A company's public website consists of an Application Load Balancer (ALB), a set of Amazon EC2 instances that run a stateless application behind the ALB, and an Amazon DynamoDB table from which the application reads data. The company is concerned about malicious scanning and DDoS attacks. The company wants to impose a restriction in which each client IP address can read the data only 3 times in any 5-minute period.
Which solution will meet this requirement with the LEAST effort?
A. Set up AWS WAF in front of the ALB. Create a rule that blocks requests that exceed the limit of 3 requests in any 5-minute period for each IP address.
B. Create an AWS Lambda function based on an Amazon CloudWatch request. Configure the Lambda function to count the requests for each IP address in rolling 5-minute intervals and to provide notification if the count exceeds 3.
C. Modify the EC2 application to count the source IP address of requests and calculate a rolling 5-minute sum. Return an error message if the count sum is greater than 3.
D. Add source IP address and request time to the DynamoDB table. Add a 5-minute TTL setting based on request time. Change the read capacity of the DynamoDB table throughput to 3.
Show Answer
Correct Answer: A
Explanation: Using AWS WAF rate-based request limiting on the Application Load Balancer is the managed solution that requires the least implementation effort. It tracks requests by client IP over a 5-minute evaluation window and can block requests from IPs that exceed the configured threshold. The other options require custom application or Lambda logic or misuse DynamoDB throughput/TTL.
Question 25
A healthcare company stares mare than 1 million patient records in an Amazon S3 bucket. The patient records include personally identifiable information (Pit). The S3 bucket contains hundreds of terabytes of data.
A security engineer receives an alert that was triggered by an Amazon GuardDuty Exfiltration:S3/AnomalousBehavior finding. The security engineer confirms that an attacker is using temporary credentials that were obtained from a compromised Amazon EC2 instance that has s3:GetObject permissions for the S3 bucket. The attacker has begun downloading the contents of the bucket. The security engineer contacts a development team. The development team will require 4 hours to implement and deploy a fix.
The security engineer must take immediate action to prevent the attacker from downloading more data from the S3 bucket.
Which solution will moot this requirement?
A. Revoke the temporary session that is associated with the instance profile that is attached to the EC2 instance.
B. Quarantine the EC2 instance by replacing the existing security group with a new security group that has no rules applied.
C. Enable Amazon Made on the S3 bucket. Configure the managed data identifiers for personally identifiable information (PII). Enable S3 Object Lock on objects that Macie flags.
D. Apply an S3 bucket policy temporarily. Configure the policy to deny read access for all principals to block downloads while the development team address the vulnerability.
Show Answer
Correct Answer: D
Explanation: A temporary explicit deny on the S3 bucket for s3:GetObject immediately stops further downloads regardless of which temporary credentials are being used. Revoking sessions may not immediately stop all active access and quarantining the instance does not invalidate already-stolen credentials. Macie/Object Lock does not mitigate ongoing exfiltration.
Sources:
https://www.certlibrary.com/exam/AWS%20Certified%20Security%20-%20Specialty%20SCS-C03
Question 26
A company recently set up Amazon GuardDuty and is receiving a high number of findings from IP addresses within the company. A security engineer has verified that these IP addresses are trusted and allowed.
Which combination of steps should the security engineer take to configure GuardDuty so that it does not produce findings for these IP addresses? (Choose two.)
A. Create a plaintext configuration file that contains the trusted IP addresses.
B. Create a JSON configuration file that contains the trusted IP addresses.
C. Upload the configuration file directly to GuardDuty.
D. Upload the configuration file to Amazon S3. Add a new trusted IP list to GuardDuty that points to the file.
E. Manually copy and paste the configuration file data into the trusted IP list in GuardDuty.
Show Answer
Correct Answer: A, D
Explanation: GuardDuty suppresses findings from trusted internal IPs by using a Trusted IP list (IPSet). The IP list must be a plaintext file containing one CIDR or IP address per line, stored in an Amazon S3 bucket. You then create an IPSet (trusted IP list) in GuardDuty that references the S3 object. GuardDuty does not accept JSON, direct uploads, or manual pasting into the console.
Question 27
A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises data center for compliance reasons. The database is sensitive to network latency. Additionally, the data that travels between the on-premises data center and AWS must have IPsec encryption.
Which combination of AWS solutions will meet these requirements? (Choose two.)
A. AWS Site-to-Site VPN
B. AWS Direct Connect
C. AWS VPN CloudHub
D. VPC peering
E. NAT gateway
Show Answer
Correct Answer: A, B
Explanation: AWS Direct Connect provides a dedicated, low-latency network connection suitable for latency-sensitive database traffic. Direct Connect by itself does not provide IPsec encryption, so combining it with an AWS Site-to-Site VPN (VPN over Direct Connect/private or transit virtual interface) provides IPsec-encrypted traffic while retaining the benefits of the dedicated connection. VPN CloudHub is for connecting multiple sites, VPC peering does not connect on-premises networks, and a NAT gateway is unrelated.
Question 29
A security engineer recently rotated the host keys for an Amazon EC2 instance. The security engineer is trying to access the EC2 instance by using the EC2 Instance Connect feature. However, the security engineer receives an error for failed host key validation. Before the rotation of the host keys, EC2 Instance Connect worked correctly with this EC2 instance.
What should the security engineer do lo resolve this error?
A. Import the key material into AWS Key Management Service (AWS KMS).
B. Manually upload the new host key to the AWS trusted host keys database
C. Ensure that the AmazonSSMManagedInstanceCore policy is attached to the EC2 instance profile.
D. Create a new SSH key pair for the EC2 instance.
Show Answer
Correct Answer: B
Explanation: EC2 Instance Connect validates the instance's SSH host key. After rotating the host key, clients or the trusted host key store must be updated to trust the new host key. Importing keys into KMS is unrelated, the SSM policy is for Systems Manager rather than EC2 Instance Connect host key validation, and creating a new SSH key pair affects user authentication, not host key verification.
Question 30
A company wants to store all objects that contain sensitive data in an Amazon S3 bucket. The company will use server-side encryption to encrypt the S3 bucket. The company’s operations team manages access to the company’s S3 buckets. The company’s security team manages access to encryption keys.
The company wants to separate the duties of the two teams to ensure that configuration errors by only one of these teams will not compromise the data by granting unauthorized access to plaintext data.
Which solution will meet this requirement?
A. Ensure that the operations team configures default bucket encryption on the S3 bucket to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to use the encryption keys.
B. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed. Ensure that the security team creates a key policy that controls access to the encryption keys.
C. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with Amazon S3 managed keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to the encryption keys.
D. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with customer-provided encryption keys (SSE-C). Ensure that the security team stores the customer-provided keys in AWS Key Management Service (AWS KMS). Ensure that the security team creates a key policy that controls access to the encryption keys.
Show Answer
Correct Answer: B
Explanation: Using SSE-KMS with a customer-managed KMS key provides separation of duties. The operations team can enforce encryption by requiring SSE-KMS through the S3 bucket policy, while the security team independently controls who can use the KMS key through the KMS key policy. Access to plaintext requires both S3 object permissions and KMS key permissions, so a configuration error by only one team does not grant unauthorized plaintext access.
Question 32
A company is running a new workload across accounts that are in an organization in AWS Organizations. All running resources must have a tag of CostCenter, and the tag must have one of three approved values. The company must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value.
Which solution will meet these requirements?
A. Create an AWS Config Custom Policy rule by using AWS CloudFormatlon Guard. Include the tag key of CostCenter and the approved values. Create an SCP that denies the creation of resources when the value of the aws:RequestTagCostCenter condition key is not one of the three approved values.
B. Create an AWS CloudTrail trail. Create an Amazon EventBridge rule that includes a rule statement that matches the creation of new resources. Configure the EventBridge rule to invoke an AWS Lambda function that checks for the CostCenter tag. Program the Lambda function to block creation in case of a noncompliant value.
C. Enable tag policies for the organization. Create a tag policy that specifies a tag key of CostCenter and the approved values. Configure the policy to enforce noncompliant operations. Create an SCP that denies the creation of resources when the aws:RequestTag.CostCenter condition key has a null value.
D. Enable tag policies for the organization. Create a tag policy that specifies a tag key of CostCenter and the approved values. Create an Amazon EventBridge rule that invokes an AWS Lambda function when a noncompliant tag is created. Program the Lambda function to block changes to the tag.
Show Answer
Correct Answer: C
Explanation: AWS Organizations tag policies are designed to standardize and enforce allowed tag keys and values across organization accounts. With enforcement enabled for supported resource types, noncompliant tagging operations (including invalid CostCenter values) are prevented. Because tag policies do not require a tag to exist on all create operations, an SCP using the aws:RequestTag/CostCenter null condition ensures the CostCenter tag is mandatory at resource creation. Together these satisfy both required presence and approved values.
Question 33
A company wants to deny a specific federated user named Bob access to an Amazon S3 bucket named DOC-EXAMPLE-BUCKET. The company wants to meet this requirement by using a bucket policy. The company also needs to ensure that this bucket policy affects Bob's S3 permissions only. Any other permissions that Bob has must remain intact.
Which policy should the company use to meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: B
Explanation: For a federated user, the bucket policy should use a Deny that targets only Bob's federated principal (or the appropriate aws:userid/PrincipalArn condition for that federated session) on the specific S3 bucket. An explicit Deny in the bucket policy affects only access to that bucket and does not remove or alter Bob's other AWS permissions.
Question 34
A company uses AWS Organizations to manage its AWS accounts. The company has a development account and a production account. An auditor has requested evidence that the production account workloads are resilient to disruption. The company needs a solution that improves the resilience of each production account workload.
Which solution will meet these requirements?
A. Use AWS Audit Manager to create a new assessment based on AWS Operational Best Practices in the production account. After the assessments are finished, provide the auditor with direct access to the reports.
B. Review the architecture by using the AWS Well-Architected Tool. Use the Well-Architected Framework and focus on the Operational Excellence, Security, and Reliability pillars. Document and implement mitigations for the identified risks. Provide the documentation to the auditor.
C. Use Amazon Inspector with a multi-account environment to assess the production account workloads for vulnerabilities. Create a CIS scan in Amazon Inspector. Configure the CIS scan as a one time scan with Benchmark Level 2. After the scan is finished, download the PDF report and provide the report to the auditor.
D. Use the AWS Fault Injection Service to create experiments in the development account for each workload. Adjust the configuration and architecture of the workloads to improve resilience. Run the experiments again. Download the PDF reports and provide the reports to the auditor.
Show Answer
Correct Answer: B
Explanation: The requirement is to improve the resilience of each production workload and provide evidence to an auditor. The AWS Well-Architected Tool, using the Well-Architected Framework with emphasis on the Reliability pillar (and relevant Operational Excellence and Security considerations), identifies architectural risks and recommended improvements. Documenting and implementing mitigations directly improves resilience and provides evidence. Audit Manager collects compliance evidence but does not improve resilience. Amazon Inspector focuses on vulnerabilities/CIS benchmarks, not workload resilience. AWS Fault Injection Service is valuable for resilience testing, but running experiments only in the development account does not provide evidence that the production workloads themselves are resilient.
Question 35
A company has enabled AWS Config for its organization in AWS Organizations. The company has deployed hundreds of Amazon S3 buckets across the organization.
A security engineer needs to identify any S3 buckets that are not encrypted with AWS Key Management Service (AWS KMS). The security engineer also must prevent objects that are not encrypted with AWS KMS from being uploaded to the S3 buckets.
Which solution will meet these requirements?
A. Use the s3-default-encryplion-kms AWS. Config managed rule to identity unencrypted S3 buckets. Create an SCP to allow the s3:PutObject action only when the object is encrypted with AWS KMS.
B. Use the s3-default-encryption-kms AWS. Config managed rule to identify unencrypted S3 buckets. Create bucket policies for each S3 bucket to deny the s3:PutObject action only when the object has server-since encryption with S3 managed keys (SSE-S3).
C. Use the s3-bucket-ssl-requests-only AWS Config managed rule to identify unencrypted S3 buckets. Create an SCP to allow the s3:PutObject action only when the object is encrypted with AWS KMS.
D. Use the s3-bucket-ssl-requests-only AWS Config managed rule to identify unencrypted S3 buckets. Create bucket policies for each S3 bucket to allow the s3:PutObject action only when the object is encrypted with AWS KMS.
Show Answer
Correct Answer: A
Explanation: The AWS Config managed rule s3-default-encryption-kms identifies S3 buckets that do not have default AWS KMS encryption configured. To prevent uploads that are not encrypted with AWS KMS across an AWS Organizations environment, an SCP can enforce that PutObject requests include AWS KMS server-side encryption conditions. The alternatives either use the wrong Config rule or enforce the wrong encryption type or an impractical per-bucket approach.
$19
Get all 87 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.