Question 1

A company uses AWS Organization to manage 50 AWS accounts. The finance staff members logs in as AWS IAM users in the FinanceDept AWS account. The staff members need to read the consolidates billing information in the MasterPayer AWS account. They should not be able to view any other resources in the MasterPayer AWS account. IAM access to billing has been enabled in the MasterPayer account. Which of the following approaches grants the finance staff the permissions they require without granting any unnecessary permissions?

Accepted Answer

A)  Create an IAM group for the finance users in the FinanceDept account, then attach the AWS managed ReadOnlyAccess IAM policy to the group. 
B)  Create an IAM group for the finance users in the MasterPayer account, then attach the AWS managed ReadOnlyAccess IAM policy to the group. 
C)  Create an AWS IAM role in the FinanceDept account with the ViewBilling permission, then grant the finance users in the MasterPayer account the permission to assume that role. 
D)  Create an AWS IAM role in the MasterPayer account with the ViewBilling permission, then grant the finance users in the FinanceDept account the permission to assume that role.

Question 2

A company hosts an application on Amazon EC2 that is subject to specific rules for regulatory compliance. One rule states that traffic to and from the workload must be inspected for network-level attacks. This involves inspecting the whole packet. To comply with this regulatory rule, a security engineer must install intrusion detection software on a c5n.4xlarge EC2 instance. The engineer must then configure the software to monitor traffic to and from the application instances. What should the security engineer do next?

Accepted Answer

A)  Place the network interface in promiscuous mode to capture the traffic. 
B)  Configure VPC Flow Logs to send traffic to the monitoring EC2 instance using a Network Load Balancer. 
C)  Configure VPC traffic mirroring to send traffic to the monitoring EC2 instance using a Network Load Balancer. 
D)  Use Amazon Inspector to detect network-level attacks and trigger an AWS Lambda function to send the suspicious packets to the EC2 instance.

Question 3

AWS CloudTrail is being used to monitor API calls in an organization. An audit revealed that CloudTrail is failing to deliver events to Amazon S3 as expected. What initial actions should be taken to allow delivery of CloudTrail events to S3? (Choose two.)

Accepted Answer

A)  Verify that the S3 bucket policy allow CloudTrail to write objects. 
B)  Verify that the IAM role used by CloudTrail has access to write to Amazon CloudWatch Logs. 
C)  Remove any lifecycle policies on the S3 bucket that are archiving objects to Amazon Glacier. 
D)  Verify that the S3 bucket defined in CloudTrail exists. 
E)  Verify that the log file prefix defined in CloudTrail exists in the S3 bucket.

Question 4

A company manages three separate AWS accounts for its production, development, and test environments. Each Developer is assigned a unique IAM user under the development account. A new application hosted on an Amazon EC2 instance in the development account requires read access to the archived documents stored in an Amazon S3 bucket in the production account. How should access be granted?

Accepted Answer

A)  Create an IAM role in the production account and allow EC2 instance in the development account to assume that role using the trust policy. Provide read access for the required S3 bucket to this role. 
B)  Use a custom identity broker to allow Developer IAM users to temporarily access the S3 bucket. 
C)  Create a temporary IAM user for the application to use in the production account. 
D)  Create a temporary IAM user in the production account and provide read access to Amazon S3. Generate the temporary IAM user's access key and secret key and store these keys on the EC2 instance used by the application in the development account.

Question 5

A company has multiple production AWS accounts. Each account has AWS CloudTrail configured to log to a single Amazon S3 bucket in a central account. Two of the production accounts have trails that are not logging anything to the S3 bucket. Which steps should be taken to troubleshoot the issue? (Choose three.)

Accepted Answer

A)  Verify that the log file prefix is set to the name of the S3 bucket where the logs should go. 
B)  Verify that the S3 bucket policy allows access for CloudTrail from the production AWS account IDs. 
C)  Create a new CloudTrail configuration in the account, and configure it to log to the account's S3 bucket. 
D)  Confirm in the CloudTrail Console that each trail is active and healthy. 
E)  Open the global CloudTrail configuration in the master account, and verify that the storage location is set to the correct S3 bucket.
F) Confirm in the CloudTrail Console that the S3 bucket name is set correctly.

Question 6

A company needs to retain log data archives for several years to be compliant with regulations. The log data is no longer used, but it must be retained. What is the MOST secure and cost-effective solution to meet these requirements?

Accepted Answer

A)  Archive the data to Amazon S3 and apply a restrictive bucket policy to deny the s3:DeleteObject API. 
B)  Archive the data to Amazon S3 Glacier and apply a Vault Lock policy. 
C)  Archive the data to Amazon S3 and replicated it to a second bucket in a second AWS Region. Choose the S3 Standard-Infrequent Access (S3 Standard-I
A)  storage class and apply a restrictive bucket policy to deny the s3:DeleteObject API. 
D)  Migrate the log data to a 16 TB Amazon Elastic Block Store (Amazon EBS) volume. Create a snapshot of the EBS volume.

Question 7

A company had one of its Amazon EC2 key pairs compromised. A Security Engineer must identify which current Linux EC2 instances were deployed and used the compromised key pair. How can this task be accomplished?

Accepted Answer

A)  Obtain the list of instances by directly querying Amazon EC2 using: aws ec2 describe-instances --filters "Name=key-name,Values=KEYNAMEHERE" . Obtain the list of instances by directly querying Amazon EC2 using: aws ec2 describe-instances --filters "Name=key-name,Values=KEYNAMEHERE" . 
B)  Obtain the fingerprint for the key pair from the AWS Management Console, then search for the fingerprint in the Amazon Inspector logs. 
C)  Obtain the output from the EC2 instance metadata using: curl http: //169.254.169.254/latest/meta-data/public- keys/0/. 
D)  Obtain the fingerprint for the key pair from the AWS Management Console, then search for the fingerprint in Amazon CloudWatch Logs using: aws logs filter-log-events . Obtain the fingerprint for the key pair from the AWS Management Console, then search for the fingerprint in Amazon CloudWatch Logs using: aws logs filter-log-events

Question 8

A company uses HTTP Live Streaming (HLS) to stream live video content to paying subscribers by using Amazon CloudFront. HLS splits the video content into chunks so that the user can request the right chunk based on different conditions. Because the video events last for several hours, the total video is made up of thousands of chunks. The origin URL is not disclosed, and every user is forced to access the CloudFront URL. The company has a web application that authenticates the paying users against an internal repository and a CloudFront key pair that is already issued. What is the simplest and MOST effective way to protect the content?

Accepted Answer

A)  Develop the application to use the CloudFront key pair to create signed URLs that users will use to access the content. 
B)  Develop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content. 
C)  Develop the application to issue a security token that Lambda@Edge will receive to authenticate and authorize access to the content. 
D)  Keep the CloudFront URL encrypted inside the application, and use AWS KMS to resolve the URL on-the-fly after the user is authenticated.

Question 9

A company is implementing a new application in a new AWS account. A VPC and subnets have been created for the application. The application has been peered to an existing VPC in another account in the same AWS Region for database access. Amazon EC2 instances will regularly be created and terminated in the application VPC, but only some of them will need access to the databases in the peered VPC over TCP port 1521. A security engineer must ensure that only the EC2 instances than need access to the databases can access them through the network. How can the security engineer implement this solution?

Accepted Answer

A)  Create a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access. 
B)  Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access. 
C)  Create a new security group in the application VPC with no inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the application VPC. Attach the application security group to the application instances that need database access, and attach the database security group to the database instances. 
D)  Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Add a new network ACL rule on the database subnets. Configure the rule to allow all traffic from the IP address range of the application VPC. Attach the new security group to the application instances that need database access.

Question 10

A company's data lake uses Amazon S3 and Amazon Athena. The company's security engineer has been asked to design an encryption solution that meets the company's data protection requirements. The encryption solution must work with Amazon S3 and keys managed by the company. The encryption solution must be protected in a hardware security module that is validated to Federal information Processing Standards (FIPS) 140-2 Level 3. Which solution meets these requirements?

Accepted Answer

A)  Use client-side encryption with an AWS KMS customer-managed key implemented with the AWS Encryption SDK. 
B)  Use AWS CloudHSM to store the keys and perform cryptographic operations. Save the encrypted text in Amazon S3. 
C)  Use an AWS KMS customer-managed key that is backed by a custom key store using AWS CloudHSM. 
D)  Use an AWS KMS customer-managed key with the bring your own key (BYOK) feature to import a key stored in AWS CloudHSM.

Question 11

A company has five AWS accounts and wants to use AWS CloudTrail to log API calls. The log files must be stored in an Amazon S3 bucket that resides in a new account specifically built for centralized services with a unique top-level prefix for each trail. The configuration must also enable detection of any modification to the logs. Which of the following steps will implement these requirements? (Choose three.)

Accepted Answer

A)  Create a new S3 bucket in a separate AWS account for centralized storage of CloudTrail logs, and enable "Log File Validation" on all trails. 
B)  Use an existing S3 bucket in one of the accounts, apply a bucket policy to the new centralized S3 bucket that permits the CloudTrail service to use the "s3: PutObject" action and the "s3 GetBucketACL" action, and specify the appropriate resource ARNs for the CloudTrail trails. 
C)  Apply a bucket policy to the new centralized S3 bucket that permits the CloudTrail service to use the "s3 PutObject" action and the "s3 GelBucketACL" action, and specify the appropriate resource ARNs for the CloudTrail trails. 
D)  Use unique log file prefixes for trails in each AWS account. 
E)  Configure CloudTrail in the centralized account to log all accounts to the new centralized S3 bucket.
F) Enable encryption of the log files by using AWS Key Management Service

Question 12

A company recently experienced a DDoS attack that prevented its web server from serving content. The website is static and hosts only HTML, CSS, and PDF files that users download. Based on the architecture shown in the image, what is the BEST way to protect the site against future attacks while minimizing the ongoing operational overhead?

Accepted Answer

A)  Move all the files to an Amazon S3 bucket. Have the web server serve the files from the S3 bucket. 
B)  Launch a second Amazon EC2 instance in a new subnet. Launch an Application Load Balancer in front of both instances. 
C)  Launch an Application Load Balancer in front of the EC2 instance. Create an Amazon CloudFront distribution in front of the Application Load Balancer. 
D)  Move all the files to an Amazon S3 bucket. Create a CloudFront distribution in front of the bucket and terminate the web server.

Question 13

A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS. Which steps should be taken to authenticate to AWS services using the company's on-premises Active Directory? (Choose three).

Accepted Answer

A)  Create IAM roles with permissions corresponding to each Active Directory group. 
B)  Create IAM groups with permissions corresponding to each Active Directory group. 
C)  Create a SAML provider with IAM. 
D)  Create a SAML provider with Amazon Cloud Directory. 
E)  Configure AWS as a trusted relying party for the Active Directory
F) Configure IAM as a trusted relying party for Amazon Cloud Directory.

Question 14

A company uses an AWS Key Management Service (AWS KMS) CMK to encrypt application data before it is stored. The company's security policy was recently modified to require encryption key rotation annually. A security engineer must ensure that annual global key rotation is enabled for the key without making changes to the application. What should the security engineer do to accomplish this requirement?

Accepted Answer

A)  Create new AWS managed keys. Configure the key schedule for the annual rotation. Create an alias to point to the new keys. 
B)  Enable automatic annual key rotation for the existing customer managed CMKs. Update the application encryption library to use a new key ID for all encryption operations. Fall back to the old key ID to decrypt data that was encrypted with previous versions of the key. 
C)  Create new AWS managed CMKs. Configure the key schedule for annual rotation. Create an alias to point to the new CMKs. 
D)  Enable automatic annual key rotation for the existing customer managed CMKs. Update the application encryption library to use a new key ID for all encryption operations. Create a key grant for the old CMKs and update the code to point to the ARN of the grants.

Question 15

A company plans to use custom AMIs to launch Amazon EC2 instances across multiple AWS accounts in a single Region to perform security monitoring and analytics tasks. The EC2 instances are launched in EC2 Auto Scaling groups. To increase the security of the solution, a Security Engineer will manage the lifecycle of the custom AMIs in a centralized account and will encrypt them with a centrally managed AWS KMS CMK. The Security Engineer configured the KMS key policy to allow cross-account access. However, the EC2 instances are still not being properly launched by the EC2 Auto Scaling groups. Which combination of configuration steps should the Security Engineer take to ensure the EC2 Auto Scaling groups have been granted the proper permissions to execute tasks?

Accepted Answer

A)  Create a customer-managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Create an IAM role in all applicable accounts and configure its access policy to allow the use of the centrally managed CMK for cryptographical operations. Configure EC2 Auto Scaling groups within each applicable account to use the created IAM role to launch EC2 instances. 
B)  Create a customer-managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Create an IAM role in all applicable accounts and configure its access policy with permissions to create grants for the centrally managed CMK. Use this IAM role to create a grant for the centrally managed CMK with permissions to perform cryptographical operations and with the EC2 Auto Scaling service-linked role defined as the grantee principal. 
C)  Create a customer-managed CMK or an AWS managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Use the CMK administrator to create a CMK grant that includes permissions to perform cryptographical operations that define EC2 Auto Scaling service-linked roles from all other accounts as the grantee principal. 
D)  Create a customer-managed CMK or an AWS managed CMK in the centralized account. Allow other applicable accounts to use that key for cryptographical operations by applying proper cross-account permissions in the key policy. Modify the access policy for the EC2 Auto Scaling roles to perform cryptographical operations against the centrally managed CMK.

Question 16

Which of the following are valid configurations for using SSL certificates with Amazon CloudFront? (Choose three.)

Accepted Answer

A)  Default AWS Certificate Manager certificate 
B)  Custom SSL certificate stored in AWS KMS 
C)  Default CloudFront certificate 
D)  Custom SSL certificate stored in AWS Certificate Manager 
E)  Default SSL certificate stored in AWS Secrets Manager
F) Custom SSL certificate stored in AWS IAM

Question 17

A company is setting up products to deploy in AWS Service Catalog. Management is concerned that when users launch products, elevated IAM privileges will be required to create resources. How should the company mitigate this concern?

Accepted Answer

A)  Add a template constraint to each product in the portfolio. 
B)  Add a launch constraint to each product in the portfolio. 
C)  Define resource update constraints for each product in the portfolio. 
D)  Update the AWS CloudFormation template backing the product to include a service role configuration.

Question 18

A Security Engineer is building a Java application that is running on Amazon EC2. The application communicates with an Amazon RDS instance and authenticates with a user name and password. Which combination of steps can the Engineer take to protect the credentials and minimize downtime when the credentials are rotated? (Choose two.)

Accepted Answer

A)  Have a Database Administrator encrypt the credentials and store the ciphertext in Amazon S3. Grant permission to the instance role associated with the EC2 instance to read the object and decrypt the ciphertext. 
B)  Configure a scheduled job that updates the credential in AWS Systems Manager Parameter Store and notifies the Engineer that the application needs to be restarted. 
C)  Configure automatic rotation of credentials in AWS Secrets Manager. 
D)  Store the credential in an encrypted string parameter in AWS Systems Manager Parameter Store. Grant permission to the instance role associated with the EC2 instance to access the parameter and the AWS KMS key that is used to encrypt it. 
E)  Configure the Java application to catch a connection failure and make a call to AWS Secrets Manager to retrieve updated credentials when the password is rotated. Grant permission to the instance role associated with the EC2 instance to access Secrets Manager.

Question 19

An application uses Amazon Cognito to manage end users' permissions when directly accessing AWS resources, including Amazon DynamoDB. A new feature request reads as follows: Provide a mechanism to mark customers as suspended pending investigation or suspended permanently. Customers should still be able to log in when suspended, but should not be able to make changes. The priorities are to reduce complexity and avoid potential for future security issues. Which approach will meet these requirements and priorities?

Accepted Answer

A)  Create a new database field "suspended_status" and modify the application logic to validate that field when processing requests. 
B)  Add suspended customers to second Cognito user pool and update the application login flow to check both user pools. 
C)  Use Amazon Cognito Sync to push out a "suspension_status" parameter and split the IAM policy into normal users and suspended users. 
D)  Move suspended customers to a second Cognito group and define an appropriate IAM access policy for the group.

Question 20

A security engineer needs to ensure their company's use of AWS meets AWS security best practices. As part of this, the AWS account root user must not be used for daily work. The root user must be monitored for use, and the security team must be alerted as quickly as possible if the root user is used. Which solution meets these requirements?

Accepted Answer

A)  Set up an Amazon CloudWatch Events rule that triggers an Amazon SNS notification. 
B)  Create root user access keys. Use an AWS Lambda function to parse AWS CloudTrail logs from Amazon S3 and generate notifications using Amazon SNS. 
C)  Set up a rule in AWS Config to trigger root user events. Trigger an AWS Lambda function and generate notifications using Amazon SNS. 
D)  Use Amazon Inspector to monitor the usage of the root user and generate notifications using Amazon SNS.

Exam 8: AWS Certified Security - Specialty (SCS-C01)

AWS CloudTrail is being used to monitor API calls in an organization. An audit revealed that CloudTrail is failing to deliver events to Amazon S3 as expected. What initial actions should be taken to allow delivery of CloudTrail events to S3? (Choose two.)

A company needs to retain log data archives for several years to be compliant with regulations. The log data is no longer used, but it must be retained. What is the MOST secure and cost-effective solution to meet these requirements?

A company had one of its Amazon EC2 key pairs compromised. A Security Engineer must identify which current Linux EC2 instances were deployed and used the compromised key pair. How can this task be accomplished?

A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS. Which steps should be taken to authenticate to AWS services using the company's on-premises Active Directory? (Choose three) .

Which of the following are valid configurations for using SSL certificates with Amazon CloudFront? (Choose three.)

A company is setting up products to deploy in AWS Service Catalog. Management is concerned that when users launch products, elevated IAM privileges will be required to create resources. How should the company mitigate this concern?