AWS-Security-Specialty Practice Questions

A.  

In the Aurora cluster configuration, set therequire_secure_transportDB cluster parameter toON.

B.  

Use AWS Directory Service for Microsoft Active Directory to create a user directory and to enforce Kerberos authentication with Aurora.

C.  

Configure the Aurora cluster to use AWS Certificate Manager (ACM) to provide encryption certificates.

D.  

Create an Amazon RDS proxy. Connect the proxy to the Aurora cluster to enable encryption.

A.  

Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.

B.  

Use encrypted parameters in the CloudFormation template.

C.  

Use SecureString parameters to reference Secrets Manager.

D.  

Use SecureString parameters encrypted by AWS KMS.

A.  

Enable CloudTrail log file integrity validation from the organization ' s management account.

B.  

Enable server-side encryption with AWS KMS keys (SSE-KMS) for CloudTrail logs. Create a KMS key. Attach a policy to the key to prevent decryption of the logs.

C.  

Create a service control policy (SCP) that includes an explicitDenyrule for the cloudtrail:StopLogging action and the cloudtrail:DeleteTrail action. Attach the SCP to the root OU.

D.  

Create IAM policies for all the company ' s users to prevent the users from performing the DescribeTrails action and the GetTrailStatus action.

A.  

Enable VPC Flow Logs in the VPC where the ALB is deployed. Examine the source field to capture the client IP addresses.

B.  

Inspect the X-Forwarded-For header in the AWS WAF logs to determine the original client IP addresses.

C.  

Modify the CloudFront distribution to disable ALB connection reuse. Examine the clientIp field in the AWS WAF logs to identify the original client IP addresses.

D.  

Configure CloudFront to add a custom header named Client-IP to origin requests that are sent to the AL

B.  

A.  

Use AWS Backup to create backups of the EC2 instances and S3 buckets every hour. Create AWS CloudFormation templates that replicate existing architecture components. Use a Git repository to store the CloudFormation templates alongside application configuration code.

B.  

Use AWS Backup to create backups of the EBS volumes and S3 objects every day. Use Amazon Security Lake to create a centralized data lake for AWS CloudTrail logs and VPC flow logs. Use the logs for automated response.

C.  

Use Amazon Security Lake to create a centralized data lake for AWS CloudTrail logs and VPC flow logs. Use the logs for automated response. Enable AWS Security Hub to establish a single location for recovery procedures. Create AWS CloudFormation templates that replicate existing architecture components. Use a Git repository to store the CloudFormation templates alongside application configuration code.

D.  

Create EBS snapshots every 4 hours. Enable Amazon GuardDuty Malware Protection. Create automation to immediately restore the most recent snapshot for any EC2 instances that produce an Execution:EC2/MaliciousFile finding in GuardDuty.

A.  

Require the developers to configure all function URLs to support cross-origin resource sharing (CORS) when the functions are called from a different domain.

B.  

Use an AWS WAF delegated administrator account to view and block unauthenticated access to function URLs in production accounts, based on the OU of accounts that are using the functions.

C.  

Use SCPs to allow all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions that have a lambda:FunctionUrlAuthType condition key value of AWS_IAM.

D.  

Use SCPs to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions that have a lambda:FunctionUrlAuthType condition key value of NON

E.  

A.  

Enable AWS Config. Create a proactive AWS Config Custom Policy rule. Create a Guard clause to evaluate the S3 bucket policies to check for a value of True for the aws:SecureTransport condition key. If the AWS Config rule evaluates to NON_COMPLIANT, block resource creation.

B.  

Enable AWS Config. Configure the s3-bucket-ssl-requests-only AWS Config managed rule and set the rule trigger type to Hybrid. Create an AWS Systems Manager Automation runbook that applies a bucket policy to deny requests when the value of the aws:SecureTransport condition key is False. Configure automatic remediation. Set the runbook as the target of the rule.

C.  

Enable Amazon Inspector. Create a custom AWS Lambda rule. Create a Lambda function that applies a bucket policy to deny requests when the value of the aws:SecureTransport condition key is False. Set the Lambda function as the target of the rule.

D.  

Create an AWS CloudTrail trail. Enable S3 data events on the trail. Create an AWS Lambda function that applies a bucket policy to deny requests when the value of the aws:SecureTransport condition key is False. Configure the CloudTrail trail to invoke the Lambda function.

A.  

Configure the S3 Block Public Access feature for the AWS account.

B.  

Configure the S3 Block Public Access feature for all objects that are in the bucket.

C.  

Deactivate ACLs for objects that are in the bucket.

D.  

Use AWS PrivateLink for Amazon S3 to access the bucket.

A.  

Grant access to the EC2 serial console at the account level.

B.  

Enable EC2 Instance Connect and configure security group rules.

C.  

Assign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy that grants access to Systems Manager Session Manager. Assign the policy to an IAM role of the DevOps team.

D.  

Use AWS Systems Manager Automation runbooks to open remote access ports.

A.  

Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string. Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.

B.  

Modify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack.

C.  

Create an AWS WAF web ACL for the AL

B.  

D.  

Create an AWS WAF web ACL for the AL

B.