AWS Certified Security - Specialty

AWS Certified Security - Specialty practice questions, page 12 of 21, with answer review and explanations.

Question 56

A company has multiple production AWS accounts. Each account has AWS CloudTrail configured to log to a single Amazon S3 bucket in a central account. Two of the production accounts have trails that are not logging anything to the S3 bucket. Which steps should be taken to troubleshoot the issue? (Choose three.)

  1. Verify that the log file prefix is set to the name of the S3 bucket where the logs should go.
  2. Verify that the S3 bucket policy allows access for CloudTrail from the production AWS account IDs.
  3. Create a new CloudTrail configuration in the account, and configure it to log to the account's S3 bucket.
  4. Confirm in the CloudTrail Console that each trail is active and healthy.
  5. Open the global CloudTrail configuration in the master account, and verify that the storage location is set to the correct S3 bucket.
  6. Confirm in the CloudTrail Console that the S3 bucket name is set correctly.

Question 57

Amazon CloudWatch Logs agent is successfully delivering logs to the CloudWatch Logs service. However, logs stop being delivered after the associated log stream has been active for a specific number of hours. What steps are necessary to identify the cause of this phenomenon? (Choose two.)

  1. Ensure that file permissions for monitored files that allow the CloudWatch Logs agent to read the file have not been modified.
  2. Verify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming.
  3. Configure an Amazon Kinesis producer to first put the logs into Amazon Kinesis Streams.
  4. Create a CloudWatch Logs metric to isolate a value that changes at least once during the period before logging stops.
  5. Use AWS CloudFormation to dynamically create and maintain the configuration file for the CloudWatch Logs agent.

Question 58

A company has deployed a custom DNS server in AWS. The Security Engineer wants to ensure that Amazon EC2 instances cannot use the Amazon-provided DNS. How can the Security Engineer block access to the Amazon-provided DNS in the VPC?

  1. Deny access to the Amazon DNS IP within all security groups.
  2. Add a rule to all network access control lists that deny access to the Amazon DNS IP.
  3. Add a route to all route tables that black holes traffic to the Amazon DNS IP.
  4. Disable DNS resolution within the VPC configuration.

Question 59

An employee accidentally exposed an AWS access key and secret access key during a public presentation. The company Security Engineer immediately disabled the key. How can the Engineer assess the impact of the key exposure and ensure that the credentials were not misused? (Choose two.)

  1. Analyze AWS CloudTrail for activity.
  2. Analyze Amazon CloudWatch Logs for activity.
  3. Download and analyze the IAM Use report from AWS Trusted Advisor.
  4. Analyze the resource inventory in AWS Config for IAM user activity.
  5. Download and analyze a credential report from IAM.

Question 60

Which of the following minimizes the potential attack surface for applications?

  1. Use security groups to provide stateful firewalls for Amazon EC2 instances at the hypervisor level.
  2. Use network ACLs to provide stateful firewalls at the VPC level to prevent access to any specific AWS resource.
  3. Use AWS Direct Connect for secure trusted connections between EC2 instances within private subnets.
  4. Design network security in a single layer within the perimeter network (also known as DMZ, demilitarized zone, and screened subnet) to facilitate quicker responses to threats.