Question 1

An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants a particular group of IAM users to access only the test instances and not the production ones. They want to deploy the instances in various locations based on the factors that will change from time to time, especially in the test group. They expect instances will often need to be churned, i.e. deleted and replaced, especially in the testing group. This means the five instances they have created now will soon be replaced by a different set of five instances. The members of each group, produc-tion and testing, will not change in the foreseeable future. Given the situation, what choice below is the most efficient and time-saving strategy to define the IAM policy?

Accepted Answer

Using tags on IAM user IDs and adding conditions to the IAM policy based on these tags allows dynamic and flexible access control, which is efficient given the frequent changes in instances.

Question 2

A user is planning to schedule a backup for an existing EBS volume. The user wants the backup to be created through snapshot, and for it to be encrypted. How can the user achieve data encryption with a snapshot?

Accepted Answer

The answer of A user is planning to schedule a...

Question 3

A company wants to review the security requirements of Glacier. Which of the below mentioned statements is true with respect to the AWS Glacier data security?

Accepted Answer

All data stored on AWS Glacier is automatically protected with AES-256 server-side encryption by default.

Question 4

ABC (with AWS account ID 111122223333) has created 50 IAM users for its organization's employees. What will be the AWS console URL for these associates?

Accepted Answer

The correct format for an AWS console URL for IAM users is https://<AWS-account-ID>.signin.aws.amazon.com/console/.

Question 5

An IAM user has two conflicting policies as part of two separate groups. One policy allows him to access an S3 bucket, while another policy denies him the access. Can the user access that bucket?

Accepted Answer

In AWS IAM, if there are conflicting policies, the explicit deny always takes precedence over any allow. Therefore, the user will not be able to access the S3 bucket.

Question 6

What does the Server-side encryption provide in Amazon S3?

Accepted Answer

Server-side encryption in Amazon S3 protects data at rest by using Amazon S3-managed encryption keys (SSE-S3), ensuring that the data stored in S3 is encrypted.

Question 7

In AWS KMS, which of the following is NOT a mode of server-side encryption that you can use to protect data at rest in Amazon S3?

Accepted Answer

SSE-K is not a mode of server-side encryption in AWS KMS.

Question 8

Fill in the blanks: One of the basic characteristics of security groups for your VPC is that you ______ .

Accepted Answer

Security groups in a VPC allow you to specify allow rules, but not deny rules. They act as a virtual firewall to control inbound and outbound traffic to AWS resources.

Question 9

The AWS Key Management Service (AWS KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data. AWS KMS is integrated with oth-er AWS services including Amazon EBS, Amazon S3, Amazon Redshift, Elastic Transcoder, Ama-zon WorkMail, and Amazon RDS to make it simple to encrypt your data with encryption keys that you manage. AWS KMS is also integrated with AWS CloudTrail to provide you with key usage logs to help meet your regulatory and compliance needs. Which of the following types of cryptog-raphy keys is supported by AWS KMS currently?

Accepted Answer

The answer of The AWS Key Management Service (AWS KMS)...

Question 10

Is it possible to create an S3 bucket accessible only by a certain IAM user using policies in a Cloud-Formation template?

Accepted Answer

CloudFormation supports creating S3 buckets, IAM users, and policies, allowing you to configure access controls for specific users.

Question 11

Amazon Relational Database Service integrates with _____, a service that lets your organization create users and groups under your organization's AWS account and assign unique security creden-tials to each user.

Accepted Answer

AWS IAM (Identity and Access Management) allows organizations to create users and groups under their AWS account and assign unique security credentials to each user.

Question 12

Is it possible to protect the connections between your application servers and your MySQL instances using SSL encryption?

Accepted Answer

MySQL supports SSL encryption for connections, allowing secure communication between application servers and MySQL instances regardless of region or network configuration.

Question 13

Network ACLs in a VPC operate at the ______.

Accepted Answer

Network ACLs in a VPC operate at the subnet level, providing a layer of security by controlling inbound and outbound traffic for subnets.

Question 14

For IAM user, a virtual Multi-Factor Authentication (MFA) device uses an application that gener-ates ______-digit authentication codes that are compatible with the time-based one-time password (TOTP) standard.

Accepted Answer

A virtual MFA device for IAM users generates six-digit authentication codes that are compatible with the TOTP standard.

Question 15

A user has configured ELB with Auto Scaling. The user temporarily suspended the Auto Scaling terminate process. What might the Availability Zone Rebalancing process (AZRebalance) conse-quently cause during this period?

Accepted Answer

When the terminate process is suspended, AZ Rebalancing might not be able to terminate instances to balance the number of instances across Availability Zones, potentially allowing one zone to exceed the maximum size.

Question 16

Which of the following statements is true of IAM?

Accepted Answer

To configure MFA with a smartphone, the device must be available to scan the QR code or enter the setup key during the setup process.

Question 17

Which of the following terms is NOT a key CloudWatch concept?

Accepted Answer

Indexes are not a key concept in CloudWatch. CloudWatch primarily deals with namespaces, units, and timestamps for organizing and measuring metrics.

Question 18

Your customers are concerned about the security of their sensitive data and their inquiry asks about what happens to old storage devices on AWS. What would be the best answer to this question?

Accepted Answer

AWS follows the guidelines in DoD 5220.22-M for data destruction during the decommissioning process to ensure data security.

Question 19

The Statement element, of an AWS IAM policy, contains an array of individual statements. Each individual statement is a(n) ______ block enclosed in braces { }.

Accepted Answer

The Statement element in an AWS IAM policy is a JSON block, as IAM policies are written in JSON (JavaScript Object Notation) format.

Question 20

Which of the following is an incorrect statement about Amazon CloudWatch?

Accepted Answer

CloudWatch does not control or monitor Security Groups and their rules; it is primarily used for monitoring and logging metrics and events related to AWS resources and applications.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)