Verified AWS-Security-Specialty dumps Q&As - Pass Guarantee or Full Refund [Oct-2021]
AWS-Security-Specialty PDF Dumps | Oct 28, 2021 Recently Updated Questions
Amazon AWS-Security-Specialty Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
NEW QUESTION 66
A company became aware that one of its access keys was exposed on a code sharing website 11 days ago. A Security Engineer must review all use of the exposed access keys to determine the extent of the exposure. The company enabled AWS CloudTrail m an regions when it opened the account Which of the following will allow (he Security Engineer 10 complete the task?
- A. Use the AWS CLI lo generate an IAM credential report Extract all the data from the past 11 days.
- B. Use Amazon Athena to query the CloudTrail logs from Amazon S3 Retrieve the rows for the exposed access key tor the past 11 days.
- C. Filter the event history on the exposed access key in the CloudTrail console Examine the data from the past 11 days.
- D. Use the Access Advisor tab in the IAM console to view all of the access key activity for the past 11 days.
Answer: B
NEW QUESTION 67
Your IT Security team has identified a number of vulnerabilities across critical EC2 Instances in the company's AWS Account. Which would be the easiest way to ensure these vulnerabilities are remediated?
Please select:
- A. Use AWS CLI commands to download the updates and patch the servers.
- B. Create AWS Lambda functions to download the updates and patch the servers.
- C. Use AWS inspector to patch the servers
- D. Use AWS Systems Manager to patch the servers
Answer: D
Explanation:
The AWS Documentation mentions the following
You can quickly remediate patch and association compliance issues by using Systems Manager Run Command. You can tat either instance IDs or Amazon EC2 tags and execute the AWS-RefreshAssociation document or the AWS-RunPatchBaseline document. If refreshing the association or re-running the patch baseline fails to resolve the compliance issue, then you need to investigate your associations, patch baselines, or instance configurations to understand why the Run Command executions did not resolve the problem Options A and B are invalid because even though this is possible, still from a maintenance perspective it would be difficult to maintain the Lambda functions Option C is invalid because this service cannot be used to patch servers For more information on using Systems Manager for compliance remediation please visit the below Link:
https://docs.aws.amazon.com/systems-manaeer/latest/usereuide/sysman-compliance-fixing.html The correct answer is: Use AWS Systems Manager to patch the servers Submit your Feedback/Queries to our Experts
NEW QUESTION 68
A company uses identity federation to authenticate users into an identity account (987654321987) where the users assume an IAM role named IdentityRole. The users then assume an IAM role named JobFunctionRole in the target AWS account (123456789123) to perform their job functions.
A user is unable to assume the IAM role in the target account. The policy attached to the role in the identity account is:
What should be done to enable the user to assume the appropriate role in the target account?
- A. Option C
- B. Option A
- C. Option B
- D. Option D
Answer: B
NEW QUESTION 69
Your application currently use AWS Cognito for authenticating users. Your application consists of different types of users. Some users are only allowed read access to the application and others are given contributor access. How wou you manage the access effectively?
Please select:
- A. Create different cognito groups, one for the readers and the other for the contributors.
- B. You need to manage this within the application itself
- C. Create different cognito endpoints, one for the readers and the other for the contributors.
- D. This needs to be managed via Web security tokens
Answer: A
Explanation:
The AWS Documentation mentions the following
You can use groups to create a collection of users in a user pool, which is often done to set the permissions for those users. For example, you can create separate groups for users who are readers, contributors, and editors of your website and app.
Option A is incorrect since you need to create cognito groups and not endpoints Options C and D are incorrect since these would be overheads when you can use AWS Cognito For more information on AWS Cognito user groups please refer to the below Link:
https://docs.aws.amazon.com/coenito/latest/developersuide/cognito-user-pools-user-groups.htmll The correct answer is: Create different cognito groups, one for the readers and the other for the contributors. Submit your Feedback/Queries to our Experts
NEW QUESTION 70
An application running on EC2 instances processes sensitive information stored on Amazon S3. The information is accessed over the Internet. The security team is concerned that the Internet connectivity to Amazon S3 is a security risk. Which solution will resolve the security concern?
Please select:
- A. Access the data through a NAT Gateway.
- B. Access the data through a VPN connection.
- C. Access the data through an Internet Gateway.
- D. Access the data through a VPC endpoint for Amazon S3
Answer: D
Explanation:
Explanation
The AWS Documentation mentions the followii
A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network.
Option A.B and C are all invalid because the question specifically mentions that access should not be provided via the Internet For more information on VPC endpoints, please refer to the below URL:
The correct answer is: Access the data through a VPC endpoint for Amazon S3 Submit your Feedback/Queries to our Experts
NEW QUESTION 71
An application developer is using an AWS Lambda function that must use AWS KMS to perform encrypt and decrypt operations for API keys that are less than 2 KB Which key policy would allow the application to do this while granting least privilege?
- A. Option B
- B. Option A
- C. Option C
- D. Option D
Answer: A
NEW QUESTION 72
A global company must mitigate and respond to DDoS attacks at Layers 3, 4 and 7. All of the company's AWS applications are serverless with static content hosted on Amazon S3 using Amazon CloudFront and Amazon Route 53.
Which solution will meet these requirements?
- A. Use AWS WAF with an upgrade to the AWS Business support plan.
- B. Use AWS WAF to protect AWS Lambda functions encrypted with AWS KMS, and a NACL restricting all ingress traffic.
- C. Use AWS Shield Advanced.
- D. Use AWS Certificate Manager with an Application Load Balancer configured with an origin access identity.
Answer: C
Explanation:
Explanation/Reference: https://aws.amazon.com/shield/faqs/
NEW QUESTION 73
The Development team receives an error message each time the team members attempt to encrypt or
decrypt a Secure String parameter from the SSM Parameter Store by using an AWS KMS customer
managed key (CMK).
Which CMK-related issues could be responsible? (Choose two.)
- A. The CMK specified in the application is not enabled.
- B. The CMK specified in the application is using an alias.
- C. The CMK specified in the application is currently is use.
- D. The CMK specified in the application is using the CMK KeyID instead of CMK Amazon Resource
Name. - E. The CMK specified in the application does not exist.
Answer: A,D
Explanation:
Explanation/Reference:
Reference: https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.html
NEW QUESTION 74
A Security Analyst attempted to troubleshoot the monitoring of suspicious security group changes. The Analyst was told that there is an Amazon CloudWatch alarm in place for these AWS CloudTrail log events. The Analyst tested the monitoring setup by making a configuration change to the security group but did not receive any alerts.
Which of the following troubleshooting steps should the Analyst perform?
- A. Ensure that CloudTrail and S3 bucket access logging is enabled for the Analyst's AWS account. B. Verify that a metric filter was created and then mapped to an alarm. Check the alarm notification action.
- B. Verify that the Analyst's account is mapped to an IAM policy that includes permissions for cloudwatch:
GetMetricStatistics and Cloudwatch: ListMetrics. - C. Check the CloudWatch dashboards to ensure that there is a metric configured with an appropriate dimension for security group changes.
Answer: C
NEW QUESTION 75
An application running on EC2 instances must use a username and password to access a database. The developer has stored those secrets in the SSM Parameter Store with type SecureString using the default KMS CMK. Which combination of configuration steps will allow the application to access the secrets via the API? Select 2 answers from the options below Please select:
- A. Add permission to use the KMS key to decrypt to the SSM service role.
- B. Add the EC2 instance role as a trusted service to the SSM service role.
- C. Add the SSM service role as a trusted service to the EC2 instance role.
- D. Add permission to read the SSM parameter to the EC2 instance role. .
- E. Add permission to use the KMS key to decrypt to the EC2 instance role
Answer: D,E
Explanation:
The below example policy from the AWS Documentation is required to be given to the EC2 Instance in order to read a secure string from AWS KMS. Permissions need to be given to the Get Parameter API and the KMS API call to decrypt the secret.
Option A is invalid because roles can be attached to EC2 and not EC2 roles to SSM Option B is invalid because the KMS key does not need to decrypt the SSM service role.
Option E is invalid because this configuration is valid For more information on the parameter store, please visit the below URL:
https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.htmll The correct answers are: Add permission to read the SSM parameter to the EC2 instance role., Add permission to use the KMS key to decrypt to the EC2 instance role Submit your Feedback/Queries to our Experts
NEW QUESTION 76
A Security Engineer must design a system that can detect whether a file on an Amazon EC2 host has been modified. The system must then alert the Security Engineer of the modification.
What is the MOST efficient way to meet these requirements?
- A. Use Amazon CloudWatch Logs to detect file system changes. If a change is detected, automatically terminate and recreate the instance from the most recent AMI. Use Amazon SNS to send notification of the event.
- B. Install host-based IDS software to check for file integrity. Export the logs to Amazon CloudWatch Logs for monitoring and alerting.
- C. Install antivirus software and ensure that signatures are up-to-date. Configure Amazon CloudWatch alarms to send alerts for security events.
- D. Export system log files to Amazon S3. Parse the log files using an AWS Lambda function that will send alerts of any unauthorized system login attempts through Amazon SNS.
Answer: B
NEW QUESTION 77
A company has a serverless application for internal users deployed on AWS. The application uses AWS Lambda for the front end and for business logic. The Lambda function accesses an Amazon RDS database inside a VPC The company uses AWS Systems Manager Parameter Store for storing database credentials. A recent security review highlighted the following issues
* The Lambda function has internet access.
* The relational database is publicly accessible.
* The database credentials are not stored in an encrypted state.
Which combination of steps should the company take to resolve these security issues? (Select THREE)
- A. Disable public access to the RDS database inside the VPC
- B. Edit the IAM role used by RDS to restrict internet access.
- C. Edit the IAM role used by Lambda to restrict internet access.
- D. Move all the Lambda functions inside the VPC.
- E. Create a VPC endpoint for Systems Manager. Store the credentials as a SecureString parameter.
- F. Create a VPC endpoint for Systems Manager. Store the credentials as a string parameter. Change the parameter type to an advanced parameter.
Answer: A,B,D
NEW QUESTION 78
An application running on Amazon EC2 instances generates log files in a folder on a Linux file system. The instances block access to the console and file transfer utilities, such as Secure Copy Protocol (SCP) and Secure File Transfer Protocol (SFTP). The Application Support team wants to automatically monitor the application log files so the team can set up notifications in the future.
A Security Engineer must design a solution that meets the following requirements:
* Make the log files available through an AWS managed service.
* Allow for automatic monitoring of the logs.
* Provide an Interlace for analyzing logs.
* Minimize effort.
Which approach meets these requirements^
- A. Install AWS Systems Manager Agent on the instances Configure an automation document to copy the application log files to AWS DeepLens
- B. install the unified Amazon CloudWatch agent on the instances Configure the agent to collect the application log dies on the EC2 tile system and send them to Amazon CloudWatch Logs
- C. Install Amazon Kinesis Agent on the instances Stream the application log files to Amazon Kinesis Data Firehose and sot the destination to Amazon Elasticsearch Service
- D. Modify the application to use the AWS SDK Write the application logs lo an Amazon S3 bucket
Answer: C
NEW QUESTION 79
A company uses identity federation to authenticate users into an identity account (987654321987) where the users assume an IAM role named IdentityRole. The users then assume an IAM role named JobFunctionRole in the target AWS account (123456789123) to perform their job functions.
A user is unable to assume the IAM role in the target account. The policy attached to the role in the identity account is:
What should be done to enable the user to assume the appropriate role in the target account?
- A. Option C
- B. Option A
- C. Option B
- D. Option D
Answer: B
NEW QUESTION 80
A Lambda function reads metadata from an S3 object and stores the metadata in a DynamoDB table. The function is triggered whenever an object is stored within the S3 bucket.
How should the Lambda function be given access to the DynamoDB table?
Please select:
- A. Create an 1AM user with permissions to write to the DynamoDB table. Store an access key for that user in the Lambda environment variables.
- B. Create an 1AM service role with permissions to write to the DynamoDB table. Associate that role with the Lambda function.
- C. Create a resource policy that grants the Lambda function permissions to write to the DynamoDB table.
Attach the poll to the DynamoDB table. - D. Create a VPC endpoint for DynamoDB within a VPC. Configure the Lambda function to access resources in the VPC.
Answer: B
Explanation:
Explanation
The ideal way is to create an 1AM role which has the required permissions and then associate it with the Lambda function The AWS Documentation additionally mentions the following Each Lambda function has an 1AM role (execution role) associated with it. You specify the 1AM role when you create your Lambda function. Permissions you grant to this role determine what AWS Lambda can do when it assumes the role. There are two types of permissions that you grant to the 1AM role:
If your Lambda function code accesses other AWS resources, such as to read an object from an S3 bucket or write logs to CloudWatch Logs, you need to grant permissions for relevant Amazon S3 and CloudWatch actions to the role.
If the event source is stream-based (Amazon Kinesis Data Streams and DynamoDB streams), AWS Lambda polls these streams on your behalf. AWS Lambda needs permissions to poll the stream and read new records on the stream so you need to grant the relevant permissions to this role.
Option A is invalid because the VPC endpoint allows access instances in a private subnet to access DynamoDB Option B is invalid because resources policies are present for resources such as S3 and KMS, but not AWS Lambda Option C is invalid because AWS Roles should be used and not 1AM Users For more information on the Lambda permission model, please visit the below URL:
https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html The correct answer is: Create an 1AM service role with permissions to write to the DynamoDB table.
Associate that role with the Lambda function.
Submit your Feedback/Queries to our Exp
NEW QUESTION 81
A company's Security Team received an email notification from the Amazon EC2 Abuse team that one or more of the company's Amazon EC2 instances may have been compromised Which combination of actions should the Security team take to respond to (be current modem? (Select TWO.)
- A. Detach the internet gateway from the VPC remove aft rules that contain 0.0.0.0V0 from the security groups, and create a NACL rule to deny all traffic Inbound from the internet
- B. Delete all 1AM users and resources in the account
- C. Open a support case with the AWS Security team and ask them to remove the malicious code from the affected instance
- D. Delete the identified compromised instances and delete any associated resources that the Security team did not create.
- E. Respond to the notification and list the actions that have been taken to address the incident
Answer: A,D
NEW QUESTION 82
An application has a requirement to be resilient across not only Availability Zones within the application's
primary region but also be available within another region altogether.
Which of the following supports this requirement for AWS resources that are encrypted by AWS KMS?
- A. Copy the application's AWS KMS CMK from the source region to the target region so that it can be
used to decrypt the resource after it is copied to the target region. - B. Configure AWS KMS to automatically synchronize the CMK between regions so that it can be used to
decrypt the resource in the target region. - C. Use AWS services that replicate data across regions, and re-wrap the data encryption key created in
the source region by using the CMK in the target region so that the target region's CMK can decrypt the
database encryption key. - D. Configure the target region's AWS service to communicate with the source region's AWS KMS so that
it can decrypt the resource in the target region.
Answer: C
NEW QUESTION 83
A company is migrating its legacy workloads to AWS. The current security information events management (SIEM) system that analyzes logs is aging, and different SIEM systems are being evaluated to replace it. The company wants to change SIEMs without re-architecture the solution.
What should the Security Engineer do to accomplish this with minimal operational impact?
- A. Select a pay-per-use SIEM in the AWS Marketplace. Deploy the AMI in each workload to provide elasticity when required. Use Amazon Athena to send real-time alerts.
- B. Configure an Amazon EC2 base AMI with an Amazon Kinesis Agent, and configure it to send to Amazon Kinesis Data Streams in the Security team AWS account. Add an AWS Lambda function at Kinesis Data Streams to push streamed logs to the SIEM.
- C. Configure an Amazon EC2 base AMI to send logs to a local AWS CloudTrail log file. Configure CloudTrail to send logs to Amazon CloudWatch. Set up a central SIEM in the Security team AWS account and configure a puller to get information on CloudWatch.
- D. Prepare an AMI with the SIEM log forwarder agent for each workload, and configure it to send logs to a centralized SIEM located in the Security team AWS account. Configure an Amazon EC2 instance base AMI to forward logs to its local log forwarder agent. Deploy an AMI in each workload.
Answer: B
NEW QUESTION 84
A company has several workloads running on AWS Employees are required to authenticate using on-premises ADFS and SSO to access the AWS Management Console Developers migrated an existing legacy web application to an Amazon EC2 instance Employees need to access this application from anywhere on the internet but currently, mere is no authentication system but into the application.
How should the Security Engineer implement employee-only access to this system without changing the application?
- A. Define an Amazon Cognito identity pool then install the connector on the Active Directory server Use the Amazon Cognito SDK on the application instance to authenticate the employees using their
- B. Create an AWS Lambda custom authorizer as the authenticator for a reverse proxy on Amazon EC2 Ensure the security group on Amazon EC2 only allows access from the Lambda function.
- C. Place the application behind an Application Load Balancer (ALB) Use Amazon Cognito as authentication (or the ALB Define a SAML-based Amazon Cognito user pool and connect it to ADFS implement AWS SSO in the master account and link it to ADFS as an identity provide' Define the EC2 instance as a managed resource, then apply an IAM policy on the resource
- D. Active Directory user names and passwords
Answer: C
NEW QUESTION 85
A company has several production AWS accounts and a central security AWS account. The security account is used for centralized monitoring and has IAM privileges to all resources in every corporate account. All of the company's Amazon S3 buckets are tagged with a value denoting the data classification of their contents.
A Security Engineer is deploying a monitoring solution in the security account that will enforce bucket policy compliance. The system must monitor S3 buckets in all production accounts and confirm that any policy change is in accordance with the bucket's data classification. If any change is out of compliance; the Security team must be notified quickly.
Which combination of actions would build the required solution? (Choose three.)
- A. Configure an Amazon CloudWatch Events rule in the security account to detect S3 bucket creation or modification events.
- B. Enable Amazon GuardDuty in the security account, and join the production accounts as members.
- C. Configure event notifications on S3 buckets for PUT; POST, and DELETE events.
- D. Enable AWS Trusted Advisor and activate email notifications for an email address assigned to the security contact.
- E. Invoke an AWS Lambda function in the security account to analyze S3 bucket settings in response to S3 events, and send non-compliance notifications to the Security team.
- F. Configure Amazon CloudWatch Events in the production accounts to send all S3 events to the security account event bus.
Answer: A,C,E
NEW QUESTION 86
Your company has defined a number of EC2 Instances over a period of 6 months. They want to know if any of the security groups allow unrestricted access to a resource. What is the best option to accomplish this requirement?
Please select:
- A. Use AWS Config to see which security groups have compromised access.
- B. Use the AWS CLI to query the security groups and then filter for the rules which have unrestricted accessd
- C. Use the AWS Trusted Advisor to see which security groups have compromised access.
- D. Use AWS Inspector to inspect all the security Groups
Answer: C
Explanation:
The AWS Trusted Advisor can check security groups for rules that allow unrestricted access to a resource. Unrestricted access increases opportunities for malicious activity (hacking, denial-of-service attacks, loss of data).
If you go to AWS Trusted Advisor, you can see the details
Option A is invalid because AWS Inspector is used to detect security vulnerabilities in instances and not for security groups.
Option C is invalid because this can be used to detect changes in security groups but not show you security groups that have compromised access.
Option Dis partially valid but would just be a maintenance overhead
For more information on the AWS Trusted Advisor, please visit the below URL:
https://aws.amazon.com/premiumsupport/trustedadvisor/best-practices;
The correct answer is: Use the AWS Trusted Advisor to see which security groups have compromised access. Submit your Feedback/Queries to our Experts
NEW QUESTION 87
A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS.
Which steps should be taken to authenticate to AWS services using the company's on-premises Active Directory? (Choose three).
- A. Create IAM groups with permissions corresponding to each Active Directory group.
- B. Create IAM roles with permissions corresponding to each Active Directory group.
- C. Configure AWS as a trusted relying party for the Active Directory
- D. Create a SAML provider with IAM.
- E. Create a SAML provider with Amazon Cloud Directory.
- F. Configure IAM as a trusted relying party for Amazon Cloud Directory.
Answer: B,C,D
Explanation:
Explanation
https://aws.amazon.com/blogs/security/aws-federated-authentication-with-active-directory-federation-services-ad
NEW QUESTION 88
An organization has tens of applications deployed on thousands of Amazon EC2 instances. During testing, the Application team needs information to let them know whether the network access control lists (network ACLs) and security groups are working as expected.
How can the Application team's requirements be met?
- A. Create an AWS Config rule for each network ACL and security group configuration, send the logs to Amazon S3, and use Amazon Athena to query the logs.
- B. Install an Amazon Inspector agent on each EC2 instance, send the logs to Amazon S3, and use Amazon EMR to query the logs.
- C. Turn on VPC Flow Logs, send the logs to Amazon S3, and use Amazon Athena to query the logs.
- D. Turn on AWS CloudTrail, send the trails to Amazon S3, and use AWS Lambda to query the trails.
Answer: D
NEW QUESTION 89
A company hosts data in S3. There is now a mandate that going forward all data in the S3 bucket needs to encrypt at rest. How can this be achieved?
Please select:
- A. Use SSL certificates to encrypt the data
- B. Enable MFA on the S3 bucket
- C. Enable server side encryption on the S3 bucket
- D. Use AWS Access keys to encrypt the data
Answer: C
Explanation:
The AWS Documentation mentions the following
Server-side encryption is about data encryption at rest-that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. As long as you authenticate your request and you have access permissions, there is no difference in the way you access encrypted or unencrypted objects.
Options A and B are invalid because neither Access Keys nor SSL certificates can be used to encrypt data.
Option D is invalid because MFA is just used as an extra level of security for S3 buckets For more information on S3 server side encryption, please refer to the below Link:
https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html Submit your Feedback/Queries to our Experts
NEW QUESTION 90
A company's AWS account consists of approximately 300 IAM users. Now there is a mandate that an access change is required for 100 IAM users to have unlimited privileges to S3.As a system administrator, how can you implement this effectively so that there is no need to apply the policy at the individual user level?
Please select:
- A. Create a policy and apply it to multiple users using a JSON script
- B. Create an S3 bucket policy with unlimited access which includes each user's AWS account ID
- C. Use the IAM groups and add users, based upon their role, to different groups and apply the policy to group
- D. Create a new role and add each user to the IAM role
Answer: C
Explanation:
Option A is incorrect since you don't add a user to the IAM Role
Option C is incorrect since you don't assign multiple users to a policy
Option D is incorrect since this is not an ideal approach An IAM group is used to collectively manage users who need the same set of permissions.
By having groups, it becomes easier to manage permissions.
So if you change the permissions on the group scale, it will affect all the users in that group For more information on IAM Groups, just browse to the below URL:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_eroups.html
The correct answer is: Use the IAM groups and add users, based upon their role, to different groups and apply the policy to group Submit your Feedback/Queries to our Experts
NEW QUESTION 91
......
AWS-Security-Specialty Exam Questions – Valid AWS-Security-Specialty Dumps Pdf: https://www.passtestking.com/Amazon/AWS-Security-Specialty-practice-exam-dumps.html
AWS-Security-Specialty Practice Test Questions Answers Updated 530 Questions: https://drive.google.com/open?id=1CPjtVvxLPY2wyDb1e55__Chb78ne9X6R