Latest Amazon AWS-Security-Specialty Actual Free Exam Questions & Community Discussion, Page 2

Question #12

A company has a set of EC2 instances hosted in IAM. These instances have EBS volumes for storing critical information. There is a business continuity requirement and in order to boost the agility of the business and to ensure data durability which of the following options are not required.
Please select:

A. Use EBS Snapshots

B. Use lifecycle policies for the EBS volumes

C. Use EBS volume encryption

D. Use EBS volume replication

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #13

A business stores website images in an Amazon S3 bucket. The firm serves the photos to end users through Amazon CloudFront. The firm learned lately that the photographs are being accessible from nations in which it does not have a distribution license.
Which steps should the business take to safeguard the photographs and restrict their distribution? (Select two.)

A. Update the website DNS record to use an Amazon Route 53 geolocation record deny list of countries where the company lacks a license.

B. Add a CloudFront geo restriction deny list of countries where the company lacks a license.

C. Enable the Restrict Viewer Access option in CloudFront to create a deny list of countries where the company lacks a license.

D. Update the S3 bucket policy with a deny list of countries where the company lacks a license.

E. Update the S3 bucket policy to restrict access to a CloudFront origin access identity (OAI).

Discussion 0

Correct Answer: B,E Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #14

A Security Engineer discovered a vulnerability in an application running on Amazon ECS. The vulnerability allowed attackers to install malicious code. Analysis of the code shows it exfiltrates data on port 5353 in batches at random time intervals.
While the code of the containers is being patched, how can Engineers quickly identify all compromised hosts and stop the egress of data on port 5353?

A. Use Amazon Athena to query IAM CloudTrail logs in Amazon S3 and look for any traffic on port 5353. Update the security groups to block port 5353 outbound.

B. Enable Amazon Inspector on Amazon ECS and configure a custom assessment to evaluate containers that have port 5353 open. Update the NACLs to block port 5353 outbound.

C. Enable IAM Shield Advanced and IAM WAF. Configure an IAM WAF custom filter for egress traffic on port 5353

D. Create an Amazon CloudWatch custom metric on the VPC Flow Logs identifying egress traffic on port 5353. Update the NACLs to block port 5353 outbound.

Discussion 0

Correct Answer: D Vote an answer

Question #15

A company is building a data processing application that uses AWS Lambda functions The application's Lambda functions need to communicate with an Amazon RDS OB instance that is deployed within a VPC in the same AWS account Which solution meets these requirements in the MOST secure way?

A. Deploy the Lambda functions inside the VPC Attach a network ACL to the Lambda subnet Provide outbound rule access to the VPC CIDR range only Update the DB instance security group to allow traffic from 0 0 0 0/0

B. Peer the Lambda default VPC with the VPC that hosts the DB instance to allow direct network access without the need for security groups

C. Configure the DB instance to allow public access Update the DB instance security group to allow access from the Lambda public address space for the AWS Region

D. Deploy the Lambda functions inside the VPC Attach a security group to the Lambda functions Provide outbound rule access to the VPC CIDR range only Update the DB instance security group to allow traffic from the Lambda security group

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #16

Your company has been using IAM for the past 2 years. They have separate S3 buckets for logging the various IAM services that have been used. They have hired an external vendor for analyzing their log files. They have their own IAM account. What is the best way to ensure that the partner account can access the log files in the company account for analysis. Choose 2 answers from the options given below Please select:

A. Ensure the IAM user has access for read-only to the S3 buckets

B. Ensure the IAM Role has access for read-only to the S3 buckets

C. Create an IAM Role in the company account

D. Create an IAM user in the company account

Discussion 0

Correct Answer: B,C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #17

An ecommerce website was down for 1 hour following a DDoS attack Users were unable to connect to the website during the attack period. The ecommerce company's security team is worried about future potential attacks and wants to prepare for such events The company needs to minimize downtime in its response to similar attacks in the future.
Which steps would help achieve this9 (Select TWO )

A. Use VPC Flow Logs to monitor network: traffic and an IAM Lambda function to automatically block an attacker's IP using security groups.

B. Enable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.

C. Use IAM WAF to create rules to respond to such attacks

D. Subscribe to IAM Shield Advanced and reach out to IAM Support in the event of an attack.

E. Set up an Amazon CloudWatch Events rule to monitor the IAM CloudTrail events in real time use IAM Config rules to audit the configuration, and use IAM Systems Manager for remediation.

Discussion 0

Correct Answer: C,D Vote an answer

Question #18

A company has complex connectivity rules governing ingress, egress, and communications between Amazon EC2 instances. The rules are so complex that they cannot be implemented within the limits of the maximum number of security groups and network access control lists (network ACLs).
What mechanism will allow the company to implement all required network rules without incurring additional cost?

A. Launch an EC2-based firewall product from the IAM Marketplace, and implement the required rules in that product.

B. Use a NAT gateway to control ingress and egress according to the requirements.

C. Use the operating system built-in, host-based firewall to implement the required rules.

D. Configure IAM WAF rules to implement the required rules.

Discussion 0

Correct Answer: C Vote an answer

Question #19

A company has a large fleet of Linux Amazon EC2 instances and Windows EC2 instances that run in private subnets. The company wants all remote administration to be performed as securely as possible in the AWS Cloud.
Which solution will meet these requirements?

A. Generate new SSH-RSA private keys for existing instances. Configure EC2 Instance Connect.

B. Do not use SSH-RSA private keys during the launch of new instances. Implement AWS Systems Manager Session Manager.

C. Do not use SSH-RSA private keys during the launch of new instances. Configure EC2 Instance Connect.

D. Generate new SSH-RSA private keys for existing instances. Implement AWS Systems Manager Session Manager.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #20

Your company has confidential documents stored in the simple storage service. Due to compliance requirements, you have to ensure that the data in the S3 bucket is available in a different geographical location. As an architect what is the change you would make to comply with this requirement.
Please select:

A. Create a snapshot of the S3 bucket and copy it to another region

B. Apply Multi-AZ for the underlying 53 bucket

C. Copy the data to an EBS Volume in another Region

D. Enable Cross region replication for the S3 bucket

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #21

You need to create a policy and apply it for just an individual user. How could you accomplish this in the right way?
Please select:

A. Add a service policy for the user

B. Add an IAM role for the user

C. Add an inline policy for the user

D. Add an IAM managed policy for the user

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #22

An application running on EC2 instances in a VPC must access sensitive data in the data center. The access must be encrypted in transit and have consistent low latency. Which hybrid architecture will meet these requirements?
Please select:

A. A VPN between the VPC and the data center over a Direct Connect connection

B. A Direct Connect connection between the VPC and data center

C. Expose the data with a public HTTPS endpoint.

D. A VPN between the VPC and the data center.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Amazon AWS-Security-Specialty Actual Free Exam Questions & Community Discussion

Download Free Amazon AWS-Security-Specialty Demo