Spring Sale 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exams65

ExamsBrite Dumps

AWS Certified Security – Specialty Question and Answers

AWS Certified Security – Specialty

Last Update Feb 28, 2026
Total Questions : 126

We are offering FREE SCS-C03 Amazon Web Services exam questions. All you do is to just go and sign up. Give your details, prepare SCS-C03 free exam questions and then go for complete pool of AWS Certified Security – Specialty test questions that will help you more.

SCS-C03 pdf

SCS-C03 PDF

$36.75  $104.99
 Add to Cart
SCS-C03 Engine

SCS-C03 Testing Engine

$43.75  $124.99
 Add to Cart
SCS-C03 PDF + Engine

SCS-C03 PDF + Testing Engine

$57.75  $164.99
 Add to Cart
Questions 1

A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region that uses an AWS KMS customer managed key. The company must copy a DB snapshot to the us-west-1 Region but cannot access the encryption key across Regions.

What should the company do to properly encrypt the snapshot in us-west-1?

Options:

A.  

Store the customer managed key in AWS Secrets Manager in us-west-1.

B.  

Create a new customer managed key in us-west-1 and use it to encrypt the snapshot.

C.  

Create an IAM policy to allow access to the key in us-east-1 from us-west-1.

D.  

Create an IAM policy that allows RDS in us-west-1 to access the key in us-east-1.

Discussion 0
Questions 2

A company's security engineer receives an abuse notification from AWS. The notification indicates that someone is hosting malware from the company's AWS account. After investigation, the security engineer finds a new Amazon S3 bucket that an IAM user created without authorization.

Which combination of steps should the security engineer take to MINIMIZE the consequences of this compromise? (Select THREE.)

Options:

A.  

Encrypt all AWS CloudTrail logs.

B.  

Turn on Amazon GuardDuty.

C.  

Change the password for all IAM users.

D.  

Rotate or delete all AWS access keys.

E.  

Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.

F.  

Delete any resources that are unrecognized or unauthorized.

Discussion 0
Questions 3

A company’s data scientists use Amazon SageMaker with datasets stored in Amazon S3. Data older than 45 days must be removed according to policy.

Which action should enforce this policy?

Options:

A.  

Configure an S3 Lifecycle rule to delete objects after 45 days.

B.  

Create a Lambda function triggered on object upload to delete old data.

C.  

Create a scheduled Lambda function to delete old objects monthly.

D.  

Configure S3 Intelligent-Tiering.

Discussion 0
Questions 4

A company is using Amazon Macie, AWS Firewall Manager, Amazon Inspector, and AWS Shield Advanced in its AWS account. The company wants to receive alerts if a DDoS attack occurs against the account.

Which solution will meet this requirement?

Options:

A.  

Use Amazon Macie to detect an active DDoS event and create Amazon CloudWatch alarms that respond to Macie findings.

B.  

Use Amazon Inspector to review resources and invoke Amazon CloudWatch alarms for any resources that are vulnerable to DDoS attacks.

C.  

Create an Amazon CloudWatch alarm that monitors AWS Firewall Manager metrics for an active DDoS event.

D.  

Create an Amazon CloudWatch alarm that monitors AWS Shield Advanced metrics for an active DDoS event.

Discussion 0
Questions 5

A company is implementing new compliance requirements to meet customer needs. According to the new requirements, the company must not use any Amazon RDS DB instances or DB clusters that lack encryption of the underlying storage. The company needs a solution that will generate an email alert when an unencrypted DB instance or DB cluster is created. The solution also must terminate the unencrypted DB instance or DB cluster.

Which solution will meet these requirements in the MOST operationally efficient manner?

Options:

A.  

Create an AWS Config managed rule to detect unencrypted RDS storage. Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.

B.  

Create an AWS Config managed rule to detect unencrypted RDS storage. Configure a manual remediation action to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.

C.  

Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.

D.  

Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.

Discussion 0
Questions 6

A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 123456789012. The attack created workloads that are distributed across multiple AWS Regions.

The security engineer contains the attack and removes all compute and storage resources from all affected Regions. However, the attacker also created an AWS KMS key. The key policy on the KMS key explicitly allows IAM principal kms:* permissions.

The key was scheduled to be deleted the previous day. However, the key is still enabled and usable. The key has an ARN of

arn:aws:kms:us-east-2:123456789012:key/mrk-0bb0212cd9864fdea0dcamzo26efb5670.

The security engineer must delete the key as quickly as possible.

Which solution will meet this requirement?

Options:

A.  

Log in to the account by using the account root user credentials. Re-issue the deletion request for the KMS key with a waiting period of 7 days.

B.  

Identify the other Regions where the KMS key ID is present and schedule the key for deletion in 7 days.

C.  

Update the IAM principal to allow kms:* permissions on the KMS key ARN. Re-issue the deletion request for the KMS key with a waiting period of 7 days.

D.  

Disable the KMS key. Re-issue the deletion request for the KMS key in 30 days.

Discussion 0
Questions 7

A company must inventory sensitive data across all Amazon S3 buckets in all accounts from a single security account.

Options:

A.  

Delegate Amazon Macie and Security Hub administration.

B.  

Use Amazon Inspector with Security Hub.

C.  

Use Inspector with Trusted Advisor.

D.  

Use Macie with Trusted Advisor.

Discussion 0
Questions 8

A company’s security engineer receives an alert that indicates that an unexpected principal is accessing a company-owned Amazon Simple Queue Service (Amazon SQS) queue. All the company’s accounts are within an organization in AWS Organizations. The security engineer must implement a mitigation solution that minimizes compliance violations and investment in tools outside of AWS.

What should the security engineer do to meet these requirements?

Options:

A.  

Create security groups and attach them to all SQS queues.

B.  

Modify network ACLs in all VPCs to restrict inbound traffic.

C.  

Create interface VPC endpoints for Amazon SQS. Restrict access using aws:SourceVpce and aws:PrincipalOrgId conditions.

D.  

Use a third-party cloud access security broker (CASB).

Discussion 0
Questions 9

A company needs to scan all AWS Lambda functions for code vulnerabilities.

Options:

A.  

Use Amazon Macie.

B.  

Enable Amazon Inspector Lambda scanning.

C.  

Use GuardDuty and Security Hub.

D.  

Use GuardDuty Lambda Protection.

Discussion 0
Questions 10

A security engineer needs to implement a solution to identify any sensitive data that is stored in an Amazon S3 bucket. The solution must report on sensitive data in the S3 bucket by using an existing Amazon Simple Notification Service (Amazon SNS) topic.

Which solution will meet these requirements with the LEAST implementation effort?

Options:

A.  

Enable AWS Config. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.

B.  

Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern. Program the Lambda function to send notifications to the SNS topic.

C.  

Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data. Create an Amazon EventBridge rule to send notifications to the SNS topic.

D.  

Enable Amazon GuardDuty. Configure AWS CloudTrail S3 data events. Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic.

Discussion 0
Questions 11

A company is running a containerized application on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The application runs as several ECS services. The ECS services are in individual target groups for an internet-facing Application Load Balancer (ALB). The ALB is the origin for an Amazon CloudFront distribution. An AWS WAF web ACL is associated with the CloudFront distribution.

Web clients access the ECS services through the CloudFront distribution. The company learns that the web clients can bypass the web ACL and can access the ALB directly.

Which solution will prevent the web clients from directly accessing the ALB?

Options:

A.  

Create an AWS PrivateLink endpoint. Specify the existing ALB as the target. Update the CloudFront distribution by setting the PrivateLink endpoint as the origin.

B.  

Create a new internal AL

B.  

Move all the ECS services to the internal AL

B.  

Delete the internet-facing AL

B.  

Update the CloudFront distribution by setting the internal ALB as the origin.

C.  

Modify the listener rules for the existing ALB. Add a condition to forward only the requests that come from IP addresses in the CloudFront origin prefix list.

D.  

Update the CloudFront distribution by adding an X-Shared-Secret custom header for the origin. Modify the listener rules for the existing ALB to forward only the requests in which the X-Shared-Secret header has the correct value.

Discussion 0
Questions 12

A company’s application team needs a new AWS Key Management Service (AWS KMS) customer managed key to use with Amazon S3. The company’s security policy requires separate keys for different AWS services to limit security exposure.

How can a security engineer limit the KMS customer managed key to work with only Amazon S3?

Options:

A.  

Configure the key policy to allow only Amazon S3 to perform the kms:Encrypt action.

B.  

Configure the key policy to allow KMS actions only when the value for the kms:ViaService condition key matches the Amazon S3 service name.

C.  

Configure the application’s IAM role policy to allow Amazon S3 to perform the iam:PassRole action.

D.  

Configure the application’s IAM role policy to allow only S3 operations when the operations are combined with the KMS customer managed key.

Discussion 0
Questions 13

A company is using AWS CloudTrail and Amazon CloudWatch to monitor resources in an AWS account. The company’s developers have been using an IAM role in the account for the last 3 months.

A security engineer needs to refine the customer managed IAM policy attached to the role to ensure that the role provides least privilege access.

Which solution will meet this requirement with the LEAST effort?

Options:

A.  

Implement AWS IAM Access Analyzer policy generation on the role.

B.  

Implement AWS IAM Access Analyzer policy validation on the role.

C.  

Search CloudWatch logs to determine the actions the role invoked and to evaluate the permissions.

D.  

Use AWS Trusted Advisor to compare the policies assigned to the role against AWS best practices.

Discussion 0
Questions 14

A company has AWS accounts in an organization in AWS Organizations. An Amazon S3 bucket in one account is publicly accessible. A security engineer must remove public access and ensure the bucket cannot be made public again.

Which solution will meet these requirements?

Options:

A.  

Enforce KMS encryption and deny s3:GetObject by SCP.

B.  

Enable PublicAccessBlock and deny s3:GetObject by SCP.

C.  

Enable PublicAccessBlock and deny s3:PutPublicAccessBlock by SCP.

D.  

Enable Object Lock governance and deny s3:PutPublicAccessBlock by SCP.

Discussion 0
Questions 15

A company runs a web application on a fleet of Amazon EC2 instances in an Auto Scaling group. Amazon GuardDuty and AWS Security Hub are enabled. The security engineer needs an automated response to anomalous traffic that follows AWS best practices and minimizes application disruption.

Which solution will meet these requirements?

Options:

A.  

Use EventBridge to disable the instance profile access keys.

B.  

Use EventBridge to invoke a Lambda function that removes the affected instance from the Auto Scaling group and isolates it with a restricted security group.

C.  

Use Security Hub to update the subnet network ACL to block traffic.

D.  

Send GuardDuty findings to Amazon SNS for email notification.

Discussion 0
Questions 16

A company requires a specific software application to be installed on all new and existing Amazon EC2 instances across an AWS Organization. SSM Agent is installed and active.

How can the company continuously monitor deployment status of the software application?

Options:

A.  

Use AWS Config organization-wide with the ec2-managedinstance-applications-required managed rule and specify the application name.

B.  

Use approved AMIs rule organization-wide.

C.  

Use Distributor package and review output.

D.  

Use Systems Manager Application Manager inventory filtering.

Discussion 0
Questions 17

A company runs a global ecommerce website using Amazon CloudFront. The company must block traffic from specific countries to comply with data regulations.

Which solution will meet these requirements MOST cost-effectively?

Options:

A.  

Use AWS WAF IP match rules.

B.  

Use AWS WAF geo match rules.

C.  

Use CloudFront geo restriction to deny the countries.

D.  

Use geolocation headers in CloudFront.

Discussion 0
Questions 18

A company must immediately disable compromised IAM users across all AWS accounts and collect all actions performed by the user in the last 7 days.

Which solution will meet these requirements?

Options:

A.  

Disable the IAM user and query CloudTrail logs in Amazon S3 using Athena.

B.  

Remove IAM policies and query logs in Security Hub.

C.  

Remove permission sets and query logs using CloudWatch Logs Insights.

D.  

Disable the user in IAM Identity Center and query the organizational event data store.

Discussion 0
Questions 19

A company's security engineer receives an abuse notification from AWS indicating that malware is being hosted from the company’s AWS account. The security engineer discovers that an IAM user created a new Amazon S3 bucket without authorization.

Which combination of steps should the security engineer take to MINIMIZE the consequences of this compromise? (Select THREE.)

Options:

A.  

Encrypt all AWS CloudTrail logs.

B.  

Turn on Amazon GuardDuty.

C.  

Change the password for all IAM users.

D.  

Rotate or delete all AWS access keys.

E.  

Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.

F.  

Delete any resources that are unrecognized or unauthorized.

Discussion 0
Questions 20

A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack from a specific IoT device brand that uses a unique user agent. A security engineer is creating an AWS WAF web ACL and will associate it with the ALB.

Which rule statement will mitigate the current attack and future attacks from these IoT devices without blocking legitimate customers?

Options:

A.  

Use an IP set match rule statement.

B.  

Use a geographic match rule statement.

C.  

Use a rate-based rule statement.

D.  

Use a string match rule statement on the user agent.

Discussion 0
Questions 21

A company needs a cloud-based, managed desktop solution for its workforce of remote employees. The company wants to ensure that the employees can access the desktops only by using company-provided devices. A security engineer must design a solution that will minimize cost and management overhead.

Which solution will meet these requirements?

Options:

A.  

Deploy a custom virtual desktop infrastructure (VDI) solution with a restriction policy to allow access only from corporate devices.

B.  

Deploy a fleet of Amazon EC2 instances. Assign an instance to each employee with certificate-based device authentication that uses Windows Active Directory.

C.  

Deploy Amazon WorkSpaces. Set up a trusted device policy with IP blocking on the authentication gateway by using AWS Identity and Access Management (IAM).

D.  

Deploy Amazon WorkSpaces. Create client certificates, and deploy them to trusted devices. Enable restricted access at the directory level.

Discussion 0
Questions 22

A company needs to build a code-signing solution using an AWS KMS asymmetric key and must store immutable evidence of key creation and usage for compliance and audit purposes.

Which solution meets these requirements?

Options:

A.  

Create an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrail trail with log file validation enabled for KMS events. Store logs in the bucket and grant auditors access.

B.  

Log application events to Amazon CloudWatch Logs and export them.

C.  

Capture KMS API calls using EventBridge and store them in DynamoDB.

D.  

Track KMS usage with CloudWatch metrics and dashboards.

Discussion 0
Questions 23

A company uses AWS to run a web application that manages ticket sales in several countries. The company recently migrated the application to an architecture that includes Amazon API Gateway, AWS Lambda, and Amazon Aurora Serverless. The company needs the application to comply with Payment Card Industry Data Security Standard (PCI DSS) v4.0. A security engineer must generate a report that shows the effectiveness of the PCI DSS v4.0 controls that apply to the application. The company's compliance team must be able to add manual evidence to the report.

Which solution will meet these requirements?

Options:

A.  

Enable AWS Trusted Advisor. Configure all the Trusted Advisor checks. Manually map the checks against the PCI DSS v4.0 standard to generate the report.

B.  

Enable and configure AWS Config. Deploy the Operational Best Practices for PCI DSS conformance pack in AWS Config. Use AWS Config to generate the report.

C.  

Enable AWS Security Hub. Enable the Security Hub PCI DSS security standard. Use the AWS Management Console to download the report from the security standard.

D.  

Create an AWS Audit Manager assessment that uses the AWS managed PCI DSS v4.0 standard framework. Add all evidence to the assessment. Generate the report in Audit Manager for download.

Discussion 0
Questions 24

A company is running an application in the eu-west-1 Region. The application uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt sensitive data. The company plans to deploy the application in the eu-north-1 Region. A security engineer needs to implement a key management solution for the application deployment in the new Region. The security engineer must minimize changes to the application code.

Which change should the security engineer make to the AWS KMS configuration to meet these requirements?

Options:

A.  

Update the key policies in eu-west-1. Point the application in eu-north-1 to use the same customer managed key as the application in eu-west-1.

B.  

Allocate a new customer managed key to eu-north-1 to be used by the application that is deployed in that Region.

C.  

Allocate a new customer managed key to eu-north-1. Create the same alias name for both keys. Configure the application deployment to use the key alias.

D.  

Allocate a new customer managed key to eu-north-1. Create an alias for eu--1. Change the application code to point to the alias for eu--1.

Discussion 0
Questions 25

A company runs its microservices architecture in Kubernetes containers on AWS by using Amazon Elastic Kubernetes Service (Amazon EKS) and Amazon Aurora. The company has an organization in AWS Organizations to manage hundreds of AWS accounts that host different microservices.

The company needs to implement a monitoring solution for logs from all AWS resources across all accounts. The solution must include automatic detection of security-related issues.

Which solution will meet these requirements with the LEAST operational effort?

Options:

A.  

Designate an Amazon GuardDuty administrator account in the organization’s management account. Enable GuardDuty for all accounts. Enable EKS Protection and RDS Protection in the GuardDuty administrator account.

B.  

Designate a monitoring account. Share Amazon CloudWatch Logs from all accounts. Use Amazon Inspector to evaluate the logs.

C.  

Centralize CloudTrail logs in Amazon S3 and analyze them with Amazon Athena.

D.  

Stream CloudWatch Logs to Amazon Kinesis and analyze them with custom AWS Lambda functions.

Discussion 0
Questions 26

A company recently experienced a malicious attack on its cloud-based environment. The company successfully contained and eradicated the attack. A security engineer is performing incident response work. The security engineer needs to recover an Amazon RDS database cluster to the last known good version. The database cluster is configured to generate automated backups with a retention period of 14 days. The initial attack occurred 5 days ago at exactly 3:15 PM.

Which solution will meet this requirement?

Options:

A.  

Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the restore to point in time feature. Set a target time 5 days ago at 3:14 PM.

B.  

Identify the Regional cluster ARN for the database. List snapshots that have been taken of the cluster. Restore the database by using the snapshot that has a creation time that is closest to 5 days ago at 3:14 PM.

C.  

List all snapshots that have been taken of all the company's RDS databases. Identify the snapshot that was taken closest to 5 days ago at 3:14 PM and restore it.

D.  

Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the restore to point in time feature. Set a target time 14 days ago.

Discussion 0
Questions 27

A security engineer needs to implement AWS IAM Identity Center with an external identity provider (IdP).

Select and order the correct steps from the following list to meet this requirement. Select each step one time or not at all. (Select and order THREE.)

. Configure the external IdP as the identity source in IAM Identity Center.

. Create an IAM role that has a trust policy that specifies the IdP's API endpoint.

. Enable automatic provisioning in IAM Identity Center settings.

. Enable automatic provisioning in the external IdP.

. Obtain the SAML metadata from IAM Identity Center.

. Obtain the SAML metadata from the external IdP.

Options:

Discussion 0
Questions 28

A company's web application is hosted on Amazon EC2 instances running behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. AWS CloudTrail is enabled and stores logs in Amazon S3 and Amazon CloudWatch Logs.

The operations team has observed some EC2 instances reboot at random. After rebooting, all access logs on the instances have been deleted. During an investigation, the operations team found that each reboot happened just after a PHP error occurred on the new-user-creation.php file. The operations team needs to view log information to determine if the company is being attacked.

Which set of actions will identify the suspect attacker's IP address for future occurrences?

Options:

A.  

Configure VPC Flow Logs on the subnet where the ALB is located and stream the data to CloudWatch. Search for the new-user-creation.php occurrences in CloudWatch.

B.  

Configure the CloudWatch agent on the ALB and send application logs to CloudWatch Logs.

C.  

Configure the ALB to export access logs to an Amazon OpenSearch Service cluster and search for the new-user-creation.php occurrences.

D.  

Configure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3 bucket. Use Amazon Athena to query the logs and find the new-user-creation.php occurrences.

Discussion 0
Questions 29

A company detects bot activity targeting Amazon Cognito user pool endpoints. The solution must block malicious requests while maintaining access for legitimate users.

Which solution meets these requirements?

Options:

A.  

Enable Amazon Cognito threat protection.

B.  

Restrict access to authenticated users only.

C.  

Associate AWS WAF with the Cognito user pool.

D.  

Monitor requests with CloudWatch.

Discussion 0
Questions 30

A security engineer needs to prepare for a security audit of an AWS account.

Select the correct AWS resource from the following list to meet each requirement. Select each resource one time or not at all. (Select THREE.)

• AWS Artifact reports

• AWS Audit Manager controls

• AWS Config conformance packs

• AWS Config rules

• Amazon Detective investigations

• AWS Identity and Access Management Access Analyzer internal access analyzers

Options:

Discussion 0
Questions 31

A company creates AWS Lambda functions from container images that are stored in Amazon Elastic Container Registry (Amazon ECR). The company needs to identify any software vulnerabilities in the container images and any code vulnerabilities in the Lambda functions.

Which solution will meet these requirements?

Options:

A.  

Enable Amazon GuardDuty. Configure Amazon ECR scanning and Lambda code scanning in GuardDuty.

B.  

Enable Amazon GuardDuty. Configure Runtime Monitoring and Lambda Protection in GuardDuty.

C.  

Enable Amazon Inspector. Configure Amazon ECR enhanced scanning and Lambda code scanning in Amazon Inspector.

D.  

Enable AWS Security Hub. Configure Runtime Monitoring and Lambda Protection in Security Hub.

Discussion 0
Questions 32

A company runs a web application on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are in the same VPC subnet as other workloads.

A security engineer deploys Amazon GuardDuty and integrates it with AWS Security Hub. The security engineer needs to implement an automated solution to detect and respond to anomalous traffic patterns. The solution must follow AWS best practices for initial incident response and must minimize disruption to the web application.

Which solution will meet these requirements?

Options:

A.  

Disable the instance profile access keys by using AWS Lambda.

B.  

Remove the affected instance from the Auto Scaling group and isolate it with a restricted security group by using AWS Lambda.

C.  

Update the network ACL to block the detected traffic source.

D.  

Send GuardDuty findings to Amazon SNS for email notification.

Discussion 0
Questions 33

A company is running a containerized application on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The application runs as several ECS services.

The ECS services are in individual target groups for an internet-facing Application Load Balancer (ALB). The ALB is the origin for an Amazon CloudFront distribution. An AWS WAF web ACL is associated with the CloudFront distribution.

Web clients access the ECS services through the CloudFront distribution. The company learns that the web clients can bypass the web ACL and can access the ALB directly.

Which solution will prevent the web clients from directly accessing the ALB?

Options:

A.  

Create an AWS PrivateLink endpoint and set it as the CloudFront origin.

B.  

Create a new internal ALB and delete the internet-facing AL

B.  

C.  

Modify the ALB listener rules to allow only CloudFront IP ranges.

D.  

Add a custom X-Shared-Secret header in CloudFront and configure the ALB listener rules to allow requests only when the header value matches.

Discussion 0
Questions 34

A company is attempting to conduct forensic analysis on an Amazon EC2 instance, but the company is unable to connect to the instance by using AWS Systems Manager Session Manager. The company has installed AWS Systems Manager Agent (SSM Agent) on the EC2 instance.

The EC2 instance is in a subnet in a VPC that does not have an internet gateway attached. The company has associated a security group with the EC2 instance. The security group does not have inbound or outbound rules. The subnet’s network ACL allows all inbound and outbound traffic.

Which combination of actions will allow the company to conduct forensic analysis on the EC2 instance without compromising forensic data? (Select THREE.)

Options:

A.  

Update the EC2 instance security group to add a rule that allows outbound traffic on port 443 for 0.0.0.0/0.

B.  

Update the EC2 instance security group to add a rule that allows inbound traffic on port 443 to the VPC's CIDR range.

C.  

Create an EC2 key pair. Associate the key pair with the EC2 instance.

D.  

Create a VPC interface endpoint for Systems Manager in the VPC where the EC2 instance is located.

E.  

Attach a security group to the VPC interface endpoint. Allow inbound traffic on port 443 to the VPC's CIDR range.

F.  

Create a VPC interface endpoint for the EC2 instance in the VPC where the EC2 instance is located.

Discussion 0
Questions 35

An AWS Lambda function was misused to alter data, and a security engineer must identify who invoked the function and what output was produced. The engineer cannot find any logs created by the Lambda function in Amazon CloudWatch Logs.

Which of the following explains why the logs are not available?

Options:

A.  

The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.

B.  

The Lambda function was invoked by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs.

C.  

The execution role for the Lambda function did not grant permissions to write to the Amazon S3 bucket where CloudWatch Logs stores the logs.

D.  

The version of the Lambda function that was invoked was not current.

Discussion 0
Questions 36

A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually.

The company often needs to query the logs to produce results about application sessions and user issues. The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in.

Which combination of steps should a security engineer take to meet these requirements MOST cost-effectively? (Select TWO.)

Options:

A.  

Configure a cron job on the instances to forward the log files to Amazon S3 periodically.

B.  

Configure AWS Glue and Amazon Athena to query the log files.

C.  

Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs.

D.  

Configure Amazon CloudWatch Logs Insights to query the log files.

E.  

Configure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume.

Discussion 0
Questions 37

A company must capture AWS CloudTrail data events and must retain the logs for 7 years. The logs must be immutable and must be available to be searched by complex queries. The company also needs to visualize the data from the logs.

Which solution will meet these requirements MOST cost-effectively?

Options:

A.  

Create a CloudTrail Lake data store. Implement CloudTrail Lake dashboards to visualize and query the results.

B.  

Use the CloudTrail Event History feature in the AWS Management Console. Visualize and query the results in the console.

C.  

Send the CloudTrail logs to an Amazon S3 bucket. Provision a persistent Amazon EMR cluster that has access to the S3 bucket. Enable S3 Object Lock on the S3 bucket. Use Apache Spark to perform queries. Use Amazon QuickSight for visualizations.

D.  

Send the CloudTrail logs to a log group in Amazon CloudWatch Logs. Set the CloudWatch Logs stream to send the data to an Amazon OpenSearch Service domain. Enable cold storage for the OpenSearch Service domain. Use OpenSearch Dashboards for visualizations and queries.

Discussion 0