A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket.
The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company’s AWS resources.
A security engineer creates a script that runs on the EC2 instance. The script uses the instance profile to generate an S3 presigned URL for the clients. Each presigned URL expires after 1 hour.
Which additional step will meet these requirements?
A. Update the S3 bucket policy to ensure that clients that use presigned URLs have the S3:Get* permission and the S3:List* permission to access S3 objects in the bucket.
B. Add a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the policy condition to restrict access based on the s3:ResourceTag/ClientId tag of each invoice. Tag each generated invoice with the ID of its corresponding client.
C. Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that has S3 GetObject permissions. Use the credentials to generate the presigned URLs.
D. Generate an access key and a secret key for an IAM user that has S3:GetObject permissions on the S3 bucket. Embed the keys into the script. Use the keys to generate the presigned URLs.
Show Answer
Correct Answer: C
Explanation: Presigned URLs are signed with the credentials used to create them. Using temporary AWS STS credentials to assume a role with the required S3 GetObject permission ensures the presigned URLs are backed by temporary credentials, satisfying the requirement that only temporary credentials be used. The URL can then expire after 1 hour. Bucket policy changes are unnecessary for presigned URLs, resource tags do not isolate access once a URL is issued, and embedding long-term IAM user keys violates the temporary credentials requirement.
Question 22
A company has two AWS accounts: Account A and Account B. Each account has a VPC. An application that runs in the VPC in Account A needs to write to an Amazon S3 bucket in Account B. The application in Account A already has permission to write to the S3 bucket in Account B.
The application and the S3 bucket are in the same AWS Region. The company cannot send network traffic over the public internet.
Which solution will meet these requirements?
A. In both accounts, create a transit gateway and VPC attachments in a subnet in each Availability Zone. Update the VPC route tables.
B. Deploy a software VPN appliance in Account A. Create a VPN connection between the software VPN appliance and a virtual private gateway in Account
C. Create a VPC peering connection between the VPC in Account A and the VPC in Account B. Update the VPC route tables, network ACLs, and security groups to allow network traffic between the peered IP ranges.
D. In Account A, create a gateway VPC endpoint for Amazon S3. Update the VPC route table in Account A.
Show Answer
Correct Answer: D
Explanation: A gateway VPC endpoint for Amazon S3 provides private connectivity from the VPC to S3 over the AWS network without traversing the public internet. Because the application already has IAM permission to write to the bucket in the other account, only private network access is needed. Cross-account access to an S3 bucket works through the S3 gateway endpoint as long as bucket and IAM policies allow it. Transit gateways, VPNs, and VPC peering connect VPCs to each other, but S3 is not hosted inside the destination VPC.
Question 23
A company is implementing a new application in a new AWS account. A VPC and subnets have been created for the application. The application has been peered to an existing VPC in another account in the same AWS Region for database access Amazon EC2 instances will regularly be created and terminated in the application VPC, but only some of them will need access to the databases in the peered VPC over TCP port 1521. A security engineer must ensure that only the EC2 instances that need access to the databases can access them through the network.
How can the security engineer implement this solution?
A. Create a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access.
B. Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access.
C. Create a new security group in the application VPC with no inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the application VPAttach the application security group to the application instances that need database access and attach the database security group to the database instances.
D. Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Add a new network ACL rule on the database subnets. Configure the rule to allow all traffic from the IP address range of the application VPC. Attach the new security group to the application instances that need database access.
Show Answer
Correct Answer: C
Explanation: Use dedicated security groups to identify only the application instances that require database access. Attach the application security group only to those EC2 instances, and configure the database security group to allow inbound TCP port 1521 from the application security group across the same-Region VPC peering connection. This provides instance-level least-privilege access and automatically accommodates frequently created and terminated instances without managing IP addresses.
Question 24
A company's public website consists of an Application Load Balancer (ALB), a set of Amazon EC2 instances that run a stateless application behind the ALB, and an Amazon DynamoDB table from which the application reads data. The company is concerned about malicious scanning and DDoS attacks. The company wants to impose a restriction in which each client IP address can read the data only 3 times in any 5-minute period.
Which solution will meet this requirement with the LEAST effort?
A. Set up AWS WAF in front of the ALB. Create a rule that blocks requests that exceed the limit of 3 requests in any 5-minute period for each IP address.
B. Create an AWS Lambda function based on an Amazon CloudWatch request. Configure the Lambda function to count the requests for each IP address in rolling 5-minute intervals and to provide notification if the count exceeds 3.
C. Modify the EC2 application to count the source IP address of requests and calculate a rolling 5-minute sum. Return an error message if the count sum is greater than 3.
D. Add source IP address and request time to the DynamoDB table. Add a 5-minute TTL setting based on request time. Change the read capacity of the DynamoDB table throughput to 3.
Show Answer
Correct Answer: A
Explanation: Using AWS WAF rate-based request limiting on the Application Load Balancer is the managed solution that requires the least implementation effort. It tracks requests by client IP over a 5-minute evaluation window and can block requests from IPs that exceed the configured threshold. The other options require custom application or Lambda logic or misuse DynamoDB throughput/TTL.
Question 25
A healthcare company stares mare than 1 million patient records in an Amazon S3 bucket. The patient records include personally identifiable information (Pit). The S3 bucket contains hundreds of terabytes of data.
A security engineer receives an alert that was triggered by an Amazon GuardDuty Exfiltration:S3/AnomalousBehavior finding. The security engineer confirms that an attacker is using temporary credentials that were obtained from a compromised Amazon EC2 instance that has s3:GetObject permissions for the S3 bucket. The attacker has begun downloading the contents of the bucket. The security engineer contacts a development team. The development team will require 4 hours to implement and deploy a fix.
The security engineer must take immediate action to prevent the attacker from downloading more data from the S3 bucket.
Which solution will moot this requirement?
A. Revoke the temporary session that is associated with the instance profile that is attached to the EC2 instance.
B. Quarantine the EC2 instance by replacing the existing security group with a new security group that has no rules applied.
C. Enable Amazon Made on the S3 bucket. Configure the managed data identifiers for personally identifiable information (PII). Enable S3 Object Lock on objects that Macie flags.
D. Apply an S3 bucket policy temporarily. Configure the policy to deny read access for all principals to block downloads while the development team address the vulnerability.
Show Answer
Correct Answer: D
Explanation: A temporary explicit deny on the S3 bucket for s3:GetObject immediately stops further downloads regardless of which temporary credentials are being used. Revoking sessions may not immediately stop all active access and quarantining the instance does not invalidate already-stolen credentials. Macie/Object Lock does not mitigate ongoing exfiltration.
Sources:
https://www.certlibrary.com/exam/AWS%20Certified%20Security%20-%20Specialty%20SCS-C03
Question 26
A company recently set up Amazon GuardDuty and is receiving a high number of findings from IP addresses within the company. A security engineer has verified that these IP addresses are trusted and allowed.
Which combination of steps should the security engineer take to configure GuardDuty so that it does not produce findings for these IP addresses? (Choose two.)
A. Create a plaintext configuration file that contains the trusted IP addresses.
B. Create a JSON configuration file that contains the trusted IP addresses.
C. Upload the configuration file directly to GuardDuty.
D. Upload the configuration file to Amazon S3. Add a new trusted IP list to GuardDuty that points to the file.
E. Manually copy and paste the configuration file data into the trusted IP list in GuardDuty.
Show Answer
Correct Answer: A, D
Explanation: GuardDuty suppresses findings from trusted internal IPs by using a Trusted IP list (IPSet). The IP list must be a plaintext file containing one CIDR or IP address per line, stored in an Amazon S3 bucket. You then create an IPSet (trusted IP list) in GuardDuty that references the S3 object. GuardDuty does not accept JSON, direct uploads, or manual pasting into the console.
Question 27
A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises data center for compliance reasons. The database is sensitive to network latency. Additionally, the data that travels between the on-premises data center and AWS must have IPsec encryption.
Which combination of AWS solutions will meet these requirements? (Choose two.)
A. AWS Site-to-Site VPN
B. AWS Direct Connect
C. AWS VPN CloudHub
D. VPC peering
E. NAT gateway
Show Answer
Correct Answer: A, B
Explanation: AWS Direct Connect provides a dedicated, low-latency network connection suitable for latency-sensitive database traffic. Direct Connect by itself does not provide IPsec encryption, so combining it with an AWS Site-to-Site VPN (VPN over Direct Connect/private or transit virtual interface) provides IPsec-encrypted traffic while retaining the benefits of the dedicated connection. VPN CloudHub is for connecting multiple sites, VPC peering does not connect on-premises networks, and a NAT gateway is unrelated.
Question 28
A company is running an application on Amazon EC2 instances in an Auto Scaling group. The application stores logs locally. A security engineer noticed that logs were lost after a scale-in event. The security engineer needs to recommend a solution to ensure the durability and availability of log data. All logs must be kept for a minimum of 1 year for auditing purposes.
What should the security engineer recommend?
A. Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review.
B. Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation. Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system.
C. Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review.
D. Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon Simple Notification Service (Amazon SNS). Configure the hook to remain in the Terminating:Wait state for 1 hour to allow manual review of the security logs prior to instance termination.
Show Answer
Correct Answer: C
Explanation: Using the Amazon CloudWatch agent to stream logs continuously to Amazon CloudWatch Logs ensures logs are preserved independently of EC2 instance lifecycle events. CloudWatch Logs is durable, supports configurable retention of at least 1 year (or longer), and is the standard solution for centralized log collection from Auto Scaling instances. The other options either rely on instance-attached storage, delayed copying, or manual intervention and do not provide the same durability and operational reliability.
Question 29
A security engineer recently rotated the host keys for an Amazon EC2 instance. The security engineer is trying to access the EC2 instance by using the EC2 Instance Connect feature. However, the security engineer receives an error for failed host key validation. Before the rotation of the host keys, EC2 Instance Connect worked correctly with this EC2 instance.
What should the security engineer do lo resolve this error?
A. Import the key material into AWS Key Management Service (AWS KMS).
B. Manually upload the new host key to the AWS trusted host keys database
C. Ensure that the AmazonSSMManagedInstanceCore policy is attached to the EC2 instance profile.
D. Create a new SSH key pair for the EC2 instance.
Show Answer
Correct Answer: B
Explanation: EC2 Instance Connect validates the instance's SSH host key. After rotating the host key, clients or the trusted host key store must be updated to trust the new host key. Importing keys into KMS is unrelated, the SSM policy is for Systems Manager rather than EC2 Instance Connect host key validation, and creating a new SSH key pair affects user authentication, not host key verification.
Question 30
A company wants to store all objects that contain sensitive data in an Amazon S3 bucket. The company will use server-side encryption to encrypt the S3 bucket. The company’s operations team manages access to the company’s S3 buckets. The company’s security team manages access to encryption keys.
The company wants to separate the duties of the two teams to ensure that configuration errors by only one of these teams will not compromise the data by granting unauthorized access to plaintext data.
Which solution will meet this requirement?
A. Ensure that the operations team configures default bucket encryption on the S3 bucket to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to use the encryption keys.
B. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed. Ensure that the security team creates a key policy that controls access to the encryption keys.
C. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with Amazon S3 managed keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to the encryption keys.
D. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with customer-provided encryption keys (SSE-C). Ensure that the security team stores the customer-provided keys in AWS Key Management Service (AWS KMS). Ensure that the security team creates a key policy that controls access to the encryption keys.
Show Answer
Correct Answer: B
Explanation: Using SSE-KMS with a customer-managed KMS key provides separation of duties. The operations team can enforce encryption by requiring SSE-KMS through the S3 bucket policy, while the security team independently controls who can use the KMS key through the KMS key policy. Access to plaintext requires both S3 object permissions and KMS key permissions, so a configuration error by only one team does not grant unauthorized plaintext access.
$19
Get all 84 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.