AWS Certified Security - Specialty

AWS Certified Security - Specialty practice questions, page 14 of 21, with answer review and explanations.

Question 66

An organization is moving non-business-critical applications to AWS while maintaining a mission-critical application in an on-premises data center. An on-premises application must share limited confidential information with the applications in AWS. The internet performance is unpredictable. Which configuration will ensure continued connectivity between sites MOST securely?

  1. VPN and a cached storage gateway
  2. AWS Snowball Edge
  3. VPN Gateway over AWS Direct Connect
  4. AWS Direct Connect

Question 67

An application has been built with Amazon EC2 instances that retrieve messages from Amazon SQS. Recently, IAM changes were made and the instances can no longer retrieve messages. What actions should be taken to troubleshoot the issue while maintaining least privilege? (Choose two.)

  1. Configure and assign an MFA device to the role used by the instances.
  2. Verify that the SQS resource policy does not explicitly deny access to the role used by the instances.
  3. Verify that the access key attached to the role used by the instances is active.
  4. Attach the AmazonSQSFullAccess managed policy to the role used by the instances.
  5. Verify that the role attached to the instances contains policies that allow access to the queue.

Question 68

A company has a forensic logging use case whereby several hundred applications running on Docker on EC2 need to send logs to a central location. The Security Engineer must create a logging solution that is able to perform real-time analytics on the log files, grants the ability to replay events, and persists data. Which AWS Services, together, can satisfy this use case? (Choose two.)

  1. Amazon Elasticsearch
  2. Amazon Kinesis
  3. Amazon SQS
  4. Amazon CloudWatch
  5. Amazon Athena

Question 69

Which of the following is the most efficient way to automate the encryption of AWS CloudTrail logs using a Customer Master Key (CMK) in AWS KMS?

  1. Use the KMS direct encrypt function on the log data every time a CloudTrail log is generated.
  2. Use the default Amazon S3 server-side encryption with S3-managed keys to encrypt and decrypt the CloudTrail logs.
  3. Configure CloudTrail to use server-side encryption using KMS-managed keys to encrypt and decrypt CloudTrail logs.
  4. Use encrypted API endpoints so that all AWS API calls generate encrypted CloudTrail log entries using the TLS certificate from the encrypted API call.

Question 70

An organization is using AWS CloudTrail, Amazon CloudWatch Logs, and Amazon CloudWatch to send alerts when new access keys are created. However, the alerts are no longer appearing in the Security Operations mail box. Which of the following actions would resolve this issue?

  1. In CloudTrail, verify that the trail logging bucket has a log prefix configured.
  2. In Amazon SNS, determine whether the ג€Account spend limitג€ has been reached for this alert.
  3. In SNS, ensure that the subscription used by these alerts has not been deleted.
  4. In CloudWatch, verify that the alarm threshold ג€consecutive periodsג€ value is equal to, or greater than 1.