AWS Certified Security – Specialty732 questions across 74 pages are complete and free, with no account or card.
732 questions in this bank
Free access · progress saved on this device
During a recent internal investigation, it was discovered that all API logging was disabled in a production account, and the root user had created new API keys that appear to have been used several times. What could have been done to detect and automatically remediate the incident?
Answer: B
A company hosts an application on Amazon EC2 that is subject to specific rules for regulatory compliance. One rule states that traffic to and from the workload must be inspected for network-level attacks. This involves inspecting the whole packet. To comply with this regulatory rule, a security engineer must install intrusion detection software on a c5n.4xlarge EC2 instance. The engineer must then configure the software to monitor traffic to and from the application instances. What should the security engineer do next?
Answer: C
An application has a requirement to be resilient across not only Availability Zones within the application's primary region but also be available within another region altogether. Which of the following supports this requirement for AWS resources that are encrypted by AWS KMS?
Answer: C
A company deploys a distributed web application on a fleet of Amazon EC2 instances. The fleet is behind an Application Load Balancer (ALB) that will be configured to terminate the TLS connection. All TLS traffic to the ALB must stay secure, even if the certificate private key is compromised. How can a security engineer meet this requirement?
Answer: B
Perfect Forward Secrecy (PFS): This is the key feature that addresses the security requirement. PFS ensures that even if the private key is compromised in the future, past communications cannot be decrypted. This meets the requirement that "All TLS traffic to the ALB must stay secure, even if the certificate private key is compromised."
Source: Adapted from community discussion — heatblur
An organization policy states that all encryption keys must be automatically rotated every 12 months. Which AWS Key Management Service (KMS) key type should be used to meet this requirement?
Answer: A
A security engineer is designing an IAM policy to protect AWS API operations. The policy must enforce multi-factor authentication (MFA) for IAM users to access certain services in the AWS production account. Each session must remain valid for only 2 hours. The current version of the IAM policy is as follows:
Which combination of conditions must the security engineer add to the IAM policy to meet these requirements? (Choose two.)
Answer: AC
C. "NumericLessThan": {"aws:MultiFactorAuthAge": "7200"} This condition ensures that the action is allowed only if the MFA session age is less than 7200 seconds (2 hours), meaning it enforces the requirement that each MFA session remains valid for only 2 hours. This is a correct choice as it directly addresses the session validity requirement. D. "NumericGreaterThan": {"aws:MultiFactorAuthAge": "7200"} This condition would allow the action only if the MFA session age is greater than 7200 seconds, which is contrary to the requirement. Therefore, this option is incorrect.
Source: Adapted from community discussion — PareshBPatel
A Security Engineer received an AWS Abuse Notice listing EC2 instance IDs that are reportedly abusing other hosts. Which action should the Engineer take based on this situation? (Choose three.)
Answer: BCE
A company recently adopted new compliance standards that require all user actions in AWS to be logged. The user actions must be logged for all accounts that belong to an organization in AWS Organizations. The company needs to set alarms that respond when specified actions occur. The alarms must forward alerts to an email distribution list. The alerts must occur in as close to real time as possible. Which solution will meet these requirements?
Answer: A
A Security Administrator is configuring an Amazon S3 bucket and must meet the following security requirements: ✑ Encryption in transit ✑ Encryption at rest ✑ Logging of all object retrievals in AWS CloudTrail Which of the following meet these security requirements? (Choose three.)
Answer: ACE
A company wants to create a log analytics solution for logs generated from its on-premises devices. The logs are collected from the devices onto a server on premises. The company wants to use AWS services to perform near real-time log analysis. The company also wants to store these logs for 365 days for pattern matching and substring search capabilities later. Which solution will meet these requirements with the LEAST development overhead?
Answer: C
The correct answer is: C. Install Amazon Kinesis Agent on the on-premises server to send the logs to Amazon Kinesis Data Firehose. Configure Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) as the destination for real-time processing. Store the logs in Amazon OpenSearch Service for pattern matching and substring search. Configure an OpenSearch Service Index State Management (ISM) policy to delete the data after 365 days. This solution meets all the requirements with the least development overhead. Amazon Kinesis Agent can be used to collect and send logs to Amazon Kinesis Data Firehose, which can handle real-time streaming data. Amazon Managed Service for Apache Flink can be used for real-time processing. The logs can be stored in Amazon OpenSearch Service (formerly known as Amazon Elasticsearch Service), which provides powerful search capabilities. An ISM policy can be configured to automatically delete data after 365 days. The other options either involve more development overhead or do not meet all the requirements.
Source: Adapted from community discussion — Certified101
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SCS-C02 practice, question 61. 732 questions available.
Version 1.0.0. How we source questions