Question 1

A Systems Engineer is troubleshooting the connectivity of a test environment that includes a virtual security appliance deployed inline. In addition to using the virtual security appliance, the Development team wants to use security groups and network ACLs to accomplish various security requirements in the environment. What configuration is necessary to allow the virtual security appliance to route the traffic?

Accepted Answer

The answer of A Systems Engineer is troubleshooting the connectivity...

Question 2

An application has been built with Amazon EC2 instances that retrieve messages from Amazon SQS. Recently, IAM changes were made and the instances can no longer retrieve messages. What actions should be taken to troubleshoot the issue while maintaining least privilege. (Select two.)

Accepted Answer

The SQS resource policy should be checked to ensure that it does not explicitly deny access to the role used by the instances. Additionally, the role attached to the instances should be verified to ensure that it contains policies that allow access to the queue.

Question 3

An employee accidentally exposed an AWS access key and secret access key during a public presentation. The company Security Engineer immediately disabled the key. How can the Engineer assess the impact of the key exposure and ensure that the credentials were not misused? (Choose two.)

Accepted Answer

Analyzing AWS CloudTrail for activity and downloading and analyzing a credential report from IAM will help the Engineer assess the impact of the key exposure and ensure that the credentials were not misused.

Question 4

Example.com hosts its internal document repository on Amazon EC2 instances. The application runs on EC2 instances and previously stored the documents on encrypted Amazon EBS volumes. To optimize the application for scale, example.com has moved the files to Amazon S3. The security team has mandated that all the files are securely deleted from the EBS volume, and it must certify that the data is unreadable before releasing the underlying disks. Which of the following methods will ensure that the data is unreadable by anyone else?

Accepted Answer

The answer of Example.com hosts its internal document repository on...

Question 5

Which option for the use of the AWS Key Management Service (KMS) supports key management best practices that focus on minimizing the potential scope of data exposed by a possible future key compromise?

Accepted Answer

The answer of Which option for the use of the...

Question 6

A Security Engineer is trying to determine whether the encryption keys used in an AWS service are in compliance with certain regulatory standards. Which of the following actions should the Engineer perform to get further guidance?

Accepted Answer

AWS Artifact provides access to AWS compliance reports and can help determine if encryption keys meet regulatory standards.

Question 7

An AWS account includes two S3 buckets: bucket1 and bucket2. The bucket2 does not have a policy defined, but bucket1 has the following bucket policy:  In addition, the same account has an IAM User named "alice", with the following IAM policy.  Which buckets can user "alice" access?

Accepted Answer

The answer of An AWS account includes two S3 buckets:...

Question 8

A company's database developer has just migrated an Amazon RDS database credential to be stored and managed by AWS Secrets Manager. The developer has also enabled rotation of the credential within the Secrets Manager console and set the rotation to change every 30 days. After a short period of time, a number of existing applications have failed with authentication errors. What is the MOST likely cause of the authentication errors?

Accepted Answer

The answer of A company's database developer has just migrated...

Question 9

A security alert has been raised for an Amazon EC2 instance in a customer account that is exhibiting strange behavior. The Security Engineer must first isolate the EC2 instance and then use tools for further investigation. What should the Security Engineer use to isolate and research this event? (Choose three.)

Accepted Answer

AWS CloudTrail can be used to track API calls and changes to the instance, VPC Flow Logs can help analyze network traffic to and from the instance, and Security groups can be used to isolate the instance by controlling inbound and outbound traffic.

Question 10

What is the function of the following AWS Key Management Service (KMS) key policy attached to a customer master key (CMK)?

Accepted Answer

The answer of What is the function of the following...

Question 11

Due to new compliance requirements, a Security Engineer must enable encryption with customer-provided keys on corporate data that is stored in DynamoDB. The company wants to retain full control of the encryption keys. Which DynamoDB feature should the Engineer use to achieve compliance'?

Accepted Answer

The answer of Due to new compliance requirements, a Security...

Question 12

During a recent security audit, it was discovered that multiple teams in a large organization have placed restricted data in multiple Amazon S3 buckets, and the data may have been exposed. The auditor has requested that the organization identify all possible objects that contain personally identifiable information (PII) and then determine whether this information has been accessed. What solution will allow the Security team to complete this request?

Accepted Answer

Amazon Macie is specifically designed for discovering and protecting sensitive data, such as PII, in AWS. It can classify data in S3 buckets and integrate with AWS CloudTrail to audit access logs for GET operations, making it suitable for this task.

Question 13

The Information Technology department has stopped using Classic Load Balancers and switched to Application Load Balancers to save costs. After the switch, some users on older devices are no longer able to connect to the website. What is causing this situation?

Accepted Answer

The answer of The Information Technology department has stopped using...

Question 14

A company has a forensic logging use case whereby several hundred applications running on Docker on EC2 need to send logs to a central location. The Security Engineer must create a logging solution that is able to perform real-time analytics on the log files, grants the ability to replay events, and persists data. Which AWS Services, together, can satisfy this use case? (Select two.)

Accepted Answer

The answer of A company has a forensic logging use...

Question 15

A Security Engineer has been asked to create an automated process to disable IAM user access keys that are more than three months old. Which of the following options should the Security Engineer use?

Accepted Answer

The answer of A Security Engineer has been asked to...

Question 16

A company has multiple VPCs in their account that are peered, as shown in the diagram. A Security Engineer wants to perform penetration tests of the Amazon EC2 instances in all three VPCs. How can this be accomplished? (Choose two.)

Accepted Answer

The answer of A company has multiple VPCs in their...

Question 17

A Developer's laptop was stolen. The laptop was not encrypted, and it contained the SSH key used to access multiple Amazon EC2 instances. A Security Engineer has verified that the key has not been used, and has blocked port 22 to all EC2 instances while developing a response plan. How can the Security Engineer further protect currently running instances?

Accepted Answer

The Security Engineer can use the EC2 RunCommand to modify the authorized_keys file on the instances to remove the compromised SSH key, effectively revoking access without needing to restart the instances.

Question 18

For compliance reasons, an organization limits the use of resources to three specific AWS regions. It wants to be alerted when any resources are launched in unapproved regions. Which of the following approaches will provide alerts on any resources launched in an unapproved region?

Accepted Answer

AWS CloudTrail logs provide a detailed record of all API calls made in your account, including the region where resources are launched. By processing these logs, you can develop an alerting mechanism to notify you when resources are launched in unapproved regions.

Question 19

A distributed web application is installed across several EC2 instances in public subnets residing in two Availability Zones. Apache logs show several intermittent brute-force attacks from hundreds of IP addresses at the layer 7 level over the past six months. What would be the BEST way to reduce the potential impact of these attacks in the future?

Accepted Answer

Network ACLs can be used to control traffic at the subnet level, allowing or denying traffic based on source IP address, destination IP address, port, and protocol. This makes them an effective way to block malicious traffic from reaching the instances.

Question 20

A company recently experienced a DDoS attack that prevented its web server from serving content. The website is static and hosts only HTML, CSS, and PDF files that users download. Based on the architecture shown in the image, what is the BEST way to protect the site against future attacks while minimizing the ongoing operational overhead?

Accepted Answer

The answer of A company recently experienced a DDoS attack...

Exam 8: AWS Certified Security - Specialty (SCS-C01)