AWS Certified Security - Specialty

AWS Certified Security - Specialty practice questions, page 15 of 21, with answer review and explanations.

Question 71

A Security Engineer must add additional protection to a legacy web application by adding the following HTTP security headers: -Content Security-Policy -X-Frame-Options -X-XSS-Protection The Engineer does not have access to the source code of the legacy web application. Which of the following approaches would meet this requirement?

  1. Configure an Amazon Route 53 routing policy to send all web traffic that does not include the required headers to a black hole.
  2. Implement an AWS Lambda@Edge origin response function that inserts the required headers.
  3. Migrate the legacy application to an Amazon S3 static website and front it with an Amazon CloudFront distribution.
  4. Construct an AWS WAF rule to replace existing HTTP headers with the required security headers by using regular expressions.

Question 72

During a security event, it is discovered that some Amazon EC2 instances have not been sending Amazon CloudWatch logs. Which steps can the Security Engineer take to troubleshoot this issue? (Choose two.)

  1. Connect to the EC2 instances that are not sending the appropriate logs and verify that the CloudWatch Logs agent is running.
  2. Log in to the AWS account and select CloudWatch Logs. Check for any monitored EC2 instances that are in the ג€Alertingג€ state and restart them using the EC2 console.
  3. Verify that the EC2 instances have a route to the public AWS API endpoints.
  4. Connect to the EC2 instances that are not sending logs. Use the command prompt to verify that the right permissions have been set for the Amazon SNS topic.
  5. Verify that the network access control lists and security groups of the EC2 instances have the access to send logs over SNMP.

Question 73

A Security Engineer discovers that developers have been adding rules to security groups that allow SSH and RDP traffic from 0.0.0.0/0 instead of the organization firewall IP. What is the most efficient way to remediate the risk of this activity?

  1. Delete the internet gateway associated with the VPC.
  2. Use network access control lists to block source IP addresses matching 0.0.0.0/0.
  3. Use a host-based firewall to prevent access from all but the organization's firewall IP.
  4. Use AWS Config rules to detect 0.0.0.0/0 and invoke an AWS Lambda function to update the security group with the organization's firewall IP.

Question 74

In response to the past DDoS attack experiences, a Security Engineer has set up an Amazon CloudFront distribution for an Amazon S3 bucket. There is concern that some users may bypass the CloudFront distribution and access the S3 bucket directly. What must be done to prevent users from accessing the S3 objects directly by using URLs?

  1. Change the S3 bucket/object permission so that only the bucket owner has access.
  2. Set up a CloudFront origin access identity (OAI), and change the S3 bucket/object permission so that only the OAI has access.
  3. Create IAM roles for CloudFront, and change the S3 bucket/object permission so that only the IAM role has access.
  4. Redirect S3 bucket access to the corresponding CloudFront distribution.

Question 75

A company plans to move most of its IT infrastructure to AWS. The company wants to leverage its existing on-premises Active Directory as an identity provider for AWS. Which steps should be taken to authenticate to AWS services using the company's on-premises Active Directory? (Choose three.)

  1. Create IAM roles with permissions corresponding to each Active Directory group.
  2. Create IAM groups with permissions corresponding to each Active Directory group.
  3. Create a SAML provider with IAM.
  4. Create a SAML provider with Amazon Cloud Directory.
  5. Configure AWS as a trusted relying party for the Active Directory
  6. Configure IAM as a trusted relying party for Amazon Cloud Directory.