16 October, 2019

Amazon AWS Certified Security - Specialty AWS-Certified-Security-Specialty Braindumps

are updated and are verified by experts. Once you have completely prepared with our you will be ready for the real AWS-Certified-Security-Specialty exam without a problem. We have . PASSED First attempt! Here What I Did.

Check AWS-Certified-Security-Specialty free dumps before getting the full version:

Page: 1 / 15

Total 191 questions Full Exam Access

Question 1

You have a vendor that needs access to an AWS resource. You create an AWS user account. You want to restrict access to the resource using a policy for just that user over a brief period. Which of the following would be an ideal policy to use?
Please select:

An AWS Managed Policy

An Inline Policy

A Bucket Policy

A bucket ACL

Question 2

A company has a set of resources defined in AWS. It is mandated that all API calls to the resources be monitored. Also all API calls must be stored for lookup purposes. Any log data greater than 6 months must be archived. Which of the following meets these requirements? Choose 2 answers from the options given below. Each answer forms part of the solution.
Please select:

Enable CloudTrail logging in all accounts into S3 buckets

Enable CloudTrail logging in all accounts into Amazon Glacier

Ensure a lifecycle policy is defined on the S3 bucket to move the data to EBS volumes after 6 months.

Ensure a lifecycle policy is defined on the S3 bucket to move the data to Amazon Glacier after 6 months.

Question 3

There is a set of Ec2 Instances in a private subnet. The application hosted on these EC2 Instances need to access a DynamoDB table. It needs to be ensured that traffic does not flow out to the internet. How can this be achieved?
Please select:

Use a VPC endpoint to the DynamoDB table

Use a VPN connection from the VPC

Use a VPC gateway from the VPC

Use a VPC Peering connection to the DynamoDB table

Question 4

Which of the following is the responsibility of the customer? Choose 2 answers from the options given below.
Please select:

Management of the Edge locations

Encryption of data at rest

Protection of data in transit

Decommissioning of old storage devices

Question 5

Your IT Security team has identified a number of vulnerabilities across critical EC2 Instances in the company's AWS Account. Which would be the easiest way to ensure these vulnerabilities are remediated?
Please select:

Create AWS Lambda functions to download the updates and patch the servers.

Use AWS CLI commands to download the updates and patch the servers.

Use AWS inspector to patch the servers

Use AWS Systems Manager to patch the servers

Question 6

An application running on EC2 instances in a VPC must call an external web service via TLS (port 443). The instances run in public subnets.
Which configurations below allow the application to function and minimize the exposure of the instances? Select 2 answers from the options given below
Please select:

A network ACL with a rule that allows outgoing traffic on port 443.

A network ACL with rules that allow outgoing traffic on port 443 and incoming traffic on ephemeral ports

A network ACL with rules that allow outgoing traffic on port 443 and incoming traffic on port 443.

A security group with a rule that allows outgoing traffic on port 443

A security group with rules that allow outgoing traffic on port 443 and incoming traffic on ephemeral ports.

A security group with rules that allow outgoing traffic on port 443 and incoming traffic on port 443.

Question 7

You have just received an email from AWS Support stating that your AWS account might have been compromised. Which of the following steps would you look to carry out immediately. Choose 3 answers from the options below.
Please select:

Change the root account password.

Rotate all 1AM access keys

Keep all resources running to avoid disruption

Change the password for all 1AM user

Question 8

DDoS attacks that happen at the application layer commonly target web applications with lower volumes of traffic compared to infrastructure attacks. To mitigate these types of attacks, you should probably want to include a WAF (Web Application Firewall) as part of your infrastructure. To inspect all HTTP requests, WAFs sit in-line with your application traffic. Unfortunately, this creates a scenario where WAFs can become a point of failure or bottleneck. To mitigate this problem, you need the ability to run multiple WAFs on demand during traffic spikes. This type of scaling for WAF is done via a

The EC2 instance running your WAF software is placed between your private subnets and any NATed connections to the internet.

The EC2 instance running your WAF software is placed between your public subnets and your Internet Gateway.

The EC2 instance running your WAF software is placed between your public subnets and your private subnets.

he EC2 instance running your WAF software is included in an Auto Scaling group and placed in between two Elastic load balancers.

Question 9

Your company uses AWS to host its resources. They have the following requirements
1) Record all API calls and Transitions
2) Help in understanding what resources are there in the account
3) Facility to allow auditing credentials and logins Which services would suffice the above requirements
Please select:

AWS Inspector, CloudTrail, IAM Credential Reports

CloudTrai

IAM Credential Reports, AWS SNS

CloudTrail, AWS Config, IAM Credential Reports

AWS SQS, IAM Credential Reports, CloudTrail

My answer: -

Reference answer: C

Reference analysis:

You can use AWS CloudTrail to get a history of AWS API calls and related events for your account. This history includes calls made with the AWS Management Console, AWS Command Line Interface, AWS SDKs, and other AWS services.
Options A,B and D are invalid because you need to ensure that you use the services of CloudTrail, AWS Config, 1AM Credential Reports
For more information on Cloudtrail, please visit the below URL: http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html
AWS Config is a service that enables you to assess, audit and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, char management and operational troubleshooting.
For more information on the config service, please visit the below URL https://aws.amazon.com/config/
You can generate and download a credential report that lists all users in your account and the status of their various credentials, including passwords, access keys, and MFA devices. You can get a credential report from the AWS Management Console, the AWS SDKs and Command Line Tools, or the 1AM API.
For more information on Credentials Report, please visit the below URL: http://docs.aws.amazon.com/IAM/latest/UserGuide/id credentials_getting-report.html
The correct answer is: CloudTrail, AWS Config, 1AM Credential Reports Submit your Feedback/Queries to our Experts

Question 10

A Lambda function reads metadata from an S3 object and stores the metadata in a DynamoDB table.
The function is triggered whenever an object is stored within the S3 bucket.
How should the Lambda function be given access to the DynamoDB table? Please select:

Create a VPC endpoint for DynamoDB within a VP

Configure the Lambda function to access resources in the VPC.

Create a resource policy that grants the Lambda function permissions to write to the DynamoDB tabl

Attach the poll to the DynamoDB table.

Create an 1AM user with permissions to write to the DynamoDB tabl

Store an access key for that user in the Lambda environment variables.

Create an 1AM service role with permissions to write to the DynamoDB tabl

Associate that role with the Lambda function.

My answer: -

Reference answer: D

Reference analysis:

The ideal way is to create an 1AM role which has the required permissions and then associate it with the Lambda function
The AWS Documentation additionally mentions the following
Each Lambda function has an 1AM role (execution role) associated with it. You specify the 1AM role when you create your Lambda function. Permissions you grant to this role determine what AWS Lambda can do when it assumes the role. There are two types of permissions that you grant to the 1AM role:
If your Lambda function code accesses other AWS resources, such as to read an object from an S3 bucket or write logs to CloudWatch Logs, you need to grant permissions for relevant Amazon S3 and CloudWatch actions to the role.
If the event source is stream-based (Amazon Kinesis Data Streams and DynamoDB streams), AWS Lambda polls these streams on your behalf. AWS Lambda needs permissions to poll the stream and read new records on the stream so you need to grant the relevant permissions to this role.
Option A is invalid because the VPC endpoint allows access instances in a private subnet to access DynamoDB
Option B is invalid because resources policies are present for resources such as S3 and KMS, but not AWS Lambda
Option C is invalid because AWS Roles should be used and not 1AM Users
For more information on the Lambda permission model, please visit the below URL: https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html
The correct answer is: Create an 1AM service role with permissions to write to the DynamoDB table. Associate that role with the Lambda function.
Submit your Feedback/Queries to our Exp

Question 11

Your company has an EC2 Instance that is hosted in an AWS VPC. There is a requirement to ensure that logs files from the EC2 Instance are stored accordingly. The access should also be limited for the destination of the log files. How can this be accomplished? Choose 2 answers from the options given below. Each answer forms part of the solution
Please select:

Stream the log files to a separate Cloudtrail trail

Stream the log files to a separate Cloudwatch Log group

Create an 1AM policy that gives the desired level of access to the Cloudtrail trail

Create an 1AM policy that gives the desired level of access to the Cloudwatch Log group

Question 12

Your team is designing a web application. The users for this web application would need to sign in via an external ID provider such asfacebook or Google. Which of the following AWS service would you use for authentication?
Please select:

AWS Cognito

AWS SAML

AWS 1AM

AWS Config

Question 13

Your company has the following setup in AWS

A set of EC2 Instances hosting a web application

An application load balancer placed in front of the EC2 InstancesThere seems to be a set of malicious requests coming from a set of IP addresse

Which of the following can be used to protect against these requests?Please select:

Use Security Groups to block the IP addresses

Use VPC Flow Logs to block the IP addresses

Use AWS inspector to block the IP addresses

Use AWS WAF to block the IP addresses

Question 14

A company has hired a third-party security auditor, and the auditor needs read-only access to all AWS resources and logs of all VPC records and events that have occurred on AWS. How can the company meet the auditor's requirements without comprising security in the AWS environment? Choose the correct answer from the options below
Please select:

Create a role that has the required permissions for the auditor.

Create an SNS notification that sends the CloudTrail log files to the auditor\'s email when CIoudTrail delivers the logs to S3, but do not allow the auditor access to the AWS environment.

The company should contact AWS as part of the shared responsibility model, and AWS will grant required access to th^ third-party auditor.

Enable CloudTrail logging and create an 1AM user who has read-only permissions to the required AWS resources, including the bucket containing the CloudTrail logs.

Question 16

You need to create a Linux EC2 instance in AWS. Which of the following steps is used to ensure secure authentication the EC2 instance from a windows machine. Choose 2 answers from the options given below.
Please select:

Ensure to create a strong password for logging into the EC2 Instance

Create a key pair using putty

Use the private key to log into the instance

Ensure the password is passed securely using SSL

Question 17

A company wants to have a secure way of generating, storing and managing cryptographic exclusive access for the keys. Which of the following can be used for this purpose?
Please select:

Use KMS and the normal KMS encryption keys

Use KMS and use an external key material

Use S3 Server Side encryption

Use Cloud HSM

My answer: -

Reference answer: D

Reference analysis:

The AWS Documentation mentions the following
The AWS CloudHSM service helps you meet corporate, contractual and regulatory compliance requirements for data security by using dedicated Hardware Security Module (HSM) instances within the AWS cloud. AWS and AWS Marketplace partners offer a variety of solutions for protecting sensitive data within the AWS platform, but for some applications and data subject to contractual or regulatory mandates for managing cryptographic keys, additional protection may be necessary. CloudHSM complements existing data protection solutions and allows you to protect your encryption keys within HSMs that are desigr and validated to government standards for secure key management. CloudHSM allows you to securely generate, store and manage cryptographic keys used for data encryption in a way that keys are accessible only by you.
Option A.B and Care invalid because in all of these cases, the management of the key will be with AWS. Here the question specifically mentions that you want to have exclusive access over the keys. This can be achieved with Cloud HSM
For more information on CloudHSM, please visit the following URL: https://aws.amazon.com/cloudhsm/faq:
The correct answer is: Use Cloud HSM Submit your Feedback/Queries to our Experts

Question 18

An application running on EC2 instances processes sensitive information stored on Amazon S3. The information is accessed over the Internet. The security team is concerned that the Internet connectivity to Amazon S3 is a security risk. Which solution will resolve the security concern? Please select:

Access the data through an Internet Gateway.

Access the data through a VPN connection.

Access the data through a NAT Gateway.

Access the data through a VPC endpoint for Amazon S3

Question 19

Your company makes use of S3 buckets for storing dat

There is a company policy that all services should have logging enable

How can you ensure thatlogging is always enabled for created S3 buckets in the AWS Account? Please select:

Use AWS Inspector to inspect all S3 buckets and enable logging for those where it is not enabled

Use AWS Config Rules to check whether logging is enabled for buckets

Use AWS Cloudwatch metrics to check whether logging is enabled for buckets

Use AWS Cloudwatch logs to check whether logging is enabled for buckets

Question 20

Your development team has started using AWS resources for development purposes. The AWS account has just been created. Your IT Security team is worried about possible leakage of AWS keys. What is the first level of measure that should be taken to protect the AWS account.
Please select:

Delete the AWS keys for the root account

Create 1AM Groups

Create 1AM Roles

Restrict access using 1AM policies

Question 21

Your company has defined a set of S3 buckets in AWS. They need to monitor the S3 buckets and know the source IP address and the person who make requests to the S3 bucket. How can this be achieved?
Please select:

Enable VPC flow logs to know the source IP addresses

Monitor the S3 API calls by using Cloudtrail logging

Monitor the S3 API calls by using Cloudwatch logging

Enable AWS Inspector for the S3 bucket

Question 22

You have an S3 bucket hosted in AWS. This is used to host promotional videos uploaded by yourself. You need to provide access to users for a limited duration of time. How can this be achieved?
Please select:

Use versioning and enable a timestamp for each version

Use Pre-signed URL\'s

Use 1AM Roles with a timestamp to limit the access

Use 1AM policies with a timestamp to limit the access

Page: 1 / 15

Total 191 questions Full Exam Access