AWS Certified Security – Specialty (Free Quiz)

How can you make your data encrypted in transit for connection with RDS instance?

An organization uses EBS volumes in AWS, and for security purpose, they want all volumes to be encrypted and they want to get notified about any unencrypted volume in the How can this be done?

You have a setup in which you use logging enabled S3 buckets. If changes to the S3 bucket are made, a config rule will be checked. If logging is deactivated, a function of Lambda is invoked. The Lambda function again allows the S3 bucket to log in. The whole flow is now a problem. You have checked the invoking of the Lambda function. However, the Lambda function does not re-open when logging for the bucket is disabled. Which one of the following might be a problem?

An organization uses EC2 instances, and they have compromised instances. They have strict policies and want to find out the culprit of the security How would they do this? (choose any 3)

How does the data forwarded to S3 can be encrypted at rest?

An enterprise has its AWS account in which it hosts the resources. All API activities in all regions must be monitored. The audit must also be carried out in future regions. To meet this requirement, which of the following could be used?

A company is planning to use AWS for hosting the resources. They have multiple independent departments that also want to use AWS. Which of the following methods could be used to manage the accounts?

From the following options, which is best to view event logs of all API on AWS which is read-only access to the auditor?

An organization has an application in which it has multiple types of users like some have read-only access, or others have contributor access. The application is using AWS Cognito for authenticating. How would they manage the users?

An enterprise uses Linux EC2 instance in AWS, and they want secure authentication to the instance from Windows. How can this requirement be met?

An organization is using AWS resource for its infrastructure, and now they are searching for the security aspect of their CI / CD pipeline. They want to ensure that there should not be any high-security vulnerabilities in the EC2 instances. They also want to make sure that the DevSecOps process is complete. How can they meet this requirement?

How will you make sure that your S3 bucket on AWS is only accessible via VPC endpoint?

An enterprise uses AWS to host its infrastructure on AWS EC2 instances. The EC2 instances are subjected to strict security regulations. You need a quick investigation of the underlying EC2 instance during a possible security violation. Which service can help you provide a test environment for the violated case quickly?

You have a huge number of keys specified in AWS KMS. You have an application which uses the keys very frequently. How can the cost of access keys in AWS KMS service be reduced?

An organization has one compromised EC2 instance. Which of the following steps are needed for applying digital forensics on the instance? (choose any 2)

There is a set of AWS-hosted applications, database, and web servers. Behind an ELB, the web servers are located. The application, database and web servers have separate security groups. The security groups of the network were defined with some configuration. Contact between the application and database servers is problematic. What ideal set of MINIMAL steps would you take to resolve the problems between only the application and the database server?

Your development team needs to use AWS Lambda service for running multiple scripts, and now they need to understand the errors encountered during the running of the script. How can they do this?

In AWS Public Cloud the client has an RHEL Linux instance. The VPC and subnet used to host the instance that were created with the Network Access Control Lists default settings. You must provide secure access to the underlying instance for the IT Administrator. How can this be done?

An organization uses the AWS cloud for creating a private connection from on-premises IT infrastructure to AWS. Now, they want a solution of getting core benefits of traffic encryption, while ensuring that the latency is kept to minimum. How would they achieve their requirement? (choose any 2)

From the following options, which is best to generate encryption keys based on FIPS 140-2 level 3? (choose any 2)

A huge multinational enterprise has thousands of EC2 instances on AWS, and now they want to make sure that all servers are not occupying any critical security flaws. How can this requirement be fulfilled? (choose any 2)

In Amazon Linux AMI instances, a company is trying to use AWS Systems Manager. The command run does not work on a number of instances. How would they diagnose the problem? (choose any 2)

A company has an EC2 instance with EBS volume, and encryption of this is done via KMS. Now, some hacker deletes the customer key that is used for encryption. Then how can they decrypt the data?

You must use the keys available in the CloudFront to serve private content. How is this possible?

For a number of EC2 instances, you must perform penetration tests on the AWS Cloud. How can you do this? (choose any 2)

The AWS KMS service provides you with a set of customer keys. These keys were used for approximately six months. Now, you are attempting to use new KMS functions for the existing key set, but you are unable to do so. What could be the issue behind this?

If you want to use your own DNS managed instance rather than using AWS DNS service for routing DNS request from the instance in VPC then how would you do this?

How do you make sure to inspect the running process on EC2 instance without interrupting its continuous running for security issues?

A company hired you and assigned you a task to make sure that AWS and its on-site Active Directory are federated authentication mechanisms. What are the important steps that must be taken in this process? (choose any 2)

If you want to get the point in time API activity of any suspicious API activity that occurred 15 days ago. How would you get that?

A set of EC2 instances is currently held by your company in the VPC. The IT Security department suspects that the instances will be attacked by DDos. What can you do to minify the chances of attack on the IP addresses that receive a large number of applications?

An incident reaction plan was drafted a few months ago by an IT team of the enterprise. The response plan is regularly implemented. Since its inception, no changes has been made to the response plan. Which of the following is the correct plan statement?

There is an S3 bucket currently hosted in an AWS account. It contains information that a partner account needs to access. What is the safest way to access S3 buckets in your account with your partner account? (choose any 3)

An organization uses AWS to host its web application for which they create EC2 instance in public subnet. Now, they need to connect an EC2 instance which will host Oracle DB. How would they do all this in a secure way? (choose an 2)

A company uses S3 bucket to store log files. These log files are used for analysis after that, they purge these files. How would they do this configuration in S3 bucket?

A windows machine in one VPC needs to join the AD domain in another VPC. VPC Peering has been established. But the domain join is not working. What is the other step that needs to be followed in order to ensure that the AD domain join can work as intended?

How do you ensure that the object in the primary region is available in the secondary region on the failure of the primary region? (choose any 2)

You try to patch a set of EC2 systems with the Systems Manager. Some of the systems are not covered by the patch. Which of these can be used to resolve the problem? (choose any 3)

How can I integrate the AWS IAM with a local LDAP (Lightweight Directory Access Protocol) directory service? What technique can be used?

How do you make CloudTrail logs encrypted when they are being delivered in AWS account?

A company has an application which currently uses customer keys which are generated via AWS KMS in the US East Now, they want to use the same set of keys from the EU-Central region. How can this be accomplished?

A set of keys was developed for your company with AWS KMS. You must ensure that only certain services are used for each key. For instance, they want to use only one key for the S3 service. How can you do that?

An enterprise is using AWS to host its java-based application on EC2 instance. That application can access the DynamoDB table and currently instance serving production based user. How securely an instance can access the DynamoDB table?

A company uses a cluster Redshift to store its data storage facility. The Internal IT Security team is required to ensure that Redshift database data should be encrypted. How can we accomplish that?

An enterprise uses S3 to put its critical data and metadata. They want all of their data and metadata to be encrypted. What steps are needed to ensure that metadata is encrypted?

A security team must submit daily briefings to the CISO containing a report that misses out on the latest security patches on thousands of EC2 instances and on-site servers. All servers must comply within 24 hours to ensure that they do not appear in the report on the next day. How does the security team meet these requirements?

An organization uses a number of EC2 instances and wants to identify the SG that allows unrestricted access to the resource. How would they fulfill their requirement?

A company uses AWS KMS service to create customer keys. These keys are used for 6 months and now they are trying to use new KMS features for an existing set of keys but are unable to do that. Why is that?

For your AWS account, an enterprise has specified privileged users. They are the administrator for key corporate resources. The security authentication for these users is now mandated to improve. How can this be done?

From the following options, which is not the best practice of security audit?

In the event, an employee will be performing unauthorized actions on AWS infrastructure, if he succeeds, a security team will execute a response plan. They want to include steps to see it as part of the incident that the IAM permissions of the employee have changed. Which steps the planning team should document?

In the AWS test environment, you have an instance setup. The required application has been installed, and the server has been promoted into a production environment. You have advised your IT Security team that traffic might flow to port 22 from an unknown IP address. How can we immediately mitigate this?

A company uses AWS KMS in the us-east region to generate customer keys, and they want to use the same keys in the EU- Central region. How would they do this?

An organization wants to use Lambda function to put metadata of objects in the DynamoDB table, whenever the data gets stored in S3. How would they give Lambda function access to DynamoDB table?

For development purposes, your development team has begun to use AWS resources. It was just created for the AWS account. Your IT safety team is concerned that AWS keys might leak. What is the first level of action to safeguard the AWS account?

A company uses CloudTrail in all of its accounts to log all AWS API operations for all regions. The CISO has called for additional steps to safeguard the integrity of the log files. How many steps will prevent intentional or unintended alteration of the log files? (choose any 2)

For an EC2 instance, you want to receive a list of vulnerabilities according to the directives of the Internet Security Center. What will you do about it?

An EC2 instance application must use username and password to access a database. These secrets have been saved in the SSM Parameter Store using the default KMS CMK type SecureString. Which configuration step combination will enable the application to access the secrets through API? (choose any 2)

In various regions, your enterprise has a wide range of accounts, which include resources like EC2, CloudWatch, DynamoDB, EBS, Redshift, RDS, S3, Elastic BeanStalk, IAM, Autoscaling and Elastic Load Balancer. A compliance report of all the resources used by your firm is required by the IT Audit department. Which of these will help you to report as quickly as possible?

An enterprise uses VPC to host its application. Inside VPC web and database, tier is hosted. During testing, they observed that the app home page is unreachable even after checking security group. How would they identify the issue?

An organization needs to perform a penetration test on its AWS resources to analyze the security of the infrastructure. How would they do this?

You have multiple EC2 instances running from the long duration and now you want to identify if there is any Security group which allows unrestricted access to the resource. How would you fulfill this requirement?

Which AWS service does an enterprise use to record all AWS KMS service calls?

An organization needs IDS for its VPC in AWS. From the following option which is the best option to implement?

Company’s AWS administrator provisioned EC2 instance with EBS volumes, having encryption key alias “aws/ebs” as part of code deployment. When will the selected KMS key be rotated?

An organization uses Lambda function, which reads metadata from an object called S3 and saves it in a table called DynamoDB. Whenever an object is saved inside the bucket S3, the feature is activated. How doeSSH the Lambda feature access the DynamoDB table?

An enterprise uses VPC for subnets, now private subnet of VPC needs access to KMS service. How would they do this?

You want a secure way of generating, storing and managing cryptographic keys with exclusive access for the keys. How would you fulfill this requirement?

A company uses S3 to host website. It has some web pages that use JavaScript, which can access resources in another bucket on which web site hosting is also enabled. But when users access the web pages, they are getting a blocked JavaScript error. How can you rectify this?

How do you encrypt the CloudTrail logs?

An enterprise gets an email that their AWS account has been compromised, then what steps should be taken? (choose any 3)

In an AWS testing environment, you have an instance setup. The application has been installed, and the server has been promoted into a production environment. Your IT Security team has informed you that traffic may flow from an unknown IP to port 22. How can this be immediately mitigated? (choose any 2)

How do you assign limited access to the user for a specific duration to object in S3 bucket?

1. You define the below custom bucket policy

{

“Version”:”2012-10-17″,

“Statement”:[

{

“Sid”:”Stmt1234567890123″,

“Effect”:”Allow”,

“Principal”: “*”,

“Action”:[“s3:GetObject”],

“Resource”:[“arn:aws:s3:::appbucket]

}

]

}

When applying this policy, you get an error “action does not apply to any resources in statement”. Why?

An EC2 instance application must have a username and password to access a database. The Developer saved those secrets in the SSM Parameter Store, using KMS CMK as default and using SecureString type. How do you use the API to access the secrets by combining configuration steps? (choose any 2)

An organization in AWS has multiple resources, and they want to request a get list of resources across the account. How would they do this?

You have an EC2 instance hosted in your company by an AWS VPC. Logs from an EC2 instance must be stored accordingly. There is a requirement; access for the purpose of log files should also be limited. How can this be done? (choose any 2)

Your company needs notification to monitor all root user activity. How can this be done? (choose any 2)

An enterprise uses AWS to host its internal network. Now, they need to use the machine inside VPC, which could authenticate private certificates and also minimize work and maintenance in working with certificates. How would they do this?

An organization uses CloudTrail to log API activities in all regions from all accounts. Now, the CEO wants to follow some steps to protect the integrity of log files. How can they protect log files from intentional and unintentional alteration? (choose any 2)

How does an organization acquire the list of vulnerabilities of EC2 instance as per the requirement of internet security center?

An enterprise uses EBS volume for underlying EC2 instance and they want that all the data on the volume must be encrypted. How would they fulfill their requirement?

In AWS, you have a 2-tier application. It consists of a separate EC2 Instance web server and database server (SQL Server). These EC2 instances security groups are created by you. The Web level must be accessed through the Internet by users. A web security group(wg-123) and the security database group(db-345) have been created. Which combination of the following rules will enable a safe and functional application? (choose any 2)

An organization has privileged users for AWS account, and these users are the administrators of key resources. So, they want to enhance the security authentication for these users. How would they do this?

An organization uses CloudFront behind the website, and now they want their website to be protected from any sort of SQL injection or Cross-site scripting attacks. How would they do this?

An enterprise uses HTTPS traffic to allow its users to access the website. They also open port 22 for administrative perspective. The administrative IP is 203.0.113.1/32. What type of SG configuration is needed for most secure but functional support of requirements? (choose any 2)

To provide AWS access to an employee in an organization, an AWS user account is created. You want to limit the access to the resources over a short period with a policy for that user alone. What is the ideal policy to use as follows?

A company hosts a common web application that connects to an Amazon RDS MySQL DB instance with default ACL in a private VPC subnet. The department of IT Security is suspected of being attacked by a suspect IP. How does the subnet protect against this attack?

A web app operates behind an Application Load Balancer in a VPC on EC2 instances. In an RDS MySQL DB instance, the application saves data. A Linux bastion host is used to update schematic to a database–managers connect from a business workstation to the host, via SSH. The infrastructure is covered by the following security groups

• sgBastion – associated with the bastion host
• sgDB – associated with the database
• sgWeb – associated with the EC2 instances
• sgLB – associated with the ELB

From the above SG configuration, which allows the application to be secure and functional?

A company would like to enable Single Sign-On (SSO) to allow its employees with their corporate directory identity to access the management console. What steps are needed in the process from below? (choose any 2)

How does an enterprise assign right level of permission to a user, developers and IT team on API gateway?

An enterprise is looking for a solution to avoid traversing of data over the internet. The data of application will traverse to and from the S3 bucket. The application is running on EC2 instances in a private subnet. How would they find a solution?

An organization has its external vendors who deliver the files to the organization. These vendors are cross-accounted and provided permissions to upload objects to one of the S3 buckets of the organization. What combination of steps must the seller take to allow the user to access the uploaded files? (choose any 2)

You create an extensive, confidential web documentation server on AWS, which is stored in all documentation on S3. One of the requirements is that it should not be accessed directly from S3 to the public and that you must use CloudFront. Which of the following methods would satisfy the outlined requirements?

How does an enterprise automate the administrative tasks on EC2 instances in AWS account?

A new web-based application is being deployed on AWS. They are expected to be the target of frequent DDoS attacks based on their other web applications. What steps can the company take to safeguard its application? (choose any 2)

An enterprise has a legacy application that displays all logs in a local text file. Logs from all AWS-operated applications need to be monitored continuously for safety-related messages. What can the company do to deploy the legacy Amazon EC2 application, and to comply with the surveillance requirement?

How does an organization encrypt the data stored in AWS at rest? (choose any 2)

From the following option, which is a secure way of accessing EC2 Linux instance?

Organization policy requires the disability on all servers of any unsafe server protocols, such as FTP, Telnet, HTTP, etc. With a planned CloudWatch event, the security team would like to check all servers regularly to ensure that the current infrastructure is complied with the policies. Which process from the following options will check the compliance of instances?