AWS Certified Security - Specialty

AWS Certified Security - Specialty practice questions, page 16 of 21, with answer review and explanations.

Question 76

A Security Analyst attempted to troubleshoot the monitoring of suspicious security group changes. The Analyst was told that there is an Amazon CloudWatch alarm in place for these AWS CloudTrail log events. The Analyst tested the monitoring setup by making a configuration change to the security group but did not receive any alerts. Which of the following troubleshooting steps should the Analyst perform?

  1. Ensure that CloudTrail and S3 bucket access logging is enabled for the Analyst's AWS account. B. Verify that a metric filter was created and then mapped to an alarm. Check the alarm notification action.
  2. Check the CloudWatch dashboards to ensure that there is a metric configured with an appropriate dimension for security group changes.
  3. Verify that the Analyst's account is mapped to an IAM policy that includes permissions for cloudwatch: GetMetricStatistics and Cloudwatch: ListMetrics.

Question 77

Example.com hosts its internal document repository on Amazon EC2 instances. The application runs on EC2 instances and previously stored the documents on encrypted Amazon EBS volumes. To optimize the application for scale, example.com has moved the files to Amazon S3. The security team has mandated that all the files are securely deleted from the EBS volume, and it must certify that the data is unreadable before releasing the underlying disks. Which of the following methods will ensure that the data is unreadable by anyone else?

  1. Change the volume encryption on the EBS volume to use a different encryption mechanism. Then, release the EBS volumes back to AWS.
  2. Release the volumes back to AWS. AWS immediately wipes the disk after it is deprovisioned.
  3. Delete the encryption key used to encrypt the EBS volume. Then, release the EBS volumes back to AWS.
  4. Delete the data by using the operating system delete commands. Run Quick Format on the drive and then release the EBS volumes back to AWS.

Question 78

A Systems Administrator has written the following Amazon S3 bucket policy designed to allow access to an S3 bucket for only an authorized AWS IAM user from the IP address range 10.10.10.0/24: When trying to download an object from the S3 bucket from 10.10.10.40, the IAM user receives an access denied message. What does the Administrator need to change to grant access to the user?

  1. Change the ג€Resourceג€ from ג€arn: aws:s3:::Bucketג€ to ג€arn:aws:s3:::Bucket/*ג€.
  2. Change the ג€Principalג€ from ג€*ג€ to {AWS:ג€arn:aws:iam: : account-number: user/usernameג€}
  3. Change the ג€Versionג€ from ג€2012-10-17ג€ to the last revised date of the policy
  4. Change the ג€Actionג€ from [ג€s3:*ג€] to [ג€s3:GetObjectג€, ג€s3:ListBucketג€]

Question 79

The Security Engineer has discovered that a new application that deals with highly sensitive data is storing Amazon S3 objects with the following key pattern, which itself contains highly sensitive data. Pattern: "randomID_datestamp_PII.csv" Example: "1234567_12302017_000-00-0000 csv" The bucket where these objects are being stored is using server-side encryption (SSE). Which solution is the most secure and cost-effective option to protect the sensitive data?

  1. Remove the sensitive data from the object name, and store the sensitive data using S3 user-defined metadata.
  2. Add an S3 bucket policy that denies the action s3:GetObject
  3. Use a random and unique S3 object key, and create an S3 metadata index in Amazon DynamoDB using client-side encrypted attributes.
  4. Store all sensitive objects in Binary Large Objects (BLOBS) in an encrypted Amazon RDS instance.

Question 80

AWS CloudTrail is being used to monitor API calls in an organization. An audit revealed that CloudTrail is failing to deliver events to Amazon S3 as expected. What initial actions should be taken to allow delivery of CloudTrail events to S3? (Choose two.)

  1. Verify that the S3 bucket policy allow CloudTrail to write objects.
  2. Verify that the IAM role used by CloudTrail has access to write to Amazon CloudWatch Logs.
  3. Remove any lifecycle policies on the S3 bucket that are archiving objects to Amazon Glacier.
  4. Verify that the S3 bucket defined in CloudTrail exists.
  5. Verify that the log file prefix defined in CloudTrail exists in the S3 bucket.