A company accidentally deleted the private key for an Amazon Elastic Block Store (Amazon EBS)-backed Amazon EC2 instance. A security engineer needs to regain access to the instance. Which combination of steps will meet this requirement? (Choose two.)

A. Stop the instance. Detach the root volume. Generate a new key pair.

C. When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance. Start the instance.

A. Stop the instance. Detach the root volume. Generate a new key pair.

B. Keep the instance running. Detach the root volume. Generate a new key pair.

C. When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance. Start the instance.

D. When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new private key. Move the volume back to the original instance. Start the instance.

E. When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance that is running.

A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The S3 bucket has the following bucket policy: Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?

C. Change the Resource element to ＆quot;arn:aws:s3:::DOC-EXAMPLE-BUCKET/*＆quot;. ＆nbsp;

A. Remove the Condition element. Change the Principal element to the following: ＆nbsp;

B. Change the Action element to the following:

C. Change the Resource element to ＆quot;arn:aws:s3:::DOC-EXAMPLE-BUCKET/*＆quot;. ＆nbsp;

D. Change the Resource element to ＆quot;arn:aws:lambda::function:MyLambdaFunction＆quot;. Change the Principal element to the following:

A company needs to improve its ability to identify and prevent IAM policies that grant public access or cross-account access to resources. The company has implemented AWS Organizations and has started using AWS Identity and Access Management Access Analyzer to refine overly broad access to accounts in the organization. A security engineer must automate a response in the company's organization for any newly created policies that are overly permissive. The automation must remediate external access and must notify the company's security team. Which combination of steps should the security engineer take to meet these requirements? (Choose three.)

A. Create an AWS Step Functions state machine that checks the resource type in the finding and adds an explicit Deny statement in the trust policy for the IAM role. Configure the state machine to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. ＆nbsp;

C. In Amazon EventBridge, create an event rule that matches active IAM Access Analyzer findings and invokes AWS Step Functions for resolution. ＆nbsp;

F. reate an Amazon Simple Notification Service (Amazon SNS) topic for external or cross-account access notices. Subscribe the security team＆#39;s email addresses to the topic.

A. Create an AWS Step Functions state machine that checks the resource type in the finding and adds an explicit Deny statement in the trust policy for the IAM role. Configure the state machine to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. ＆nbsp;

B. Create an AWS Batch job that forwards any resource type findings to an AWS Lambda function. Configure the Lambda function to add an explicit Deny statement in the trust policy for the IAM role. Configure the AWS Batch job to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. ＆nbsp;

C. In Amazon EventBridge, create an event rule that matches active IAM Access Analyzer findings and invokes AWS Step Functions for resolution. ＆nbsp;

D. In Amazon CloudWatch, create a metric filter that matches active IAM Access Analyzer findings and invokes AWS Batch for resolution. ＆nbsp;

E. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure the queue to forward a notification to the security team that an external principal has been granted access to the specific IAM role and has been blocked. ＆nbsp;

F. reate an Amazon Simple Notification Service (Amazon SNS) topic for external or cross-account access notices. Subscribe the security team＆#39;s email addresses to the topic.

A security engineer is configuring a new website that is named example.com. The security engineer wants to secure communications with the website by requiring users to connect to example.com through HTTPS. Which of the following is a valid option for storing SSL/TLS certificates?

C. Custom SSL certificate that is stored in AWS Certificate Manager (ACM)

A. Custom SSL certificate that is stored in AWS Key Management Service (AWS KMS)

B. Default SSL certificate that is stored in Amazon CloudFront

C. Custom SSL certificate that is stored in AWS Certificate Manager (ACM)

D. Default SSL certificate that is stored in Amazon S3

A company has configured an organization in AWS Organizations for its AWS accounts.AWS CloudTrail is enabled in all AWS Regions. A security engineer must implement a solution to prevent CloudTrail from being disabled. Which solution will meetthis requirement?

C. Create an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail action.Attach the SCP to the root ou.

A. Enable CloudTrail log file integrity validation from the organization's management account.

B. Enable server-side encryption with AWS KMS keys(SSE-KMS) for CloudTrail logs. Create a KMS key. Attach a policy to the key to prevent decryption of the logs.

C. Create an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail action.Attach the SCP to the root ou.

D. Create IAM policies for allthe company's users to prevent the users from performing the DescribeTrails action and the GetTrailStatus action.

A company uses AWS Organizations and has Amazon Elastic Kubernetes Service (Amazon EKS) clusters in many AWS accounts. A security engineer integrates Amazon EKS with AWS CloudTrail. The CloudTrail trails are stored in an Amazon S3 bucket in each account to monitor API calls. The security engineer observes that CloudTrail logs are not displaying Kubernetes pod creation events. What should the security engineer do to view the Kubernetes events from Amazon CloudWatch?

B. Enable Kubernetes API server component logs for each cluster. ＆nbsp;

A. Configure the EKS clusters to use private S3 VPC endpoints. Configure the S3 buckets for logging. ＆nbsp;

B. Enable Kubernetes API server component logs for each cluster. ＆nbsp;

C. Enable cross-origin resource sharing (CORS) in the S3 bucket that is used for logging. ＆nbsp;

D. Configure CloudWatch. View the events in the CloudWatch console.

A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager. Which solution will meet the requirements?

A. Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.

B. Use a parameter in the CloudFormation template to reference the database credentials. Encrypt the CloudFormation template by using AWS KMS. ＆nbsp;

C. Use a SecureString parameter in the CloudFormation template to reference the database credentials in Secrets Manager. ＆nbsp;

D. Use a SecureString parameter in the CloudFormation template to reference an encrypted value in AWS KMS.

An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installs the Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2 instances launch with an IAM role that has an IAM policy attached. The policy provides access to publish custom metrics to CloudWatch. The EC2 instances run in a private subnet inside a VPC. The VPC provides access to the internet for private subnets through a NAT gateway. A security engineer notices that no logs are being published to CloudWatch Logs for the EC2 instances that the Auto Scaling group launches.The security engineer validates that the CloudWatch Logs agent is running and is configured properly on the EC2 instances. In addition, the security engineer validates that network communications are working properly to AWS services. What can the security engineer do to ensure that the logs are published to CloudWatch Logs?

A. Configure the IAM policy in use by the IAM role to have access to the required cloudwatch: API actions that will publish logs. ＆nbsp;

B. Adjust the Amazon EC2 Auto Scaling service-linked role to have permissions to write to CloudWatch Logs. ＆nbsp;

C. Configure the IAM policy in use by the IAM role to have access to the required AWS logs: API actions that will publish logs. ＆nbsp;

D. Add an interface VPC endpoint to provide a route to CloudWatch Logs.

A company is designing a multi-account structure for its development teams. The company is using AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On). The company must implement a solution so that the development teams can use only specific AWS Regions and so that each AWS account allows access to only specific AWS services. Which solution will meet these requirements with the LEAST operational overhead?

C. Create SCPs that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.

A. Use IAM Identity Center to set up service-linked roles with IAM policy statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.

B. Deactivate AWS Security Token Service (AWS STS) in Regions that the developers are not allowed to use.

C. Create SCPs that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.

D. For each AWS account, create tailored identity-based policies for IAM Identity Center. Use statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.

AWS SCS-C02 Chapter 1 Free Practice Test 2025 — Security Specialty Exam Questions

AWS SCS-C02 Chapter 1 Practice Questions (100 Questions)

Practice questions for the AWS SCS-C02 (Security Specialty) exam, Chapter 1.

Q1. A company accidentally deleted the private key for an Amazon Elastic Block Store (Amazon EBS)-backed Amazon EC2 instance. A security engineer needs to regain access to the instance. Which combination of steps will meet this requirement? (Choose two.)
- A. Stop the instance. Detach the root volume. Generate a new key pair.
- B. Keep the instance running. Detach the root volume. Generate a new key pair.
- C. When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance. Start the instance.
- D. When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new private key. Move the volume back to the original instance. Start the instance.
- E. When the volume is detached from the original instance, attach the volume to another instance as a data volume. Modify the authorized_keys file with a new public key. Move the volume back to the original instance that is running.
View question →
Q2. A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The S3 bucket has the following bucket policy: Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?
- A. Remove the Condition element. Change the Principal element to the following: ＆nbsp;
- B. Change the Action element to the following:
- C. Change the Resource element to ＆quot;arn:aws:s3:::DOC-EXAMPLE-BUCKET/*＆quot;. ＆nbsp;
- D. Change the Resource element to ＆quot;arn:aws:lambda::function:MyLambdaFunction＆quot;. Change the Principal element to the following:
View question →
Q3. A company needs to improve its ability to identify and prevent IAM policies that grant public access or cross-account access to resources. The company has implemented AWS Organizations and has started using AWS Identity and Access Management Access Analyzer to refine overly broad access to accounts in the organization. A security engineer must automate a response in the company's organization for any newly created policies that are overly permissive. The automation must remediate external access and must notify the company's security team. Which combination of steps should the security engineer take to meet these requirements? (Choose three.)
- A. Create an AWS Step Functions state machine that checks the resource type in the finding and adds an explicit Deny statement in the trust policy for the IAM role. Configure the state machine to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. ＆nbsp;
- B. Create an AWS Batch job that forwards any resource type findings to an AWS Lambda function. Configure the Lambda function to add an explicit Deny statement in the trust policy for the IAM role. Configure the AWS Batch job to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. ＆nbsp;
- C. In Amazon EventBridge, create an event rule that matches active IAM Access Analyzer findings and invokes AWS Step Functions for resolution. ＆nbsp;
- D. In Amazon CloudWatch, create a metric filter that matches active IAM Access Analyzer findings and invokes AWS Batch for resolution. ＆nbsp;
- E. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure the queue to forward a notification to the security team that an external principal has been granted access to the specific IAM role and has been blocked. ＆nbsp;
- F. reate an Amazon Simple Notification Service (Amazon SNS) topic for external or cross-account access notices. Subscribe the security team＆#39;s email addresses to the topic.
View question →
Q4. A security engineer is configuring a new website that is named example.com. The security engineer wants to secure communications with the website by requiring users to connect to example.com through HTTPS. Which of the following is a valid option for storing SSL/TLS certificates?
- A. Custom SSL certificate that is stored in AWS Key Management Service (AWS KMS)
- B. Default SSL certificate that is stored in Amazon CloudFront
- C. Custom SSL certificate that is stored in AWS Certificate Manager (ACM)
- D. Default SSL certificate that is stored in Amazon S3
View question →
Q5. A company has configured an organization in AWS Organizations for its AWS accounts.AWS CloudTrail is enabled in all AWS Regions. A security engineer must implement a solution to prevent CloudTrail from being disabled. Which solution will meetthis requirement?
- A. Enable CloudTrail log file integrity validation from the organization's management account.
- B. Enable server-side encryption with AWS KMS keys(SSE-KMS) for CloudTrail logs. Create a KMS key. Attach a policy to the key to prevent decryption of the logs.
- C. Create an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail action.Attach the SCP to the root ou.
- D. Create IAM policies for allthe company's users to prevent the users from performing the DescribeTrails action and the GetTrailStatus action.
View question →
Q6. A company uses AWS Organizations and has Amazon Elastic Kubernetes Service (Amazon EKS) clusters in many AWS accounts. A security engineer integrates Amazon EKS with AWS CloudTrail. The CloudTrail trails are stored in an Amazon S3 bucket in each account to monitor API calls. The security engineer observes that CloudTrail logs are not displaying Kubernetes pod creation events. What should the security engineer do to view the Kubernetes events from Amazon CloudWatch?
- A. Configure the EKS clusters to use private S3 VPC endpoints. Configure the S3 buckets for logging. ＆nbsp;
- B. Enable Kubernetes API server component logs for each cluster. ＆nbsp;
- C. Enable cross-origin resource sharing (CORS) in the S3 bucket that is used for logging. ＆nbsp;
- D. Configure CloudWatch. View the events in the CloudWatch console.
View question →
Q7. A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager. Which solution will meet the requirements?
- A. Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.
- B. Use a parameter in the CloudFormation template to reference the database credentials. Encrypt the CloudFormation template by using AWS KMS. ＆nbsp;
- C. Use a SecureString parameter in the CloudFormation template to reference the database credentials in Secrets Manager. ＆nbsp;
- D. Use a SecureString parameter in the CloudFormation template to reference an encrypted value in AWS KMS.
View question →
Q8. An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installs the Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2 instances launch with an IAM role that has an IAM policy attached. The policy provides access to publish custom metrics to CloudWatch. The EC2 instances run in a private subnet inside a VPC. The VPC provides access to the internet for private subnets through a NAT gateway. A security engineer notices that no logs are being published to CloudWatch Logs for the EC2 instances that the Auto Scaling group launches.The security engineer validates that the CloudWatch Logs agent is running and is configured properly on the EC2 instances. In addition, the security engineer validates that network communications are working properly to AWS services. What can the security engineer do to ensure that the logs are published to CloudWatch Logs?
- A. Configure the IAM policy in use by the IAM role to have access to the required cloudwatch: API actions that will publish logs. ＆nbsp;
- B. Adjust the Amazon EC2 Auto Scaling service-linked role to have permissions to write to CloudWatch Logs. ＆nbsp;
- C. Configure the IAM policy in use by the IAM role to have access to the required AWS logs: API actions that will publish logs. ＆nbsp;
- D. Add an interface VPC endpoint to provide a route to CloudWatch Logs.
View question →
Q9. A company is designing a multi-account structure for its development teams. The company is using AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On). The company must implement a solution so that the development teams can use only specific AWS Regions and so that each AWS account allows access to only specific AWS services. Which solution will meet these requirements with the LEAST operational overhead?
- A. Use IAM Identity Center to set up service-linked roles with IAM policy statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
- B. Deactivate AWS Security Token Service (AWS STS) in Regions that the developers are not allowed to use.
- C. Create SCPs that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
- D. For each AWS account, create tailored identity-based policies for IAM Identity Center. Use statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
View question →
Q10. A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises data center for compliance reasons. The database is sensitive to network latency. Additionally, the data that travels between the on-premises data center and AWS must have IPsec encryption. Which combination of AWS solutions will meet these requirements? (Choose two.)
- A. AWS Site-to-Site VPN
- B. AWS Direct Connect
- C. AWS VPN CloudHub
- D. VPC peering
- E. NAT gateway
View question →
Q11. A company's data scientists want to create artificial intelligence and machine learning (AI/ML) training models by using Amazon SageMaker. The training models will use large datasets in an Amazon S3 bucket. The datasets contain sensitive information. On average, the data scientists need 30 days to train models. The S3 bucket has been secured appropriately. The company's data retention policy states that all data that is older than 45 days must be removed from the S3 bucket. Which action should a security engineer take to enforce this data retention policy?
- A. Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days. ＆nbsp;
- B. Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an S3 event notification to invoke the Lambda function for each PutObject operation. ＆nbsp;
- C. Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an Amazon EventBridge rule to invoke the Lambda function each month. ＆nbsp;
- D. Configure S3 Intelligent-Tiering on the S3 bucket to automatically transition objects to another storage class.
View question →
Q12. /p> A company has an application that needs to get objects from an Amazon S3 bucket. The application runs on Amazon EC2 instances.  All the objects in the S3 bucket are encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The resources in the  VPC do not have access to the internet and use a gateway VPC endpoint to access Amazon S3.  The company discovers that the application is unable to get objects from the S3 bucket.  Which factors could cause this issue? (Choose three.)
- A. The IAM instance profile that is attached to the EC2 instances does not allow the s3:ListBucket action for the S3 bucket
- B. The IAM instance profile that is attached to the EC2 instances does not allow the s3:ListParts action for the S3 bucket
- C. The KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:ListKeys action to the EC2 instance pro
- D. The KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:Decrypt action to the EC2 instance pro
- E. The S3 bucket policy does not allow access from the gateway VPC endpoint
- F. ＆nbsp;The security group that is attached to the EC2 instances is missing an inbound rule from the S3 managed prefix list over port 443
View question →
Q13. A company wants to create a log analytics solution for logs generated from its on-premises devices. The logs are collected from the devices onto a server on premises. The company wants to use AWS services to perform near real-time log analysis. The company also wants to store these logs for 365 days for pattern matching and substring search capabilities later. Which solution will meet these requirements with the LEAST development overhead?
- A. Install Amazon Kinesis Agent on the on-premises server to send the logs to Amazon DynamoDB. Configure an AWS Lambda trigger on DynamoDB streams to perform near real-time log analysis. Export the DynamoDB data to Amazon S3 periodically. Run Amazon Athena queries for pattern matching and substring search. Set up S3 Lifecycle policies to delete the log data after 365 days.
- B. Install Amazon Managed Streaming for Apache Kafka (Amazon MSK) on the on-premises server. Create an MSK cluster to collect the streaming data and analyze the data in real time. Set the data retention period to 365 days to store the logs persistently for pattern matching and substring search.
- C. Install Amazon Kinesis Agent on the on-premises server to send the logs to Amazon Kinesis Data Firehose. Configure Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) as the destination for real-time processing. Store the logs in Amazon OpenSearch Service for pattern matching and substring search. Configure an OpenSearch Service Index State Management (ISM) policy to delete the data after 365 days.
- D. Use Amazon API Gateway and AWS Lambda to write the logs from the on-premises server to Amazon DynamoDB. Configure a Lambda trigger on DynamoDB streams to perform near real-time log analysis. Run Amazon Athena federated queries on DynamoDB data for pattern matching and substring search. Set up TTL to delete data after 365 days.
View question →
Q14. A company is using Amazon Elastic Container Service (Amazon ECS) to run its container-based application on AWS. The company needs to ensure that the container images contain no severe vulnerabilities. The company also must ensure that only specific IAM roles and specific AWS accounts can access the container images. Which solution will meet these requirements with the LEAST management overhead?
- A. Pull images from the public container registry. Publish the images to Amazon Elastic Container Registry (Amazon ECR) repositories with scan on push configured in a centralized AWS account. Use a CI/CD pipeline to deploy the images to different AWS accounts. Use identity based policies to restrict access to which IAM principals can access the images. ＆nbsp;
- B. Pull images from the public container registry. Publish the images to a private container registry that is hosted on Amazon EC2 instances in a centralized AWS account. Deploy host-based container scanning tools to EC2 instances that run Amazon ECS. Restrict access to the container images by using basic authentication over HTTPS. ＆nbsp;
- C. Pull images from the public container registry. Publish the images to Amazon Elastic Container Registry (Amazon ECR) repositories with scan on push configured in a centralized AWS account. Use a CI/CD pipeline to deploy the images to different AWS accounts. Use repository policies and identity-based policies to restrict access to which IAM principals and accounts can access the images. ＆nbsp;
- D. Pull images from the public container registry. Publish the images to AWS CodeArtifact repositories in a centralized AWS account. Use a CI/CD pipeline to deploy the images to different AWS accounts. Use repository policies and identity-based policies to restrict access to which IAM principals and accounts can access the images.
View question →
Q15. A company needs complete encryption of the traffic between external users and an application. The company hosts the application on a fleet of Amazon EC2 instances that run in an Auto Scaling group behind an Application Load Balancer (ALB). How can a security engineer meet these requirements?
- A. Create a new Amazon-issued certificate in AWS Secrets Manager. Export the certificate from Secrets Manager. Import the certificate into the ALB and the EC2 instan
- B. Create a new Amazon-issued certificate in AWS Certificate Manager (ACM). Associate the certificate with the ALB. Export the certificate from ACM. Install the certificate on the EC2 instances. ＆nbsp;
- C. Import a new third-party certificate into AWS Identity and Access Management (IAM). Export the certificate from IAM. Associate the certificate with the ALB and the EC2 instances. ＆nbsp;
- D. Import a new third-party certificate into AWS Certificate Manager (ACM). Associate the certificate with the ALB. Install the certificate on the EC2 instances.
View question →
Q16. A company needs to detect unauthenticated access to its Amazon Elastic Kubernetes Service (Amazon EKS) clusters. The company needs a solution that requires no additional configuration of the existing EKS deployment. Which solution will meet these requirements with the LEAST operational effort?
- A. Install an Amazon EKS add-on from a security vendor.
- B. Enable AWS Security Hub. Monitor the Kubernetes ndings.
- C. Monitor Amazon CloudWatch Container Insights metrics for Amazon EKS.
- D. Enable Amazon GuardDuty. Use EKS Audit Log Monitoring.
View question →
Q17. A company discovers a billing anomaly in its AWS account. A security consultant investigates the anomaly and discovers that an employee who left the company 30 days ago still has access to the account. The company has not monitored account activity in the past.  The security consultant needs to determine which resources have been deployed or recongured by the employee as quickly as possible.  Which solution will meet these requirements?
- A. In AWS Cost Explorer, lter chart data to display results from the past 30 days. Export the results to a data table. Group the data table by resource.
- B. Use AWS Cost Anomaly Detection to create a cost monitor. Access the detection history. Set the time frame to Last 30 days. In the search area, choose the service category.
- C. In AWS CloudTrail, lter the event history to display results from the past 30 days. Create an Amazon Athena table that contains the data. Partition the table by event source.
- D. Use AWS Audit Manager to create an assessment for the past 30 days. Apply a usage-based framework to the assessment. Congure the assessment to assess by resource.
View question →
Q18. A company has an application on Amazon EC2 instances that store condential customer data. The company must restrict access to customer data. A security engineer requires secure access to the instances that host the application. According to company policy, users must not open any inbound ports, maintain bastion hosts, or manage SSH keys for the EC2 instances. The security engineer wants to monitor, store, and access all session activity logs. The logs must be encrypted. Which solution will meet these requirements?
- A. Use AWS Control Tower to connect to the EC2 instances. Congure Amazon CloudWatch logging for the sessions. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.
- B. Use AWS Security Hub to connect to the EC2 instances. Congure Amazon CloudWatch logging for the sessions. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.
- C. Use AWS Systems Manager Session Manager to connect to the EC2 instances. Congure Amazon CloudWatch monitoring to record the sessions. Select the store session logs option for the desired CloudWatch Logs log groups.
- D. Use AWS Systems Manager Session Manager to connect to the EC2 instances. Congure Amazon CloudWatch logging. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.
View question →
Q19. >A company has enabled Amazon GuardDuty in all AWS Regions as part of its security monitoring strategy. In one of its VPCs, the company hosts an Amazon EC2 instance that works as an FTP server. A high number of clients from multiple locations contact the FTP server. GuardDuty identifies this activity as a brute force attack because of the high number of connections that happen every hour. The company has flagged the finding as a false positive, but GuardDuty continues to raise the issue. A security engineer must improve the signal-to-noise ratio without compromising the company's visibility of potential anomalous behavior. Which solution will meet these requirements?
- A. Disable the FTP rule in GuardDuty in the Region where the FTP server is deployed.
- B. Add the FTP server to a trusted IP list. Deploy the list to GuardDuty to stop receiving the notifications.
- C. Create a suppression rule in GuardDuty to filter findings by automatically archiving new findings that match the specified criteria.
- D. Create an AWS Lambda function that has the appropriate permissions to delete the finding whenever a new occurrence is reported.
View question →
Q20. >A security engineer is trying to use Amazon EC2 Image Builder to create an image of an EC2 instance. The security engineer has congured the pipeline to send logs to an Amazon S3 bucket. When the security engineer runs the pipeline, the build fails with the following error: "AccessDenied: Access Denied status code: 403".  The security engineer must resolve the error by implementing a solution that complies with best practices for least privilege access.  Which combination of steps will meet these requirements? (Choose two.)
- A. Ensure that the following policies are attached to the IAM role that the security engineer is using＆middot;EC2InstanceProleForImageBuilder, EC2InstanceProleForImageBuilderECRContainerBuilds, and AmazonSSMManagedInstanceCore.
- B. Ensure that the following policies are attached to the instance prole for the EC2 instance: EC2InstanceProleForImageBuilder, EC2InstanceProleForImageBuilderECRContainerBuilds, and AmazonSSMManagedInstanceCore.
- C. Ensure that the AWSImageBuilderFullAccess policy is attached to the instance prole for the EC2 instance.
- D. Ensure that the security engineer＆#39;s IAM role has the s3:PutObject permission for the S3 bucket.
- E. Ensure that the instance prole for the EC2 instance has the s3:PutObject permission for the S3 bucket.
View question →
Q21. A company is developing a new serverless application that uses AWS Lambda functions.The company uses AWS CloudFormation to deploy the Lambda functions. The company's developers are trying to debug a Lambda function that is deployed.The developers cannot debug the Lambda function because the Lambda function is not logging its output to Amazon CloudWatch Logs. Which combination of steps should a security engineer take to resolve this issue?(Choose two.)
- A. Checkthe role that is defined in the CloudFormation template and is passed to the Lambda function.Ensure that the role has a trust policy that allowsthe sts:AssumeRole action by the service principal lambda amazonaws.com.
- B. Check the execution role that is configured in the CloudFormation template for the Lambda function.Ensure that the execution role hasl the necessary permissions to write to CloudWatch Logs.
- C. Check the Lambda function configuration in the CloudFormation template. Ensure thatthe Lambda function has an AWS X-Ray tracing configuration that is set to Active mode or PassThrough mode.
- D. Check the resource policy that is configured in the CloudFormation template for the Lambda function. Ensure that the resource policy has the necessary permissions to write to CloudWatch Logs.
- E. Check the role that the developers use to debug the Lambda function. Ensure that the role has a trust policy that allows the sts:AssumeRole action by the service principal lambda.amazonaws.com.
View question →
Q22. A company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters to run its Kubernetes-based applications.The company uses Amazon GuardDuty to protecttheapplications. EKS Protection is enabled in GuardDuty. However, the coresponding GuardDuty feature is not monitoring the Kubernetes-based applications. Which solution willcause GuardDuty to monitor the Kubernetes-based applications?
- A. Enable VPC flow logs for the VPC thathosts the EKS clusters.
- B. Assign the CloudWatchEventsFulIAccess AWS managed policy to the EKSclusters.
- C. Ensure that the AmazonGuardDutyFullAccess AWS managed policy is attached tothe GuardDuty service role.
- D. Enable the control plane logs in Amazon EKS. Ensure that the logs are ingested into Amazon CloudWatch.
View question →
Q23. A company uses AWS Organizations and has production workloads across multiple AWS accounts. A security engineer needs to design a solution that will proactively monitor for suspicious behavior across all the accounts that contain production workloads. The solution must automate remediation of incidents across the production accounts. The solution must also publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when a critical security finding is detected. In addition, the solution must send all security incident logs to a dedicated account. Which solution will meet these requirements?
- A. Activate Amazon GuardDuty in each production account. In a dedicated logging account, aggregate all GuardDuty logs from each production account. Remediate incidents by configuring GuardDuty to directly invoke an AWS Lambda function. Configure the Lambda function to also publish notifications to the SNS topic.
- B. Activate AWS Security Hub in each production account. In a dedicated logging account, aggregate all Security Hub findings from each production account. Remediate incidents by using AWS Config and AWS Systems Manager. Configure Systems Manager to also publish notifications to the SNS topic.
- C. Activate Amazon GuardDuty in each production account. In a dedicated logging account, aggregate all GuardDuty logs from each production account. Remediate incidents by using Amazon EventBridge to invoke a custom AWS Lambda function from the GuardDuty findings. Configure the Lambda function to also publish notifications to the SNS topic.
- D. Activate AWS Security Hub in each production account. In a dedicated logging account, aggregate all Security Hub findings from each production account. Remediate incidents by using Amazon EventBridge to invoke a custom AWS Lambda function from the Security Hub findings. Configure the Lambda function to also publish notifications to the SNS topic.
View question →
Q24. A company is developing a mechanism that will help data scientists use Amazon SageMaker to read, process, and output data to an Amazon S3 bucket. Data scientists will have access to a dedicated S3 prefix for each of their projects. The company will implement bucket policies that use the dedicated S3 prefixes to restrict access to the S3 objects. The projects can last up to 60 days. The company's security team mandates that data cannot remain in the S3 bucket after the end of the projects that use the data. Which solution will meet these requirements MOST cost-effectively?
- A. Create an AWS Lambda function to identify and delete objects in the S3 bucket that have not been accessed for 60 days. Create an Amazon EventBridge scheduled rule that runs every day to invoke the Lambda function. ＆nbsp;
- B. Create a new S3 bucket. Configure the new S3 bucket to use S3 Intelligent-Tiering. Copy the objects to the new S3 bucket. ＆nbsp;
- C. Create an S3 Lifecycle configuration for each S3 bucket prefix for each project. Set the S3 Lifecycle configurations to expire objects after 60 days. ＆nbsp;
- D. Create an AWS Lambda function to delete objects that have not been accessed for 60 days. Create an S3 event notification for S3 Intelligent-Tiering automatic archival events to invoke the Lambda function.
View question →
Q25. A company’s security engineer wants to receive an email alert whenever Amazon GuardDuty, AWS Identity and Access Management Access Analyzer, or Amazon Macie generate a high-severity security nding. The company uses AWS Control Tower to govern all of its accounts. The company also uses AWS Security Hub with all of the AWS service integrations turned on. Which solution will meet these requirements with the LEAST operational overhead?
- A. Set up separate AWS Lambda functions for GuardDuty, IAM Access Analyzer, and Macie to call each service's public API to retrieve highseverity ndings. Use Amazon Simple Notication Service (Amazon SNS) to send the email alerts. Create an Amazon EventBridge rule to invoke the functions on a schedule.
- B. Create an Amazon EventBridge rule with a pattern that matches Security Hub ndings events with high severity. Congure the rule to send the ndings to a target Amazon Simple Notication Service (Amazon SNS) topic. Subscribe the desired email addresses to the SNS topic.
- C. Create an Amazon EventBridge rule with a pattern that matches AWS Control Tower events with high severity. Congure the rule to send the ndings to a target Amazon Simple Notication Service (Amazon SNS) topic. Subscribe the desired email addresses to the SNS topic.
- D. Host an application on Amazon EC2 to call the GuardDuty. IAM Access Analyzer, and Macie APIs. Within the application, use the Amazon Simple Notication Service (Amazon SNS) API to retrieve high-severity ndings and to send the ndings to an SNS topic. Subscribe the desired email addresses to the SNS topic.
View question →
Q26. an engineer uploaded their AWS access key and secret access key. The engineer reported the mistake to a manager, and the manager immediately disabled the access key. The company needs to assess the impact of the exposed access key. A security engineer must recommend a solution that requires the least possible managerial overhead. Which solution meets these requirements?
- A. Analyze an AWS Identity and Access Management (IAM) use report from AWS Trusted Advisor to see when the access key was last used.
- B. Analyze Amazon CloudWatch Logs for activity by searching for the access key.
- C. Analyze VPC flow logs for activity by searching for the access key.
- D. Analyze a credential report in AWS Identity and Access Management (IAM) to see when the access key was last used.
View question →
Q27. A company has an organization with SCPs in AWS Organizations. The root SCP for the organization is as follows: The company's developers are members of a group that has an IAM policy that allows access to Amazon Simple Email Service (Amazon SES) by allowing ses:* actions. The account is a child to an OU that has an SCP that allows Amazon SES. The developers are receiving a not authorized error when they try to access Amazon SES through the AWS Management Console. Which change must a security engineer implement so that the developers can access Amazon SES?
- A. Add a resource policy that allows each member of the group to access Amazon SES. ＆nbsp;
- B. Add a resource policy that allows ＆quot;Principal＆quot;: {＆quot;AWS＆quot;: ＆quot;arn:aws:iam::account-number:group/Dev＆quot;}.
- C. ＆nbsp;Remove the AWS Control Tower control (guardrail) that restricts access to Amazon SES.＆nbsp;
- D. Remove Amazon SES from the root SCP.
View question →
Q28. A security engineer is building a Java application that is running on Amazon EC2. The application communicates with an Amazon RDS instance and authenticates with a user name and password.  Which combination of steps can the engineer take to protect the credentials and minimize downtime when the credentials are rotated? (Choose two.)
- A. Have a database administrator encrypt the credentials and store the ciphertext in Amazon S3. Grant permission to the instance role associated with the EC2 instance to read the object and decrypt the ciphertext.
- B. Congure a scheduled job that updates the credential in AWS Systems Manager Parameter Store and noties the engineer that the application needs to be restarted.
- C. Congure automatic rotation of credentials in AWS Secrets Manager
- D. Store the credential in an encrypted string parameter in AWS Systems Manager Parameter Store. Grant permission to the instance role associated with the EC2 instance to access the parameter and the AWS KMS key that is used to encrypt it.
- E. Congure the Java application to catch a connection failure and make a call to AWS Secrets Manager to retrieve updated credentials when the password is rotated. Grant permission to the instance role associated with the EC2 instance to access Secrets Manager.
View question →
Q29. A company uses an AWS Key Management Service (AWS KMS) AWS owned key in its application to encrypt files in an AWS account. The company's security team wants the ability to change to new key material for new files whenever a potential key breach occurs. A security engineer must implement a solution that gives the security team the ability to change the key whenever the team wants to do so. Which solution will meet these requirements?
- A. Create a new customer managed key. Add a key rotation schedule to the key. Invoke the key rotation schedule every time the security team requests a key change. ＆nbsp;
- B. Create a new AWS managed key. Add a key rotation schedule to the key. Invoke the key rotation schedule every time the security team requests a key change. ＆nbsp;
- C. Create a key alias. Create a new customer managed key every time the security team requests a key change. Associate the alias with the new key. ＆nbsp;
- D. Create a key alias. Create a new AWS managed key every time the security team requests a key change. Associate the alias with the new key.
View question →
Q30. A security engineer needs to set up an Amazon CloudFront distribution for an Amazon S3 bucket that hosts a static website. The security engineer must allow only specified IP addresses to access the website. The security engineer also must prevent users from accessing the website directly by using S3 URLs. Which solution will meet these requirements?
- A. Generate an S3 bucket policy. Specify cloudfront.amazonaws.com as the principal. Use the aws:SourceIp condition key to allow access only if the request comes from the specified IP addresses. ＆nbsp;
- B. Create a CloudFront origin access control (OAC). Create the S3 bucket policy so that only the OAC has access. Create an AWS WAF web ACL, and add an IP set rule. Associate the web ACL with the CloudFront distribution. ＆nbsp;
- C. Implement security groups to allow only the specified IP addresses access and to restrict S3 bucket access by using the CloudFront distribution. ＆nbsp;
- D. Create an S3 bucket access point to allow access from only the CloudFront distribution. Create an AWS WAF web ACL and add an IP set rule. Associate the web ACL with the CloudFront distribution.
View question →
Q31. A company hosts a public website on an Amazon EC2 instance. HTTPS traffic must be able to access the website. The company uses SSH for management of the web server. The website is on the subnet 10.0.1.0/24. The management subnet is 192.168.100.0/24. A security engineer must create a security group for the EC2 instance. Which combination of steps should the security engineer take to meet these requirements in the MOST secure manner? (Choose two.)
- A. Allow port 22 from source 0.0.0.0/0. ＆nbsp;
- B. Allow port 443 from source 0.0.0.0/0. ＆nbsp;
- C. Allow port 22 from 192.168.100.0/24. ＆nbsp;
- D. Allow port 22 from 10.0.1.0/24. ＆nbsp;
- E. Allow port 443 from 10.0.1.0/24.
View question →
Q32. A company has several petabytes of data. The company must preserve this data for 7 years to comply with regulatory requirements. The company's compliance team asks a security ocer to develop a strategy that will prevent anyone from changing or deleting the data.  Which solution will meet this requirement MOST cost-effectively?
- A. Create an Amazon S3 bucket. Congure the bucket to use S3 Object Lock in compliance mode. Upload the data to the bucket. Create a resource-based bucket policy that meets all the regulatory requirements.
- B. Create an Amazon S3 bucket. Congure the bucket to use S3 Object Lock in governance mode. Upload the data to the bucket. Create a user-based IAM policy that meets all the regulatory requirements.
- C. Create a vault in Amazon S3 Glacier. Create a Vault Lock policy in S3 Glacier that meets all the regulatory requirements. Upload the data to the vault.
- D. Create an Amazon S3 bucket. Upload the data to the bucket. Use a lifecycle rule to transition the data to a vault in S3 Glacier. Create a Vault Lock policy that meets all the regulatory requirements.
View question →
Q33. A company that operates in a hybrid cloud environment must meet strict compliance requirements. The company wants to create a report that includes evidence from on-premises workloads alongside evidence from AWS resources. A security engineer must implement a solution to collect, review, and manage the evidence to demonstrate compliance with company policy.  Which solution will meet these requirements?
- A. Create an assessment in AWS Audit Manager from a prebuilt framework or a custom framework. Upload manual evidence from the onpremises workloads. Add the evidence to the assessment. Generate an assessment report after Audit Manager collects the necessary evidence from the AWS resources.
- B. Install the Amazon CloudWatch agent on the on-premises workloads. Use AWS Cong to deploy a conformance pack from a sample conformance pack template or a custom YAML template. Generate an assessment report after AWS Cong identies noncompliant workloads and resources.
- C. Set up the appropriate security standard in AWS Security Hub. Upload manual evidence from the on-premises workloads. Wait for Security Hub to collect the evidence from the AWS resources. Download the list of controls as a .csv le.
- D. Install the Amazon CloudWatch agent on the on-premises workloads. Create a CloudWatch dashboard to monitor the on-premises workloads and the AWS resources. Run a query on the workloads and resources. Download the results.
View question →
Q34. A company's security team needs to receive a notification whenever an AWS access key has not been rotated in 90 or more days. A security engineer must develop a solution that provides these notifications automatically. Which solution will meet these requirements with the LEAST amount of effort?
- A. Deploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days. Create an Amazon EventBridge rule with an event pattern that matches the compliance type of NON_COMPLIANT from AWS Config for the managed rule. Configure EventBridge to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
- B. Create a script to export a .csv file from the AWS Trusted Advisor check for IAM access key rotation. Load the script into an AWS Lambda function that will upload the .csv file to an Amazon S3 bucket. Create an Amazon Athena table query that runs when the .csv file is uploaded to the S3 bucket. Publish the results for any keys older than 90 days by using an invocation of an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
- C. Create a script to download the IAM credentials report on a periodic basis. Load the script into an AWS Lambda function that will run on a schedule through Amazon EventBridge. Configure the Lambda script to load the report into memory and to filter the report for records in which the key was last rotated at least 90 days ago. If any records are detected, send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
- D. Create an AWS Lambda function that queries the IAM API to list all the users. Iterate through the users by using the ListAccessKeys operation. Verify that the value in the CreateDate field is not at least 90 days old. Send an Amazon Simple Notification Service (Amazon SNS) notification to the security team if the value is at least 90 days old. Create an Amazon EventBridge rule to schedule the Lambda function to run each day.
View question →
Q35. A company uses an external identity provider to allow federation into different AWS accounts. A security engineer for the company needs to identify the federated user that terminated a production Amazon EC2 instance a week ago. What is the FASTEST way for the security engineer to identify the federated user?
- A. Review the AWS CloudTrail event history logs in an Amazon S3 bucket and look for the TerminateInstances event to identify the federated user from the role session name.
- B. Filter the AWS CloudTrail event history for the TerminateInstances event and identify the assumed IAM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username.
- C. Search the AWS CloudTrail logs for the TerminateInstances event and note the event time. Review the IAM Access Advisor tab for all federated roles. The last accessed time should match the time when the instance was terminated.
- D. Use Amazon Athena to run a SQL query on the AWS CloudTrail logs stored in an Amazon S3 bucket and filter on the TerminateInstances event. Identify the corresponding role and run another query to filter the AssumeRoleWithWebIdentity event for the user name.
View question →
Q36. A company is migrating container workloads from a data center to Amazon Elastic ContainerService(Amazon ECS)custers.The company must implement a solution to detect potential threats in the workloads and to improve the security posture of the container clusters. Which solution will meetthese requirements?
- A. Configure Amazon Inspector on the VPC that is running the ECS clusters.
- B. Enable Amazon GuardDuty Runtime Monitoring on the ECS clusters.
- C. Audit Amazon ECS API access by using Amazon CloudWatch logs to identify unauthorized access.
- D. Create container clusters in the same VPC. Use VPC flow logs to centrally monitor network traffic.
View question →
Q37. A company needs to prevent Amazon S3 objects from being shared with IAM identities outside of the company's organization in AWS Organizations.A security engineer is creating and deploying an SCP to accomplish this goal.The company has enabled the S3 Block Public Access feature on allof its S3 buckets. What should the SCP do to meet these requirements?
- A. Deny the S3:*action with a Condition element that comprises an operator of StringNotEquals, a key of aws:ResourceorglD,and a value of S{aws PrincipalorgID}.
- B. Deny the S3:PutAccountPublicAccessBlock action with a Condition element that comprises an operatorof StringLike,a key of aws:PrincipalArn, and the values of the external IAM principals.
- C. Allow the S3:* action with a Condition element that comprises an operator of StringNotEquals,a key of aws:PrincipalOrglD, and a value of S{aws:PrincipalOrgID}.
- D. Denythe S3:* action with a Condition element that comprises an operator of StringLike,a key of aws:PrincipalArn,and the values of the external IAM principals
View question →
Q38. A company is designing a new application stack. The design includes web servers and backend servers that are hosted on Amazon EC2 instances. The design also includes an Amazon Aurora MySQL DB cluster. The EC2 instances are in an Auto Scaling group that uses launch templates. The EC2 instances for the web layer and the backend layer are backed by Amazon Elastic Block Store (Amazon EBS) volumes. No layers are encrypted at rest. A security engineer needs to implement encryption at rest. Which combination of steps will meet these requirements? (Choose two.)
- A. Modify EBS default encryption settings in the target AWS Region to enable encryption. Use an Auto Scaling group instance refresh. ＆nbsp;
- B. Modify the launch templates for the web layer and the backend layer to add AWS Certificate Manager (ACM) encryption for the attached EBS volumes. Use an Auto Scaling group instance refresh. ＆nbsp;
- C. Create a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster. ＆nbsp;
- D. Apply AWS Key Management Service (AWS KMS) encryption to the existing DB cluster. ＆nbsp;
- E. Apply AWS Certificate Manager (ACM) encryption to the existing DB cluster.
View question →
Q39. A company is using Amazon Route 53 Resolver for its hybrid DNS infrastructure. The company has set up Route 53 Resolver forwarding rules for authoritative domains that are hosted on on-premises DNS servers. A new security mandate requires the company to implement a solution to log and query DNS traffic that goes to the on-premises DNS servers. The logs must show details of the source IP address of the instance from which the query originated. The logs also must show the DNS name that was requested in Route 53 Resolver. Which solution will meet these requirements?
- A. Use VPC Traffic Mirroring. Configure all relevant elastic network interfaces as the traffic source, include amazon-dns in the mirror filter, and set Amazon CloudWatch Logs as the mirror target.
- B. Configure VPC flow logs on all relevant VPCs. Send the logs to an Amazon S3 bucket. Use Amazon Athena to run SQL queries on the source IP address and DNS name.
- C. Configure Route 53 Resolver query logging on all relevant VPCs. Send the logs to Amazon CloudWatch Logs. Use CloudWatch Insights to run queries on the source IP address and DNS name.
- D. Modify the Route 53 Resolver rules on the authoritative domains that forward to the on-premises DNS servers. Send the logs to an Amazon S3 bucket. Use Amazon Athena to run SQL queries on the source IP address and DNS name.
View question →
Q40. A company has an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Amazon EC2 Auto Scaling group and are attached to Amazon Elastic Block Store (Amazon EBS) volumes. A security engineer needs to preserve all forensic evidence from one of the instances. Which order of steps should the security engineer use to meet this requirement?
- A. Take an EBS volume snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take a memory snapshot of the instance and store the snapshot in an S3 bucket Detach the instance from the Auto Scaling group. Deregister the instance from the ALB. Stop the instance.
- B. Take a memory snapshot of the instance and store the snapshot in an Amazon S3 bucket. Stop the instance. Take an EBS volume snapshot of the instance and store the snapshot in an S3 bucket. Detach the instance from the Auto Scaling group. Deregister the instance from the ALB.
- C. Detach the instance from the Auto Scaling group. Deregister the instance from the ALB. Take an EBS volume snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take a memory snapshot of the instance and store the snapshot in an S3 bucket. Stop the instance.
- D. Detach the instance from the Auto Scaling group. Deregister the instance from the ALB Stop the instance. Take a memory snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take an EBS volume snapshot of the instance and store the snapshot in an S3 bucket.
View question →
Q41. A-company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certicate, users saw the following message when trying to log in: Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken) A security engineer needs to provide a solution that corrects the error and minimizes operational overhead.  Which solution meets these requirements?
- A. Upload the third-party signing certicate＆rsquo;s new private key to the AWS identity provider entity dened in AWS Identity and Access Management (IAM) by using the AWS Management Console.
- B. Sign the identity provider＆#39;s metadata le with the new public key. Upload the signature to the AWS identity provider entity dened in AWS Identity and Access Management (IAM) by using the AWS CLI.
- C. Download the updated SAML metadata le from the identity service provider. Update the le in the AWS identity provider entity dened in AWS Identity and Access Management (IAM) by using the AWS CLI.
- D. Congure the AWS identity provider entity dened in AWS Identity and Access Management (IAM) to synchronously fetch the new public key by using the AWS Management Console.
View question →
Q42. A security engineer creates an Amazon S3 bucket policy that denies access to all users. A few days later, the security engineer adds an additional statement to the bucket policy to allow read-only access to one other employee. Even after updating the policy, the employee still receives an access denied message. What is the likely cause of this access denial?
- A. The ACL in the bucket needs to be updated.
- B. The IAM policy does not allow the user to access the bucket.
- C. It takes a few minutes for a bucket policy to take effect.
- D. The allow permission is being overridden by the deny.
View question →
Q43. The security engineer is managing a traditional three-tier web application that is running on Amazon EC2 instances. The application has become the target of increasing numbers of malicious attacks from the internet. What steps should the security engineer take to check for known vulnerabilities and limit the attack surface? (Choose two.)
- A. Use AWS Certificate Manager to encrypt all traffic between the client and application servers. ＆nbsp;
- B. Review the application security groups to ensure that only the necessary ports are open. ＆nbsp;
- C. Use Elastic Load Balancing to offload Secure Sockets Layer encryption. ＆nbsp;
- D. Use Amazon Inspector to periodically scan the backend instances. ＆nbsp;
- E. Use AWS Key Management Service (AWS KMS) to encrypt all the traffic between the client and application servers.
View question →
Q44. A security engineer is designing an IAM policy to protect AWS API operations. The policy must enforce multi-factor authentication (MFA) for IAM users to access certain services in the AWS production account. Each session must remain valid for only 2 hours. The current version of the IAM policy is as follows: Which combination of conditions must the security engineer add to the IAM policy to meet these requirements? (Choose two.)
- A. ＆quot;Bool＆quot;: {＆quot;aws:MultiFactorAuthPresent＆quot;: ＆quot;true＆quot;}
- B. ＆quot;Bool＆quot;: {＆quot;aws:MultiFactorAuthPresent＆quot;: ＆quot;false＆quot;}
- C. ＆quot;NumericLessThan＆quot;: {＆quot;aws:MultiFactorAuthAge＆quot;: ＆quot;7200＆quot;}
- D. ＆quot;NumericGreaterThan＆quot;: {＆quot;aws:MultiFactorAuthAge＆quot;: ＆quot;7200＆quot;}
- E. "NumericLessThan": {"MaxSessionDuration": "7200"}
View question →
Q45. What are the MOST secure ways to protect the AWS account root user of a recently opened AWS account? (Choose two.)
- A. Use the AWS account root user access keys instead of the AWS Management Console.
- B. Enable multi-factor authentication (MFA＆gt;＆gt;＆gt; for the AWS IAM users with the AdministratorAccess managed policy attached to them.
- C. Use AWS KMS to encrypt all AWS account root user and AWS IAM access keys and set automatic rotation to 30 days.
- D. Do not create access keys for the AWS account root user; instead, create AWS IAM users.
- E. Enable multi-factor authentication for the AWS account root user.
View question →
Q46. A company runs workloads in the us-east-1 Region. The company has never deployed resources to other AWS Regions and does not have any multi-Region resources. The company needs to replicate its workloads and infrastructure to the us-west-1 Region. A security engineer must implement a solution that uses AWS Secrets Manager to store secrets in both Regions. The solution must use AWS Key Management Service (AWS KMS) to encrypt the secrets. The solution must minimize latency and must be able to work if only one Region is available. The security engineer uses Secrets Manager to create the secrets in us-east-1. What should the security engineer do next to meet the requirements?
- A. Encrypt the secrets in us-east-1 by using an AWS managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using a new AWS managed KMS key in us-west-1. ＆nbsp;
- B. Encrypt the secrets in us-east-1 by using an AWS managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1. ＆nbsp;
- C. Encrypt the secrets in us-east-1 by using a customer managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1. ＆nbsp;
- D. Encrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1.
View question →
Q47. A company suspects that an attacker has exploited an overly permissive role to export credentials from Amazon EC2 instance metadata. The company uses Amazon GuardDuty and AWS Audit Manager. The company has enabled AWS CloudTrail logging and Amazon CloudWatch logging for all of its AWS accounts. A security engineer must determine if the credentials were used to access the company's resources from an external account. Which solution will provide this information?
- A. Review GuardDuty ndings to nd InstanceCredentialExltration events.
- B. Review assessment reports in the Audit Manager console to nd InstanceCredentialExltration events.
- C. Review CloudTrail logs for GetSessionToken API calls to AWS Security Token Service (AWS STS) that come from an account ID from outside the company.
- D. Review CloudWatch logs for GetSessionToken API calls to AWS Security Token Service (AWS STS) that come from an account ID from outside the company.
View question →
Q48. An international company has established a new business entity in South Korea. The company also has established a new AWS account to contain the workload for the South Korean region. The company has set up the workload in the new account in the ap-northeast-2 Region. The workload consists of three Auto Scaling groups of Amazon EC2 instances. All workloads that operate in this Region must keep system logs and application logs for 7 years. A security engineer must implement a solution to ensure that no logging data is lost for each instance during scaling activities. The solution also must keep the logs for only the required period of 7 years. Which combination of steps should the security engineer take to meet these requirements? (Choose three.)
- A. Ensure that the Amazon CloudWatch agent is installed on all the EC2 instances that the Auto Scaling groups launch. Generate a CloudWatch agent configuration file to forward the required logs to Amazon CloudWatch Logs.
- B. Set the log retention for desired log groups to 7 years.
- C. Attach an IAM role to the launch configuration or launch template that the Auto Scaling groups use. Configure the role to provide the necessary permissions to forward logs to Amazon CloudWatch Logs.
- D. Attach an IAM role to the launch configuration or launch template that the Auto Scaling groups use. Configure the role to provide the necessary permissions to forward logs to Amazon S3.
- E. Ensure that a log forwarding application is installed on all the EC2 instances that the Auto Scaling groups launch. Configure the log forwarding application to periodically bundle the logs and forward the logs to Amazon S3.
- F. Configure an Amazon S3 Lifecycle policy on the target S3 bucket to expire objects after 7 years.
View question →
Q49. A company has AWS accounts that are in an organization in AWS Organizations. An Amazon S3 bucket in one of the accounts is publicly accessible. A security engineer must change the configuration so that the S3 bucket is no longer publicly accessible. The security engineer also must ensure that the S3 bucket cannot be made publicly accessible in the future. Which solution will meet these requirements?
- A. Configure the S3 bucket to use an AWS Key Management Service (AWS KMS) key. Encrypt all objects in the S3 bucket by creating a bucket policy that enforces encryption. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account. ＆nbsp;
- B. Enable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account. ＆nbsp;
- C. Enable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account. ＆nbsp;
- D. Configure the S3 bucket to use S3 Object Lock in governance mode. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account.
View question →
Q50. A security engineer for a large company is managing a data processing application used by 1,500 subsidiary companies. The parent and subsidiary companies all use AWS. The application uses TCP port 443 and runs on Amazon C2 behind a Network Load Balancer (NLB). For compliance reasons, the application should only be accessible to the subsidiaries and should not be available on the public internet. To meet the compliance requirements for restricted access, the engineer has received the public and private CIDR block ranges for each subsidiary. What solution should the engineer use to implement the appropriate access restrictions for the application?
- A. Create a NACL to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the NACL to both the NLB and EC2 instances.
- B. Create an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the security group to the NLCreate a second security group for EC2 instances with access on TCP port 443 from the NLB security group.
- C. Create an AWS PrivateLink endpoint service in the parent company account attached to the NLB. Create an AWS security group for the instances to allow access on TCP port 443 from the AWS PrivateLink endpoint. Use AWS PrivateLink interface endpoints in the 1,500 subsidiary AWS accounts to connect to the data processing application.
- D. Create an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the security group with EC2 instances.
View question →
Q51. A company uses AWS Organizations to manage a small number of AWS accounts. However, the company plans to add 1,000 more accounts soon. The company allows only a centralized security team to create IAM roles for all AWS accounts and teams. Application teams submit requests for IAM roles to the security team. The security team has a backlog of IAM role requests and cannot review and provision the IAM roles quickly. The security team must create a process that will allow application teams to provision their own IAM roles. The process must also limit the scope of IAM roles and prevent privilege escalation. Which solution will meet these requirements with the LEAST operational overhead?
- A. Create an IAM group for each application team. Associate policies with each IAM group. Provision IAM users for each application team member. Add the new IAM users to the appropriate IAM group by using role-based access control (RBAC).
- B. Delegate application team leads to provision IAM roles for each team. Conduct a quarterly review of the IAM roles the team leads have provisioned. Ensure that the application team leads have the appropriate training to review IAM roles.
- C. Put each AWS account in its own OU. Add an SCP to each OU to grant access to only the AWS services that the teams plan to use. Include conditions in the AWS account of each team.
- D. Create an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that only roles that have the permissions boundary attached can create any new IAM roles.
View question →
Q52. A company has deployed servers on Amazon EC2 instances in a VPC. External vendors access these servers over the internet. Recently, the company deployed a new application on EC2 instances in a new CIDR range. The company needs to make the application available to the vendors. A security engineer verified that the associated security groups and network ACLs are allowing the required ports in the inbound direction. However, the vendors cannot connect to the application. Which solution will provide the vendors access to the application?
- A. Modify the security group that is associated with the EC2 instances to have the same outbound rules as inbound rules. ＆nbsp;
- B. Modify the network ACL that is associated with the CIDR range to allow outbound traffic to ephemeral ports. ＆nbsp;
- C. Modify the inbound rules on the internet gateway to allow the required ports. ＆nbsp;
- D. Modify the network ACL that is associated with the CIDR range to have the same outbound rules as inbound rules.
View question →
Q53. Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in  the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic. Which of the following troubleshooting steps should be performed?
- A. Check inbound and outbound security groups, looking for DENY rules
- B. Check inbound and outbound Network ACL rules, looking for DENY rules
- C. Review the rejected packet reason codes in the VPC Flow Logs
- D. Use AWS X-Ray to trace the end-to-end application
View question →
Q54. An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connect to the website during the attack period. The ecommerce company’s security team is worried about future potential attacks and wants to prepare for such events. The company needs to minimize downtime in its response to similar attacks in the future. Which steps would help achieve this? (Choose two.)
- A. Enable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
- B. Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack.
- C. Use VPC Flow Logs to monitor network traffic and an AWS Lambda function to automatically block an attacker’s IP using security groups.
- D. Set up an Amazon EventBridge rule to monitor the AWS CloudTrail events in real time, use AWS Cong rules to audit the configuration, and use AWS Systems Manager for remediation.
- E. Use AWS WAF to create rules to respond to such attacks.
View question →
Q55. A company is running internal microservices on Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type. The company is using Amazon Elastic Container Registry (Amazon ECR) private repositories. A security engineer needs to encrypt the private repositories by using AWS Key Management Service (AWS KMS). The security engineer also needs to analyze the container images for any common vulnerabilities and exposures (CVEs). Which solution will meet these requirements?
- A. Enable KMS encryption on the existing ECR repositories. Install Amazon Inspector Agent from the ECS container instances＆rsquo; user data. Run an assessment with the CVE rules.
- B. Recreate the ECR repositories with KMS encryption and ECR scanning enabled. Analyze the scan report after the next push of images.
- C. Recreate the ECR repositories with KMS encryption and ECR scanning enabled. Install AWS Systems Manager Agent on the ECS container instances. Run an inventory report.
- D. Enable KMS encryption on the existing ECR repositories. Use AWS Trusted Advisor to check the ECS container instances and to verify the findings against a list of current CVEs.
View question →
Q56. A company needs to log object-level activity in its Amazon S3 buckets.The company also needs to validate the integrity of the log file by using a digital signature. Which solution will meetthese requirements?
- A. Create an AWS CloudTrail trail with log fle validation enabled. Enable data events.Specify Amazon S3 as the data event type.
- B. Create a new S3 bucket for S3 server access logs.Confgure the existing S3 buckets to send their S3 server accesslogs to the new S3 bucket.
- C. Create an Amazon CloudWatch Logs log group.Configure the existing S3 buckets to send their S3 server access logs to the log group.
- D. Create a new S3 bucket for S3 server access logs with log file validation enabled.Enable data events. Specify Amazon S3 as the data event type.
View question →
Q57. A medical company recently completed an acquisition and inherited an existing AWS environment. The company has an upcoming audit and is concerned about the compliance posture of its acquisition. The company must identify personal health information inside Amazon S3 buckets and must identify S3 buckets that are publicly accessible. The company needs to prepare for the audit by collecting evidence in the environment. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)
- A. Enable Amazon Macie. Run an on-demand sensitive data discovery job that uses the PERSONAL_INFORMATION managed data identier.
- B. Use AWS Glue with the Detect PII transform to identify sensitive data and to mask the sensitive data.
- C. Enable AWS Audit Manager. Create an assessment by using a supported framework.
- D. Enable Amazon GuardDuty S3 Protection. Document any ndings that are related to suspicious access of S3 buckets.
- E. Enable AWS Security Hub. Use the AWS Foundational Security Best Practices standard. Review the controls dashboard for evidence of failed S3 Block Public Access controls.
- F. Enable AWS Cong. Set up the s3-bucket-public-write-prohibited AWS Cong managed rule.
View question →
Q58. A company uses Amazon RDS for MySQL as a database engine for its applications. A recent security audit revealed an RDS instance that is not compliant with company policy for encrypting data at rest. A security engineer at the company needs to ensure that all existing RDS databases are encrypted using server-side encryption and that any future deviations from the policy are detected. Which combination of steps should the security engineer take to accomplish this?
- A. Create an AWS Config rule to detect the creation of unencrypted RDS databases. Create an Amazon EventBridge rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.
- B. Use AWS System Manager State Manager to detect RDS database encryption configuration drift. Create an Amazon EventBridge rule to track state changes and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.
- C. Create a read replica for the existing unencrypted RDS database and enable replica encryption in the process. Once the replica becomes active, promote it into a standalone database instance and terminate the unencrypted database instance.
- D. Take a snapshot of the unencrypted RDS database. Copy the snapshot and enable snapshot encryption in the process. Restore the database instance from the newly created encrypted snapshot. Terminate the unencrypted database instance.
- E. Enable encryption for the identiFied unencrypted RDS instance by changing the con
View question →
Q59. A systems engineer is troubleshooting the connectivity of a test environment that includes a virtual security appliance deployed inline. In addition to using the virtual security appliance, the development team wants to use security groups and network ACLs to accomplish various security requirements in the environment. What configuration is necessary to allow the virtual security appliance to route the traffic?
- A. Disable network ACLs. ＆nbsp;
- B. Configure the security appliance＆#39;s elastic network interface for promiscuous mode. ＆nbsp;
- C. isable the Network Source/Destination check on the security appliance＆#39;s elastic network interface. ＆nbsp;
- D. Place the security appliance in the public subnet with the internet gateway.
View question →
Q60. A company is implementing a new application in a new AWS account. A VPC and subnets have been created for the application. The application has been peered to an existing VPC in another account in the same AWS Region for database access. Amazon EC2 instances will regularly be created and terminated in the application VPC, but only some of them will need access to the databases in the peered VPC over TCP port 1521. A security engineer must ensure that only the EC2 instances that need access to the databases can access them through the network. How can the security engineer implement this solution?
- A. Create a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access. ＆nbsp;
- B. Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access. ＆nbsp;
- C. Create a new security group in the application VPC with no ＆nbsp;inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the application VPC. Attach the application security group to the application instances that need database access and attach the database security group to the database instances. ＆nbsp;
- D. Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Add a new network ACL rule on the database subnets. Configure the rule to allow all traffic from the IP address range of the application VPC. Attach the new security group to the application instances that need database access.
View question →
Q61. A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards.However,the security engineer is concerned about a situation in which several confguration changes are made to the resource in quick succession.The security engineer wants to record onlythe latest configuration of that resource to indicate the cumulative impact of the set of changes. Which solution will meet this requirement in the MOST operationally efficient way?
- A. Use AWS CloudTrail to detect the configuration changesbyfitering APl call to monitor the changes.Use the most recent APl call to indicate the cumulative impact of multiple calls.
- B. Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.
- C. Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent APl call to indicate the cumulative impact of multiple calls.
- D. Use AWS Cloud Map to detect the configuration changes.Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.
View question →
Q62. A company needs to create a centralized solution to analyze log files. The company uses an organization in AWS Organizations to manage its AWS accounts. The solution must aggregate and normalize events from the following sources: - The entire organization in Organizations - All AWS Marketplace offerings that run in the company’s AWS accounts - The company's on-premises systems Which solution will meet these requirements?
- A. Configure a centralized Amazon S3 bucket for the logs. Enable VPC Flow Logs, AWS CloudTrail, and Amazon Route 53 logs in all accounts. Configure all accounts to use the centralized S3 bucket. Configure AWS Glue crawlers to parse the log files. Use Amazon Athena to query the log data. ＆nbsp;
- B. ＆nbsp;Configure log streams in Amazon CloudWatch Logs for the sources that need monitoring. Create log subscription filters for each log stream. Forward the messages to Amazon OpenSearch Service for analysis. ＆nbsp;
- C. Set up a delegated Amazon Security Lake administrator account in Organizations. Enable and configure Security Lake for the organization. Add the accounts that need monitoring. Use Amazon Athena to query the log data. ＆nbsp;
- D. Apply an SCP to configure all member accounts and services to deliver log files to a centralized Amazon S3 bucket. Use Amazon OpenSearch Service to query the centralized S3 bucket for log entries.
View question →
Q63. A company must retain backup copies of Amazon RDS DB instances and Amazon Elastic Block Store (Amazon EBS) volumes.The company must retain the backup copies in data centers that are several hundred miles apart. Which solution will meetthese requirements with the LEAST operational overhead?
- A. Configure AWS Backupto create the backups according to the needed schedule.In the backup plan, specify multiple Availability Zones as backup destinations.
- B. Configure Amazon Data Lifecycle Manager to create the backups. Configure the Amazon Data Lifecycle Manager policy to copy the backups to an Amazon S3 bucket. Enable replication on the S3 bucket.
- C. Configure AWS Backup to create the backups according to the needed schedule.Create a destination backup vault in a dfferent AWS Region. Configure AWS Backup to copy the backups to the destination backup vault.
- D. Configure Amazon Data Lifecycle Manager to create the backups.Create an AWS Lambda function to copy the backups to a different AWS Region.Use Amazon EventBridge to invoke the Lambda function on a schedule.
View question →
Q64. A company is planning to migrate its applications to AWS in a single AWS Region.The company's applications will use a combination of Amazon EC2 instances, Elastic Load Balancing(ELB)load balancers,and Amazon S3 buckets.The company wants to complete the migration as quickly as possible.All the applications must meet the following requirements: · Data must be encrypted at rest. ·Data must be encrypted in transit. ·Endpoints must be monitored for anomalous network traffic. Which combination of steps should a security engineer take to meet these requirements with the LEAST effort?(Choose three.)
- A. Install the Amazon Inspector agent on EC2 instances by using AWS Systems Manager Automation.
- B. Enable Amazon GuardDuty in all AWS accounts.
- C. Create VPC endpoints for Amazon EC2 and Amazon S3.Update VPC route tables to use only the secure VPC endpoints.
- D. Configure AWS Certificate Manager(ACM).Configure the load balancers to use certificates from ACM.
- E. Use AWS Key Management Service (AWS KMS) for key management.Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-meta-side-encryption.
- F. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any Putobject command with a condition forx-amz-server-side-encryption.
View question →
Q65. A public subnet contains two Amazon EC2 instances.The subnet has a custom network ACL. A security enginee is designing a solution to improve the subnet security. The solution must allow outbound traffic to an internet service that uses TLS through port 443.The solution also must deny inbound trafic that is destined for MySQL port 3306. Which network ACL rule set meets these requirements?
- A. Use inbound rule 100 to allowtraffic on TCP port 443.Use inbound rule 200 to deny trafic on TCP port 3306.Use outbound rule 100 to allow traffic on TCP port 443.
- B. Use inbound rule 100 to deny traffic on TCP port 3306.Use inbound rule 200 to allow traffic on TCP port range 1024-65535.Use outbound rule 100 to allow traffic on TCP port 443.
- C. Use inbound ule 100 to allow trafic on TCP port range 1024-65535.Use inbound rule 200 to deny trafic on TCP port 3306.Use outbound rule 100to allow traffic on TCP port 443.
- D. Use inbound rule 100 to deny traffic on TCP port 3306.Use inbound rule 200 to allow traffic on TCP port 443.Use outbound rule 100 to allow traffic on TCP port 443.
View question →
Q66. A company uses AWS Cong rules to identify Amazon S3 buckets that are not compliant with the company’s data protection policy. The S3 buckets are hosted in several AWS Regions and several AWS accounts. The accounts are in an organization in AWS Organizations. The company needs a solution to remediate the organization’s existing noncompliant S3 buckets and any noncompliant S3 buckets that are created in the future. Which solution will meet these requirements?
- A. Deploy an AWS Cong aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Cong ndings of noncompliant S3 buckets by deleting or reconguring the S3 buckets.
- B. Deploy an AWS Cong aggregator with organization-wide resource data aggregation. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
- C. Deploy an AWS Cong aggregator that scopes only the accounts and Regions that the company currently uses. Create an AWS Lambda function that responds to AWS Cong ndings of noncompliant S3 buckets by deleting or reconguring the S3 buckets.
- D. Deploy an AWS Cong aggregator that scopes only the accounts and Regions that the company currently uses. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
View question →
Q67. A company is using AWS Organizations to implement a multi-account strategy. The company does not have on-premises infrastructure. All workloads run on AWS. The company currently has eight member accounts. The company anticipates that it will have no more than 20 AWS accounts total at any time. The company issues a new security policy that contains the following requirements: • No AWS account should use a VPC within the AWS account for workloads. • The company should use a centrally managed VPC that all AWS accounts can access to launch workloads in subnets. • No AWS account should be able to modify another AWS account's application resources within the centrally managed VPC. • The centrally managed VPC should reside in an existing AWS account that is named Account-A within an organization. The company uses an AWS CloudFormation template to create a VPC that contains multiple subnets in Account-A. This template exports the subnet IDs through the CloudFormation Outputs section. Which solution will complete the security setup to meet these requirements?
- A. Use a CloudFormation template in the member accounts to launch workloads. Configure the template to use the Fn::ImportValue function to obtain the subnet ID values.
- B. Use a transit gateway in the VPC within Account-A. Congure the member accounts to use the transit gateway to access the subnets in Account-A to launch workloads.＆nbsp;
- C. Use AWS Resource Access Manager (AWS RAM) to share Account-A＆#39;s VPC subnets with the remaining member accounts. Congure the member accounts to use the shared subnets to launch workloads.
- D. Create a peering connection between Account-A and the remaining member accounts. Congure the member accounts to use the subnets in Account-A through the VPC peering connection to launch workloads.
View question →
Q68. A company hosts its microservices application on Amazon Elastic Kubernetes Service(Amazon EKS).The company has set up continuous deployments to update the application on demand. A security engineer must implement a solution to provide automatic detection of anomalies in application logs in near real time.The solution also must send notifications about these anomalies to the security team. Which solution will meet these requirements?
- A. Configure Amazon Cloudwatch Container Insights to collect and aggregate EKS application ogs. Create a Cloudwatch alarm to monitor for anomalies.Configure the alarm to launch an AWSLambda function to alert the security team when anomalies are detected.
- B. Configure Amazon EKS to send application logs to Amazon Cloudwatch.Create a CloudWatch alarm based on a log group metric filter. Specify anomaly detection as the threshold type. Configure the alarm to use Amazon Simple Notification Service (Amazon SNS) to alert the security team.
- C. Configure Amazon EKS to export ogs to Amazon S3.Use Amazon Athena queries to analyze the logs for anomalies.Use Amazon QuickSight to visualize and monitor user access requests for anomalies.Configure Amazon Simple Notification Service(Amazon SNS) notifications to alert the securityteam.
- D. Configure AWS App Mesh to monitor the traffic to the microservices in Amazon EKS.Integrate App Mesh with AWS CloudTrail for logging.Use Amazon Detective to analyze the logs for anomalies and to alert the security team when anomalies are detected.
View question →
Q69. >A company hosts a web application on an Apache web server. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The company configured the EC2 instances to send the Apache web server logs to an Amazon CloudWatch Logs group that the company has configured to expire after 1 year. Recently, the company discovered in the Apache web server logs that a specific IP address is sending suspicious requests to the web application. A security engineer wants to analyze the past week of Apache web server logs to determine how many requests that the IP address sent and the corresponding URLs that the IP address requested. What should the security engineer do to meet these requirements with the LEAST effort?
- A. Export the CloudWatch Logs group data to Amazon S3. Use Amazon Macie to query the logs for the specific IP address and the requested URL.
- B. Configure a CloudWatch Logs subscription to stream the log group to an Amazon OpenSearch Service cluster. Use OpenSearch Service to analyze the logs for the specific IP address and the requested URLs.
- C. Use CloudWatch Logs Insights and a custom query syntax to analyze the CloudWatch logs for the specific IP address and the requested URLs.
- D. Export the CloudWatch Logs group data to Amazon S3. Use AWS Glue to crawl the S3 bucket for only the log entries that contain the specific IP address. Use AWS Glue to view the results.
View question →
Q70. A company is migrating its Amazon EC2 based applications to use Instance Metadata Service Version 2 (IMDSv2). A security engineer needs to determine whether any of the EC2 instances are still using Instance Metadata Service Version 1 (IMDSv1). What should the security engineer do to conrm that the IMDSv1 endpoint is no longer being used?
- A. Congure logging on the Amazon CloudWatch agent for IMDSv1 as part of EC2 instance startup. Create a metric lter and a CloudWatch dashboard. traffick the metric in the dashboard.
- B. Create an Amazon CloudWatch dashboard. Verify that the EC2:MetadataNoToken metric is zero across all EC2 instances. Monitor the dashboard.
- C. Create a security group that blocks access to HTTP for the IMDSv1 endpoint. Attach the security group to all EC2 instances.
- D. Congure user data scripts for all EC2 instances to send logging information to AWS CloudTrail when IMDSV1 is used. Create a metric lter and an Amazon CloudWatch dashboard. traffick the metric in the dashboard.
View question →
Q71. A security engineer is designing a cloud architecture to support an application. The application runs on Amazon EC2 instances and processes sensitive information, including credit card numbers. The application will send the credit card numbers to a component that is running in an isolated environment. The component will encrypt, store, and decrypt the numbers. The component then will issue tokens to replace the numbers in other parts of the application. The component of the application that manages the tokenization process will be deployed on a separate set of EC2 instances. Other components of the application must not be able to store or access the credit card numbers. Which solution will meet these requirements?
- A. Use EC2 Dedicated Instances for the tokenization component of the application.
- B. Place the EC2 instances that manage the tokenization process into a partition placement group.
- C. Create a separate VPDeploy new EC2 instances into the separate VPC to support the data tokenization.
- D. Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances.
View question →
Q72. A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets. The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region. Which solution will meet these requirements?
- A. Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region. ＆nbsp;
- B. Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. ＆nbsp;
- C. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region. ＆nbsp;
- D. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 ＆nbsp;bucket in the secondary Region.
View question →
Q73. A company hosts an application on Amazon EC2 that is subject to specific rules for regulatory compliance. One rule states that traffic to and from the workload must be inspected for network-level attacks. This involves inspecting the whole packet. To comply with this regulatory rule, a security engineer must install intrusion detection software on a c5n.4xlarge EC2 instance. The engineer must then configure the software to monitor traffic to and from the application instances. What should the security engineer do next?
- A. Place the network interface in promiscuous mode to capture the traffic ＆nbsp;
- B. Configure VPC Flow Logs to send traffic to the monitoring EC2 instance using a Network Load Balancer. ＆nbsp;
- C. Configure VPC traffic mirroring to send traffic to the monitoring EC2 instance using a Network Load Balancer. ＆nbsp;
- D. Use Amazon Inspector to detect network-level attacks and trigger an AWS Lambda function to send the suspicious packets to the EC2 instance.
View question →
Q74. A company is storing data in Amazon S3 Glacier. A security engineer implemented a new vault lock policy for 10 TB of data and called the initiate-vault-lock operation 12 hours ago. The audit team identied a typo in the policy that is allowing unintended access to the vault. What is the MOST cost-effective way to correct this error?
- A. Call the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again.
- B. Copy the vault data to a new S3 bucket. Delete the vault Create a new vault with the data.
- C. Update the policy to keep the vault lock in place.
- D. Update the policy. Call the initiate-vault-lock operation again to apply the new policy.
View question →
Q75. A company has a requirement that no Amazon EC2 security group can allow SSH access from the CIDR block 0.0.0.0/0. The company wants to monitor compliance with this requirement at all times and wants to receive a near-real-time notication if any security group is noncompliant. A security engineer has congured AWS Cong and will use the restricted-ssh managed rule to monitor the security groups. What should the security engineer do next to meet these requirements?
- A. Congure AWS Cong to send its configuration snapshots to an Amazon S3 bucket. Create an AWS Lambda function to run on a PutEvent to the S3 bucket. Congure the Lambda function to parse the snapshot for a compliance change to the restricted-ssh managed rule. Congure the Lambda function to send a notication to an Amazon Simple Notication Service (Amazon SNS) topic if a change is discovered.
- B. Congure an Amazon EventBridge event rule that is invoked by a compliance change event from AWS Cong for the restricted-ssh managed rule. Congure the event rule to target an Amazon Simple Notication Service (Amazon SNS) topic that will provide a notication.
- C. Congure AWS Cong to push all its compliance notications to Amazon CloudWatch Logs. Congure a CloudWatch Logs metric lter on the AWS Cong log group to look for a compliance notication change on the restricted-ssh managed rule. Create an Amazon CloudWatch alarm on the metric lter to send a notication to an Amazon Simple Notication Service (Amazon SNS) topic if the alarm is in the ALARM state.
- D. Congure an Amazon CloudWatch alarm on the CloudWatch metric for the restricted-ssh managed rule. Congure the CloudWatch alarm to send a notication to an Amazon Simple Notication Service (Amazon SNS) topic if the alarm is in the ALARM state.
View question →
Q76. A company is planning to create an organization by using AWS Organizations. The company needs to integrate user management with the company’s external identity provider (IdP). The company also needs to centrally manage access to all of its AWS accounts and applications from the organization’s management account. Which solution will meet these requirements?
- A. Congure AWS Directory Service with the external IdP. Create IAM policies and associate them with users from the external IdP.
- B. Enable AWS IAM Identity Center and use the external IdP as the identity source. Create permission sets and account assignments by using IAM Identity Center.
- C. Congure AWS Identity and Access Management (IAM) to use the external IdP as an IdP. Create IAM policies and associate them with users from the external IdP.
- D. Enable Amazon Cognito in the organization’s management account. Create an identity pool and associate it with the external IdP. Create IAM roles and associate them with the identity pool.
View question →
Q77. An AWS account includes two S3 buckets: bucket1 and bucket2. The bucket2 does not have a policy dened, but bucket1 has the following bucket policy: In addition, the same account has an IAM User named “alice”, with the following IAM policy. Which buckets can user “alice” access?
- A. bucket1 only
- B. bucket2 only
- C. Both bucket1 and bucket2
- D. Neither bucket1 nor bucket2
View question →
Q78. A company is hosting multiple applications within a single VPC in its AWS account. The applications are running behind an Application Load Balancer that is associated with an AWS WAF web ACL. The company's security team has identified that multiple port scans are originating from a specific range of IP addresses on the internet. A security engineer needs to deny access from the offending IP addresses. Which solution will meet these requirements?
- A. Modify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.
- B. Add a rule to all security groups to deny the incoming requests from the IP address range.
- C. Modify the AWS WAF web ACL with a rate-based rule statement to deny incoming requests from the IP address range.
- D. Configure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny incoming requests based on the match condition.
View question →
Q79. A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and download the toolset's code. The company discovers that the code contains an IAM access key and secret key that provide access to internal resources in the company’s AWS environment. A security engineer must implement a solution to identify whether unauthorized usage of the exposed credentials has occurred. The solution also must prevent any additional usage of the exposed credentials. Which combination of steps will meet these requirements? (Choose two.)
- A. Use AWS Identity and Access Management Access Analyzer to determine which resources the exposed credentials accessed and who used them. ＆nbsp;
- B. Deactivate the exposed IAM access key from the user＆rsquo;s IAM account. ＆nbsp;
- C. Create a rule in Amazon GuardDuty to block the access key in the source code from being used. ＆nbsp;
- D. reate a new IAM access key and secret key for the user whose credentials were exposed. ＆nbsp;
- E. Generate an IAM credential report. Check the report to determine when the user that owns the access key last logged in.
View question →
Q80. Amazon CloudWatch Logs agent is successfully delivering logs to the CloudWatch Logs service. However, logs stop being delivered after the associated log stream has been active for a specic number of hours. What steps are necessary to identify the cause of this phenomenon? (Choose two.)
- A. Ensure that le permissions for monitored les that allow the CloudWatch Logs agent to read the le have not been modied.
- B. Verify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming.
- C. Congure an Amazon Kinesis producer to rst put the logs into Amazon Kinesis Streams.
- D. Create a CloudWatch Logs metric to isolate a value that changes at least once during the period before logging stops.
- E. Use AWS CloudFormation to dynamically create and maintain the configuration le for the CloudWatch Logs agent.
View question →
Q81. An application is running on an Amazon EC2 instance that has an IAM role attached. The IAM role provides access to an AWS Key Management Service (AWS KMS) customer managed key and an Amazon S3 bucket. The key is used to access 2 TB of sensitive data that is stored in the S3 bucket. A security engineer discovers a potential vulnerability on the EC2 instance that could result in the compromise of the sensitive data. Due to other critical operations, the security engineer cannot immediately shut down the EC2 instance for vulnerability patching. What is the FASTEST way to prevent the sensitive data from being exposed?
- A. Download the data from the existing S3 bucket to a new EC2 instance. Then delete the data from the S3 bucket. Re-encrypt the data with a client-based key. Upload the data to a new S3 bucket.
- B. Block access to the public range of S3 endpoint IP addresses by using a host-based firewall. Ensure that internet-bound traffic from the affected EC2 instance is routed through the host-based firewall.
- C. Revoke the IAM role＆#39;s active session permissions. Update the S3 bucket policy to deny access to the IAM role. Remove the IAM role from the EC2 instance profile.
- D. Disable the current key. Create a new KMS key that the IAM role does not have access to, and re-encrypt all the data with the new key. Schedule the compromised key for deletion.
View question →
Q82. A company has a batch-processing system that uses Amazon S3, Amazon EC2, and AWS Key Management Service (AWS KMS). The system uses two AWS accounts: Account A and Account B. Account A hosts an S3 bucket that stores the objects that will be processed. The S3 bucket also stores the results of the processing. All the S3 bucket objects are encrypted by a KMS key that is managed in Account A. Account B hosts a VPC that has a eet of EC2 instances that access the S3 bucket in Account A by using statements in the bucket policy. The VPC was created with DNS hostnames enabled and DNS resolution enabled. A security engineer needs to update the design of the system without changing any of the system's code. No AWS API calls from the batchprocessing EC2 instances can travel over the internet. Which combination of steps will meet these requirements? (Choose two.)
- A. In the Account B VPC, create a gateway VPC endpoint for Amazon S3. For the gateway VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, s3:PutObject, and s3:PutObjectAcl actions for the S3 bucket.
- B. In the Account B VPC, create an interface VPC endpoint for Amazon S3. For the interface VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, s3:PutObject, and s3:PutObjectAcl actions for the S3 bucket.
- C. In the Account B VPC, create an interface VPC endpoint for AWS KMS. For the interface VPC endpoint, create a resource policy that allows the kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey actions for the KMS key. Ensure that private DNS is turned on for the endpoint.
- D. In the Account B VPC, create an interface VPC endpoint for AWS KMS. For the interface VPC endpoint, create a resource policy that allows the kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey actions for the KMS key. Ensure that private DNS is turned off for the endpoint.
- E. In the Account B VPC, verify that the S3 bucket policy allows the s3:PutObjectAcl action for cross-account use. In the Account B VPC, create a gateway VPC endpoint for Amazon S3. For the gateway VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, and s3:PutObject actions for the S3 bucket.
View question →
Q83. A security engineer is implementing a solution to allow users to seamlessly encrypt Amazon S3 objects without having to touch the keys directly. The solution must be highly scalable without requiring continual management. Additionally, the organization must be able to immediately delete the encryption keys. Which solution meets these requirements?
- A. Use AWS KMS with AWS managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.
- B. Use KMS with AWS imported key material and then use the DeleteImportedKeyMaterial API to remove the key material if necessary.
- C. Use AWS CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.
- D. Use the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the keys if necessary.
View question →
Q84. A company's AWS CloudTrail logs are all centrally stored in an Amazon S3 bucket. The security team controls the company's AWS account. The security team must prevent unauthorized access and tampering of the CloudTrail logs. Which combination of steps should the security team take? (Choose three.)
- A. Congure server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
- B. Compress log les with secure gzip.
- C. Create an Amazon EventBridge rule to notify the security team of any modications on CloudTrail log les.
- D. Implement least privilege access to the S3 bucket by conguring a bucket policy.
- E. Congure CloudTrail log le integrity validation.
- F. Congure Access Analyzer for S3.
View question →
Q85. A company has a group of Amazon EC2 instances in a single private subnet of a VPC with no internet gateway attached. A security engineer has installed the Amazon CloudWatch agent on all instances in that subnet to capture logs from a specific application. To ensure that the logs flow securely, the company's networking team has created VPC endpoints for CloudWatch monitoring and CloudWatch logs. The networking team has attached the endpoints to the VPC. The application is generating logs. However, when the security engineer queries CloudWatch, the logs do not appear. Which combination of steps should the security engineer take to troubleshoot this issue? (Choose three.)
- A. Ensure that the EC2 instance profile that is attached to the EC2 instances has permissions to create log streams and write logs.
- B. Create a metric filter on the logs so that they can be viewed in the AWS Management Console.
- C. Check the CloudWatch agent configuration file on each EC2 instance to make sure that the CloudWatch agent is collecting the proper log files.
- D. Check the VPC endpoint policies of both VPC endpoints to ensure that the EC2 instances have permissions to use them.
- E. Create a NAT gateway in the subnet so that the EC2 instances can communicate with CloudWatch.
- F. Ensure that the security groups allow all the EC2 instances to communicate with each other to aggregate logs before sending.
View question →
Q86. Company A has an AWS account that is named Account A. Company A recently acquired Company B, which has an AWS account that is named Account B. Company B stores its files in an Amazon S3 bucket. The administrators need to give a user from Account A full access to the S3 bucket in Account B. After the administrators adjust the IAM permissions for the user in Account A to access the S3 bucket in Account B, the user still cannot access any files in the S3 bucket. Which solution will resolve this issue?
- A. In Account B, create a bucket ACL to allow the user from Account A to access the S3 bucket in Account B.
- B. In Account B, create an object ACL to allow the user from Account A to access all the objects in the S3 bucket in Account B.
- C. In Account B, create a bucket policy to allow the user from Account A to access the S3 bucket in Account B.
- D. In Account B, create a user policy to allow the user from Account A to access the S3 bucket in Account B.
View question →
Q87. A security engineer logs in to the AWS Lambda console with administrator permissions. The security engineer is trying to view logs in Amazon CloudWatch for a Lambda function that is named myFunction. When the security engineer chooses the option in the Lambda console to view logs in CloudWatch, an "error loading Log Streams" message appears. The IAM policy for the Lambda function's execution role contains the following:  How should the security engineer correct the error?
- A. Move the logs:CreateLogGroup action to the second Allow statement.
- B. Add the logs:PutDestination action to the second Allow statement.
- C. Add the logs:GetLogEvents action to the second Allow statement.
- D. Add the logs:CreateLogStream action to the second Allow statement.
View question →
Q88. A company has a legacy application that runs on a single Amazon EC2 instance. A security audit shows that the application has been using an IAM access key within its code to access an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET1 in the same AWS account. This access key pair has the s3:GetObject permission to all objects in only this S3 bucket. The company takes the application offline because the application is not compliant with the company’s security policies for accessing other AWS resources from Amazon EC2. A security engineer validates that AWS CloudTrail is turned on in all AWS Regions. CloudTrail is sending logs to an S3 bucket that is named DOC-EXAMPLE-BUCKET2. This S3 bucket is in the same AWS account as DOC-EXAMPLE-BUCKET1. However, CloudTrail has not been configured to send logs to Amazon CloudWatch Logs. The company wants to know if any objects in DOC-EXAMPLE-BUCKET1 were accessed with the IAM access key in the past 60 days. If any objects were accessed, the company wants to know if any of the objects that are text files (.txt extension) contained personally identifiable information (PII). Which combination of steps should the security engineer take to gather this information? (Choose two.)
- A. Use Amazon CloudWatch Logs Insights to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII and that were available to the access key.
- B. Use Amazon OpenSearch Service to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for API calls that used the access key to access an object that contained PII.
- C. Use Amazon Athena to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for any API calls that used the access key to access an object that contained PII.
- D. Use AWS Identity and Access Management Access Analyzer to identify any API calls that used the access key to access objects that contained PII in DOC-EXAMPLE-BUCKET1.
- E. Configure Amazon Macie to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII and that were available to the access key.
View question →
Q89. A company is using AWS WAF to protect a customized public API service that is based on Amazon EC instances. The API uses an Application Load Balancer. The AWS WAF web ACL is configured with an AWS Managed Rules rule group. After a software upgrade to the API and the client application, some types of requests are no longer working and are causing application stability issues. A security engineer discovers that AWS WAF logging is not turned on for the web ACL. The security engineer needs to immediately return the application to service, resolve the issue, and ensure that logging is not turned off in the future. The security engineer turns on logging for the web ACL and specifies Amazon CloudWatch Logs as the destination. Which additional set of steps should the security engineer take to meet the requirements?
- A. Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs. ＆nbsp;
- B. Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs. ＆nbsp;
- C. Edit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs. ＆nbsp;
- D. Edit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.
View question →
Q90. A company is implementing new compliance requirements to meet customer needs.According to the new requirements, the company must not use any Amazon RDS DB instances or DB clusters that lack encryption of the underlying storage. The company needs a solution that will generate an email alert when an unencrypted DB instance or DB cluster is created. The solution also must terminate the unencrypted DB instance or DB cluster. Which solution will meetthese requirements in the MOST operationally efficient manner?
- A. Create an AWS Config managed rule to detect unencrypted RDS storage. Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon SNS)topicthat includes an AWS Lambda function and an email delivery target as subscribers.Configure the Lambda function to delete the unencrypted resource.
- B. Create an AWS Config managed rule to detect unencrypted RDS storage. Configure a manual remediation action to invoke an AWS Lambda function.Configure the Lambda function to publish messages to an Amazon Simple Notification Service(Amazon SNS) topic and to delete the unencrypted resource.
- C. Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to publish messages to an Amazon Simple Notifcation Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.
- D. Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to invoke an AWS Lambda function.Configure the Lambda function to publish messages to an Amazon Simple Notification Service(Amazon SNS) topic and to delete the unencrypted resource.
View question →
Q91. A company has a new web-based account management system for an online game.Players create a unique username and password to log in to the system. The company has implemented an AWS WAF web ACL for the system.The web ACL includes the core rule set(CRS) AWS managed rule group on the Application Load Balancer that serves the system. The company's security team finds that the system was the target of a credential stufing attack. Credentials that were exposed in other breaches were used to try to log in to the system. The security team must implement a solution to reduce the chance of a successful credential stuffing attackin the future.The solution also must minimize impact on legitimate users of the system. Which combination of actionswill meet these requirements?(Choose two.)
- A. Create an Amazon CloudWatch custom metric to analyze the number of successful login responses from a single IP address.
- B. Add the account takeover prevention (ATP)AWS managed rule group to the web ACL.Configure the rule group to inspect login requests| to the system.Block any requests that have the awswaf:managed:aws:atp:signal:credential_compromised label.
- C. Configure a default web ACL action that requires all users to solve a CAPTCHA puzzle when they log in.
- D. Implement IP-based match rules in the web ACL for any IP addresses that generate many successful ogin responses.Block any IP addresses that generate many successful logins.
- E. Create a custom block response that redirects usersto a secure workflow to reset their password inside the system.
View question →
Q92. A startup company is using a single AWS account that has resources in a single AWS Region. A security engineer congures an AWS CloudTrail trail in the same Region to deliver log les to an Amazon S3 bucket by using the AWS CLI. Because of expansion, the company adds resources in multiple Regions. The security engineer notices that the logs from the new Regions are not reaching the S3 bucket.  What should the security engineer do to x this issue with the LEAST amount of operational overhead?
- A. Create a new CloudTrail trail. Select the new Regions where the company added resources.
- B. Change the S3 bucket to receive notications to track all actions from all Regions.
- C. Create a new CloudTrail trail that applies to all Regions
- D. Change the existing CloudTrail trail so that it applies to all Regions.
View question →
Q93. A company is using AWS Organizations to manage multiple AWS accounts for its human resources, finance, software development, and production departments. All the company's developers are part of the software development AWS account. The company discovers that developers have launched Amazon EC2 instances that were preconfigured with software that the company has not approved for use. The company wants to implement a solution to ensure that developers can launch EC2 instances with only approved software applications and only in the software development AWS account. Which solution will meet these requirements?
- A. In the software development account, create AMIs of preconfigured instances that include only approved software. Include the AMI IDs in the condition section of an AWS CloudFormation template to launch the appropriate AMI based on the AWS Region. Provide the developers with the CloudFormation template to launch EC2 instances in the software development account.
- B. Create an Amazon EventBridge rule that runs when any EC2 RunInstances API event occurs in the software development account. Specify AWS Systems Manager Run Command as a target of the rule. Configure Run Command to run a script that will install all approved software onto the instances that the developers launch.
- C. Use an AWS Service Catalog portfolio that contains EC2 products with appropriate AMIs that include only approved software. Grant the developers permission to access only the Service Catalog portfolio to launch a product in the software development account.
- D. In the management account, create AMIs of preconfigured instances that include only approved software. Use AWS CloudFormation StackSets to launch the AMIs across any AWS account in the organization. Grant the developers permission to launch the stack sets within the management account.
View question →
Q94. A company has secured the AWS account root user for its AWS account by following AWS best practices. The company also has enabled AWS CloudTrail, Which is sending its logs to Amazon S3. A security engineer wants to receive notication in near-real time if a user uses the AWS account root user credentials to sign in to the AWS Management Console Which solutions will provide this notication? (Choose two.)
- A. Use AWS Trusted Advisor and its security evaluations for the root account. Congure an Amazon EventBridge event rule that is invoked by the Trusted Advisor API. Congure the rule to target an Amazon Simple Notication Service (Amazon SNS) topic. Subscribe any required endpoints to the SNS topic so that these endpoints can receive notication.
- B. Use AWS IAM Access Analyzer. Create an Amazon Cloud Watch Logs metric lter to evaluate log entries from Access Analyzer that detect a successful root account login. Create an Amazon CloudWatch alarm that monitors whether a root login has occurred. Congure the CloudWatch alarm to notify an Amazon Simple Notication Service (Amazon SNS) topic when the alarm enters the ALARM state. Subscribe any required endpoints to this SNS topic so that these endpoints can receive notication.
- C. Congure AWS CloudTrail to send its logs to Amazon CloudWatch Logs. Congure a metric lter on the CloudWatch Logs log group used by CloudTrail to evaluate log entries for successful root account logins. Create an Amazon CloudWatch alarm that monitors whether a root login has occurred. Congure the CloudWatch alarm to notify an Amazon Simple Notication Service (Amazon SNS) topic when the alarm enters the ALARM state. Subscribe any required endpoints to this SNS topic so that these endpoints can receive notication.
- D. Congure AWS CloudTrail to send log notications to an Amazon Simple Notication Service (Amazon SNS) topic. Create an AWS Lambda function that parses the CloudTrail notication for root login activity and noties a separate SNS topic that contains the endpoints that should receive notication. Subscribe the Lambda function to the SNS topic that is receiving log notications from CloudTrail.
- E. Congure an Amazon EventBridge event rule that runs when Amazon CloudWatch API calls are recorded for a successful root login. Congure the rule to target an Amazon Simple Notication Service (Amazon SNS) topic. Subscribe any required endpoints to the SNS topic so that these endpoints can receive notication.
View question →
Q95. A company is investigating controls to protect sensitive data. The company uses Amazon Simple Notification Service (Amazon SNS) topics to publish messages from application components to custom logging services. The company is concerned that an application component might publish sensitive data that will be accidentally exposed in transaction logs and debug logs. Which solution will protect the sensitive data in these messages from accidental exposure?
- A. Use Amazon Macie to scan the SNS topics for sensitive data elements in the SNS messages. Create an AWS Lambda function that masks sensitive data inside the messages when Macie records a new finding.
- B. Configure an inbound message data protection policy. In the policy, include the De-identify operation to mask the sensitive data inside the messages. Apply the policy to the SNS topics. ＆nbsp;
- C. Configure the SNS topics with an AWS Key Management Service (AWS KMS) customer managed key to encrypt the data elements inside the messages. Grant permissions to all message publisher IAM roles to allow access to the key to encrypt data. ＆nbsp;
- D. Create an Amazon GuardDuty finding for sensitive data that is transmitted to the SNS topics. Create an AWS Security Hub custom remediation action to block messages that contain sensitive data from being delivered to subscribers of the SNS topics.
View question →
Q96. A security engineer is configuring account-based access control (ABAC) to allow only specific principals to put objects into an Amazon S3 bucket. The principals already have access to Amazon S3. The security engineer needs to configure a bucket policy that allows principals to put objects into the S3 bucket only if the value of the Team tag on the object matches the value of the Team tag that is associated with the principal. During testing, the security engineer notices that a principal can still put objects into the S3 bucket when the tag values do not match. Which combination of factors are causing the PutObject operation to succeed when the tag values are different? (Choose two.)
- A. The principal＆#39;s identity-based policy grants access to put objects into the S3 bucket with no conditions.
- B. The principal＆#39;s identity-based policy overrides the condition because the identity-based policy contains an explicit allow.
- C. The S3 bucket＆#39;s resource policy does not deny access to put objects.
- D. The S3 bucket＆#39;s resource policy cannot allow actions to the principal.
- E. The bucket policy does not apply to principals in the same zone of trust.
View question →
Q97. A security engineer is checking an AWS CloudFormation template for vulnerabilities. The security engineer nds a parameter that has a default value that exposes an application's API key in plaintext. The parameter is referenced several times throughout the template. The security engineer must replace the parameter while maintaining the ability to reference the value in the template.  Which solution will meet these requirements in the MOST secure way?
- A. Store the API key value as a SecureString parameter in AWS Systems Manager Parameter Store. In the template, replace all references to the value with {{resolve:ssm:MySSMParameterName:1}}.
- B. Store the API key value in AWS Secrets Manager. In the template, replace all references to the value with {{resolve:secretsmanager:MySecretId:SecretString}}.
- C. Store the API key value in Amazon DynamoDB. In the template, replace all references to the value with {{resolve:dynamodb:MyTableName:MyPrimaryKey}}.
- D. Store the API key value in a new Amazon S3 bucket. In the template, replace all references to the value with {{resolve:s3:MyBucketName:MyObjectName}}.
View question →
Q98. While securing the connection between a company’s VPC and its on-premises data center, a security engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). The ping command did not return a response. The flow log in the VPC showed the following: What action should be performed to allow the ping to work?
- A. In the security group of the EC2 instance, allow inbound ICMP traffic.
- B. In the security group of the EC2 instance, allow outbound ICMP traffic.
- C. In the VPC＆rsquo;s NACL, allow inbound ICMP traffic.
- D. In the VPC＆rsquo;s NACL, allow outbound ICMP traffic.
View question →
Q99. A security engineer recently rotated all IAM access keys in an AWS account. The security engineer then configured AWS Config and enabled the following AWS Config managed rules: mfa-enabled-for-iam-console-access, iam-user-mfa-enabled, access-keys-rotated, and iam-user-unused-credentials-check. The security engineer notices that all resources are displaying as noncompliant after the IAM GenerateCredentialReport API operation is invoked. What could be the reason for the noncompliant status?
- A. The IAM credential report was generated within the past 4 hours. ＆nbsp;
- B. The security engineer does not have the GenerateCredentialReport permission. ＆nbsp;
- C. The security engineer does not have the GetCredentialReport permission. ＆nbsp;
- D. The AWS Config rules have a Maximum ExecutionFrequency value of 24 hours.
View question →
Q100. ; A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator. A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application. Which solution will meet these requirements?
- A. Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string. Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm. ＆nbsp;
- B. Modify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack. ＆nbsp;
- C. Create an AWS WAF web ACL for the ALB. Create a custom rule that blocks requests that contain the user agent string of the device emulator. ＆nbsp;
- D. Create an AWS WAF web ACL for the ALB. Create a custom rule that allows requests from legitimate user agent strings.
View question →