AWS Certified Security - Specialty

AWS Certified Security - Specialty practice questions, page 5 of 21, with answer review and explanations.

Question 21

An organization has a system in AWS that allows a large number of remote workers to submit data files. File sizes vary from a few kilobytes to several megabytes. A recent audit highlighted a concern that data files are not encrypted while in transit over untrusted networks. Which solution would remediate the audit finding while minimizing the effort required?

  1. Upload an SSL certificate to IAM, and configure Amazon CloudFront with the passphrase for the private key.
  2. Call KMS.Encrypt() in the client, passing in the data file contents, and call KMS.Decrypt() server-side.
  3. Use AWS Certificate Manager to provision a certificate on an Elastic Load Balancing in front of the web service's servers.
  4. Create a new VPC with an Amazon VPC VPN endpoint, and update the web service's DNS record.

Question 22

Which option for the use of the AWS Key Management Service (KMS) supports key management best practices that focus on minimizing the potential scope of data exposed by a possible future key compromise?

  1. Use KMS automatic key rotation to replace the master key, and use this new master key for future encryption operations without re-encrypting previously encrypted data.
  2. Generate a new Customer Master Key (CMK), re-encrypt all existing data with the new CMK, and use it for all future encryption operations.
  3. Change the CMK alias every 90 days, and update key-calling applications with the new key alias.
  4. Change the CMK permissions to ensure that individuals who can provision keys are not the same individuals who can use the keys.

Question 23

A Security Engineer must enforce the use of only Amazon EC2, Amazon S3, Amazon RDS, Amazon DynamoDB, and AWS STS in specific accounts. What is a scalable and efficient approach to meet this requirement?

  1. Set up an AWS Organizations hierarchy, and replace the FullAWSAccess policy with the following Service Control Policy for the governed organization units:
  2. Create multiple IAM users for the regulated accounts, and attach the following policy statement to restrict services as required:
  3. Set up an Organizations hierarchy, replace the global FullAWSAccess with the following Service Control Policy at the top level:
  4. Set up all users in the Active Directory for federated access to all accounts in the company. Associate Active Directory groups with IAM groups, and attach the following policy statement to restrict services as required:

Question 24

A company's database developer has just migrated an Amazon RDS database credential to be stored and managed by AWS Secrets Manager. The developer has also enabled rotation of the credential within the Secrets Manager console and set the rotation to change every 30 days. After a short period of time, a number of existing applications have failed with authentication errors. What is the MOST likely cause of the authentication errors?

  1. Migrating the credential to RDS requires that all access come through requests to the Secrets Manager.
  2. Enabling rotation in Secrets Manager causes the secret to rotate immediately, and the applications are using the earlier credential.
  3. The Secrets Manager IAM policy does not allow access to the RDS database.
  4. The Secrets Manager IAM policy does not allow access for the applications.

Question 25

A Security Engineer launches two Amazon EC2 instances in the same Amazon VPC but in separate Availability Zones. Each instance has a public IP address and is able to connect to external hosts on the internet. The two instances are able to communicate with each other by using their private IP addresses, but they are not able to communicate with each other when using their public IP addresses. Which action should the Security Engineer take to allow communication over the public IP addresses?

  1. Associate the instances to the same security groups.
  2. Add 0.0.0.0/0 to the egress rules of the instance security groups.
  3. Add the instance IDs to the ingress rules of the instance security groups.
  4. Add the public IP addresses to the ingress rules of the instance security groups.