What is the effect of the following AWS Key Management Service (AWS KMS} key policy that is attached to a customer managed key?
A. Amazon WorkMail and Amazon Simple Email Service (Amazon SES) have delegated KMS encrypt and decrypt permissions to the ExampleRole principal in the 111122223333 account.
B. The ExampleRole principal can transparently encrypt and decrypt email exchanges specifically between ExampleRole and AWS.
C. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.
D. The key policy allows Amazon WorkMail or Amazon Simple Email Service (Amazon SES) to encrypt or decrypt on behalf of the ExampleRole for any customer managed key in the account.
Show Answer
Correct Answer: C
Explanation: A KMS key policy using the kms:ViaService condition restricts use of the customer managed key to requests that are made through the specified AWS service(s) in the specified AWS Region, and the principal specified in the policy must also match. It does not grant permissions for all keys, nor does it create transparent email encryption only between AWS and the role.
Question 32
A company is running a new workload across accounts that are in an organization in AWS Organizations. All running resources must have a tag of CostCenter, and the tag must have one of three approved values. The company must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value.
Which solution will meet these requirements?
A. Create an AWS Config Custom Policy rule by using AWS CloudFormatlon Guard. Include the tag key of CostCenter and the approved values. Create an SCP that denies the creation of resources when the value of the aws:RequestTagCostCenter condition key is not one of the three approved values.
B. Create an AWS CloudTrail trail. Create an Amazon EventBridge rule that includes a rule statement that matches the creation of new resources. Configure the EventBridge rule to invoke an AWS Lambda function that checks for the CostCenter tag. Program the Lambda function to block creation in case of a noncompliant value.
C. Enable tag policies for the organization. Create a tag policy that specifies a tag key of CostCenter and the approved values. Configure the policy to enforce noncompliant operations. Create an SCP that denies the creation of resources when the aws:RequestTag.CostCenter condition key has a null value.
D. Enable tag policies for the organization. Create a tag policy that specifies a tag key of CostCenter and the approved values. Create an Amazon EventBridge rule that invokes an AWS Lambda function when a noncompliant tag is created. Program the Lambda function to block changes to the tag.
Show Answer
Correct Answer: C
Explanation: AWS Organizations tag policies are designed to standardize and enforce allowed tag keys and values across organization accounts. With enforcement enabled for supported resource types, noncompliant tagging operations (including invalid CostCenter values) are prevented. Because tag policies do not require a tag to exist on all create operations, an SCP using the aws:RequestTag/CostCenter null condition ensures the CostCenter tag is mandatory at resource creation. Together these satisfy both required presence and approved values.
Question 33
A company wants to deny a specific federated user named Bob access to an Amazon S3 bucket named DOC-EXAMPLE-BUCKET. The company wants to meet this requirement by using a bucket policy. The company also needs to ensure that this bucket policy affects Bob's S3 permissions only. Any other permissions that Bob has must remain intact.
Which policy should the company use to meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: B
Explanation: For a federated user, the bucket policy should use a Deny that targets only Bob's federated principal (or the appropriate aws:userid/PrincipalArn condition for that federated session) on the specific S3 bucket. An explicit Deny in the bucket policy affects only access to that bucket and does not remove or alter Bob's other AWS permissions.
Question 34
A company uses AWS Organizations to manage its AWS accounts. The company has a development account and a production account. An auditor has requested evidence that the production account workloads are resilient to disruption. The company needs a solution that improves the resilience of each production account workload.
Which solution will meet these requirements?
A. Use AWS Audit Manager to create a new assessment based on AWS Operational Best Practices in the production account. After the assessments are finished, provide the auditor with direct access to the reports.
B. Review the architecture by using the AWS Well-Architected Tool. Use the Well-Architected Framework and focus on the Operational Excellence, Security, and Reliability pillars. Document and implement mitigations for the identified risks. Provide the documentation to the auditor.
C. Use Amazon Inspector with a multi-account environment to assess the production account workloads for vulnerabilities. Create a CIS scan in Amazon Inspector. Configure the CIS scan as a one time scan with Benchmark Level 2. After the scan is finished, download the PDF report and provide the report to the auditor.
D. Use the AWS Fault Injection Service to create experiments in the development account for each workload. Adjust the configuration and architecture of the workloads to improve resilience. Run the experiments again. Download the PDF reports and provide the reports to the auditor.
Show Answer
Correct Answer: B
Explanation: The requirement is to improve the resilience of each production workload and provide evidence to an auditor. The AWS Well-Architected Tool, using the Well-Architected Framework with emphasis on the Reliability pillar (and relevant Operational Excellence and Security considerations), identifies architectural risks and recommended improvements. Documenting and implementing mitigations directly improves resilience and provides evidence. Audit Manager collects compliance evidence but does not improve resilience. Amazon Inspector focuses on vulnerabilities/CIS benchmarks, not workload resilience. AWS Fault Injection Service is valuable for resilience testing, but running experiments only in the development account does not provide evidence that the production workloads themselves are resilient.
Question 35
A company has enabled AWS Config for its organization in AWS Organizations. The company has deployed hundreds of Amazon S3 buckets across the organization.
A security engineer needs to identify any S3 buckets that are not encrypted with AWS Key Management Service (AWS KMS). The security engineer also must prevent objects that are not encrypted with AWS KMS from being uploaded to the S3 buckets.
Which solution will meet these requirements?
A. Use the s3-default-encryplion-kms AWS. Config managed rule to identity unencrypted S3 buckets. Create an SCP to allow the s3:PutObject action only when the object is encrypted with AWS KMS.
B. Use the s3-default-encryption-kms AWS. Config managed rule to identify unencrypted S3 buckets. Create bucket policies for each S3 bucket to deny the s3:PutObject action only when the object has server-since encryption with S3 managed keys (SSE-S3).
C. Use the s3-bucket-ssl-requests-only AWS Config managed rule to identify unencrypted S3 buckets. Create an SCP to allow the s3:PutObject action only when the object is encrypted with AWS KMS.
D. Use the s3-bucket-ssl-requests-only AWS Config managed rule to identify unencrypted S3 buckets. Create bucket policies for each S3 bucket to allow the s3:PutObject action only when the object is encrypted with AWS KMS.
Show Answer
Correct Answer: A
Explanation: The AWS Config managed rule s3-default-encryption-kms identifies S3 buckets that do not have default AWS KMS encryption configured. To prevent uploads that are not encrypted with AWS KMS across an AWS Organizations environment, an SCP can enforce that PutObject requests include AWS KMS server-side encryption conditions. The alternatives either use the wrong Config rule or enforce the wrong encryption type or an impractical per-bucket approach.
Question 36
An IAM user receives an Access Denied message when the user attempts to access objects in an Amazon S3 bucket. The user and the S3 bucket are in the same AWS account. The S3 bucket is configured to use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt all of its objects at rest by using a customer managed key from the same AWS account. The S3 bucket has no bucket policy defined. The IAM user has been granted permissions through an IAM policy that allows the kms:Decrypt permission to the customer managed key. The IAM policy also allows the s3:List* and s3:Get* permissions for the S3 bucket and its objects.
Which of the following is a possible reason that the IAM user cannot access the objects in the S3 bucket?
A. The IAM policy needs to allow the kms:DescribeKey permission.
B. The S3 bucket has been changed to use the AWS managed key to encrypt objects at rest.
C. An S3 bucket policy needs to be added to allow the IAM user to access the objects.
D. The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.
Show Answer
Correct Answer: D
Explanation: For SSE-KMS, access requires both S3 permissions and authorization to use the KMS key. IAM permissions alone are not sufficient if the KMS key policy does not allow the account to use IAM policies (or otherwise authorize the principal). If the key policy was modified to remove the account's full access/default delegation, decrypt requests can fail with Access Denied even though the IAM policy grants kms:Decrypt. kms:DescribeKey is not required for S3 object reads, no bucket policy is needed for same-account access when IAM allows it, and switching to an AWS managed key would not match the stated configuration.
Question 37
A company runs an application on a fleet of Amazon EC2 instances. The company can remove instances from the fleet without risk to the application. All EC2 instances use the same security group named ProdFleet. Amazon GuardDuty and AWS Config are active in the company's AWS account.
A security engineer needs to provide a solution that will prevent an EC2 instance from sending outbound traffic if GuardDuty generates a cryptocurrency finding event. The security engineer creates a new security group named isolate that contains no outbound rules. The security engineer configures an AWS Lambda function to remove an EC2 instance from the ProdFleet security group and add it to the isolate security group.
Which additional step will meet this requirement?
A. Configure GuardDuty to directly invoke the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.
B. Configure an AWS Config rule that invokes the Lambda function if a CryptoCurroncy:EC2/* configuration change event occurs for an EC2 instance.
C. Configure an Amazon EventBridge rule that invokes the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.
D. Configure an Amazon EventBridge rule that invokes the Lambda function if AWS Config detects a CryptoCurrency:ЕС2/* configuration change event for an EC2 instance.
Show Answer
Correct Answer: C
Explanation: Amazon GuardDuty emits findings as Amazon EventBridge events. Create an EventBridge rule that matches GuardDuty finding types in the CryptoCurrency:EC2/* category and invokes the Lambda function, which swaps the instance's security group to the isolate group, preventing outbound traffic. GuardDuty does not directly invoke Lambda, and AWS Config does not generate GuardDuty cryptocurrency finding events.
Question 38
A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The auditor is having trouble accessing some of the accounts.
Which of the following may be causing this problem? (Choose three.)
A. The external ID used by the auditor is missing or incorrect.
B. The auditor is using the incorrect password.
C. The auditor has not been granted sts:AssumeRole for the role in the destination account.
D. The Amazon EC2 role used by the auditor must be set to the destination account role.
E. The secret key used by the auditor is missing or incorrect.
F. The role ARN used by the auditor is missing or incorrect.
Show Answer
Correct Answer: A, C, F
Explanation: Cross-account role assumption requires the caller to specify the correct role ARN, have permission to call sts:AssumeRole on the target role, and satisfy the target role's trust policy, including providing the correct external ID if the trust policy requires one. Incorrect console passwords or access keys are not specific causes of AssumeRole failures in this scenario, and an EC2 instance profile does not need to match the destination role.
Question 39
A company uses AWS Organizations. The company has learns that use an AWS CloudHSM hardware security module (HSM) that is hosted in a central AWS account. One of the teams creates its own new dedicated AWS account and wants to use the HSM that is hosted in the central account.
How should a security engineer share the HSM that is hosted in the central account with the new dedicated account?
A. Use AWS Resource Access Manager (AWS RAM) to share the VPC subnet ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.
B. Use AWS Identity and Access Management (IAM) to create a cross-account role to access the CloudHSM cluster that is in the central account. Create a new IAM user in the new dedicated account. Assign the cross-account role to the new IAM user.
C. Use AWS IAM Identity Center to create an AWS Security Token Service (AWS STS) token to authenticate from the new dedicated account to the central account. Use the cross-account permissions that are assigned to the STS token to invoke an operation on the HSM in the central account.
D. Use AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the now dedicated account.
Show Answer
Correct Answer: A
Explanation: AWS CloudHSM access is based on network connectivity to the HSM ENIs, not cross-account IAM role assumptions or STS operations. In a multi-account AWS Organizations setup, share the VPC subnet that hosts the CloudHSM using AWS RAM, then allow the client instances from the new account to reach the HSM by configuring the CloudHSM security group appropriately. You do not share the HSM resource ID itself via RAM.
Question 40
A company is investigating an increase in its AWS monthly bill. The company discovers that bad actors compromised some Amazon EC2 instances and served webpages for a large email phishing campaign.
A security engineer must implement a solution to monitor for cost increases in the future to help detect malicious activity.
Which solution will offer the company the EARLIEST detection of cost increases?
A. Create an Amazon EventBridge rule that invokes an AWS Lambda function hourly. Program the Lambda function to download an AWS usage report from AWS Data Exports about usage of all services. Program the Lambda function to analyze the report and to send a notification when anomalies are detected.
B. Create a cost monitor in AWS Cost Anomaly Detection. Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage above the expected cost exceeds a threshold.
C. Review AWS Cost Explorer daily to detect anomalies in cost from prior months. Review the usage of any services that experience a significant cost increase from prior months.
D. Capture VPC flow logs from the VPC where the EC2 instances run. Use a third-party network analysis tool to analyze the flow logs and to detect anomalies in network traffic that might increase cost.
Show Answer
Correct Answer: B
Explanation: AWS Cost Anomaly Detection is designed to continuously monitor AWS spending using machine learning and can send Amazon SNS alerts when unexpected cost increases are detected. It provides earlier detection of anomalous cost spikes than manual Cost Explorer reviews or custom reporting based on usage exports, and VPC Flow Logs monitor network activity rather than costs.
$19
Get all 84 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.