Editing AWS Certified Security - Specialty: 9 Sample questions

https://d1.awsstatic.com/training-and-certification/docs-security-spec/AWS-Certified-Security-Speciality_Sample-Questions.pdf

1) A corporate cloud security policy states that '''communication between the company's [[VPC]] and [[KMS]]''' must travel entirely within the AWS network and not use public service endpoints. Which combination of the following actions MOST satisfies this requirement? (Select TWO.)
:A) Add the <code>aws:sourceVpce</code> condition to the AWS KMS key policy referencing the company's [[VPC endpoint]] ID.
:B) Remove the [[VPC internet gateway]] from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.
:C) Create a [[VPC endpoint]] for [[AWS KMS]] with private DNS enabled.
:D) Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.
:E) Add the following condition to the AWS KMS key policy: <code>"aws:SourceIp": "10.0.0.0/16"</code>


2) An application team is designing a solution with two applications. The security team wants the
applications' logs to be captured in two different places, because one of the applications produces logs
with sensitive data.
Which solution meets the requirement with the LEAST risk and effort?
:A) Use [[Amazon CloudWatch Logs]] to capture all logs, write an AWS Lambda function that parses the log file, and move sensitive data to a different log.
:B) Use Amazon CloudWatch Logs with two [[log groups]], with one for each application, and use an [[AWS IAM policy]] to control access to the log groups, as required.
:C) Aggregate logs into one file, then use Amazon CloudWatch Logs, and then design two CloudWatch metric filters to filter sensitive data from the logs.
:D) Add logic to the application that saves sensitive data logs on the Amazon EC2 instances' local storage, and write a batch script that logs into the Amazon EC2 instances and moves sensitive logs to a secure location.


3) A security engineer must set up security group rules for a three-tier application:
:Presentation tier – Accessed by users over the web, protected by the security group presentation-sg
:Logic tier – RESTful API accessed from the presentation tier through HTTPS, protected by the security group logic-sg
:Data tier – SQL Server database accessed over port 1433 from the logic tier, protected by the security group data-sg
Which combination of the following security group rules will allow the application to be secure and
functional? (Select THREE.)
:A) presentation-sg: Allow ports 80 and 443 from 0.0.0.0/0
:B) data-sg: Allow port 1433 from presentation-sg
:C) data-sg: Allow port 1433 from logic-sg
:D) presentation-sg: Allow port 1433 from data-sg
:E) logic-sg: Allow port 443 from presentation-sg
:F) logic-sg: Allow port 443 from 0.0.0.0/0


4) A security engineer is working with a product team building a web application on AWS. The application uses Amazon S3 to host the static content, [[Amazon API Gateway]] to provide RESTful services, and Amazon DynamoDB as the backend data store. The users already exist in a directory that is exposed through a SAML identity provider. Which combination of the following actions should the engineer take to enable users to be authenticated into the web application and call APIs? (Select THREE).
:A) Create a custom authorization service using AWS Lambda.
:B) Configure a [[SAML identity provider]] in [[Amazon Cognito]] to map attributes to the Amazon Cognito user pool attributes.
:C) Configure the SAML identity provider to add the Amazon Cognito user pool as a relying party.
:D) Configure an Amazon Cognito identity pool to integrate with social login providers.
:E) Update DynamoDB to store the user email addresses and passwords.
:F) Update [[API Gateway]] to use an Amazon Cognito user pool authorizer.

5) TODO

6) A company decides to place database hosts in its own VPC, and to set up [[VPC peering]] to different VPCs containing the application and web tiers. The application servers are unable to connect to the database.
Which network troubleshooting steps should be taken to resolve the issue? (Select TWO.)
:A) Check to see if the application servers are in a private subnet or public subnet.
:B) Check the route tables for the application server subnets for routes to the VPC peering connection.
:C) Check the [[NACLs]] for the database subnets for rules that allow traffic from the internet.
:D) Check the database security groups for rules that allow traffic from the application servers.
:E) Check to see if the database VPC has an internet gateway

7) TODO

8) 8) A company is building a data lake on Amazon S3. The data consists of millions of small files containing
sensitive information. The security team has the following requirements for the architecture:
* Data must be encrypted in transit.
* Data must be encrypted at rest.
* The bucket must be private, but if the bucket is accidentally made public, the data must remain confidential.

Which combination of steps would meet the requirements? (Select TWO.)
:A) Enable [[AES-256]] encryption using server-side encryption with Amazon S3-managed encryption keys (SSE-S3) on the S3 bucket.
:B) Enable default encryption with server-side encryption with AWS KMS-managed keys (SSE-KMS) on the S3 bucket.
:C) Add a bucket policy that includes a deny if a <code>[[PutObject]]</code> request does not include <code>aws:SecureTransport</code>.
:D) Add a bucket policy with <code>aws:SourceIp</code> to allow uploads and downloads from the corporate intranet only.
:E) Enable [[Amazon Macie]] to monitor and act on changes to the data lake's S3 bucket.

== See also ==
* [[AWS Certified Security - Specialty]]


[[Category:AWS]]
@@ Line 6: / Line 6: @@
 :C) Create a [[VPC endpoint]] for [[AWS KMS]] with private DNS enabled.
 :D) Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.
-:E) Add the following condition to the AWS KMS key policy: <code>"[[aws:SourceIp]]": "10.0.0.0/16"</code>
+:E) Add the following condition to the AWS KMS key policy: <code>"aws:SourceIp": "10.0.0.0/16"</code>
@@ Line 62: / Line 62: @@
 :A) Enable [[AES-256]] encryption using server-side encryption with Amazon S3-managed encryption keys (SSE-S3) on the S3 bucket.
 :B) Enable default encryption with server-side encryption with AWS KMS-managed keys (SSE-KMS) on the S3 bucket.
-:C) Add a bucket policy that includes a deny if a <code>[[PutObject]]</code> request does not include <code>[[aws:SecureTransport]]</code>.
+:C) Add a bucket policy that includes a deny if a <code>[[PutObject]]</code> request does not include <code>aws:SecureTransport</code>.
-:D) Add a [[bucket policy]] with <code>[[aws:SourceIp]]</code> to allow uploads and downloads from the corporate intranet only.
+:D) Add a bucket policy with <code>aws:SourceIp</code> to allow uploads and downloads from the corporate intranet only.
 :E) Enable [[Amazon Macie]] to monitor and act on changes to the data lake's S3 bucket.
-) TODO
-) A security engineer has been informed that a user’s access key has been found on GitHub. The engineer must ensure that this access key cannot continue to be used, and must assess whether the access key was used to perform any unauthorized activities. Which steps must be taken to perform these tasks?
-:A) Review the user's IAM permissions and delete any unrecognized or unauthorized resources.
-:B) Delete the user, review Amazon CloudWatch Logs in all regions, and report the abuse.
-:C) Delete or rotate the user’s key, review the AWS CloudTrail logs in all regions, and delete any unrecognized or unauthorized resources.
-:D) Instruct the user to remo
 == See also ==