Question 1

An application uses Amazon Cognito to manage end users' permissions when directly accessing AWS resources, including Amazon DynamoDB. A new feature request reads as follows: Provide a mechanism to mark customers as suspended pending investigation or suspended permanently. Customers should still be able to log in when suspended, but should not be able to make changes. The priorities are to reduce complexity and avoid potential for future security issues. Which approach will meet these requirements and priorities?

Accepted Answer

The answer of An application uses Amazon Cognito to manage...

Question 2

A company had one of its Amazon EC2 key pairs compromised. A Security Engineer must identify which current Linux EC2 instances were deployed and used the compromised key pair. How can this task be accomplished?

Accepted Answer

The answer of A company had one of its Amazon...

Question 3

A Security Engineer has discovered that, although encryption was enabled on the Amazon S3 bucket examplebucket, anyone who has access to the bucket has the ability to retrieve the files. The Engineer wants to limit access to each IAM user can access an assigned folder only. What should the Security Engineer do to achieve this?

Accepted Answer

The Security Engineer should modify the IAM policy to restrict access to the specific folder for each user by using the "${aws:username}" variable in the resource ARN. This ensures that each IAM user can only access their assigned folder within the S3 bucket.

Question 4

A Security Engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled. While testing the solution, the Security Engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?

Accepted Answer

The KMS key policy likely does not grant the Security Engineer's IAM user or role the necessary permissions to decrypt the log files, which are encrypted with SSE-KMS.

Question 5

A company has enabled Amazon GuardDuty in all Regions as part of its security monitoring strategy. In one of the VPCs, the company hosts an Amazon EC2 instance working as an FTP server that is contacted by a high number of clients from multiple locations. This is identified by GuardDuty as a brute force attack due to the high number of connections that happen every hour. The finding has been flagged as a false positive. However, GuardDuty keeps raising the issue. A Security Engineer has been asked to improve the signal-to-noise ratio. The Engineer needs to ensure that changes do not compromise the visibility of potential anomalous behavior. How can the Security Engineer address the issue?

Accepted Answer

Adding the FTP server's IP to a trusted IP list in GuardDuty will prevent it from being flagged as a threat, thus reducing false positives while maintaining visibility for other potential threats.

Question 6

An organization receives an alert that indicates that an EC2 instance behind an ELB Classic Load Balancer has been compromised. What techniques will limit lateral movement and allow evidence gathering?

Accepted Answer

Tightening the security group will prevent further access, limiting lateral movement, while keeping the instance running allows for evidence gathering.

Question 7

A Security Administrator at a university is configuring a fleet of Amazon EC2 instances. The EC2 instances are shared among students, and non-root SSH access is allowed. The Administrator is concerned about students attacking other AWS account resources by using the EC2 instance metadata service. What can the Administrator do to protect against this potential attack?

Accepted Answer

Implementing iptables-based restrictions can help control and limit access to the EC2 instance metadata service, thereby preventing unauthorized access to sensitive information that could be used to attack other AWS resources.

Question 8

A corporate cloud security policy states that communications between the company's VPC and KMS must travel entirely within the AWS network and not use public service endpoints. Which combination of the following actions MOST satisfies this requirement? (Choose two.)

Accepted Answer

The answer of A corporate cloud security policy states that...

Question 9

The Security team believes that a former employee may have gained unauthorized access to AWS resources sometime in the past 3 months by using an identified access key. What approach would enable the Security team to find out what the former employee may have done within AWS?

Accepted Answer

D  AWS CloudTrail records API calls made on your account, which can be searched using the CloudTrail console or queried using Amazon Athena if logs are stored in S3.

Question 10

An organization is using Amazon CloudWatch Logs with agents deployed on its Linux Amazon EC2 instances. The agent configuration files have been checked and the application log files to be pushed are configured correctly. A review has identified that logging from specific instances is missing. Which steps should be taken to troubleshoot the issue? (Choose two.)

Accepted Answer

The answer of An organization is using Amazon CloudWatch Logs...

Question 11

What are the MOST secure ways to protect the AWS account root user of a recently opened AWS account? (Choose two.)

Accepted Answer

The answer of What are the MOST secure ways to...

Question 12

The Security Engineer for a mobile game has to implement a method to authenticate users so that they can save their progress. Because most of the users are part of the same OpenID-Connect compatible social media website, the Security Engineer would like to use that as the identity provider. Which solution is the SIMPLEST way to allow the authentication of users using their social media identities?

Accepted Answer

Amazon Cognito is the simplest solution as it directly supports authentication with OpenID Connect compatible identity providers, such as social media websites, allowing users to authenticate using their social media identities.

Question 13

A Security Engineer discovered a vulnerability in an application running on Amazon ECS. The vulnerability allowed attackers to install malicious code. Analysis of the code shows it exfiltrates data on port 5353 in batches at random time intervals. While the code of the containers is being patched, how can Engineers quickly identify all compromised hosts and stop the egress of data on port 5353?

Accepted Answer

VPC Flow Logs can be used to monitor network traffic, and creating a custom CloudWatch metric can help identify egress traffic on port 5353. Updating the NACLs to block port 5353 outbound will stop the data exfiltration.

Question 14

An Amazon EC2 instance is part of an EC2 Auto Scaling group that is behind an Application Load Balancer (ALB). It is suspected that the EC2 instance has been compromised. Which steps should be taken to investigate the suspected compromise? (Choose three.)

Accepted Answer

The answer of An Amazon EC2 instance is part of...

Question 15

A Security Engineer is looking for a way to control access to data that is being encrypted under a CMK. The Engineer is also looking to use additional authenticated data (AAD) to prevent tampering with ciphertext. Which action would provide the required functionality?

Accepted Answer

The answer of A Security Engineer is looking for a...

Question 16

The Security Engineer is managing a web application that processes highly sensitive personal information. The application runs on Amazon EC2. The application has strict compliance requirements, which instruct that all incoming traffic to the application is protected from common web exploits and that all outgoing traffic from the EC2 instances is restricted to specific whitelisted URLs. Which architecture should the Security Engineer use to meet these requirements?

Accepted Answer

The answer of The Security Engineer is managing a web...

Question 17

A company has multiple production AWS accounts. Each account has AWS CloudTrail configured to log to a single Amazon S3 bucket in a central account. Two of the production accounts have trails that are not logging anything to the S3 bucket. Which steps should be taken to troubleshoot the issue? (Choose three.)

Accepted Answer

The answer of A company has multiple production AWS accounts....

Question 18

Compliance requirements state that all communications between company on-premises hosts and EC2 instances be encrypted in transit. Hosts use custom proprietary protocols for their communication, and EC2 instances need to be fronted by a load balancer for increased availability. Which of the following solutions will meet these requirements?

Accepted Answer

Routing traffic through a TCP listener on a Classic Load Balancer and terminating the TLS connection on the EC2 instances ensures that the communication remains encrypted end-to-end, meeting the compliance requirements.

Question 19

The Security Engineer is given the following requirements for an application that is running on Amazon EC2 and managed by using AWS CloudFormation templates with EC2 Auto Scaling groups: -Have the EC2 instances bootstrapped to connect to a backend database. -Ensure that the database credentials are handled securely. -Ensure that retrievals of database credentials are logged. Which of the following is the MOST efficient way to meet these requirements?

Accepted Answer

Storing database passwords in AWS Systems Manager Parameter Store using SecureString parameters ensures that the credentials are handled securely. Setting the IAM role for the EC2 instance profile to allow access to these parameters ensures secure retrieval, and AWS Systems Manager logs access to parameters, meeting the requirement for logging retrievals.

Question 20

A company maintains sensitive data in an Amazon S3 bucket that must be protected using an AWS KMS CMK. The company requires that keys be rotated automatically every year. How should the bucket be configured?

Accepted Answer

To enable automatic key rotation every year, you should use a customer-managed CMK with key rotation enabled. This is achieved by selecting Amazon S3-AWS KMS managed encryption keys (S3-KMS) and choosing a customer-managed CMK.

Exam 8: AWS Certified Security - Specialty (SCS-C01)