Question 1

A Security Engineer for a large company is managing a data processing application used by 1,500 subsidiary companies. The parent and subsidiary companies all use AWS. The application uses TCP port 443 and runs on Amazon EC2 behind a Network Load Balancer (NLB). For compliance reasons, the application should only be accessible to the subsidiaries and should not be available on the public internet. To meet the compliance requirements for restricted access, the Engineer has received the public and private CIDR block ranges for each subsidiary. What solution should the Engineer use to implement the appropriate access restrictions for the application?

Accepted Answer

Using AWS PrivateLink allows the application to be accessed privately without exposing it to the public internet. It provides a secure and scalable way to connect services across different AWS accounts and VPCs, ensuring compliance with the requirement to restrict access to only the subsidiaries.

Question 2

A company had one of its Amazon EC2 key pairs compromised. A Security Engineer must identify which current Linux EC2 instances were deployed and used the compromised key pair. How can this task be accomplished?

Accepted Answer

The answer of A company had one of its Amazon...

Question 3

A company has five AWS accounts and wants to use AWS CloudTrail to log API calls. The log files must be stored in an Amazon S3 bucket that resides in a new account specifically built for centralized services with a unique top-level prefix for each trail. The configuration must also enable detection of any modification to the logs. Which of the following steps will implement these requirements? (Choose three.)

Accepted Answer

The answer of A company has five AWS accounts and...

Question 4

A company has a few dozen application servers in private subnets behind an Elastic Load Balancer (ELB) in an AWS Auto Scaling group. The application is accessed from the web over HTTPS. The data must always be encrypted in transit. The Security Engineer is worried about potential key exposure due to vulnerabilities in the application software. Which approach will meet these requirements while protecting the external certificate during a breach?

Accepted Answer

Using an internal self-signed certificate for the instances and an external certificate for the ELB ensures that the external certificate is not exposed to the application servers. The ELB decrypts the traffic and re-encrypts it with the internal certificate, maintaining encryption in transit and protecting the external certificate.

Question 5

Which of the following are valid event sources that are associated with web access control lists that trigger AWS WAF rules? (Choose two.)

Accepted Answer

Amazon CloudFront distributions and Application Load Balancers are valid event sources for AWS WAF, allowing you to associate web access control lists to trigger rules.

Question 6

A company is building a data lake on Amazon S3. The data consists of millions of small files containing sensitive information. The Security team has the following requirements for the architecture: • Data must be encrypted in transit. • Data must be encrypted at rest. • The bucket must be private, but if the bucket is accidentally made public, the data must remain confidential. Which combination of steps would meet the requirements? (Choose two.)

Accepted Answer

The answer of A company is building a data lake...

Question 7

A Security Engineer must implement mutually authenticated TLS connections between containers that communicate inside a VPC. Which solution would be MOST secure and easy to maintain?

Accepted Answer

The answer of A Security Engineer must implement mutually authenticated...

Question 8

The AWS Systems Manager Parameter Store is being used to store database passwords used by an AWS Lambda function. Because this is sensitive data, the parameters are stored as type SecureString and protected by an AWS KMS key that allows access through IAM. When the function executes, this parameter cannot be retrieved as the result of an access denied error. Which of the following actions will resolve the access denied error?

Accepted Answer

The answer of The AWS Systems Manager Parameter Store is...

Question 9

A company uses user data scripts that contain sensitive information to bootstrap Amazon EC2 instances. A Security Engineer discovers that this sensitive information is viewable by people who should not have access to it. What is the MOST secure way to protect the sensitive information used to bootstrap the instances?

Accepted Answer

Store the scripts in the AMI and encrypt the sensitive data using AWS KMS. Use the instance role profile to control access to the KMS keys needed to decrypt the data.

Question 10

A Security Engineer is building a Java application that is running on Amazon EC2. The application communicates with an Amazon RDS instance and authenticates with a user name and password. Which combination of steps can the Engineer take to protect the credentials and minimize downtime when the credentials are rotated? (Choose two.)

Accepted Answer

Using AWS Secrets Manager for automatic rotation (C) ensures credentials are updated without manual intervention, minimizing downtime. Configuring the application to handle connection failures and retrieve updated credentials from Secrets Manager (E) ensures the application can continue to operate smoothly when credentials change.

Question 11

A Security Engineer is defining the logging solution for a newly developed product. Systems Administrators and Developers need to have appropriate access to event log files in AWS CloudTrail to support and troubleshoot the product. Which combination of controls should be used to protect against tampering with and unauthorized access to log files? (Choose two.)

Accepted Answer

A) Ensure that the log file integrity validation mechanism is enabled.D) Ensure that Systems Administrators and Developers with job-related need-to-know requirements only are capable of viewing-but not modifying-the log files.

Question 12

An application uses Amazon Cognito to manage end users' permissions when directly accessing AWS resources, including Amazon DynamoDB. A new feature request reads as follows: Provide a mechanism to mark customers as suspended pending investigation or suspended permanently. Customers should still be able to log in when suspended, but should not be able to make changes. The priorities are to reduce complexity and avoid potential for future security issues. Which approach will meet these requirements and priorities?

Accepted Answer

The answer of An application uses Amazon Cognito to manage...

Question 13

An Amazon S3 bucket is encrypted using an AWS KMS CMK. An IAM user is unable to download objects from the S3 bucket using the AWS Management Console; however, other users can download objects from the S3 bucket. Which policies should the Security Engineer review and modify to resolve this issue? (Choose three.)

Accepted Answer

The answer of An Amazon S3 bucket is encrypted using...

Question 14

A Security Engineer is working with a Product team building a web application on AWS. The application uses Amazon S3 to host the static content, Amazon API Gateway to provide RESTful services; and Amazon DynamoDB as the backend data store. The users already exist in a directory that is exposed through a SAML identity provider. Which combination of the following actions should the Engineer take to enable users to be authenticated into the web application and call APIs? (Choose three.)

Accepted Answer

B: Configure a SAML identity provider in Amazon Cognito to map attributes to the Amazon Cognito user pool attributes.C: Configure the SAML identity provider to add the Amazon Cognito user pool as a relying party.F: Update API Gateway to use a COGNITO_USER_POOLS authorizer.

Question 15

The Accounting department at Example Corp. has made a decision to hire a third-party firm, AnyCompany, to monitor Example Corp.'s AWS account to help optimize costs. The Security Engineer for Example Corp. has been tasked with providing AnyCompany with access to the required Example Corp. AWS resources. The Engineer has created an IAM role and granted permission to AnyCompany's AWS account to assume this role. When customers contact AnyCompany, they provide their role ARN for validation. The Engineer is concerned that one of AnyCompany's other customers might deduce Example Corp.'s role ARN and potentially compromise the company's account. What steps should the Engineer perform to prevent this outcome?

Accepted Answer

Using an external ID in the role's trust policy helps ensure that only the intended third-party (AnyCompany) can assume the role, even if another customer deduces the role ARN. This adds an additional layer of security by requiring a unique identifier that only AnyCompany knows.

Question 16

A company uses identity federation to authenticate users into an identity account (987654321987) where the users assume an IAM role named IdentityRole. The users then assume an IAM role named JobFunctionRole in the target AWS account (123456789123) to perform their job functions. A user is unable to assume the IAM role in the target account. The policy attached to the role in the identity account is:  What should be done to enable the user to assume the appropriate role in the target account?

Accepted Answer

The answer of A company uses identity federation to authenticate...

Question 17

A Security Engineer is implementing a solution to allow users to seamlessly encrypt Amazon S3 objects without having to touch the keys directly. The solution must be highly scalable without requiring continual management. Additionally, the organization must be able to immediately delete the encryption keys. Which solution meets these requirements?

Accepted Answer

AWS KMS with imported key material allows for immediate deletion of the key material using the DeletelmportedKeyMaterial API, meeting the requirement for immediate deletion.

Question 18

To meet regulatory requirements, a Security Engineer needs to implement an IAM policy that restricts the use of AWS services to the us-east-1 Region. What policy should the Engineer implement?

Accepted Answer

The answer of To meet regulatory requirements, a Security Engineer...

Question 19

A company's security policy requires that VPC Flow Logs are enabled on all VPCs. A Security Engineer is looking to automate the process of auditing the VPC resources for compliance. What combination of actions should the Engineer take? (Choose two.)

Accepted Answer

The answer of A company's security policy requires that VPC...

Question 20

An AWS Lambda function was misused to alter data, and a Security Engineer must identify who invoked the function and what output was produced. The Engineer cannot find any logs created by the Lambda function in Amazon CloudWatch Logs. Which of the following explains why the logs are not available?

Accepted Answer

The execution role for the Lambda function must have permissions to write log data to CloudWatch Logs. Without these permissions, the logs will not be created or stored in CloudWatch Logs.

Exam 8: AWS Certified Security - Specialty (SCS-C01)