Question 1

A company recently experienced a DDoS attack that prevented its web server from serving content. The website is static and hosts only HTML, CSS, and PDF files that users download. Based on the architecture shown in the image, what is the BEST way to protect the site against future attacks while minimizing the ongoing operational overhead?

Accepted Answer

A)  Move all the files to an Amazon S3 bucket. Have the web server serve the files from the S3 bucket. 
B)  Launch a second Amazon EC2 instance in a new subnet. Launch an Application Load Balancer in front of both instances. 
C)  Launch an Application Load Balancer in front of the EC2 instance. Create an Amazon CloudFront distribution in front of the Application Load Balancer. 
D)  Move all the files to an S3 bucket. Create a CloudFront distribution in front of the bucket and terminate the web server.

Question 2

A Security Architect is evaluating managed solutions for storage of encryption keys. The requirements are: -Storage is accessible by using only VPCs. -Service has tamper-evident controls. -Access logging is enabled. -Storage has high availability. Which of the following services meets these requirements?

Accepted Answer

A)  Amazon S3 with default encryption 
B)  AWS CloudHSM 
C)  Amazon DynamoDB with server-side encryption 
D)  AWS Systems Manager Parameter Store

Question 3

An organization has a system in AWS that allows a large number of remote workers to submit data files. File sizes vary from a few kilobytes to several megabytes. A recent audit highlighted a concern that data files are not encrypted while in transit over untrusted networks. Which solution would remediate the audit finding while minimizing the effort required?

Accepted Answer

A)  Upload an SSL certificate to IAM, and configure Amazon CloudFront with the passphrase for the private key. 
B)  Call KMS.Encrypt() in the client, passing in the data file contents, and call KMS.Decrypt() server-side. Call KMS.Encrypt() in the client, passing in the data file contents, and call KMS.Decrypt() server-side. 
C)  Use AWS Certificate Manager to provision a certificate on an Elastic Load Balancing in front of the web service's servers. 
D)  Create a new VPC with an Amazon VPC VPN endpoint, and update the web service's DNS record.

Question 4

A company's Security Engineer is copying all application logs to centralized Amazon S3 buckets. Currently, each of the company's application is in its own AWS account, and logs are pushed into S3 buckets associated with each account. The Engineer will deploy an AWS Lambda function into each account that copies the relevant log files to the centralized S3 bucket. The Security Engineer is unable to access the log files in the centralized S3 bucket. The Engineer's IAM user policy from the centralized account looks like this:  The centralized S3 bucket policy looks like this:  Why is the Security Engineer unable to access the log files?

Accepted Answer

A)  The S3 bucket policy does not explicitly allow the Security Engineer access to the objects in the bucket. 
B)  The object ACLs are not being updated to allow the users within the centralized account to access the objects. 
C)  The Security Engineer's IAM policy does not grant permissions to read objects in the S3 bucket. 
D)  The s3:PutObject and s3:PutObjectAcl permissions should be applied at the S3 bucket level.

Question 5

Users report intermittent availability of a web application hosted on AWS. Monitoring systems report an excess of abnormal network traffic followed by high CPU utilization on the application web tier. Which of the following techniques will improve the availability of the application? (Choose two.)

Accepted Answer

A)  Deploy AWS WAF to block all unsecured web applications from accessing the internet. 
B)  Deploy an Intrusion Detection/Prevention Systems (IDS/IPS) to monitor or block unusual incoming network traffic. 
C)  Configure security groups to allow outgoing network traffic only from hosts that are protected with up-to-date antivirus software. 
D)  Create Amazon CloudFront distribution and configure AWS WAF rules to protect the web applications from malicious traffic. 
E)  Use the default Amazon VPC for external-facing systems to allow AWS to actively block malicious network traffic affecting Amazon EC2 instances.

Question 6

Which approach will generate automated security alerts should too many unauthorized AWS API requests be identified?

Accepted Answer

A)  Create an Amazon CloudWatch metric filter that looks for API call error codes and then implement an alarm based on that metric's rate. 
B)  Configure AWS CloudTrail to stream event data to Amazon Kinesis. Configure an AWS Lambda function on the stream to alarm when the threshold has been exceeded. 
C)  Run an Amazon Athena SQL query against CloudTrail log files. Use Amazon QuickSight to create an operational dashboard. 
D)  Use the Amazon Personal Health Dashboard to monitor the account's use of AWS services, and raise an alert if service error rates increase.

Question 7

A company has a VPC with an IPv6 address range and a public subnet with an IPv6 address block. The VPC currently hosts some public Amazon EC2 instances, but a security engineer needs to migrate a second application into the VPC that also requires IPv6 connectivity. This new application will occasionally make API requests to an external, internet-accessible endpoint to receive updates. However, the security team does not want the application's EC2 instance exposed directly to the internet. The security engineer intends to create a private subnet with a custom route table and to associate the route table with the private subnet. What else does the security engineer need to do to ensure the application will not be exposed directly to the internet, but can still communicate as required?

Accepted Answer

A)  Launch a NAT instance in the public subnet. Update the custom route table with a new route to the NAT instance. 
B)  Remove the internet gateway, and add AWS PrivateLink to the VPC. Then update the custom route table with a new route to AWS PrivateLink. 
C)  Add a managed NAT gateway to the VPC. Update the custom route table with a new route to the gateway. 
D)  Add an egress-only internet gateway to the VPC. Update the custom route table with a new route to the gateway.

Question 8

A company maintains sensitive data in an Amazon S3 bucket that must be protected using an AWS KMS CMK. The company requires that keys be rotated automatically every year. How should the bucket be configured?

Accepted Answer

A)  Select server-side encryption with Amazon S3-managed keys (SSE-S3) and select an AWS-managed CMK. 
B)  Select Amazon S3-AWS KMS managed encryption keys (S3-KMS) and select a customer-managed CMK with key rotation enabled. 
C)  Select server-side encryption with Amazon S3-managed keys (SSE-S3) and select a customer-managed CMK that has imported key material. 
D)  Select server-side encryption with AWS KMS-managed keys (SSE-KMS) and select an alias to an AWS-managed CMK.

Question 9

While securing the connection between a company's VPC and its on-premises data center, a Security Engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). The ping command did not return a response. The flow log in the VPC showed the following: 2 123456789010 eni-1235b8ca 203.0.113.12 172.31.16.139 0 0 1 4 336 1432917027 1432917142 ACCEPT OK 2 123456789010 eni-1235b8ca 172.31.16.139 203.0.113.12 0 0 1 4 336 1432917094 1432917142 REJECT OK What action should be performed to allow the ping to work?

Accepted Answer

A)  In the security group of the EC2 instance, allow inbound ICMP traffic. 
B)  In the security group of the EC2 instance, allow outbound ICMP traffic. 
C)  In the VPC's NACL, allow inbound ICMP traffic. 
D)  In the VPC's NACL, allow outbound ICMP traffic.

Question 10

A Security Engineer is working with the development team to design a supply chain application that stores sensitive inventory data in an Amazon S3 bucket. The application will use an AWS KMS customer master key (CMK) to encrypt the data on Amazon S3. The inventory data on Amazon S3 will be shared of vendors. All vendors will use AWS principals from their own AWS accounts to access the data on Amazon S3. The vendor list may change weekly, and the solution must support cross-account access. What is the MOST efficient way to manage access control for the KMS CMK7?

Accepted Answer

A)  Use KMS grants to manage key access. Programmatically create and revoke grants to manage vendor access. 
B)  Use an IAM role to manage key access. Programmatically update the IAM role policies to manage vendor access. 
C)  Use KMS key policies to manage key access. Programmatically update the KMS key policies to manage vendor access. 
D)  Use delegated access across AWS accounts by using IAM roles to manage key access. Programmatically update the IAM trust policy to manage cross-account vendor access.

Question 11

An Amazon EC2 instance is denied access to a newly created AWS KMS CMK used for decrypt actions. The environment has the following configuration: The instance is allowed the kms:Decrypt action in its IAM role for all resources The AWS KMS CMK status is set to enabled The instance can communicate with the KMS API using a configured VPC endpoint What is causing the issue?

Accepted Answer

A)  The kms:GenerateDataKey permission is missing from the EC2 instance's IAM role 
B)  The ARN tag on the CMK contains the EC2 instance's ID instead of the instance's ARN 
C)  The kms:Encrypt permission is missing from the EC2 IAM role 
D)  The KMS CMK key policy that enables IAM user permissions is missing

Question 12

A Security Engineer must add additional protection to a legacy web application by adding the following HTTP security headers: -Content Security-Policy -X-Frame-Options -X-XSS-Protection The Engineer does not have access to the source code of the legacy web application. Which of the following approaches would meet this requirement?

Accepted Answer

A)  Configure an Amazon Route 53 routing policy to send all web traffic that does not include the required headers to a black hole. 
B)  Implement an AWS Lambda@Edge origin response function that inserts the required headers. 
C)  Migrate the legacy application to an Amazon S3 static website and front it with an Amazon CloudFront distribution. 
D)  Construct an AWS WAF rule to replace existing HTTP headers with the required security headers by using regular expressions.

Question 13

A company has two AWS accounts: Account A and Account B. Account A has an IAM role that IAM users in Account B assume when they need to upload sensitive documents to Amazon S3 buckets in Account A. A new requirement mandates that users can assume the role only if they are authenticated with multi-factor authentication (MFA). A security engineer must recommend a solution that meets this requirement with minimum risk and effort. Which solution should the security engineer recommend?

Accepted Answer

A)  Add an aws:MultiFactorAuthPresent condition to the role's permissions policy. 
B)  Add an aws:MultiFactorAuthPresent condition to the role's trust policy. 
C)  Add an aws:MultiFactorAuthPresent condition to the session policy. 
D)  Add an aws:MultiFactorAuthPresent condition to the S3 bucket policies.

Question 14

A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The Auditor is having trouble accessing some of the accounts. Which of the following may be causing this problem? (Choose three.)

Accepted Answer

A)  The external ID used by the Auditor is missing or incorrect. 
B)  The Auditor is using the incorrect password. 
C)  The Auditor has not been granted sts:AssumeRole for the role in the destination account. The Auditor has not been granted sts:AssumeRole for the role in the destination account. 
D)  The Amazon EC2 role used by the Auditor must be set to the destination account role. 
E)  The secret key used by the Auditor is missing or incorrect.
F) The role ARN used by the Auditor is missing or incorrect.

Question 15

A Security Engineer is troubleshooting a connectivity issue between a web server that is writing log files to the logging server in another VPC. The Engineer has confirmed that a peering relationship exists between the two VPCs. VPC flow logs show that requests sent from the web server are accepted by the logging server, but the web server never receives a reply. Which of the following actions could fix this issue?

Accepted Answer

A)  Add an inbound rule to the security group associated with the logging server that allows requests from the web server. 
B)  Add an outbound rule to the security group associated with the web server that allows requests to the logging server. 
C)  Add a route to the route table associated with the subnet that hosts the logging server that targets the peering connection. 
D)  Add a route to the route table associated with the subnet that hosts the web server that targets the peering connection.

Question 16

A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running in Amazon Elastic Container Service (Amazon ECS). This solution will also handle volatile traffic patterns. Which solution would have the MOST scalability and LOWEST latency?

Accepted Answer

A)  Configure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers. 
B)  Configure an Application Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers. 
C)  Configure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers. 
D)  Configure Amazon Route to use multivalue answer routing to send traffic to the containers.

Question 17

A company's Security Engineer has been tasked with restricting a contractor's IAM account access to the company's Amazon EC2 console without providing access to any other AWS services. The contractor's IAM account must not be able to gain access to any other AWS service, even if the IAM account is assigned additional permissions based on IAM group membership. What should the Security Engineer do to meet these requirements?

Accepted Answer

A)  Create an Inline IAM user policy that allows for Amazon EC2 access for the contractor's IAM user. 
B)  Create an IAM permissions boundary policy that allows Amazon EC2 access. Associate the contractor's IAM account with the IAM permissions boundary policy. 
C)  Create an IAM group with an attached policy that allows for Amazon EC2 access. Associate the contractor's IAM account with the IAM group. 
D)  Create an IAM role that allows for EC2 and explicitly denies all other services. Instruct the contractor to always assume this role.

Question 18

A company has two software development teams that are creating applications that store sensitive data in Amazon S3. Each team's data must always be separate. The company's security team must design a data encryption strategy for both teams that provides the ability to audit key usage. The solution must also minimize operational overhead. What should the security team recommend?

Accepted Answer

A)  Tell the application teams to use two different S3 buckets with separate AWS Key Management Service (AWS KMS) AWS managed CMKs. Limit the key policies to allow encryption and decryption of the CMKs to their respective teams only. Force the teams to use encryption context to encrypt and decrypt. 
B)  Tell the application teams to use two different S3 buckets with a single AWS Key Management Service (AWS KMS) AWS managed CMK. Limit the key policy to allow encryption and decryption of the CMK only. Do not allow the teams to use encryption context to encrypt and decrypt. 
C)  Tell the application teams to use two different S3 buckets with separate AWS Key Management Service (AWS KMS) customer managed CMKs. Limit the key policies to allow encryption and decryption of the CMKs to their respective teams only. Force the teams to use encryption context to encrypt and decrypt. 
D)  Tell the application teams to use two different S3 buckets with a single AWS Key Management Service (AWS KMS) customer managed CMK. Limit the key policy to allow encryption and decryption of the CMK only. Do not allow the teams to use encryption context to encrypt and decrypt.

Question 19

For compliance reasons, an organization limits the use of resources to three specific AWS regions. It wants to be alerted when any resources are launched in unapproved regions. Which of the following approaches will provide alerts on any resources launched in an unapproved region?

Accepted Answer

A)  Develop an alerting mechanism based on processing AWS CloudTrail logs. 
B)  Monitor Amazon S3 Event Notifications for objects stored in buckets in unapproved regions. 
C)  Analyze Amazon CloudWatch Logs for activities in unapproved regions. 
D)  Use AWS Trusted Advisor to alert on all resources being created.

Question 20

A Developer who is following AWS best practices for secure code development requires an application to encrypt sensitive data to be stored at rest, locally in the application, using AWS KMS. What is the simplest and MOST secure way to decrypt this data when required?

Accepted Answer

A)  Request KMS to provide the stored unencrypted data key and then use the retrieved data key to decrypt the data. 
B)  Keep the plaintext data key stored in Amazon DynamoDB protected with IAM policies. Query DynamoDB to retrieve the data key to decrypt the data 
C)  Use the Encrypt API to store an encrypted version of the data key with another customer managed key. Decrypt the data key and use it to decrypt the data when required. 
D)  Store the encrypted data key alongside the encrypted data. Use the Decrypt API to retrieve the data key to decrypt the data when required.

Exam 8: AWS Certified Security - Specialty (SCS-C01)

Users report intermittent availability of a web application hosted on AWS. Monitoring systems report an excess of abnormal network traffic followed by high CPU utilization on the application web tier. Which of the following techniques will improve the availability of the application? (Choose two.)

Which approach will generate automated security alerts should too many unauthorized AWS API requests be identified?

A company maintains sensitive data in an Amazon S3 bucket that must be protected using an AWS KMS CMK. The company requires that keys be rotated automatically every year. How should the bucket be configured?

For compliance reasons, an organization limits the use of resources to three specific AWS regions. It wants to be alerted when any resources are launched in unapproved regions. Which of the following approaches will provide alerts on any resources launched in an unapproved region?

A Developer who is following AWS best practices for secure code development requires an application to encrypt sensitive data to be stored at rest, locally in the application, using AWS KMS. What is the simplest and MOST secure way to decrypt this data when required?