Question 1

A company has deployed a custom DNS server in AWS. The Security Engineer wants to ensure that Amazon EC2 instances cannot use the Amazon-provided DNS. How can the Security Engineer block access to the Amazon-provided DNS in the VPC?

Accepted Answer

A)  Deny access to the Amazon DNS IP within all security groups. 
B)  Add a rule to all network access control lists that deny access to the Amazon DNS IP. 
C)  Add a route to all route tables that black holes traffic to the Amazon DNS IP. 
D)  Disable DNS resolution within the VPC configuration.

Question 2

A Security Engineer has been asked to troubleshoot inbound connectivity to a web server. This single web server is not receiving inbound connections from the internet, whereas all other web servers are functioning properly. The architecture includes network ACLs, security groups, and a virtual security appliance. In addition, the Development team has implemented Application Load Balancers (ALBs) to distribute the load across all web servers. It is a requirement that traffic between the web servers and the internet flow through the virtual security appliance. The Security Engineer has verified the following: 1. The rule set in the Security Groups is correct 2. The rule set in the network ACLs is correct 3. The rule set in the virtual appliance is correct Which of the following are other valid items to troubleshoot in this scenario? (Choose two.)

Accepted Answer

A)  Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to a NAT gateway. 
B)  Verify which Security Group is applied to the particular web server's elastic network interface (ENI). 
C)  Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to the virtual security appliance. 
D)  Verify the registered targets in the ALB. 
E)  Verify that the 0.0.0.0/0 route in the public subnet points to a NAT gateway.

Question 3

A company's on-premises networks are connected to VPCs using an AWS Direct Connect gateway. The company's on-premises application needs to stream data using an existing Amazon Kinesis Data Firehose delivery stream. The company's security policy requires that data be encrypted in transit using a private network. How should the company meet these requirements?

Accepted Answer

A)  Create a VPC endpoint for Kinesis Data Firehose. Configure the application to connect to the VPC endpoint. 
B)  Configure an IAM policy to restrict access to Kinesis Data Firehose using a source IP condition. Configure the application to connect to the existing Firehose delivery stream. 
C)  Create a new TLS certificate in AWS Certificate Manager (ACM). Create a public-facing Network Load Balancer (NL
B)  and select the newly created TLS certificate. Configure the NLB to forward all traffic to Kinesis Data Firehose. Configure the application to connect to the NLB. 
D)  Peer the on-premises network with the Kinesis Data Firehose VPC using Direct Connect. Configure the application to connect to the existing Firehose delivery stream.

Question 4

A company uses an Amazon S3 bucket to store reports. Management has mandated that all new objects stored in this bucket must be encrypted at rest using server-side encryption with a client specified AWS Key Management Service (AWS KMS) CMK owned by the same account as the S3 bucket. The AWS account number is 111122223333, and the bucket name is reportbucket. The company's security specialist must write the S3 bucket policy to ensure the mandate can be implemented. Which statement should the security specialist include in the policy?

Accepted Answer

A)   
B)   
C)   
D)

Question 5

A company is using AWS Organizations to manage multiple AWS accounts. The company has an application that allows users to assume the AppUser IAM role to download files from an Amazon S3 bucket that is encrypted with an AWS KMS CMK. However, when users try to access the files in the S3 bucket, they get an access denied error. What should a security engineer do to troubleshoot this error? (Choose three.)

Accepted Answer

A)  Ensure the KMS policy allows the AppUser role to have permission to decrypt for the CMK. 
B)  Ensure the S3 bucket policy allows the AppUser role to have permission to get objects for the S3 bucket. 
C)  Ensure the CMK was created before the S3 bucket. 
D)  Ensure the S3 block public access feature is enabled for the S3 bucket. 
E)  Ensure that automatic key rotation is disabled for the CMK.
F) Ensure the SCPs within Organizations allow access to the S3 bucket.

Question 6

An application is running on an Amazon EC2 instance that has an IAM role attached. The IAM role provides access to an AWS Key Management Service (AWS KMS) customer managed key and an Amazon S3 bucket. A security engineer discovers a potential vulnerability on the EC2 instance that could result in the compromise of the sensitive data. Due to other critical operations, the security engineer cannot immediately shut down the EC2 instance for vulnerability patching. What is the FASTEST way to prevent the sensitive data from being exposed?

Accepted Answer

A)  Download the data from the existing S3 bucket to a new EC2 instance. Then delete the data from the S3 bucket. Re-encrypt the data with a client-based key. Upload the data to a new S3 bucket. 
B)  Block access to the public range of S3 endpoint IP addresses by using a host-based firewall. Ensure that internet-bound traffic from the affected EC2 instance is routed through the host-based firewall. 
C)  Revoke the IAM role's active session permissions. Update the S3 bucket policy to deny access to the IAM role. Remove the IAM role from the EC2 instance profile. 
D)  Disable the current key. Create a new KMS key that the IAM role does not have access to, and re-encrypt all the data with the new key. Schedule the compromised key for deletion.

Question 7

A Security Administrator is restricting the capabilities of company root user accounts. The company uses AWS Organizations and has enabled it for all feature sets, including consolidated billing. The top-level account is used for billing and administrative purposes, not for operational AWS resource purposes. How can the Administrator restrict usage of member root user accounts across the organization?

Accepted Answer

A)  Disable the use of the root user account at the organizational root. Enable multi-factor authentication of the root user account for each organizational member account. 
B)  Configure IAM user policies to restrict root account capabilities for each Organizations member account. 
C)  Create an organizational unit (OU) in Organizations with a service control policy that controls usage of the root user. Add all operational accounts to the new OU. 
D)  Configure AWS CloudTrail to integrate with Amazon CloudWatch Logs and then create a metric filter for RootAccountUsage . Configure AWS CloudTrail to integrate with Amazon CloudWatch Logs and then create a metric filter for RootAccountUsage .

Question 8

A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company's primary website. The GuardDuty finding received read: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor. What is the first step the security engineer should take?

Accepted Answer

A)  Open the EC2 console and remove any security groups that allow inbound traffic from 0.0.0.0/0. 
B)  Install the AWS Systems Manager Agent on the EC2 instance and run an inventory report. 
C)  Install the Amazon Inspector agent on the host and run an assessment with the CVE rules package. 
D)  Open the IAM console and revoke all IAM sessions that are associated with the instance profile.

Question 9

A company uses identity federation to authenticate users into an identity account (987654321987) where the users assume an IAM role named IdentityRole. The users then assume an IAM role named JobFunctionRole in the target AWS account (123456789123) to perform their job functions. A user is unable to assume the IAM role in the target account. The policy attached to the role in the identity account is:  What should be done to enable the user to assume the appropriate role in the target account?

Accepted Answer

A)  Update the IAM policy attached to the role in the identity account to be:  
B)  Update the trust policy on the role in the target account to be:  
C)  Update the trust policy on the role in the identity account to be:  
D)  Update the IAM policy attached to the role in the target account to be:

Question 10

A Security Engineer manages AWS Organizations for a company. The Engineer would like to restrict AWS usage to allow Amazon S3 only in one of the organizational units (OUs). The Engineer adds the following SCP to the OU:  The next day, API calls to AWS IAM appear in AWS CloudTrail logs in an account under that OU. How should the Security Engineer resolve this issue?

Accepted Answer

A)  Move the account to a new OU and deny IAM:* permissions. 
B)  Add a Deny policy for all non-S3 services at the account level. 
C)  Change the policy to:  
D)  Detach the default FullAWSAccess SCP.

Question 11

The Development team receives an error message each time the team members attempt to encrypt or decrypt a Secure String parameter from the SSM Parameter Store by using an AWS KMS customer managed key (CMK). Which CMK-related issues could be responsible? (Choose two.)

Accepted Answer

A)  The CMK specified in the application does not exist. 
B)  The CMK specified in the application is currently in use. 
C)  The CMK specified in the application is using the CMK KeyID instead of CMK Amazon Resource Name. 
D)  The CMK specified in the application is not enabled. 
E)  The CMK specified in the application is using an alias.

Question 12

A company has a VPC with several Amazon EC2 instances behind a NAT gateway. The company's security policy states that all network traffic must be logged and must include the original source and destination IP addresses. The existing VPC Flow Logs do not include this information. A security engineer needs to recommend a solution. Which combination of steps should the security engineer recommend? (Choose two.)

Accepted Answer

A)  Edit the existing VPC Flow Logs. Change the log format of the VPC Flow Logs from the Amazon default format to a custom format. 
B)  Delete and recreate the existing VPC Flow Logs. Change the log format of the VPC Flow Logs from the Amazon default format to a custom format. 
C)  Change the destination to Amazon CloudWatch Logs. 
D)  Include the pkt-srcaddr and pkt-dstaddr fields in the log format. 
E)  Include the subnet-id and instance-id fields in the log format.

Question 13

A large corporation is creating a multi-account strategy and needs to determine how its employees should access the AWS Infrastructure. Which of the following solutions would provide the MOST scalable solution?

Accepted Answer

A)  Create dedicated IAM users within each AWS account that employees can assume though federation based upon group membership in their existing identity provider. 
B)  Use a centralized account with IAM roles that employees can assume through federation with their existing identity provider. Use cross-account roles to allow the federated users to assume their target role in the resource accounts. 
C)  Configure the AWS Security Token Service to use Kerberos tokens so that users can use their existing corporate user names and passwords to access AWS resources directly. 
D)  Configure the IAM trust policies within each account's role to set up a trust back to the corporation's existing identity provider, allowing users to assume the role based off their SAML token.

Question 14

A security team is responsible for reviewing AWS API call activity in the cloud environment for security violations. These events must be recorded and retained in a centralized location for both current and future AWS regions. What is the SIMPLEST way to meet these requirements?

Accepted Answer

A)  Enable AWS Trusted Advisor security checks in the AWS Console, and report all security incidents for all regions. 
B)  Enable AWS CloudTrail by creating individual trails for each region, and specify a single Amazon S3 bucket to receive log files for later analysis. 
C)  Enable AWS CloudTrail by creating a new trail and applying the trail to all regions. Specify a single Amazon S3 bucket as the storage location. 
D)  Enable Amazon CloudWatch logging for all AWS services across all regions, and aggregate them to a single Amazon S3 bucket for later analysis.

Question 15

The Security Engineer is managing a traditional three-tier web application that is running on Amazon EC2 instances. The application has become the target of increasing numbers of malicious attacks from the Internet. What steps should the Security Engineer take to check for known vulnerabilities and limit the attack surface? (Choose two.)

Accepted Answer

A)  Use AWS Certificate Manager to encrypt all traffic between the client and application servers. 
B)  Review the application security groups to ensure that only the necessary ports are open. 
C)  Use Elastic Load Balancing to offload Secure Sockets Layer encryption. 
D)  Use Amazon Inspector to periodically scan the backend instances. 
E)  Use AWS Key Management Services to encrypt all the traffic between the client and application servers.

Question 16

A company's Developers plan to migrate their on-premises applications to Amazon EC2 instances running Amazon Linux AMIs. The applications are accessed by a group of partner companies. The Security Engineer needs to implement the following host-based security measures for these instances: Block traffic from documented known bad IP addresses. Detect known software vulnerabilities and CIS Benchmarks compliance. Which solution addresses these requirements?

Accepted Answer

A)  Launch the EC2 instances with an IAM role attached. Include a user data script that uses the AWS CLI to retrieve the list of bad IP addresses from AWS Secrets Manager, and uploads it as a threat list in Amazon GuardDuty. Use Amazon Inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance. 
B)  Launch the EC2 instances with an IAM role attached. Include a user data script that uses the AWS CLI to create NACLs blocking ingress traffic from the known bad IP addresses in the EC2 instance's subnets. Use AWS Systems Manager to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance. 
C)  Launch the EC2 instances with an IAM role attached. Include a user data script that uses the AWS CLI to create and attach security groups that only allow an allow listed source IP address range inbound. Use Amazon Inspector to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance. 
D)  Launch the EC2 instances with an IAM role attached. Include a user data script that creates a cron job to periodically retrieve the list of bad IP addresses from Amazon S3, and configures iptables on the instances blocking the list of bad IP addresses. Use Amazon Inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance.

Question 17

Auditors for a health care company have mandated that all data volumes by encrypted at rest. Infrastructure is deployed mainly via AWS CloudFormation: however, third-party frameworks and manual deployment are required on some legacy systems. What is the BEST way to monitor, on a recurring basis, whether all EBS volumes are encrypted?

Accepted Answer

A)  On a recurring basis, update all IAM user policies to require that EC2 instances are created with an encrypted volume. 
B)  Configure an AWS Config rule to run on a recurring basis for volume encryption. 
C)  Set up Amazon Inspector rules for volume encryption to run on a recurring schedule. 
D)  Use CloudWatch Logs to determine whether instances were created with an encrypted volume.

Question 18

An organization is using AWS CloudTrail, Amazon CloudWatch Logs, and Amazon CloudWatch to send alerts when new access keys are created. However, the alerts are no longer appearing in the Security Operations mail box. Which of the following actions would resolve this issue?

Accepted Answer

A)  In CloudTrail, verify that the trail logging bucket has a log prefix configured. 
B)  In Amazon SNS, determine whether the "Account spend limit" has been reached for this alert. 
C)  In SNS, ensure that the subscription used by these alerts has not been deleted. 
D)  In CloudWatch, verify that the alarm threshold "consecutive periods" value is equal to, or greater than 1.

Question 19

During a recent security audit, it was discovered that multiple teams in a large organization have placed restricted data in multiple Amazon S3 buckets, and the data may have been exposed. The auditor has requested that the organization identify all possible objects that contain personally identifiable information (PII) and then determine whether this information has been accessed. What solution will allow the Security team to complete this request?

Accepted Answer

A)  Using Amazon Athena, query the impacted S3 buckets by using the PII query identifier function. Then, create a new Amazon CloudWatch metric for Amazon S3 object access to alert when the objects are accessed. 
B)  Enable Amazon Macie on the S3 buckets that were impacted, then perform data classification. For identified objects that contain PII, use the research function for auditing AWS CloudTrail logs and S3 bucket logs for GET operations. 
C)  Enable Amazon GuardDuty and enable the PII rule set on the S3 buckets that were impacted, then perform data classification. Using the PII findings report from GuardDuty, query the S3 bucket logs by using Athena for GET operations. 
D)  Enable Amazon Inspector on the S3 buckets that were impacted, then perform data classification. For identified objects that contain PII, query the S3 bucket logs by using Athena for GET operations.

Question 20

A financial institution has the following security requirements: Cloud-based users must be contained in a separate authentication domain. Cloud-based users cannot access on-premises systems. As part of standing up a cloud environment, the financial institution is creating a number of Amazon managed databases and Amazon EC2 instances. An Active Directory service exists on-premises that has all the administrator accounts, and these must be able to access the databases and instances. How would the organization manage its resources in the MOST secure manner? (Choose two.)

Accepted Answer

A)  Configure an AWS Managed Microsoft AD to manage the cloud resources. 
B)  Configure an additional on-premises Active Directory service to manage the cloud resources. 
C)  Establish a one-way trust relationship from the existing Active Directory to the new Active Directory service. 
D)  Establish a one-way trust relationship from the new Active Directory to the existing Active Directory service. 
E)  Establish a two-way trust between the new and existing Active Directory services.

Exam 8: AWS Certified Security - Specialty (SCS-C01)

A company has deployed a custom DNS server in AWS. The Security Engineer wants to ensure that Amazon EC2 instances cannot use the Amazon-provided DNS. How can the Security Engineer block access to the Amazon-provided DNS in the VPC?

The Development team receives an error message each time the team members attempt to encrypt or decrypt a Secure String parameter from the SSM Parameter Store by using an AWS KMS customer managed key (CMK) . Which CMK-related issues could be responsible? (Choose two.)

A large corporation is creating a multi-account strategy and needs to determine how its employees should access the AWS Infrastructure. Which of the following solutions would provide the MOST scalable solution?

A security team is responsible for reviewing AWS API call activity in the cloud environment for security violations. These events must be recorded and retained in a centralized location for both current and future AWS regions. What is the SIMPLEST way to meet these requirements?

An organization is using AWS CloudTrail, Amazon CloudWatch Logs, and Amazon CloudWatch to send alerts when new access keys are created. However, the alerts are no longer appearing in the Security Operations mail box. Which of the following actions would resolve this issue?