A security engineer needs to implement a solution to identify any sensitive data that is stored in an Amazon S3 bucket. The solution must report on sensitive data in the S3 bucket by using an existing Amazon Simple Notification Service (Amazon SNS) topic.
Which solution will meet these requirements with the LEAST implementation effort?
A. Enable AWS Config. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.
B. Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern. Program the Lambda function to send notifications to the SNS topic.
C. Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data. Create an Amazon EventBridge rule to send notifications to the SNS topic.
D. Enable Amazon GuardDuty. Configure AWS CloudTrail S3 data events. Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic.
Show Answer
Correct Answer: C
Explanation: Amazon Macie is the AWS service designed to discover and classify sensitive data in Amazon S3 using managed data identifiers. It generates findings that can be routed through Amazon EventBridge, which can target an existing Amazon SNS topic with minimal implementation effort. AWS Config does not inspect object contents for sensitive data, a custom Lambda requires significant development, and GuardDuty detects threats rather than classifying sensitive data stored in S3.
Question 42
A public subnet contains two Amazon EC2 instances. The subnet has a custom network ACL. A security engineer is designing a solution to improve the subnet security.
The solution must allow outbound traffic to an internet service that uses TLS through port 443. The solution also must deny inbound traffic that is destined for MySQL port 3306.
Which network ACL rule set meets these requirements?
A. Use inbound rule 100 to allow traffic on TCP port 443. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
B. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port 443.
C. Use inbound rule 100 to allow traffic on TCP port range 1024-65535. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
D. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port 443. Use outbound rule 100 to allow traffic on TCP port 443.
Show Answer
Correct Answer: B
Explanation: Network ACLs are stateless, so outbound HTTPS (TCP 443) requires an outbound allow rule for destination port 443 and an inbound allow rule for the return traffic on the client's ephemeral port range (typically 1024-65535). To block inbound MySQL, add a deny rule for TCP 3306 with a lower rule number than the broader ephemeral allow so the deny is evaluated first.
Question 43
A security engineer for a company needs to design an incident response plan that addresses compromised IAM user account credentials. The company uses an organization in AWS Organizations and AWS IAM Identify Center to manage user access. The company uses a delegated administrator account to implement AWS Security Hub. The delegated administrator account contains an organizational trail in AWS CloudTrail that logs all events to an Amazon S3 bucket. The company has also configured an organizational event data store that captures all events from the trail.
The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident.
The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.
Which solution will meet these requirements?
A. Disable the compromised IAM user in the organization management account. Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.
B. Remove all IAM policies that are attached to the IAM user in the organization management account. Use Security Hub to query the CloudTrail logs for actions that the IAM user performed in the previous 7 days.
C. Remove any permission sets that arc assigned to the IAM user in IAM Identity Center. Use Amazon CloudWatch Logs Insights to directly query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed m the previous 7 days.
D. Disable the IAM user's access in IAM Identity Center. Use CloudTrail to query the organizational event data store for actions that the IAM user performed in the previous 7 days.
Show Answer
Correct Answer: D
Explanation: Because IAM Identity Center manages user access, disabling the user's access in IAM Identity Center immediately prevents access to assigned AWS accounts. For investigation, CloudTrail event data stores support querying collected organization-wide events directly for the previous 7 days, matching the requirement. Athena queries S3 logs, but the scenario explicitly provides an organizational event data store for querying. Security Hub and CloudWatch Logs Insights are not the appropriate query mechanisms here.
Question 44
A company's security engineer is designing an isolation procedure for Amazon EC2 instances as part of an incident response plan. The security engineer needs to isolate a target instance to block any traffic to and from the target instance, except for traffic from the company's forensics team. Each of the company's EC2 instances has its own dedicated security group. The EC2 instances are deployed in subnets of a VPC. A subnet can contain multiple instances.
The security engineer is testing the procedure for EC2 isolation and opens an SSH session to the target instance. The procedure starts to simulate access to the target instance by an attacker. The security engineer removes the existing security group rules and adds security group rules to give the forensics team access to the target instance on port 22.
After these changes, the security engineer notices that the SSH connection is still active and usable. When the security engineer runs a ping command to the public IP address of the target instance, the ping command is blocked.
What should the security engineer do to isolate the target instance?
A. Add an inbound rule to the security group to allow traffic from 0.0.0.0/0 for all ports. Add an outbound rule to the security group to allow traffic to 0.0.0.0/0 for all ports. Then immediately delete these rules.
B. Remove the port 22 security group rule. Attach an instance role policy that allows AWS Systems Manager Session Manager connections so that the forensics team can access the target instance.
C. Create a network ACL that is associated with the target instance's subnet. Add a rule at the top of the inbound rule set to deny all traffic from 0.0.0.0/0. Add a rule at the top of the outbound rule set to deny all traffic to 0.0.0.0/0.
D. Create an AWS Systems Manager document that adds a host-level firewall rule to block all inbound traffic and outbound traffic. Run the document on the target instance.
Show Answer
Correct Answer: A
Explanation: Security groups are stateful and existing tracked SSH connections can remain active after rules are removed. A documented way to immediately terminate existing tracked connections is to temporarily make the flow untracked by allowing all inbound and outbound traffic, then immediately remove those allow-all rules. This forces the existing connection to be dropped while preserving instance-level isolation without affecting other instances in the subnet. A subnet-level NACL would affect every instance in the subnet.
Question 45
A company is running its application on AWS. The company has a multi-environment setup, and each environment is isolated in a separate AWS account. The company has an organization in AWS Organizations to manage the accounts. There is a single dedicated security account for the organization.
The company must create an inventory of all sensitive data that is stored in Amazon S3 buckets across the organization’s accounts. The findings must be visible from a single location.
Which solution will meet these requirements?
A. Set the security account as the delegated administrator for Amazon Macie and AWS Security Hub. Enable and configure Macie to publish sensitive data findings to Security Hub.
B. Set the security account as the delegated administrator for AWS Security Hub. In each account, configure Amazon Inspector to scan the S3 buckets for sensitive data. Publish sensitive data findings to Security Hub.
C. In each account, configure Amazon Inspector to scan the S3 buckets for sensitive data. Enable Amazon Inspector integration with AWS Trusted Advisor. Publish sensitive data findings to Trusted Advisor.
D. In each account, enable and configure Amazon Macie to detect sensitive data. Enable Macie integration with AWS Trusted Advisor. Publish sensitive data findings to Trusted Advisor.
Show Answer
Correct Answer: A
Explanation: Amazon Macie is the AWS service that discovers and inventories sensitive data in Amazon S3. In an AWS Organizations environment, you can designate a delegated administrator account for Macie to centrally manage member accounts. Integrating Macie with AWS Security Hub allows sensitive data findings to be aggregated and viewed from a central security account. Amazon Inspector does not scan S3 for sensitive data, and Trusted Advisor is not the service used to aggregate Macie sensitive data findings.
Question 46
A company uses AWS IAM Identity Center to manage access to its AWS accounts. The accounts are in an organization in AWS Organizations.
A security engineer needs to set up delegated administration of IAM Identity Center in the organization's management account.
Which combination of steps should the security engineer perform in IAM Identity Center before configuring delegated administration? (Choose three.)
A. Grant least privilege access to the organization's management account.
B. Create a new IAM Identity Center directory in the organization's management account.
C. Set up a second AWS Region in the organization's management account.
D. Create permission sets for use only in the organization's management account.
E. Create IAM users for use only in the organization's management account.
F. Create user assignments only in the organization’s management account.
Show Answer
Correct Answer: A, D, F
Explanation: Before configuring delegated administration for IAM Identity Center, AWS recommends restricting access to the management account (least privilege), creating permission sets that are used only for the management account, and creating user assignments only in the management account. This ensures the delegated administrator does not manage access to the organization's management account. Creating a new directory, adding a second Region, or creating IAM users are not prerequisites for delegated administration.
Question 47
A security engineer uses Amazon Macie to scan a company’s Amazon S3 buckets for sensitive data. The company has many S3 buckets and many objects stored in the S3 buckets. The security engineer must identify S3 buckets that contain sensitive data and must perform additional scanning on those S3 buckets.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Configure S3 Cross-Region Replication (CRR) on the S3 buckets to replicate the objects to a second AWS Region. Configure Macie in the second Region to scan the replicated objects daily.
B. Create an AWS Lambda function as an S3 event destination for the S3 buckets. Configure the Lambda function to start a Macie scan of an object when the object is uploaded to an S3 bucket.
C. Configure Macie automated discovery to continuously sample data from the S3 buckets. Perform full scans of the S3 buckets where Macie discovers sensitive data.
D. Configure Macie scans to run on the S3 buckets. Aggregate the results of the scans in an Amazon DynamoDB table. Use the DynamoDB table for queries.
Show Answer
Correct Answer: C
Explanation: Amazon Macie automated discovery continuously and intelligently samples data across S3 buckets to identify buckets that are likely to contain sensitive data. This minimizes cost and administrative effort compared to scanning every object. After automated discovery identifies buckets with sensitive data, targeted full sensitive data discovery jobs can be run on those buckets. The other options add unnecessary operational overhead or do not match Macie's intended workflow.
Question 48
A security engineer is designing security controls for a fleet of Amazon EC2 instances that run sensitive workloads in a VPC. The security engineer needs to implement a solution to detect and mitigate software vulnerabilities on the EC2 instances.
Which solution will meet this requirement?
A. Scan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager.
B. Install host-based firewall and antivirus software on each EC2 instance. Use AWS Systems Manager Run Command to update the firewall and antivirus software.
C. Install the Amazon CloudWatch agent on the EC2 instances. Enable detailed logging. Use Amazon EventBridge to review the software logs for anomalies.
D. Scan the EC2 instances by using Amazon GuardDuty Malware Protection. Apply security patches and updates by using AWS Systems Manager Patch Manager.
Show Answer
Correct Answer: A
Explanation: Amazon Inspector is the AWS service designed to assess EC2 instances for software vulnerabilities and exposure. AWS Systems Manager Patch Manager automates applying security patches to supported operating systems and software. GuardDuty Malware Protection focuses on malware detection rather than vulnerability scanning, CloudWatch/EventBridge are not vulnerability management tools, and host-based firewall/antivirus alone does not provide comprehensive vulnerability detection.
Question 49
A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator.
A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application.
Which solution will meet these requirements?
A. Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.
B. Modify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack.
C. Create an AWS WAF web ACL for the ALB Create a custom rule that blocks requests that contain the user agent string of the device emulator.
D. Create an AWS WAF web ACL for the ALB. Create a custom rule that allows requests from legitimate user agent strings.
Show Answer
Correct Answer: C
Explanation: AWS WAF can inspect HTTP request attributes such as the User-Agent header and apply custom rules at the ALB. Because the attack originates from many IP addresses, IP-based blocking is ineffective. Blocking requests with the known emulator User-Agent mitigates the credential stuffing attack while still allowing other legitimate clients. A CloudWatch alarm does not block traffic, and allowing only 'legitimate' user agents would likely block valid clients and is impractical.
Question 50
A corporate cloud security policy slates that communications between the company's VPC and KMS must travel entirely within the AWS network and not use public service endpoints.
Which combination of the following actions MOST satisfies this requirement? (Choose two.)
A. Add the aws:sourceVpce condition to the AWS KMS key policy referencing the company’s VPC endpoint ID.
B. Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.
C. Create a VPC endpoint for AWS KMS with private DNS enabled.
D. Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.
E. Add the following condition to the AWS KMS key policy: "aws:SourceIp": "10.0.0.0/16".
Show Answer
Correct Answer: A, C
Explanation: Creating an interface VPC endpoint for AWS KMS with private DNS ensures KMS API calls use AWS PrivateLink and remain on the AWS network instead of public service endpoints. Adding the aws:sourceVpce condition to the KMS key policy restricts key usage to requests that come through the specified VPC endpoint, enforcing that access occurs via the private endpoint. Removing the internet gateway is unnecessary for this requirement, Import Key is unrelated to KMS API connectivity, and SourceIp is not the appropriate control for enforcing VPC endpoint usage.
$19
Get all 84 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.