A company begins to use AWS WAF after experiencing an increase in traffic to the company's public web applications. A security engineer needs to determine if the increase in traffic is because of application-layer attacks. The security engineer needs a solution to analyze AWS WAF traffic.
Which solution will meet this requirement?
A. Configure AWS WAF to send logs to a trail in AWS CloudTrail. Create an Amazon Data Firehose delivery stream to send the logs to Amazon OpenSearch Service. Use OpenSearch Dashboards and an Amazon Athena connector to query the logs.
B. Configure AWS WAF to send logs to an Amazon S3 bucket Configure an OpenSearch table with a partition projection of the S3 bucket. Use OpenSearch to query the data in the S3 bucket
C. Configure AWS WAF to send logs to an Amazon S3 bucket. Configure an Amazon Athena table with a partition projection of the S3 bucket. Use Athena to query the data in the S3 bucket.
D. Configure AWS WAF to send logs to a trail in AWS CloudTrail. Create an Amazon Data Firehose delivery stream to send the logs to an Amazon S3 bucket. Use Amazon Athena to query the data in the S3 bucket.
Show Answer
Correct Answer: C
Explanation: AWS WAF supports logging web ACL traffic to Amazon S3 (via supported logging destinations), and Amazon Athena is the standard service for querying log files stored in S3. Using partition projection avoids manual partition management and improves query efficiency for time-based log data. The CloudTrail options are incorrect because AWS WAF traffic logs are not delivered as CloudTrail trails, and OpenSearch does not query S3 via an 'OpenSearch table' as described.
Question 12
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company wants to centrally give users the ability to access Amazon Q Developer.
Which solution will meet this requirement?
A. Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application.
B. Enable Amazon Cognito and create a new identity pool for Amazon Q Developer.
C. Enable Amazon Cognito and set up Amazon Q Developer as an AWS managed application
D. Enable AWS IAM Identity Center and create a new identity pool for Amazon Q Developer.
Show Answer
Correct Answer: A
Explanation: AWS IAM Identity Center is the recommended centralized identity service for AWS Organizations. Amazon Q Developer integrates as an AWS managed application with IAM Identity Center for centralized user assignment and access management across multiple AWS accounts. Amazon Cognito identity pools are intended for application end-user identities and are not used to centrally provision Amazon Q Developer access in an organization.
Question 13
A company in France uses Amazon Cognito with the Cognito Hosted UI as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application's users will come from France.
When the company launches the application, the company’s security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France.
The security team needs a solution to perform custom validation at sign-up. Based on the results of the validation, the solution must accept or deny the registration request.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool.
B. Use a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.
C. Configure an app client for the application’s Amazon Cognito user pool. Use the app client ID to validate the requests in the hosted UI.
D. Update the application’s Amazon Cognito user pool to configure a geographic restriction setting.
E. Use Amazon Cognito to configure a social identity provider (IdP) to validate the requests on the hosted UI.
Show Answer
Correct Answer: A, B
Explanation: A pre sign-up Lambda trigger allows custom validation logic and can accept or reject user registrations before the user is created. An AWS WAF web ACL with a geographic match rule can be associated with the Amazon Cognito Hosted UI/user pool endpoint to block requests originating outside France, reducing fraudulent sign-ups. Cognito has no built-in geographic restriction setting, app client IDs do not perform this validation, and social identity providers do not provide the required custom sign-up validation.
Question 14
A company runs critical workloads in an on-premises data center. The company wants to implement an AWS based disaster recovery (DR) solution that will achieve an RTO of less than 1 hour. The company needs to continuously replicate physical and virtual servers. The company must optimize costs for data storage and bandwidth usage. The DR solution must be automated.
Which solution will meet these requirements?
A. Use AWS Backup to directly replicate the on-premises servers to AWS. Enable cross-Region backup copying and data vaulting. Configure recovery points to match the defined RTO. Use AWS Step Functions to automate recovery steps.
B. Configure an AWS Storage Gateway Volume Gateway to use Amazon Elastic Block Store (Amazon EBS) snapshots for recovery. Configure AWS Backup to manage the snapshots. Create automated recovery procedures.
C. Enable AWS Elastic Disaster Recovery. Configure replication agents to continuously replicate each on-premises server. Enable the default staging area subnet configuration.
D. Create an AWS Direct Connect connection between the on-premises data center and AWS. Configure Amazon EventBridge to monitor for failures and to invoke AWS Lambda functions that launch preconfigured Amazon EC2 instances from AMIs in the event of an incident.
Show Answer
Correct Answer: C
Explanation: AWS Elastic Disaster Recovery (AWS DRS) is purpose-built for disaster recovery of physical and virtual on-premises servers. It provides continuous block-level replication, automated failover and recovery orchestration, supports RTOs of minutes (well under 1 hour), and uses a low-cost staging area to optimize storage and bandwidth until recovery is needed. The other options either use services not designed for continuous server replication or require significant custom implementation.
Question 15
A company is using Amazon Made, AWS Firewall Manager. Amazon Inspector, and AWS Shield Advanced in its AWS account. The company wants to receive alerts if a DDoS attack occurs against the account.
Which solution will meet this requirement?
A. Use Macie to detect an active DDoS event. Create Amazon CloudWatch alarms that respond to Macie findings.
B. Use Amazon Inspector to review resources and to invoke Amazon CloudWatch alarms for any resources that are vulnerable to DDoS attacks.
C. Create an Amazon CloudWatch alarm that monitors Firewall Manager metrics for an active DDoS event.
D. Create an Amazon CloudWatch alarm that monitors Shield Advanced metrics for an active DDoS event.
Show Answer
Correct Answer: D
Explanation: AWS Shield Advanced is the AWS service that detects and protects against DDoS attacks. It publishes DDoS-related metrics to Amazon CloudWatch, which can be used to create CloudWatch alarms and notifications (for example, via Amazon SNS) when an active DDoS event is detected. Macie is for sensitive data discovery, Inspector is for vulnerability management, and Firewall Manager is for centrally managing security policies rather than detecting DDoS events itself.
Question 16
HOTSPOT
-
A company is developing an incident response process to quarantine Amazon EC2 hosts that become infected by malware. The company uses an organization in AWS Organizations to manage multiple AWS accounts. The company configures AWS Security Hub in the organization to receive findings from multiple accounts that run across multiple AWS Regions. A security engineer develops an AWS Lambda function to remove all the rules from all security groups for any EC2 instance the company suspects might be infected by malware.
Select and order the correct steps from the following list to deploy and use the Lambda function as a custom action in Security Hub. Select each step one time or not at all. (Select and order THREE.)
• Create a custom action that uses the Lambda function in Security Hub.
• Create and apply a filter set to the Amazon EventBridge rule in Security Hub.
• Define a rule in Amazon EventBridge.
• Select the custom action in Security Hub for EC2 host findings.
• Select the custom action in Security Hub for security group findings.
Show Answer
Correct Answer: Step 1: Create a custom action that uses the Lambda function in Security Hub.
Step 2: Define a rule in Amazon EventBridge.
Step 3: Select the custom action in Security Hub for EC2 host findings.
Explanation: Security Hub custom actions emit EventBridge events. An EventBridge rule matches the custom action event and invokes the Lambda function. Analysts then run the custom action on EC2 host findings to trigger the remediation. Filters on EventBridge are part of the rule's event pattern, not a separate Security Hub deployment step, and security group findings are not the target.
Question 17
A company uses an organization in AWS Organizations to manage multiple AWS accounts. Users access AWS accounts by using IAM users and secret access keys. A security team requires all access to accounts to use temporary security credentials that expire after 60 minutes. Users must use a SAML-based identity provider (IdP) to access the accounts.
Which solution will meet these requirements?
A. Enable access to the AWS Security Token Service (AWS STS). Ensure that users run the get-session-token AWS CLI command with an appropriate duration. Require users to use STS temporary credentials to access AWS accounts.
B. Set up AWS IAM Identity Center and configure an external IdP. Configure permission sets that allow the access that the users require. Configure a session duration limit. Require the users to retrieve SSO credentials by using the AWS CLI. Remove the IAM users from the AWS accounts.
C. Set up AWS Secrets Manager and Amazon Cognito in each AWS account. Configure a Cognito identity pool to use an external IdP and connect to Secrets Manager. Enable managed secret rotation in Secrets Manager. Ensure that the users run the get-secret-value AWS CLI command to access the AWS accounts.
D. Enable AWS IAM Roles Anywhere in the organization management account. Ensure that users install the credential helper tool. Configure IAM roles within the management account with an appropriate session duration. Ensure that the users retrieve temporary credentials from the credential helper tool to access the AWS accounts.
Show Answer
Correct Answer: B
Explanation: AWS IAM Identity Center integrates with an external SAML identity provider, issues temporary AWS STS credentials, supports configurable session durations (such as 60 minutes), and is the recommended approach for multi-account access through AWS Organizations. Removing IAM users ensures access is through federated temporary credentials only.
Question 18
A company maintains both on-premises legacy systems and resources in AWS. The AWS resources include an Amazon DynamoDB table and an Amazon S3 bucket. The on-premises legacy systems need to connect to DynamoDB and Amazon S3 on a regular basis.
The company currently uses a bastion host in a public subnet in a VPC. The company connects to the bastion host by using an SSH private key that the company stores on-premises. The instance profile that is assigned to the bastion host has full access to Amazon S3 and DynamoDB.
A security team issues a new internal policy that requires all bastion hosts to be removed. The policy requires all systems to authenticate by using certificate-based authentication.
Which solution will meet these requirements?
A. Set up an AWS Direct Connect connection and create a VPN connection to a VPC that has access to VPC endpoints for the required services.
B. Set up the on-premises systems to use AWS IAM Roles Anywhere to authenticate.
C. Use AWS Private Certificate Authority to issue SSL certificates to give on-premises systems access to resources on AWS.
D. Create an IAM user that has permission to temporarily assume an IAM role and to use temporarily assumed role credentials to access the required resources.
Show Answer
Correct Answer: B
Explanation: AWS IAM Roles Anywhere is designed to allow workloads running outside AWS to authenticate using X.509 certificates issued by a trusted CA and obtain temporary AWS credentials for IAM roles. This satisfies the requirement to remove bastion hosts and use certificate-based authentication while accessing Amazon S3 and DynamoDB. AWS Private CA alone only issues certificates and does not grant IAM access. Direct Connect/VPN provides network connectivity but not certificate-based IAM authentication. IAM users with assumed roles rely on IAM credentials rather than X.509 certificate authentication.
Question 19
A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off.
What is the MOST efficient way to implement this solution?
A. Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.
B. Create an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging API.
C. Create an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLogging event name to invoke an AWS Lambda function to call the StartLogging API.
D. Monitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.
Show Answer
Correct Answer: A
Explanation: AWS Config provides a managed rule to detect when CloudTrail is not enabled and can automatically invoke the AWS-EnableCloudTrail remediation to re-enable logging. This is the most efficient approach because it uses managed detection and auto-remediation without custom code and can be deployed across multiple Regions. EventBridge option B listens for StartLogging rather than StopLogging, C incorrectly uses CloudWatch alarms for CloudTrail API events instead of EventBridge/CloudTrail event matching, and Trusted Advisor does not provide automatic remediation.
Question 20
An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connect to the website during the attack period. The ecommerce company's security team is worried about future potential attacks and wants to prepare for such events. The company needs to minimize downtime in its response to similar attacks in the future.
Which steps would help achieve this? (Choose two.)
A. Enable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
B. Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack.
C. Use VPC Flow Logs to monitor network traffic and an AWS Lambda function to automatically block an attacker's IP using security groups.
D. Set up an Amazon EventBridge rule to monitor the AWS CloudTrail events in real time, use AWS Config rules to audit the configuration, and use AWS Systems Manager for remediation.
E. Use AWS WAF to create rules to respond to such attacks.
Show Answer
Correct Answer: B, E
Explanation: AWS Shield Advanced provides enhanced DDoS protection, automatic mitigation capabilities, and access to the AWS DDoS Response Team (DRT), helping reduce downtime during attacks. AWS WAF can filter and block malicious web requests with rate-based and custom rules, mitigating application-layer DDoS attacks in real time. GuardDuty detects threats but does not automatically block DDoS traffic, VPC Flow Logs with Lambda and security groups are not an effective primary DDoS mitigation strategy, and EventBridge/CloudTrail/Config/Systems Manager focus on auditing and remediation rather than real-time DDoS protection.
$19
Get all 84 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
