How to pass Amazon SCS-C02 exam with the help of dumps?

Question # 1

A security team is responsible for reviewing AWS API call activity in the cloud environmentfor security violations. These events must be recorded and retained in a centralizedlocation for both current and future AWS regions.What is the SIMPLEST way to meet these requirements?

A. Enable AWS Trusted Advisor security checks in the AWS Console, tsnd report allsecurity incidents for all regions.
B. Enable AWS CloudTrail by creating individual trails for each region, and specify a singleAmazon S3 bucket to receive log files for later analysis.
C. Enable AWS CloudTrail by creating a new trail and applying the trail to all regions.Specify a single Amazon S3 bucket as the storage location.
D. Enable Amazon CloudWatch logging for all AWS services across all regions, andaggregate them to a single Amazon S3 bucket for later analysis.

Show Answer

Question # 2

A company has a guideline that mandates the encryption of all Amazon S3 bucket data intransit. A security engineer must implement an S3 bucket policy that denies any S3operations if data is not encrypted. Which S3 bucket policy will meet this requirement?  

A. Option A
B. Option B
C. Option C
D. Option D

Show Answer

Question # 3

An IAM user receives an Access Denied message when the user attempts to accessobjects in an Amazon S3 bucket. The user and the S3 bucket are in the same AWSaccount. The S3 bucket is configured to use server-side encryption with AWS KMS keys(SSE-KMS) to encrypt all of its objects at rest by using a customer managed key from thesame AWS account. The S3 bucket has no bucket policy defined. The IAM user has beengranted permissions through an IAM policy that allows the kms:Decrypt permission to thecustomer managed key. The IAM policy also allows the s3:List* and s3:Get* permissions for the S3 bucket and its objects.Which of the following is a possible reason that the IAM user cannot access the objects inthe S3 bucket?

A. The IAM policy needs to allow the kms:DescribeKey permission.
B. The S3 bucket has been changed to use the AWS managed key to encrypt objects atrest.
C. An S3 bucket policy needs to be added to allow the IAM user to access the objects.
D. The KMS key policy has been edited to remove the ability for the AWS account to havefull access to the key.

Show Answer

Question # 4

A company is storing data in Amazon S3 Glacier. A security engineer implemented a newvault lock policy for 10 TB of data and called the initiate-vault-lock operation 12 hours ago.The audit team identified a typo in the policy that is allowing unintended access to the vault.What is the MOST cost-effective way to correct this error?

A. Call the abort-vault-lock operation. Update the policy. Call the initiate-vault-lockoperation again.
B. Copy the vault data to a new S3 bucket. Delete the vault. Create a new vault with thedata.
C. Update the policy to keep the vault lock in place
D. Update the policy. Call the initiate-vault-lock operation again to apply the new policy.

Show Answer

Question # 5

A company wants to implement host-based security for Amazon EC2 instances andcontainers in Amazon Elastic Container Registry (Amazon ECR). The company has deployed AWS Systems Manager Agent (SSM Agent) on the EC2 instances. All thecompany's AWS accounts are in one organization in AWS Organizations. The companywill analyze the workloads for software vulnerabilities and unintended network exposure.The company will push any findings to AWS Security Hub. which the company hasconfigured for the organization.The company must deploy the solution to all member accounts, including pew accounts,automatically. When new workloads come online, the solution must scan the workloads.Which solution will meet these requirements?

A. B. Configure a delegated administrator for Amazon GuardDuty for the organization.Create an Amazon EventBridge rule to initiate analysis of ECR containers
B. Configure a delegated administrator for Amazon Inspector for the organization.Configure automatic scanning for new member accounts.
C. D. Configure a delegated administrator for Amazon Inspector for the organization.Create an AWS Config rule to initiate analysis of ECR containers

Show Answer

Question # 6

A company that operates in a hybrid cloud environment must meet strict compliancerequirements. The company wants to create a report that includes evidence from onpremisesworkloads alongside evidence from AWS resources. A security engineer mustimplement a solution to collect, review, and manage the evidence to demonstratecompliance with company policy.'Which solution will meet these requirements?

A. Create an assessment in AWS Audit Manager from a prebuilt framework or a customframework. Upload manual evidence from the on-premises workloads. Add the evidence tothe assessment. Generate an assessment report after Audit Manager collects thenecessary evidence from the AWS resources.
B. Install the Amazon CloudWatch agent on the on-premises workloads. Use AWS Configto deploy a conformance pack from a sample conformance pack template or a customYAML template. Generate an assessment report after AWS Config identifies noncompliant workloads and resources.
C. Set up the appropriate security standard in AWS Security Hub. Upload manual evidencefrom the on-premises workloads. Wait for Security Hub to collect the evidence from theAWS resources. Download the list of controls as a .csv file.
D. Install the Amazon CloudWatch agent on the on-premises workloads. Create aCloudWatch dashboard to monitor the on-premises workloads and the AWS resources.Run a query on the workloads and resources. Download the results.

Show Answer

Question # 7

An Amazon API Gateway API invokes an AWS Lambda function that needs to interact witha software-as-a-service (SaaS) platform. A unique client token is generated in the SaaSplatform to grant access to the Lambda function. A security engineer needs to design asolution to encrypt the access token at rest and pass the token to the Lambda function atruntime.Which solution will meet these requirements MOST cost-effectively

A. Store the client token as a secret in AWS Secrets Manager. Use th^AWS SDK toretneve the secret in the Lambda function.
B. Configure a token-based Lambda authorizer in API Gateway.
C. Store the client token as a SecureString parameter in AWS Systems ManagerParameter Store. Use the AWS SDK to retrieve the value of the SecureString parameter inthe Lambda function.
D. Use AWS Key Management Service (AWS KMS) to encrypt the client token. Pass thetoken to the Lambda function at runtime through an environment variable.

Show Answer

Question # 8

A company has two AWS accounts: Account A and Account B Each account has a VPC.An application that runs in the VPC in Account A needs to write to an Amazon S3 bucket inAccount B. The application in Account A already has permission to write to the S3 bucket inAccount B.The application and the S3 bucket are in the same AWS Region. The company cannotsend network traffic over the public internet.Which solution will meet these requirements? b

A. In both accounts, create a transit gateway and VPC attachments in a subnet in eachAvailability Zone. Update the VPC route tables.
B. Deploy a software VPN appliance in Account A. Create a VPN connection between thesoftware VPN appliance and a virtual private gateway in Account B
C. Create a VPC peering connection between the VPC in Account A and the VPC inAccount B. Update the VPC route tables, network ACLs, and security groups to allownetwork traffic between the peered IP ranges.
D. In Account A. create a gateway VPC endpoint for Amazon S3. Update the VPC routetable in Account A.

Show Answer

Question # 9

The Security Engineer is managing a traditional three-tier web application that is running onAmazon EC2 instances. The application has become the target of increasing numbers ofmalicious attacks from the Internet.What steps should the Security Engineer take to check for known vulnerabilities and limitthe attack surface? (Choose two.)

A. Use AWS Certificate Manager to encrypt all traffic between the client and applicationservers.
B. Review the application security groups to ensure that only the necessary ports are open.
C. Use Elastic Load Balancing to offload Secure Sockets Layer encryption.
D. Use Amazon Inspector to periodically scan the backend instances.
E. Use AWS Key Management Services to encrypt all the traffic between the client andapplication servers.

Show Answer

Question # 10

A company is evaluating the use of AWS Systems Manager Session Manager to gamaccess to the company's Amazon EC2 instances. However, until the company implementsthe change, the company must protect the key file for the EC2 instances from read andwrite operations by any other users.When a security administrator tries to connect to a critical EC2 Linux instance during anemergency, the security administrator receives the following error. "Error Unprotectedprivate key file - Permissions for' ssh/my_private_key pern' are too open".Which command should the security administrator use to modify the private key Mepermissions to resolve this error?

A. chmod 0040 ssh/my_private_key pern
B. chmod 0400 ssh/my_private_key pern
C. chmod 0004 ssh/my_private_key pern
D. chmod 0777 ssh/my_private_key pern

Show Answer

Question # 11

A company's data scientists want to create artificial intelligence and machine learning(AI/ML) training models by using Amazon SageMaker. The training models will use largedatasets in an Amazon S3 bucket. The datasets contain sensitive information.On average. the data scientists need 30 days to train models. The S3 bucket has beensecured appropriately The companfs data retention policy states that all data that is olderthan 45 days must be removed from the S3 bucket.Which action should a security engineer take to enforce this data retention policy?

A. Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days.
B. Create an AWS Lambda function to check the last-modified date of the S3 objects anddelete objects that are older than 45 days. Create an S3 event notification to invoke theLambda function for each PutObject operation.
C. Create an AWS Lambda function to check the last-modified date of the S3 objects anddelete objects that are older than 45 days. Create an Amazon EventBridge rule to invoke the Lambda function each month.
D. Configure S3 Intelligent-Ttering on the S3 bucket to automatically transition objects toanother storage class.

Show Answer

Question # 12

A company uses Amazon EC2 instances to host frontend services behind an ApplicationLoad Balancer. Amazon Elastic Block Store (Amazon EBS) volumes are attached to theEC2 instances. The company uses Amazon S3 buckets to store large files for images andmusic.The company has implemented a security architecture oit>AWS to prevent, identify, andisolate potential ransomware attacks. The company now wants to further reduce risk.A security engineer must develop a disaster recovery solution that can recover to normaloperations if an attacker bypasses preventive and detective controls. The solution mustmeet an RPO of 1 hour.Which solution will meet these requirements?

A. Use AWS Backup to create backups of the EC2 instances and S3 buckets every hour.Create AWS CloudFormation templates that replicate existing architecture components.Use AWS CodeCommit to store the CloudFormation templates alongside applicationconfiguration code.
B. Use AWS Backup to create backups of the EBS volumes and S3 objects every day. UseAmazon Security Lake to create a centralized data lake for AWS CloudTrail logs and VPCflow logs. Use the logs for automated response.
C. Use Amazon Security Lake to create a centralized data lake for AWS CloudTrail logsand VPC flow logs. Use the logs for automated response Enable AWS Security Hub toestablish a single location for recovery procedures. Create AWS CloudFormation templatesthat replicate existing architecture components. Use AWS CodeCommit to store theCloudFormation templates alongside application configuration code.
D. Create EBS snapshots every 4 hours Enable Amazon GuardDuty Malware Protection.Create automation to immediately restore the most recent snapshot for any EC2 instancesthat produce an Execution:EC2/MaliciousFile finding in GuardDuty.

Show Answer

Question # 13

AWS CloudTrail is being used to monitor API calls in an organization. An audit revealedthat CloudTrail is failing to deliver events to Amazon S3 as expected.What initial actions should be taken to allow delivery of CloudTrail events to S3? (SelectTWO.)

A. Verify thattheS3 bucket policy allows CloudTrail to write objects.
B. Verify thatthe1AM role used by CloudTrail has access to write to Amazon CloudWatchLogs.
C. Remove any lifecycle policies on the S3 bucket that are archiving objects to S3 GlacierFlexible Retrieval.
D. Verify thattheS3 bucket defined in CloudTrail exists.
E. Verify that the log file prefix defined in CloudTrail exists in the S3 bucket.

Show Answer

Question # 14

A company deployed an Amazon EC2 instance to a VPC on AWS. A recent alert indicatesthat the EC2 instance is receiving a suspicious number of requests over an open TCP portfrom an external source. The TCP port remains open for long periods of time.The company's security team needs to stop all activity to this port from the external sourceto ensure that the EC2 instance is not being compromised. The application must remainavailable to other users.Which solution will mefet these requirements?

A. Update the network ACL that is attached to the subnet that is associated with the EC2instance. Add a Deny statement for the port and the source IP addresses.
B. Update the elastic network interface security group that is attached to the EC2 instanceto remove the port from theinbound rule list.
C. Update the elastic network interface security group that is attached to the EC2 instanceby adding a Deny entry in the inbound list for the port and the sourceIP addresses.
D. Create a new network ACL for the subnet. Deny all traffic from the EC2 instance toprevent data from being removed.

Show Answer

Question # 15

A company is running an application on Amazon EC2 instances in an Auto Scaling group.The application stores logs locally. A security engineer noticed that logs were lost after ascale-in event. The security engineer needs to recommend a solution to ensure thedurability and availability of log data All logs must be kept for a minimum of 1 year forauditing purposes. What should the security engineer recommend?

A. Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon ElasticBlock Store (Amazon EBS) log volume each time an EC2 instance is created. When theinstance is terminated, the EBS volume can be reattached to another instance for logreview.
B. Create an Amazon Elastic File System (Amazon EFS) file system and add a commandin the user data section of the Auto Scaling launch template to mount the EFS file systemduring EC2 instance creation. Configure a process on the instance to copy the logs once aday from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory inthe EFS file system.
C. Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group.Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review,
D. Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon SimpleNotification Service (Amazon SNS). Configure the hook to remain in the Terminating:Waitstate for 1 hour to allow manual review of the security logs prior to instance termination.

Show Answer

Question # 16

A company has AWS accounts in an organization in AWS Organizations. The companyneeds to install a corporate software package on all Amazon EC2 instances for all theaccounts in the organization.A central account provides base AMIs for the EC2 instances. The company uses AWSSystems Manager for software inventory and patching operations.A security engineer must implement a solution that detects EC2 instances ttjat do not havethe required software. The solution also must automatically install the software if thesoftware is not present.Which solution will meet these requirements?

A. Provide new AMIs that have the required software pre-installed. Apply a tag to the AMIsto indicate that the AMIs have the required software. Configure an SCP that allows newEC2 instances to be launched only if the instances have the tagged AMIs. Tag all existingEC2 instances.
B. Configure a custom patch baseline in Systems Manager Patch Manager. Add thepackage name for the required software to the approved packages list. Associate the newpatch baseline with all EC2 instances. Set up a maintenance window for softwaredeployment.
C. Centrally enable AWS Config. Set up the ec2-managedinstance-applications-requiredAWS Config rule for all accounts Create an Amazon EventBridge rule that reacts to AWSConfig events. Configure the EventBridge rule to invoke an AWS Lambda function thatuses Systems Manager Run Command to install the required software.
D. Create a new Systems Manager Distributor package for the required software. Specifythe download location. Select all EC2 instances in the different accounts. Install thesoftware by using Systems Manager Run Command.

Show Answer

Question # 17

A company uses HTTP Live Streaming (HL'S) to stream live video content to payingsubscribers by using Amazon CloudFront. HLS splits the video content into chunks so thatthe user can request the right chunk based on different conditions. Because the videoevents last for several hours, the total video is made up of thousands of chunks.The origin URL is not disclosed, and every user is forced to access the CloudFront URL.The company has a web application that authenticates the paying users against aninternal repository and a CloudFront key pair that is already issued.What is the simplest and MOST effective way to protect the content?

A. Develop the application to use the CloudFront key pair to set the signed cookies thatusers will use to access the content.
B. Develop the application to issue a security token that Lambda@Edge will receive toauthenticate and authorize access to the content
C. Keep the CloudFront URL encrypted inside the application, and use AWS KMS toresolve the URL on-the-fly after the user is authenticated.

Show Answer

Question # 18

A company hosts an application on Amazon EC2 instances. The application also usesAmazon S3 and Amazon Simple Queue Service (Amazon SQS). The application is behindan Application Load Balancer (ALB) and scales with AWS Auto Scaling.The company’s security policy requires the use of least privilege access, which has beenapplied to all existing AWS resources. A security engineer needs to implement privateconnectivity to AWS services.Which combination of steps should the security engineer take to meet this requirement?(Select THREE.)

A. A. Use an interface VPC endpoint for Amazon SQS
B. B. Configure a connection to Amazon S3 through AWS Transit Gateway.
C. C. Use a gateway VPC endpoint for Amazon S3.
D. D. Modify the 1AM role applied to the EC2 instances in the Auto Scaling group to allowoutbound traffic to the interface endpoints.
E. E. Modify the endpoint policies on all VPC endpoints. Specify the SQS and S3 resourcesthat the application uses
F. F. Configure a connection to Amazon S3 through AWS Firewall Manager

Show Answer

Question # 19

A company operates a web application that runs on Amazon EC2 instances. Theapplication listens on port 80 and port 443. The company uses an Application LoadBalancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the applicationinstances only on port 80.The ALB is in public subnets that are associated with a network ACL that is named NACL1.The application instances are in dedicated private subnets that are associated with a network ACL that is named NACL2. An Amazon RDS for PostgreSQL DB instance thatuses port 5432 is in a dedicated private subnet that is associated with a network ACL thatis named NACL3. All the network ACLs currently allow all inbound and outbound traffic.Which set of network ACL changes will increase the security of the application whileensuring functionality?

A. Make the following changes to NACL3:• Add a rule that allows inbound traffic on port 5432 from NACL2.• Add a rule that allows outbound traffic on ports 1024-65536 to NACL2.• Remove the default rules that allow all inbound and outbound traffic.
B. Make the following changes to NACL3:• Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the applicationinstance subnets.• Add a rule that allows outbound traffic on ports 1024-65536 to the application instancesubnets.• Remove the default rules that allow all inbound and outbound traffic.
C. Make the following changes to NACL2:• Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDSsubnets.• Remove the default rules that allow all inbound and outbound traffic.
D. Make the following changes to NACL2:• Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDSsubnets.• Add a rule that allows outbound traffic on port 5432 to the RDS subnets.

Show Answer

Question # 20

An AWS Lambda function was misused to alter data, and a security engineer must identifywho invoked the function and what output was produced. The engineer cannot find anylogs create^ by the Lambda function in Amazon CloudWatch Logs.Which of the following explains why the logs are not available?

A. The execution role for the Lambda function did not grant permissions to write log data toCloudWatch Logs.
B. The Lambda function was invoked by using Amazon API Gateway, so the logs are notstored in CloudWatch Logs.
C. The execution role for the Lambda function did not grant permissions to write to theAmazon S3 bucket where CloudWatch Logs stores the logs.
D. The version of the Lambda function that was invoked was not current.

Show Answer

Question # 21

A company that uses AWS Organizations is using AWS 1AM Identity Center (AWS SingleSign-On) to administer access to AWS accounts. A security engineer is creating a custompermission set in 1AM Identity Center. The company will use the permission set acrossmultiple accounts. An AWS managed policy and a customer managed policy are attachedto the permission set. The security engineer has full administrative permissions and isoperating in the management account.When the security engineer attempts to assign the permission set to an 1AM IdentityCenter user who has access to multiple accounts, the assignment fails.What should the security engineer do to resolve this failure?

A. Create the customer managed policy in every account where the permission set isassigned. Give the customer managed policy the same name and same permissions ineach account.
B. Remove either the AWS managed policy or the customer managed policy from thepermission set. Create a second permission set that includes the removed policy. Apply thepermission sets separately to the user.
C. Evaluate the logic of the AWS managed policy and the customer managed policy.Resolve any policy conflicts in the permission set before deployment.
D. Do not add the new permission set to the user. Instead, edit the user's existingpermission set to include the AWS managed policy and the customer managed policy.

Show Answer

Question # 22

A company suspects that an attacker has exploited an overly permissive role to exportcredentials from Amazon EC2 instance metadata. The company uses Amazon GuardDutyand AWS Audit Manager. The company has enabled AWS CloudTrail logging and AmazonCloudWatch logging for all of its AWS accounts. A security engineer must determine if the credentials were used to access the company'sresources from an external account.Which solution will provide this information?

A. Review GuardDuty findings to find InstanceCredentialExfiltration events.
B. Review assessment reports in the Audit Manager console to findInstanceCredentialExfiltration events.
C. Review CloudTrail logs for GetSessionToken API calls to AWS Security Token Service(AWS STS) that come from an acount ID from outside the company.
D. Review CloudWatch logs for GetSessionToken API calls to AWS Security TokenService (AWS STS) that come from an account ID from outside the company.

Show Answer

Question # 23

A security team is working on a solution that will use Amazon EventBridge (AmazonCloudWatch Events) to monitor new Amazon S3 objects. The solution will monitor forpublic access and for changes to any S3 bucket policy or setting that result in publicaccess. The security team configures EventBridge to watch for specific API calls that arelogged from AWS CloudTrail. EventBridge has an action to send an email notificationthrough Amazon Simple Notification Service (Amazon SNS) to the security team immediately with details of the API call.Specifically, the security team wants EventBridge to watch for the s3:PutObjectAcl,s3:DeleteBucketPolicy, and s3:PutBucketPolicy API invocation logs from CloudTrail. Whiledeveloping the solution in a single account, the security team discovers that thes3:PutObjectAcl API call does not invoke an EventBridge event. However, thes3:DeleteBucketPolicy API call and the s3:PutBucketPolicy API call do invoke an event.The security team has enabled CloudTrail for AWS management events with a basicconfiguration in the AWS Region in which EventBridge is being tested. Verification of theEventBridge event pattern indicates that the pattern is set up correctly. The security teammust implement a solution so that the s3:PutObjectAcl API call will invoke an EventBridgeevent. The solution must not generate false notifications.Which solution will meet these requirements?

A. Modify the EventBridge event pattern by selecting Amazon S3. Select All Events as theevent type.
B. Modify the EventBridge event pattern by selecting Amazon S3. Select Bucket LevelOperations as the event type.
C. Enable CloudTrail Insights to identify unusual API activity.
D. Enable CloudTrail to monitor data events for read and write operations to S3 buckets.

Show Answer

Question # 24

A company runs an online game on AWS. When players sign up for the game, theirusername and password credentials are stored in an Amazon Aurora database.The number of users has grown to hundreds of thousands of players. The number ofrequests for password resets and login assistance has become a burden for the company’scustomer service team.The company needs to implement a solution to give players another way to log in to thegame. The solution must remove the burden of password resets and login assistance whilesecurely protecting each player's credentials.Which solution will meet these requirements?

A. When a new player signs up, use an AWS Lambda function to automatically create an1AM access key and a secret access key. Program the Lambda function to store thecredentials on the player's device. Create 1AM keys for existing players. B Migrate the player credentials from the Aurora database to AWS Secrets Manager. Whena new player signs up. create a key-value pair in Secrets Manager for the player's user IDand password.
B. Configure Amazon Cognito user pools to federate access to the game with third-partyidentity providers (IdPs), such as social IdPs Migrate the game's authentication mechanismto Cognito.
C. Instead of using usernames and passwords for authentication, issue API keys to newand existing players. Create an Amazon API Gateway API to give the game client accessto the game's functionality.

Show Answer

Question # 25

A company wants to receive automated email notifications when AWS access keys fromdeveloper AWS accounts are detected on code repository sites.Which solution will provide the required email notifications?

A. Create an Amazon EventBridge rule to send Amazon Simple Notification Service(Amazon SNS) email notifications for Amazon GuardDutyUnauthorizedAccesslAMUser/lnstanceCredentialExfiltration OutsideAWS findings.
B. Change the AWS account contact information for the Operations type to a separateemail address. Periodically poll this email address for notifications.
C. Create an Amazon EventBridge rule that reacts to AWS Health events that have a valueof Risk for the service category Configure email notifications by using Amazon SimpleNotification Service (Amazon SNS).
D. D. Implement new anomaly detection software. Ingest AWS CloudTrail logs. Configuremonitoring for ConsoleLogin events in the AWS Management Console. Configure emailnotifications from the anomaly detection software.

Show Answer

Question # 26

A company’s security team needs to receive a notification whenever an AWS access keyhas not been rotated in 90 or more days. A security engineer must develop a solution thatprovides these notifications automatically.Which solution will meet these requirements with the LEAST amount of effort?

A. Deploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select theaccess-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days.Create an Amazon EventBridge (Amazon CloudWatch Events) rule with an event patternthat matches the compliance type of NON_COMPLIANT from AWS Config for themanaged rule. Configure EventBridge (CloudWatch Events) to send an Amazon SimpleNotification Service (Amazon SNS) notification to the security team.
B. Create a script to export a .csv file from the AWS Trusted Advisor check for IAM accesskey rotation. Load the script into an AWS Lambda function that will upload the .csv file toan Amazon S3 bucket. Create an Amazon Athena table query that runs when the .csv fileis uploaded to the S3 bucket. Publish the results for any keys older than 90 days by usingan invocation of an Amazon Simple Notification Service (Amazon SNS) notification to thesecurity team.
C. Create a script to download the IAM credentials report on a periodic basis. Load thescript into an AWS Lambda function that will run on a schedule through AmazonEventBridge (Amazon CloudWatch Events). Configure the Lambda script to load the reportinto memory and to filter the report for records in which the key was last rotated at least 90days ago. If any records are detected, send an Amazon Simple Notification Service(Amazon SNS) notification to the security team.
D. Create an AWS Lambda function that queries the IAM API to list all the users. Iteratethrough the users by using the ListAccessKeys operation. Verify that the value in the CreateDate field is not at least 90 days old. Send an Amazon Simple Notification Service(Amazon SNS) notification to the security team if the value is at least 90 days old. Createan Amazon EventBridge (Amazon CloudWatch Events) rule to schedule the Lambdafunction to run each day.

Show Answer

Question # 27

A company has an application that runs on Amazon EC2 instances behind an ApplicationLoad Balancer (ALB). The instances are in an Amazon EC2 Auto Scaling group and areattached to Amazon Elastic Blodfc Store (Amazon EBS) volumes.A security engineer needs to preserve all forensic evidence from one of the instances.Which order of steps should the security engineer use to meet this requirement?

A. Take an EBS volume snapshot of the instance and store the snapshot in an Amazon S3bucket. Take a memory snapshot of the instance and store the snapshot in an S3 bucket.Detach the instance from the Auto Scaling group. Deregister the instance from the ALB.Stop the instance.
B. Take a memory snapshot of the instance and store the snapshot in an Amazon S3bucket. Stop the instance. Take an EBS volume snapshot of the instanceand store the snapshot in an S3 bucket. Detach the instance from the Auto Scaling group.Deregister the instance from the ALB.
C. Detach the instance from the Auto Scaling group. Deregister the instance from the ALB.Take an EBS volume snapshot of the instance and store the snapshotin an Amazon S3 bucket. Take a memory snapshot of the instance and store the snapshotin an S3 bucket. Stop the instance
D. Detach the instance from the Auto Scaling group Deregister the instance from the ALB.Stop the instance. Take a memory snapshot of the instance and store the snapshot in anAmazon S3 bucket. Take an EBS volume snapshot of the instance and store the snapshotin an S3 bucket.

Show Answer

Question # 28

A company manages multiple AWS accounts using AWS Organizations. The company'ssecurity team notices that some member accounts are not sending AWS CloudTrail logs toa centralized Amazon S3 logging bucket. The security team wants to ensure there is atleast one trail configured for all existing accounts and for any account that is created in thefuture.Which set of actions should the security team implement to accomplish this?

A. Create a new trail and configure it to send CloudTraiI logs to Amazon S3. Use AmazonEventBridge to send notification if a trail is deleted or stopped.
B. Deploy an AWS Lambda function in every account to check if there is an existing trailand create a new trail, if needed.
C. Edit the existing trail in the Organizations management account and apply it to theorganization.
D. Create an SCP to deny the cloudtraiI:DeIete• and cloudtraiI:Stop• actbns. Apply the SCPto all accounts.

Show Answer

Question # 29

A security engineer is implementing a solution to allow users to seamlessly encryptAmazon S3 objects without having to touch the keys directly. The solution must be highlyscalable without requiring continual management. Additionally, the organization must beable to immediately delete the encryption keys.Which solution meets these requirements?

A. Use AWS KMS with AWS managed keys and the ScheduleKeyDeletion API with aPendingWindowInDays set to 0 to remove the keys if necessary.
B. B. Use KMS with AWS imported key material and then use theDeletelmportedKeyMaterial API to remove the key material if necessary.
C. Use AWS CloudHSM to store the keys and then use the CloudHSM API or the PKCS11library to delete the keys if necessary.
D. Use the Systems Manager Parameter Store to store the keys and then use the serviceAPI operations to delete the keys if necessary.

Show Answer

Question # 30

A company needs to implement DNS Security Extensions (DNSSEC) for a specificsubdomain. The subdomain is already registered with Amazon Route 53. A securityengineer has enabled DNSSEC signing and has created a key-signing key (KSK). Whenthe security engineer tries to test the configuration, the security engineer receives an errorfor a broken trust chain.What should the security engineer do to resolve this error?

A. Replace the KSK with a zone-signing key (ZSK).
B. Deactivate and then activate the KSK.
C. Create a Delegation Signer (DS) record in the parent hosted zone.
D. Create a Delegation Signer (DS) record in the subdomain.

Show Answer

Question # 31

A security analyst attempted to troubleshoot the monitoring of suspicious security groupchanges. The analyst was told that there is an Amazon CloudWatch alarm in place forthese AWS CloudTrail log events. The analyst tested the monitoring setup by making aconfiguration change to the security group but did not receive any alerts.Which of the following troubleshooting steps should the analyst perform?

A. Ensure that CloudTrail and S3 bucket access logging is enabled for the analyst's AWSaccount.
B. Verify that a metric filter was created and then mapped to an alarm. Check the alarm notification action.
C. Check the CloudWatch dashboards to ensure that there is a metric configured with anappropriate dimension for security group changes.
D. Verify that the analyst's account is mapped to an IAM policy that includes permissionsfor cloudwatch:GetMetricStatistics and cloudwatch:ListMetrics.

Show Answer

Question # 32

A company has public certificates that are managed by AWS Certificate Manager (ACM).The certificates are either imported certificates or managed certificates from ACM withmixed validation methods. A security engineer needs to design a monitoring solution toprovide alerts by email when a certificate is approaching its expiration date.What is the MOST operationally efficient way to meet this requirement?

A. Create an AWS Lambda function to list all certificates and to go through each certificateto describe the certificate by using the AWS SDK. Filter on the NotAfter attribute and sendan email notification. Use an Amazon EventBridge rate expression to schedule the Lambdafunction to run daily.
B. Create an Amazon CloudWatch alarm Add all the certificate ARNs in the AWS/CertificateManager namespace to the DaysToExpiry metnc. Configure the alarm topublish a notification to an Amazon Simple Notification Service (Amazon SNS) topic whenthe value for the DaysToExpiry metric is less than or equal to 31.
C. Set up AWS Security Hub. Turn on the AWS Foundational Security Best Practicesstandard with integrated ACM to send findings. Configure and use a custom action bycreating a rule to match the pattern from the ACM findings on the NotBefore attribute as theevent source Create an Amazon Simple Notification Service (Amazon SNS) topic as thetarget
D. Create an Amazon EventBridge rule by using a predefined pattern for ACM Choose themetric in the ACM Certificate Approaching Expiration event as the event pattern. Create anAmazon Simple Notification Service (Amazon SNS) topic as the target

Show Answer

Question # 33

A company runs workloads in the us-east-1 Region. The company has never deployedresources to other AWS Regions and does not have any multi-Region resources.The company needs to replicate its workloads and infrastructure to the us-west-1 Region.A security engineer must implement a solution that uses AWS Secrets Manager to storesecrets in both Regions. The solution must use AWS Key Management Service (AWSKMS) to encrypt the secrets. The solution must minimize latency and must be able to workif only one Region is available.The security engineer uses Secrets Manager to create the secrets in us-east-1.What should the security engineer do next to meet the requirements?

A. Encrypt the secrets in us-east-1 by using an AWS managed KMS key. Replicate thesecrets to us-west-1. Encrypt the secrets in us-west-1 by using a new AWS managed KMSkey in us-west-1.
B. Encrypt the secrets in us-east-1 by using an AWS managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
C. Encrypt the secrets in us-east-1 by using a customer managed KMS key. Configureresources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
D. Encrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate thesecrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managedKMS key from us-east-1.

Show Answer

Question # 34

A company used AWS Organizations to set up an environment with multiple AWSaccounts. The company's organization currently has two AWS accounts, and the companyexpects to add more than 50 AWS accounts during the next 12 months The company willrequire all existing and future AWS accounts to use Amazon GuardDuty. Each existingAWS account has GuardDuty active. The company reviews GuardDuty findings by logginginto each AWS account individually.The company wants a centralized view of the GuardDuty findings for the existing AWSaccounts and any future AWS accounts. The company also must ensure that any newAWS account has GuardDuty automatically turned on.Which solution will meet these requirements?

A. B. Create a new AWS account in the organization. Enable GuardDuty in the newaccount. Designate the new account as the delegated administrator account forGuardDuty. Configure GuardDuty to add existing accounts as member accounts. Select theoption to automatically add new AWS accounts to the organization
B. Create a new AWS account in the organization. Enable GuardDuty in the new account.Enable AWS Security Hub in each account. Select the option to automatically add newAWS accounts to the organization.
C. D. Enable AWS Security Hub in the organization's management account. Designate themanagement account as the delegated administrator account for Security Hub. Addexisting accounts as member accounts. Select the option to automatically add new AWSaccounts to the organization. Send all Security Hub findings to the organization'sGuardDuty account.

Show Answer

Question # 35

A company has AWS accounts that are in an organization in AWS Organizations. Asecurity engineer needs to set up AWS Security Hub in a dedicated account for securitymonitoring. The security engineer must ensure that Security Hub automatically manages all existingaccounts and all new accounts that are added to the organization. Security Hub also mustreceive findings from all AWS Regions.Which combination of actions will meet these requirements with the LEAST operationaloverhead? (Select TWO.)

A. B. Create an AWS Lambda function that routes events from other Regions to thededicated Security Hub account. Create an Amazon EventBridge rule to invoke theLambda function.
B. Turn on the option to automatically enable accounts for Security Hub.
C. Create an SCP that denies the securityhub DisableSecurityHub permission. Attach theSCP to the organization’s root account.
D. E. Configure services in other Regions to write events to an AWS CloudTrailorganization trail. Configure Security Hub to read events from the trail.

Show Answer

Question # 36

A security engineer is creating an AWS Lambda function. The Lambda function needs touse a role that is named LambdaAuditRole to assume a role that is namedAcmeAuditFactoryRole in a different AWS account.When the code is processed, the following error message appears: "An error oc-curred(AccessDenied) when calling the AssumeRole operation."Which combination of steps should the security engineer take to resolve this er-ror? (SelectTWO.)

A. Ensure that LambdaAuditRole has the sts:AssumeRole permission for AcmeAuditFactoryRole.
B. Ensure that LambdaAuditRole has the AWSLambdaBasicExecutionRole managedpolicy attached.
C. Ensure that the trust policy for AcmeAuditFactoryRole allows the sts:AssumeRole actionfrom LambdaAuditRole.
D. Ensure that the trust policy for LambdaAuditRole allows the sts:AssumeRole action fromthe lambda.amazonaws.com service.
E. Ensure that the sts:AssumeRole API call is being issued to the us-east-I Regionendpoint.

Show Answer

Question # 37

A systems engineer deployed containers from several custom-built images that anapplication team provided through a QA workflow The systems engineer used AmazonElastic Container Service (Amazon ECS) with the Fargate launch type as the targetplatform The system engineer now needs to collect logs from all containers into an existingAmazon CloudWatch log groupWhich solution will meet this requirement?

A. Turn on the awslogs log driver by specifying parameters for awslogs-group andawslogs-region m the LogConfiguration property
B. Download and configure the CloudWatch agent on the container instances
C. Set up Fluent Bit and FluentO as a DaemonSet to send logs to Amazon CloudWatchLogs
D. Configure an 1AM policy that includes the togs CreateLogGroup action Assign the policyto the container instances

Show Answer

Question # 38

An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installsthe Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2instances launch with an IAM role that has an IAM policy attached. The policy providesaccess to publish custom metrics to CloudWatch. The EC2 instances run in a privatesubnet inside a VPC. The VPC provides ^ccess to the internet for private subnets througha NAT gateway.A security engineer notices that no logs are being published to CloudWatch Logs for theEC2 instances that the Auto Scaling group launches. The security engineer validates thatthe CloudWatch Logs agent is running and is configured properly on the EC2 instances. Inaddition, the security engineer validates that network communications are working properlyto AWS services.What can the security engineer do to ensure that the logs are published to CloudWatchLogs?

A. Configure the IAM policy in use by the IAM role to have access to the requiredcloudwatch: API actions thatwill publish logs.
B. Adjust the Amazon EC2 Auto Scaling service-linked role to have permissions to write toCloudWatch Logs.
C. Configure the IAM policy in use by the IAM role to have access to the required AWSlogs: API actions that willpublish logs.
D. Add an interface VPC endpoint to provide a route to CloudWatch Logs.

Show Answer

Question # 39

A company has secured the AWS account root user for its AWS account by following AWSbest practices. The company also has enabled AWS CloudTrail, which is sending its logs toAmazon S3. A security engineer wants to receive notification in near-real time if a useruses the AWS account root user credentials to sign in to the AWS Management Console.Which solutions will provide this notification? (Select TWO.)

A. Use AWS Trusted Advisor and its security evaluations for the root account. Configure an Amazon EventBridge event rule that is invoked by the Trusted Advisor API. Configure therule to target an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe anyrequired endpoints to the SNS topic so that these endpoints can receive notification.
B. B. Use AWS IAM Access Analyzer. Create an Amazon CloudWatch Logs metric filter toevaluate log entries from Access Analyzer that detect a successful root account login.Create an Amazon CloudWatch alarm that monitors whether a root login has occurred.Configure the CloudWatch alarm to notify an Amazon Simple Notification Service (AmazonSNS) topic when the alarm enters the ALARM state. Subscribe any required endpoints tothis SNS topic so that these endpoints can receive notification.
C. Configure AWS CloudTrail to send its logs to Amazon CloudWatch Logs. Configure ametric filter on the CloudWatch Logs log group used by CloudTrail to evaluate log entriesfor successful root account logins. Create an Amazon CloudWatch alarm that monitorswhether a root login has occurred Configure the CloudWatch alarm to notify an AmazonSimple Notification Service (Amazon SNS) topic when the alarm enters the ALARM state.Subscribe any required endpoints to this SNS topic so that these endpoints can receivenotification.
D. Configure AWS CloudTrail to send log notifications to an Amazon Simple NotificationService (Amazon SNS) topic. Create an AWS Lambda function that parses the CloudTrailnotification for root login activity and notifies a separate SNS topic that contains theendpoints that should receive notification. Subscribe the Lambda function to the SNS topicthat is receiving log notifications from CloudTrail.
E. E. Configure an Amazon EventBridge event rule that runs when Amazon CloudWatchAPI calls are recorded for a successful root login. Configure the rule to target an AmazonSimple Notification Service (Amazon SNS) topic. Subscribe any required endpoints to theSNS topic so that these endpoints can receive notification.

Show Answer

Question # 40

A company needs to create a centralized solution to analyze log files. The company usesan organization in AWS Organizations to manage its AWS accounts.The solution must aggregate and normalize events from the following sources: • The entire organization in Organizations• All AWS Marketplace offerings that run in the company’s AWS accounts• The company's on-premises systemsWhich solution will meet these requirements?

A. Configure log streams in Amazon CloudWatch Logs for the sources that needmonitoring. Create log subscription filters for each log stream. Forward the messages toAmazon OpenSearch Service for analysis.
B. Set up a delegated Amazon Security Lake administrator account in Organizations.Enable and configure Security Lake for the organization. Add the accounts that needmonitoring. Use Amazon Athena to query the log data.
C. D. Apply an SCP to configure all member accounts and services to deliver log files to acentralized Amazon S3 bucket. Use Amazon OpenSearch Service to query the centralizedS3 bucket for log entries.

Show Answer

Question # 41

A company has a VPC that has no internet access and has the private DNS hostnamesoption enabled. An Amazon Aurora database is running inside the VPC. A securityengineer wants to use AWS Secrets Manager to automatically rotate the credentials for theAurora database The security engineer configures the Secrets Manager default AWSLambda rotation function to run inside the same VPC that the Aurora database uses.However, the security engineer determines that the password cannot be rotated properlybecause the Lambda function cannot communicate with the Secrets Manager endpoint.What is the MOST secure way that the security engineer can give the Lambda function theability to communicate with the Secrets Manager endpoint?

A. Add a NAT gateway to the VPC to allow access to the Secrets Manager endpoint.
B. Add a gateway VPC endpoint to the VPC to allow access to the Secrets Managerendpoint.
C. Add an interface VPC endpoint to the VPC to allow access to the Secrets Managerendpoint.
D. Add an internet gateway for the VPC to allow access to the Secrets Manager endpoint.

Show Answer

Question # 42

A company is evaluating the use of AWS Systems Manager Session Manager to gamaccess to the company's Amazon EC2 instances. However, until the company implementsthe change, the company must protect the key file for the EC2 instances from read andwrite operations by any other users.When a security administrator tries to connect to a critical EC2 Linux instance during anemergency, the security administrator receives the following error. "Error Unprotectedprivate key file - Permissions for' ssh/my_private_key pern' are too open". Which command should the security administrator use to modify the private key Mepermissions to resolve this error?

A. chmod 0040 ssh/my_private_key pern
B. chmod 0400 ssh/my_private_key pern
C. chmod 0004 ssh/my_private_key pern
D. chmod 0777 ssh/my_private_key pern

Show Answer

Question # 43

A company has deployed servers on Amazon EC2 instances in a VPC. External vendorsaccess these servers over the internet. Recently, the company deployed a new applicationon EC2 instances in a new CIDR range. The company needs to make the applicationavailable to the vendors.A security engineer verified that the associated security groups and network ACLs areallowing the required ports in the inbound diction. However, the vendors cannot connect tothe application.Which solution will provide the vendors access to the application?

A. Modify the security group that is associated with the EC2 instances to have the sameoutbound rules as inbound rules.
B. Modify the network ACL that is associated with the CIDR range to allow outbound trafficto ephemeral ports.
C. Modify the inbound rules on the internet gateway to allow the required ports.
D. Modify the network ACL that is associated with the CIDR range to have the sameoutbound rules as inbound rules.

Show Answer

Question # 44

A company uses AWS Signer with all of the company’s AWS Lambda functions. Adeveloper recently stopped working for the company. The company wants to ensure that allthe code that the developer wrote can no longer be deployed to the Lambda functions.Which solution will meet this requirement?

A. Revoke all versions of the signing profile assigned to the developer.
B. Examine the developer’s IAM roles. Remove all permissions that grant access to Signer.
C. Re-encrypt all source code with a new AWS Key Management Service (AWS KMS) key.
D. Use Amazon CodeGuru to profile all the code that the Lambda functions use.

Show Answer

Question # 45

A Network Load Balancer (NLB) target instance is not entering the InService state. A security engineer determines that health checks are failing. Which factors could cause the health check failures? (Select THREE.)

A. Revoke all versions of the signing profile assigned to the developer.
B. Examine the developer’s IAM roles. Remove all permissions that grant access to Signer.
C. Re-encrypt all source code with a new AWS Key Management Service (AWS KMS) key.
D. Use Amazon CodeGuru to profile all the code that the Lambda functions use.

Show Answer

Question # 46

A security engineer recently rotated all IAM access keys in an AWS account. The securityengineer then configured AWS Config and enabled the following AWSConfig managed rules; mfa-enabled-for-iam-console-access, iam-user-mfa-enabled,access-key-rotated, and iam-user-unused-credentials-check.The security engineer notices that all resources are displaying as noncompliant after theIAM GenerateCredentialReport API operation is invoked. What could be the reason for the noncompliant status?

A. The IAM credential report was generated within the past 4 hours.
B. The security engineer does not have the GenerateCredentialReport permission.
C. The security engineer does not have the GetCredentialReport permission.
D. The AWS Config rules have a MaximumExecutionFrequency value of 24 hours.

Show Answer

Question # 47

A Systems Engineer is troubleshooting the connectivity of a test environment that includesa virtual security appliance deployed inline. In addition to using the virtual securityappliance, the Development team wants to use security groups and network ACLs toaccomplish various security requirements in the environment.What configuration is necessary to allow the virtual security appliance to route the traffic?

A. Disable network ACLs.
B. Configure the security appliance's elastic network interface for promiscuous mode.
C. Disable the Network Source/Destination check on the security appliance's elastic network interface
D. Place the security appliance in the public subnet with the internet gateway

Show Answer

Question # 48

A Security Engineer is building a Java application that is running on Amazon EC2. Theapplication communicates with an Amazon RDS instance and authenticates with a username and password.Which combination of steps can the Engineer take to protect the credentials and minimizedowntime when the credentials are rotated? (Choose two.)

A. Have a Database Administrator encrypt the credentials and store the ciphertext inAmazon S3. Grant permission to the instance role associated with the EC2 instance toread the object and decrypt the ciphertext.
B. Configure a scheduled job that updates the credential in AWS Systems ManagerParameter Store and notifies the Engineer that the application needs to be restarted.
C. Configure automatic rotation of credentials in AWS Secrets Manager.
D. Store the credential in an encrypted string parameter in AWS Systems ManagerParameter Store. Grant permission to the instance role associated with the EC2 instance toaccess the parameter and the AWS KMS key that is used to encrypt it.
E. Configure the Java application to catch a connection failure and make a call to AWSSecrets Manager to retrieve updated credentials when the password is rotated. Grantpermission to the instance role associated with the EC2 instance to access SecretsManager.

Show Answer

Question # 49

A company has a group of Amazon EC2 instances in a single private subnet of a VPC withno internet gateway attached. A security engineer has installed the Amazon CloudWatchagent on all instances in that subnet to capture logs from a specific application. To ensurethat the logs flow securely, the company's networking team has created VPC endpoints forCloudWatch monitoring and CloudWatch logs. The networking team has attached theendpoints to the VPC.The application is generating logs. However, when the security engineer queriesCloudWatch, the logs do not appear.Which combination of steps should the security engineer take to troubleshoot this issue?(Choose three.)

A. Ensure that the EC2 instance profile that is attached to the EC2 instances haspermissions to create log streams and write logs.
B. Create a metric filter on the logs so that they can be viewed in the AWS Management Console.
C. Check the CloudWatch agent configuration file on each EC2 instance to make sure thatthe CloudWatch agent is collecting the proper log files.
D. Check the VPC endpoint policies of both VPC endpoints to ensure that the EC2instances have permissions to use them.
E. Create a NAT gateway in the subnet so that the EC2 instances can communicate withCloudWatch.
F. Ensure that the security groups allow all the EC2 instances to communicate with eachother to aggregate logs before sending.

Show Answer

Question # 50

An AWS account administrator created an IAM group and applied the following managedpolicy to require that each individual user authenticate using multi-factor authentication: After implementing the policy, the administrator receives reports that users are unable toperform Amazon EC2 commands using the AWS CLI.What should the administrator do to resolve this problem while still enforcing multi-factorauthentication?

A. Change the value of aws:MultiFactorAuthPresent to true.
B. Instruct users to run the aws sts get-session-token CLI command and pass the multifactorauthentication --serial-number and --token-code parameters. Use these resultingvalues to make API/CLI calls.
C. Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
D. Create a role and enforce multi-factor authentication in the role trust policy. Instructusers to run the sts assume-role CLI command and pass --serial-number and --token-codeparameters. Store the resulting values in environment variables. Add sts:AssumeRole toNotAction in the policy. 

Show Answer

Question # 51

A company uses SAML federation to grant users access to AWS accounts. A companyworkload that is in an isolated AWS account runs on immutable infrastructure with nohuman access to Amazon EC2. The company requires a specialized user known as abreak glass user to have access to the workload AWS account and instances in the case ofSAML errors. A recent audit discovered that the company did not create the break glassuser for the AWS account that contains the workload.The company must create the break glass user. The company must log any activities of thebreak glass user and send the logs to a security team.Which combination of solutions will meet these requirements? (Select TWO.)

A. Create a local individual break glass IAM user for the security team. Create a trail inAWS CloudTrail that has Amazon CloudWatch Logs turned on. Use Amazon EventBridgeto monitor local user activities.
B. Create a break glass EC2 key pair for the AWS account. Provide the key pair to thesecurity team. Use AWS CloudTraiI to monitor key pair activity. Send notifications to thesecurity team by using Amazon Simple Notification Service (Amazon SNS).
C. Create a break glass IAM role for the account. Allow security team members to performthe AssumeRoleWithSAML operation. Create an AWS Cloud Trail trail that has AmazonCloudWatch Logs turned on. Use Amazon EventBridge to monitor security team activities.
D. Create a local individual break glass IAM user on the operating system level of each workload instance. Configure unrestricted security groups on the instances to grant accessto the break glass IAM users.
E. Configure AWS Systems Manager Session Manager for Amazon EC2. Configure anAWS Cloud Trail filter based on Session Manager. Send the results to an Amazon SimpleNotification Service (Amazon SNS) topic.

Show Answer

Question # 52

A security engineer must use AWS Key Management Service (AWS KMS) to design a keymanagement solution for a set of Amazon Elastic Block Store (AmazonEBS) volumes that contain sensitive data. The solution needs to ensure that the keymaterial automatically expires in 90 days.Which solution meets these criteria?

A. A customer managed CMK that uses customer provided key material
B. A customer managed CMK that uses AWS provided key material
C. An AWS managed CMK
D. Operation system-native encryption that uses GnuPG

Show Answer

Question # 53

A security engineer is trying to use Amazon EC2 Image Builder to create an image of anEC2 instance. The security engineer has configured the pipeline to send logs to anAmazon S3 bucket. When the security engineer runs the pipeline, the build fails with thefollowing error: “AccessDenied: Access Denied status code: 403”.The security engineer must resolve the error by implementing a solution that complies withbest practices for least privilege access.Which combination of steps will meet these requirements? (Choose two.)

A. Ensure that the following policies are attached to the IAM role that the security engineeris using: EC2InstanceProfileForImageBuilder,EC2InstanceProfileForImageBuilderECRContainerBuilds, andAmazonSSMManagedInstanceCore.
B. Ensure that the following policies are attached to the instance profile for the EC2 instance: EC2InstanceProfileForImageBuilder,EC2InstanceProfileForImageBuilderECRContainerBuilds, andAmazonSSMManagedInstanceCore.
C. Ensure that the AWSImageBuilderFullAccess policy is attached to the instance profilefor the EC2 instance.
D. Ensure that the security engineer’s IAM role has the s3:PutObject permission for the S3bucket.
E. Ensure that the instance profile for the EC2 instance has the s3:PutObject permissionfor the S3 bucket.

Show Answer

Question # 54

A company has contracted with a third party to audit several AWS accounts. To enable theaudit, cross- account IAM roles have been created in each account targeted for audit. The Auditor is having trouble accessing some of the accounts.Which of the following may be causing this problem? (Choose three.)

A. The external ID used by the Auditor is missing or incorrect.
B. The Auditor is using the incorrect password.
C. The Auditor has not been granted sts:AssumeRole for the role in the destination account.
D. The Amazon EC2 role used by the Auditor must be set to the destination account role.
E. The secret key used by the Auditor is missing or incorrect.
F. The role ARN used by the Auditor is missing or incorrect.

Show Answer

Question # 55

A Security Engineer is working with a Product team building a web application on AWS.The application uses Amazon S3 to host the static content, Amazon APIGateway to provide RESTful services; and Amazon DynamoDB as the backend data store.The users already exist in a directory that is exposed through a SAML identity provider.Which combination of the following actions should the Engineer take to enable users to beauthenticated into the web application and call APIs? (Choose three.)

A. Create a custom authorization service using AWS Lambda.
B. Configure a SAML identity provider in Amazon Cognito to map attributes to the AmazonCognito user pool attributes.
C. Configure the SAML identity provider to add the Amazon Cognito user pool as a relying party.
D. Configure an Amazon Cognito identity pool to integrate with social login providers.
E. Update DynamoDB to store the user email addresses and passwords.
F. Update API Gateway to use a COGNITO_USER_POOLS authorizer.

Show Answer

Question # 56

A company has an organization with SCPs in AWS Organizations. The root SCP for theorganization is as follows: The company's developers are members of a group that has an IAM policy that allowsaccess to Amazon Simple Email Service (Amazon SES) by allowing ses:* actions. Theaccount is a child to an OU that has an SCP that allows Amazon SES. The developers arereceiving a not-authorized error when they try to access Amazon SES through the AWSManagement Console.Which change must a security engineer implement so that the developers can accessAmazon SES?

A. Add a resource policy that allows each member of the group to access Amazon SES.
B. Add a resource policy that allows "Principal": {"AWS": "arn:aws:iam::accountnumber:group/Dev"}.
C. Remove the AWS Control Tower control (guardrail) that restricts access to AmazonSES.
D. Remove Amazon SES from the root SCP.

Show Answer

Question # 57

A company is evaluating its security posture. In the past, the company has observed issueswith specific hosts and host header combinations that affectedthe company's business. The company has configured AWS WAF web ACLs as an initialstep to mitigate these issues.The company must create a log analysis solution for the AWS WAF web ACLs to monitorproblematic activity. The company wants to process all the AWS WAF logs in a centrallocation. The company must have the ability to filter out requests based on specific hosts.A security engineer starts to enable access logging for the AWS WAF web ACLs.What should the security engineer do next to meet these requirements with the MOSToperational efficiency?

A. Specify Amazon Redshift as the destination for the access logs. Deploy the AmazonAthena Redshift connector. Use Athena to query the data from Amazon Redshift and tofilter the logs by host.
B. Specify Amazon CloudWatch as the destination for the access logs. Use AmazonCloudWatch Logs Insights to design a query to filter the logs by host.
C. Specify Amazon CloudWatch as the destination for the access logs. Export theCloudWatch logs to an Amazon S3 bucket. Use Amazon Athena to query the logs and tofilter the logs by host.
D. Specify Amazon CloudWatch as the destination for the access logs. Use AmazonRedshift Spectrum to query the logs and to filter the logs by host.

Show Answer

Question # 58

A company uses AWS Organizations. The company wants to implement short-term credentialsfor third-party AWS accounts to use to access accounts within the com-pany'sorganization. Access is for the AWS Management Console and third-party software-as-aservice(SaaS) applications. Trust must be enhanced to prevent two external accounts fromusing the same credentials. The solution must require the least possible operational effort.Which solution will meet these requirements?

A. Use a bearer token authentication with OAuth or SAML to manage and share a centralAmazon Cognito user pool across multiple Amazon API Gateway APIs.
B. Implement AWS IAM Identity Center (AWS Single Sign-On), and use an identi-ty sourceof choice. Grant access to users and groups from other accounts by using permission setsthat are assigned by account.
C. Create a unique IAM role for each external account. Create a trust policy. Use AWS Secrets Manager to create a random external key.
D. Create a unique IAM role for each external account. Create a trust policy that includes acondition that uses the sts:Externalld condition key.

Show Answer

Question # 59

A company uses AWS Organizations to manage several AWs accounts. The companyprocesses a large volume of sensitive data. The company uses a serverless approach tomicroservices. The company stores all the data in either Amazon S3 or AmazonDynamoDB. The company reads the data by using either AWS lambda functions orcontainer-based services that the company hosts on Amazon Elastic Kubernetes Service(Amazon EKS) on AWS Fargate.The company must implement a solution to encrypt all the data at rest and enforce leastprivilege data access controls. The company creates an AWS Key Management Service(AWS KMS) customer managed key.What should the company do next to meet these requirements?

A. Create a key policy that allows the kms:Decrypt action only for Amazon S3 andDynamoDB. Create an SCP that denies the creation of S3 buckets and DynamoDB tablesthat are not encrypted with the key.
B. Create an 1AM policy that denies the kms:Decrypt action for the key. Create a Lambdafunction than runs on a schedule to attach the policy to any new roles. Create an AWSConfig rule to send alerts for resources that are not encrypted with the key.
C. Create a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB,Lambda, and Amazon EKS. Create an SCP that denies the creation of S3 buckets andDynamoDB tables that are not encrypted with the key.
D. Create a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB,Lambda, and Amazon EKS. Create an AWS Config rule to send alerts for resources thatare not encrypted with the key.

Show Answer

Question # 60

A security engineer is creating an AWS Lambda function. The Lambda function needs touse a role that is named LambdaAuditRole to assume a role that is namedAcmeAuditFactoryRole in a different AWS account.When the code is processed, the following error message appears: "An error oc-curred(AccessDenied) when calling the AssumeRole operation."Which combination of steps should the security engineer take to resolve this er-ror? (SelectTWO.)

A. Ensure that LambdaAuditRole has the sts:AssumeRole permission for AcmeAuditFactoryRole.
B. Ensure that LambdaAuditRole has the AWSLambdaBasicExecutionRole managedpolicy attached.
C. Ensure that the trust policy for AcmeAuditFactoryRole allows the sts:AssumeRole actionfrom LambdaAuditRole.
D. Ensure that the trust policy for LambdaAuditRole allows the sts:AssumeRole action fromthe lambda.amazonaws.com service.
E. Ensure that the sts:AssumeRole API call is being issued to the us-east-I Regionendpoint.

Show Answer

Question # 61

A company hosts a public website on an Amazon EC2 instance. HTTPS traffic must beable to access the website. The company uses SSH for management of the web server.The website is on the subnet 10.0.1.0/24. The management subnet is 192.168.100.0/24. Asecurity engineer must create a security group for the EC2instance.Which combination of steps should the security engineer take to meet these requirementsin the MOST secure manner? (Select TWO.)

A. Allow port 22 from source 0.0.0.0/0.
B. Allow port 443 from source 0.0.0.0/0.
C. Allow port 22 from 192.168.100.0/24.
D. Allow port 22 from 10.0.1.0/24.
E. Allow port 443 from 10.0.1.0/24.

Show Answer

Question # 62

A security engineer is configuring a mechanism to send an alert when three or more failedsign-in attempts to the AWS Management Console occur during a 5-minute period. Thesecurity engineer creates a trail in AWS CloudTrail to assist in this work.Which solution will meet these requirements?

A. In CloudTrail, turn on Insights events on the trail. Configure an alarm on the insight witheventName matching ConsoleLogin and errorMessage matching “Failed authentication”.Configure a threshold of 3 and a period of 5 minutes.
B. Configure CloudTrail to send events to Amazon CloudWatch Logs. Create a metric filterfor the relevant log group. Create a filter pattern with eventName matching ConsoleLoginand errorMessage matching “Failed authentication”. Create a CloudWatch alarm with athreshold of 3 and a period of 5 minutes.
C. Create an Amazon Athena table from the CloudTrail events. Run a query for eventNamematching ConsoleLogin and for errorMessage matching “Failed authentication”. Create anotification action from the query to send an Amazon Simple Notification Service (AmazonSNS) notification when the count equals 3 within a period of 5 minutes.
D. In AWS Identity and Access Management Access Analyzer, create a new analyzer.Configure the analyzer to send an Amazon Simple Notification Service (Amazon SNS)notification when a failed sign-in event occurs 3 times for any IAM user within a period of 5minutes.

Show Answer

Question # 63

A company is using AWS Organizations to implement a multi-account strategy. Thecompany does not have on-premises infrastructure. All workloads run on AWS. Thecompany currently has eight member accounts. The company anticipates that it will haveno more than 20 AWS accounts total at any time.The company issues a new security policy that contains the following requirements:• No AWS account should use a VPC within the AWS account for workloads.• The company should use a centrally managed VPC that all AWS accounts can access tolaunch workloads in subnets.• No AWS account should be able to modify another AWS account's application resourceswithin the centrally managed VPC.• The centrally managed VPC should reside in an existing AWS account that is namedAccount-A within an organization.The company uses an AWS CloudFormation template to create a VPC that containsmultiple subnets in Account-A. This template exports the subnet IDs through theCloudFormation Outputs section. Which solution will complete the security setup to meet these requirements?

A. Use a CloudFormation template in the member accounts to launch workloads. Configurethe template to use the Fn::lmportValue function to obtain the subnet ID values.
B. Use a transit gateway in the VPC within Account-A. Configure the member accounts touse the transit gateway to access the subnets in Account-A to launch workloads.
C. Use AWS Resource Access Manager (AWS RAM) to share Account-A's VPC subnetswith the remaining member accounts. Configure the member accounts to use the sharedsubnets to launch workloads.
D. Create a peering connection between Account-A and the remaining member accounts.Configure the member accounts to use the subnets in Account-A through the VPC peeringconnection to launch workloads.

Show Answer

Question # 64

A Security Engineer is asked to update an AWS CloudTrail log file prefix for an existingtrail. When attempting to save the change in the CloudTrail console, the Security Engineer receives the following error message: `There is a problem with thebucket policy.`What will enable the Security Engineer to save the change?

A. Create a new trail with the updated log file prefix, and then delete the original trail.Update the existing bucket policy in the Amazon S3 console with the new log file prefix,and then update the log file prefix in the CloudTrail console.
B. Update the existing bucket policy in the Amazon S3 console to allow the SecurityEngineer's Principal to perform PutBucketPolicy, and then update the log file prefix in theCloudTrail console.
C. Update the existing bucket policy in the Amazon S3 console with the new log file prefix,and then update the log file prefix in the CloudTrail console.
D. Update the existing bucket policy in the Amazon S3 console to allow the SecurityEngineer's Principal to perform GetBucketPolicy, and then update the log file prefix in theCloudTrail console.

Show Answer

Question # 65

A company needs complete encryption of the traffic between external users and anapplication. The company hosts the application on a fleet of Amazon EC2 instances thatrun in an Auto Scaling group behind an Application Load Balancer (ALB).How can a security engineer meet these requirements?

A. Create a new Amazon-issued certificate in AWS Secrets Manager. Export the certificatefrom Secrets Manager. Import the certificate into the ALB and the EC2 instances.
B. Create a new Amazon-issued certificate in AWS Certificate Manager (ACM). Associatethe certificate with the ALB. Export the certificate from ACM. Install the certificate on theEC2 instances.
C. Import a new third-party certificate into AWS Identity and Access Management (IAM).Export the certificate from IAM. Associate the certificate with the ALB and the EC2instances.
D. Import a new third-party certificate into AWS Certificate Manager (ACM). Associate thecertificate with the ALB. Install the certificate on the EC2 instances.

Show Answer