Question 1

During a manual review of system logs from an Amazon Linux EC2 instance, a Security Engineer noticed that there are sudo commands that were never properly alerted or reported on the Amazon CloudWatch Logs agent. Why were there no alerts on the sudo commands?

Accepted Answer

The IAM instance profile must be properly configured to allow the CloudWatch Logs agent to push logs to CloudWatch. Without the correct permissions, the logs will not be sent.

Question 2

An application running on Amazon EC2 instances generates log files in a folder on a Linux file system. The instances block access to the console and file transfer utilities, such as Secure Copy Protocol (SCP) and Secure File Transfer Protocol (SFTP). The Application Support team wants to automatically monitor the application log files so the team can set up notifications in the future. A Security Engineer must design a solution that meets the following requirements: Make the log files available through an AWS managed service. Allow for automatic monitoring of the logs. Provide an interface for analyzing logs. Minimize effort. Which approach meets these requirements?

Accepted Answer

The unified Amazon CloudWatch agent can collect log files from EC2 instances and send them to Amazon CloudWatch Logs, which is an AWS managed service. This allows for automatic monitoring and provides an interface for analyzing logs, meeting all the requirements with minimal effort.

Question 3

A company requires that SSH commands used to access its AWS instance be traceable to the user who executed each command. How should a Security Engineer accomplish this?

Accepted Answer

The answer of A company requires that SSH commands used...

Question 4

A large company wants its Compliance team to audit its Amazon S3 buckets to identify if personally identifiable information (PII) is stored in them. The company has hundreds of S3 buckets and has asked the Security Engineers to scan every bucket. How can this task be accomplished?

Accepted Answer

Amazon Macie is a service specifically designed to classify and protect sensitive data, including PII, in Amazon S3 buckets. It can automatically discover, classify, and protect sensitive data using machine learning.

Question 5

A large corporation is creating a multi-account strategy and needs to determine how its employees should access the AWS Infrastructure. Which of the following solutions would provide the MOST scalable solution?

Accepted Answer

The answer of A large corporation is creating a multi-account...

Question 6

A company needs a forensic-logging solution for hundreds of applications running in Docker on Amazon EC2. The solution must perform real-time analytics on the logs, must support the replay of messages, and must persist the logs. Which AWS services should be used to meet these requirements? (Choose two.)

Accepted Answer

Amazon Kinesis can be used for real-time analytics and message replay, while Amazon Elasticsearch can be used to persist and search the logs.

Question 7

A company's web application is hosted on Amazon EC2 instances running behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. AWS CloudTrail is enabled, and stores logs in Amazon S3 and Amazon CloudWatch Logs. The Operations team has observed some EC2 instances reboot at random. After rebooting, all access logs on the instances have been deleted. During an investigation, the Operations team found that each reboot happened just after a PHP error occurred on the new-user-creation.php file. The Operations team needs to view log information to determine if the company is being attacked. Which set of actions will identify the suspect attacker's IP address for future occurrences?

Accepted Answer

VPC Flow Logs will capture all the traffic going in and out of the subnet where the ALB is located. By streaming the data to CloudWatch, the Operations team can search for the new-user-creation.php occurrences and identify the suspect attacker's IP address.

Question 8

A company has a compliance requirement to rotate its encryption keys on an annual basis. A Security Engineer needs a process to rotate the KMS Customer Master Keys (CMKs) that were created using imported key material. How can the Engineer perform the key rotation process MOST efficiently?

Accepted Answer

The answer of A company has a compliance requirement to...

Question 9

A company needs to retain log data archives for several years to be compliant with regulations. The log data is no longer used, but it must be retained. What is the MOST secure and cost-effective solution to meet these requirements?

Accepted Answer

The answer of A company needs to retain log data...

Question 10

A company uses an Amazon S3 bucket to store reports. Management has mandated that all new objects stored in this bucket must be encrypted at rest using server-side encryption with a client specified AWS Key Management Service (AWS KMS) CMK owned by the same account as the S3 bucket. The AWS account number is 111122223333, and the bucket name is reportbucket. The company's security specialist must write the S3 bucket policy to ensure the mandate can be implemented. Which statement should the security specialist include in the policy?

Accepted Answer

The answer of A company uses an Amazon S3 bucket...

Question 11

Developers in an organization have moved from a standard application deployment to containers. The Security Engineer is tasked with ensuring that containers are secure. Which strategies will reduce the attack surface and enhance the security of the containers? (Choose two.)

Accepted Answer

The answer of Developers in an organization have moved from...

Question 12

A company manages multiple AWS accounts using AWS Organizations. The company's security team notices that some member accounts are not sending AWS CloudTrail logs to a centralized Amazon S3 logging bucket. The security team wants to ensure there is at least one trail configured for all existing accounts and for any account that is created in the future. Which set of actions should the security team implement to accomplish this?

Accepted Answer

The answer of A company manages multiple AWS accounts using...

Question 13

A company's security information events management (SIEM) tool receives new AWS CloudTrail logs from an Amazon S3 bucket that is configured to send all object created event notifications to an Amazon SNS topic. An Amazon SQS queue is subscribed to this SNS topic. The company's SIEM tool then polls this SQS queue for new messages using an IAM role and fetches new log events from the S3 bucket based on the SQS messages. After a recent security review that resulted in restricted permissions, the SIEM tool has stopped receiving new CloudTrail logs. Which of the following are possible causes of this issue? (Choose three.)

Accepted Answer

The answer of A company's security information events management (SIEM)...

Question 14

An organizational must establish the ability to delete an AWS KMS Customer Master Key (CMK) within a 24-hour timeframe to keep it from being used for encrypt or decrypt operations. Which of the following actions will address this requirement?

Accepted Answer

The schedule key deletion function in AWS KMS allows you to specify a minimum wait period for deletion, which can be set to 24 hours.

Question 15

A company uses HTTP Live Streaming (HLS) to stream live video content to paying subscribers by using Amazon CloudFront. HLS splits the video content into chunks so that the user can request the right chunk based on different conditions. Because the video events last for several hours, the total video is made up of thousands of chunks. The origin URL is not disclosed, and every user is forced to access the CloudFront URL. The company has a web application that authenticates the paying users against an internal repository and a CloudFront key pair that is already issued. What is the simplest and MOST effective way to protect the content?

Accepted Answer

Using signed URLs with CloudFront key pairs is a straightforward and effective way to control access to content, ensuring that only authenticated users can access the video chunks.

Question 16

A company plans to use custom AMIs to launch Amazon EC2 instances across multiple AWS accounts in a single Region to perform security monitoring and analytics tasks. The EC2 instances are launched in EC2 Auto Scaling groups. To increase the security of the solution, a Security Engineer will manage the lifecycle of the custom AMIs in a centralized account and will encrypt them with a centrally managed AWS KMS CMK. The Security Engineer configured the KMS key policy to allow cross-account access. However, the EC2 instances are still not being properly launched by the EC2 Auto Scaling groups. Which combination of configuration steps should the Security Engineer take to ensure the EC2 Auto Scaling groups have been granted the proper permissions to execute task?

Accepted Answer

The answer of A company plans to use custom AMIs...

Question 17

Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic. Which of the following troubleshooting steps should be performed?

Accepted Answer

Reviewing the rejected packet reason codes in the VPC Flow Logs will provide information about why the packets are being dropped.

Question 18

A security engineer noticed an anomaly within a company EC2 instance as shown in the image. The engineer must now investigate what is causing the anomaly.  What are the MOST effective steps to take to ensure that the instance is not further manipulated, while allowing the engineer to understand what happened?

Accepted Answer

The answer of A security engineer noticed an anomaly within...

Question 19

A company's data lake uses Amazon S3 and Amazon Athena. The company's security engineer has been asked to design an encryption solution that meets the company's data protection requirements. The encryption solution must work with Amazon S3 and keys managed by the company. The encryption solution must be protected in a hardware security module that is validated to Federal information Processing Standards (FIPS) 140-2 Level 3. Which solution meets these requirements?

Accepted Answer

The answer of A company's data lake uses Amazon S3...

Question 20

A company's Chief Security Officer has requested that a Security Analyst review and improve the security posture of each company AWS account. The Security Analyst decides to do this by improving AWS account root user security. Which actions should the Security Analyst take to meet these requirements? (Choose three.)

Accepted Answer

The answer of A company's Chief Security Officer has requested...

Exam 8: AWS Certified Security - Specialty (SCS-C01)