AWS Security Specialty Exam Questions

AWS Security Specialty Exam Questions

• Question 1: A Security team suspects a former employee accessed AWS resources using an access key. The best way to find out what the former employee did is to use the AWS CloudTrail console to search for user activity.
• Question 2: A Security Engineer implemented a vault lock policy with a typo, allowing incorrect access. The most cost-effective way to correct this is to abort the vault lock, fix the typo, and then initiate the vault lock again.
• Question 3: To integrate an existing Microsoft Active Directory with AWS resources, the company needs to create AWS IAM roles. These roles map permissions for AWS services to Active Directory user attributes.
• Question 4: A third-party auditor is having trouble accessing some AWS accounts using cross-account IAM roles. Potential issues include:
  • Incorrect trust relationships between the auditor's role and the target account roles.
  • Insufficient permissions granted to the auditor's role in the target accounts..
  • Account lockout due to security violations or password resets.
• Question 5: A threat involves a malicious actor uploading sensitive data from a server to an S3 bucket they control. To counter this, the following mitigation steps should be implemented:
  • Bypass the proxy server and use an S3 VPC endpoint with a policy that whitelists only certain S3 buckets in the legitimate account.
  • Configure Network ACLs on the server to deny access to S3 endpoints.
• Question 10: A company wants to store sensitive documents in three S3 buckets with different classification levels ("Sensitive", "Confidential", "Restricted"), encrypting each object with a unique key, requiring two-factor authentication for decryption of "Restricted" data, and automatic key rotation annually.
  • The solution requires creating a Customer Master Key (CMK) for each data classification type, enabling annual rotation, and utilizing S3 SSE-KMS to encrypt objects.
  • For the "Restricted" CMK, define the MFA policy within the key policy.
• Question 55: To generate automated security alerts for unauthorized AWS API requests, configure AWS CloudTrail to stream event data to Amazon Kinesis. Then, set up an AWS Lambda function on the stream to trigger alarms when the threshold of unauthorized requests is exceeded.
• Question 56: Two production AWS accounts with CloudTrail configured to log to a central S3 bucket are not logging anything. To troubleshoot, the following steps should be taken:
  • Verify the S3 bucket policy allows access for CloudTrail from the production accounts.
  • Confirm that each CloudTrail configuration is active and healthy in the CloudTrail console.
  • Check the log file prefix setting to ensure it matches the S3 bucket name.
• Question 66: To connect an on-premises application with AWS applications securely, considering unpredictable internet performance and the need to share confidential information, the ideal solution is a VPN Gateway over AWS Direct Connect.
  • This ensures secure and reliable connectivity over a dedicated connection, minimizing internet reliance and enhancing security.
• Question 67: An application using EC2 instances to retrieve messages from an Amazon SQS queue is unable to retrieve messages after IAM changes. To troubleshoot, while maintaining least privilege:
  • Verify the SQS resource policy does not have explicit access denial for the role used by the instances.
  • Check if the role attached to the instances has policies allowing access to the queue.
• Question 68: To restrict access to a web application from certain geographic regions, configure AWS CloudFront with a geographic restriction policy.
• Question 94: To mitigate the risk of a subnet being accidentally or maliciously exposed to the internet, the best approach is to mark the VPC as private and disable Elastic IP addresses within the Amazon VPC configuration.
  • This ensures the subnet remains isolated and inaccessible from the public internet.
• Question 95: An application needs to encrypt sensitive data locally using AWS KMS. The simplest yet secure approach is to store the encrypted data key alongside the encrypted data. When decryption is required, use the Decrypt API to retrieve the data key and decrypt the data.
• Question 96: A security administrator is setting up a fleet of Amazon EC2 instances for a university.
  • Consider implementing AWS Inspector for automated vulnerability assessments and security checks on the instances.
  • Review Amazon GuardDuty to detect any unusual behavior or potential threats on the EC2 fleet.
  • Use AWS Config to monitor configuration changes and enforce security compliance rules.
  • Deploy Amazon CloudWatch for comprehensive logging and monitoring of EC2 instances, helping to identify and respond to security events.
  • Enable AWS CloudTrail to audit and track API calls made to the EC2 fleet.
  • Configure IAM roles to provide least privilege access to the EC2 instances.

Test your knowledge with these AWS Security Specialty exam questions focused on IAM roles, CloudTrail, and vault lock policies. Each question challenges your understanding of AWS best practices and security measures. Prepare effectively for your certification!