAM role in all applicable accounts and configure its access policy with permissions to create grants for the centrally managed CMK. Use this IAM role to create a grant for the centrally managed CMK with permissions to perform cryptographical operations and with the EC2 Auto Scaling service-linked role defined as the grantee principal. C. Create a customer-managed CMK or an AWS managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Use the CMK administrator to create a CMK grant that includes permissions to perform cryptographical operations that define EC2 Auto Scaling service-linked roles from all other accounts as the grantee principal. D. Create a customer-managed CMK or an AWS managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Modify the access policy for the EC2 Auto Scaling roles to perform cryptographical operations against the centrally managed CMK. “
“B. Create a customer-managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Create an IAM role in all applicable accounts and configure its access policy with permissions to create grants for the centrally managed CMK. Use this IAM role to create a grant for the centrally managed CMK with permissions to perform cryptographical operations and with the EC2 Auto Scaling service-linked role defined as the grantee principal. “
“A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running In Amazon Elastic Container Service (Amazon ECS). This solution will also handle volatile traffic patterns Which solution would have the MOST scalability and LOWEST latency? A. Configure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers B. Configure an Application Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers C. Configure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers D. Configure Amazon Route 53 to use multivalue answer routing to send traffic to the containers “
“A. Configure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers “
“A security engineer has noticed an unusually high amount of traffic coming from a single IP address. This was discovered by analyzing the Application Load Balancer’s access logs. How can the security engineer limit the number of requests from a specific IP address without blocking the IP address? A. Add a rule to the Application Load Balancer to route the traffic originating from the IP address in question and show a static webpage. B. Implement a rate-based rule with AWS WAF C. Use AWS Shield to limit the originating traffic hit rate. D. Implement the GeoLocation feature in Amazon Route 53. “
“C. Use AWS Shield to limit the originating traffic hit rate. “
“A Security Engineer has several thousand Amazon EC2 instances split across production and development environments. Each instance is tagged with its environment. The Engineer needs to analyze and patch all the development EC2 instances to ensure they are not currently exposed to any common vulnerabilities or exposures (CVEs) Which combination of steps is the MOST efficient way for the Engineer to meet these requirements? (Select TWO.) A. Log on to each EC2 instance, check and export the different software versions installed, and verify this against a list of current CVEs. B. Install the Amazon Inspector agent on all development instances Build a custom rule package, and configure Inspector to perform a scan using this custom rule on all instances tagged as being in the development environment. C. Install the Amazon Inspector agent on all development instances Configure Inspector to perform a scan using the CVE rule package on all instances tagged as being in the development environment. D. Install the Amazon EC2 System Manager agent on all development instances Issue the Run command to EC2 System Manager to update all instances E. Use AWS Trusted Advisor to check that all EC2 instances have been patched to the most recent version of operating system and installed software. “
“C. Install the Amazon Inspector agent on all development instances Configure Inspector to perform a scan using the CVE rule package on all instances tagged as being in the development environment. D. Install the Amazon EC2 System Manager agent on all development instances Issue the Run command to EC2 System Manager to update all instances “
“An application running on Amazon EC2 instances generates log files in a folder on a Linux file system. The instances block access to the console and file transfer utilities, such as Secure Copy Protocol (SCP) and Secure File Transfer Protocol (SFTP). The Application Support team wants to automatically monitor the application log files so the team can set up notifications in the future. A Security Engineer must design a solution that meets the following requirements: • Make the log files available through an AWS managed service. • Allow for automatic monitoring of the logs. • Provide an Interlace for analyzing logs. • Minimize effort. Which approach meets these requirements? A. Modify the application to use the AWS SDK Write the application logs lo an Amazon S3 bucket B. install the unified Amazon CloudWatch agent on the instances Configure the agent to collect the application log dies on the EC2 tile system and send them to Amazon CloudWatch Logs C. Install AWS Systems Manager Agent on the instances Configure an automation document to copy the application log files to AWS DeepLens D. Install Amazon Kinesis Agent on the instances Stream the application log files to Amazon Kinesis Data Firehose and sot the destination to Amazon Elasticsearch Service “
“D. Install Amazon Kinesis Agent on the instances Stream the application log files to Amazon Kinesis Data Firehose and sot the destination to Amazon Elasticsearch Service “
“To meet regulatory requirements, a Security Engineer needs to implement an IAM policy that restricts the use of AWS services to the us-east-1 Region. What policy should the Engineer implement? A. Option A B. Option B C. Option C D. Option D “
“A. Option A “
“A company has a VPC with an IPv6 address range and a public subnet with an IPv6 address block. The VPC currently hosts some public Amazon EC2 instances but a Security Engineer needs to migrate a second application into the VPC that also requires IPv6 connectivity. This new application will occasionally make API requests to an external, internet-accessible endpoint to receive updates However, the Security team does not want the application’s EC2 instance exposed directly to the internet The Security Engineer intends to create a private subnet with a custom route table and to associate the route table with the private subnet What else does the Security Engineer need to do to ensure the application will not be exposed directly to the internet, but can still communicate as required’’ A. Launch a NAT instance in the public subnet Update the custom route table with a new route to the NAT instance B. Remove the internet gateway, and add AWS PrivateLink to the VPC Then update the custom route table with a new route to AWS PrivateLink C. Add a managed NAT gateway to the VPC Update the custom route table with a new route to the gateway D. Add an egress-only internet gateway to the VPC. Update the custom route table with a new route to the gateway “
“D. Add an egress-only internet gateway to the VPC. Update the custom route table with a new route to the gateway “
“A Security Engineer accidentally deleted the imported key material in an AWS KMS CMK. What should the Security Engineer do to restore the deleted key material? A. Create a new CMK. Download a new wrapping key and a new import token to import the original key material B. Create a new CMK Use the original wrapping key and import token to import the original key material. C. Download a new wrapping key and a new import token Import the original key material into the existing CMK. D. Use the original wrapping key and import token Import the original key material into the existing CMK “
“D. Use the original wrapping key and import token Import the original key material into the existing CMK “
“Authorized Administrators are unable to connect to an Amazon EC2 Linux bastion host using SSH over the internet. The connection either fails to respond or generates the following error message: Network error: Connection timed out. What could be responsible for the connection failure? (Select THREE ) A. The NAT gateway in the subnet where the EC2 instance is deployed has been misconfigured B. The internet gateway of the VPC has been reconfigured C. The security group denies outbound traffic on ephemeral ports D. The route table is missing a route to the internet gateway E. The NACL denies outbound traffic on ephemeral ports F. The host-based firewall is denying SSH traffic “
“C. The security group denies outbound traffic on ephemeral ports E. The NACL denies outbound traffic on ephemeral ports F. The host-based firewall is denying SSH traffic “
“A company is setting up products to deploy in AWS Service Catalog. Management is concerned that when users launch products, elevated IAM privileges will be required to create resources. How should the company mitigate this concern? A. Add a template constraint to each product in the portfolio. B. Add a launch constraint to each product in the portfolio. C. Define resource update constraints for each product in the portfolio. D. Update the AWS CloudFormalion template backing the product to include a service role configuration. “
“C. Define resource update constraints for each product in the portfolio. “
