AWS-Certified-Security-Specialty Free Practice Test

- (Exam Topic 2)
An Amazon EC2 instance is part of an EC2 Auto Scaling group that is behind an Application Load Balancer (ALB). It is suspected that the EC2 instance has been compromised.
Which steps should be taken to investigate the suspected compromise? (Choose three.)

1. A. Detach the elastic network interface from the EC2 instance.
2. B. Initiate an Amazon Elastic Block Store volume snapshot of all volumes on the EC2 instance.
3. C. Disable any Amazon Route 53 health checks associated with the EC2 instance.
4. D. De-register the EC2 instance from the ALB and detach it from the Auto Scaling group.
5. E. Attach a security group that has restrictive ingress and egress rules to the EC2 instance.
6. F. Add a rule to an AWS WAF to block access to the EC2 instance.

Correct Answer: BDE
https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf

- (Exam Topic 3)
A company has developed a new Amazon RDS database application. The company must secure the ROS database credentials for encryption in transit and encryption at rest. The company also must rotate the credentials automatically on a regular basis.
Which solution meets these requirements?

1. A. Use AWS Systems Manager Parameter Store to store the database credentiai
2. B. Configure automatic rotation of the credentials.
3. C. Use AWS Secrets Manager to store the database credential
4. D. Configure automat* rotation of the credentials
5. E. Store the database credentials in an Amazon S3 bucket that is configured with server-side encryption with S3 managed encryption keys (SSE-S3) Rotate the credentials with 1AM database authentication.
6. F. Store the database credentials m Amazon S3 Glacier, and use S3 Glacier Vault Lock Configure an AWS Lambda function to rotate the credentials on a scheduled basts

Correct Answer: A

- (Exam Topic 3)
Every application in a company's portfolio has a separate AWS account for development and production. The security team wants to prevent the root user and all IAM users in the production accounts from accessing a specific set of unneeded services. How can they control this functionality?
Please select:

1. A. Create a Service Control Policy that denies access to the service
2. B. Assemble all production accounts in an organizational uni
3. C. Apply the policy to that organizational unit.
4. D. Create a Service Control Policy that denies access to the service
5. E. Apply the policy to the root account.
6. F. Create an IAM policy that denies access to the service
7. G. Associate the policy with an IAM group and enlist all users and the root users in this group.
8. H. Create an IAM policy that denies access to the service
9. I. Create a Config Rule that checks that all users have the policy m assigne
10. J. Trigger a Lambda function that adds the policy when found missing.

Correct Answer: A
As an administrator of the master account of an organization, you can restrict which AWS services and individual API actions the users and roles in each member account can access. This restriction even overrides the administrators of member accounts in the organization. When AWS Organizations blocks access to a service or API action for a member account a user or role in that account can't access any prohibited service or API action, even if an administrator of a member account explicitly grants such permissions in an IAM policy. Organization permissions overrule account permissions.
Option B is invalid because service policies cannot be assigned to the root account at the account level. Option C and D are invalid because IAM policies alone at the account level would not be able to suffice the
requirement
For more information, please visit the below URL id=docs_orgs_console https://docs.aws.amazon.com/IAM/latest/UserGi manage attach-policy.html
The correct answer is: Create a Service Control Policy that denies access to the services. Assemble all production accounts in an organizational unit. Apply the policy to that organizational unit
Submit your Feedback/Queries to our Experts

- (Exam Topic 3)
A company hosts data in S3. There is now a mandate that going forward all data in the S3 bucket needs to encrypt at rest. How can this be achieved?
Please select:

1. A. Use AWS Access keys to encrypt the data
2. B. Use SSL certificates to encrypt the data
3. C. Enable server side encryption on the S3 bucket
4. D. Enable MFA on the S3 bucket

Correct Answer: C
The AWS Documentation mentions the following
Server-side encryption is about data encryption at rest—that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. As long as you authenticate your request and you have access permissions, there is no difference in the way you access encrypted or unencrypted objects.
Options A and B are invalid because neither Access Keys nor SSL certificates can be used to encrypt data. Option D is invalid because MFA is just used as an extra level of security for S3 buckets
For more information on S3 server side encryption, please refer to the below Link: https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html Submit your Feedback/Queries to our Experts

- (Exam Topic 3)
Your organization is preparing for a security assessment of your use of AWS. In preparation for this assessment, which three IAM best practices should you consider implementing?
Please select:

1. A. Create individual IAM users
2. B. Configure MFA on the root account and for privileged IAM users
3. C. Assign IAM users and groups configured with policies granting least privilege access
4. D. Ensure all users have been assigned and dre frequently rotating a password, access ID/secret key, andX.509 certificate

Correct Answer: ABC
When you go to the security dashboard, the security status will show the best practices for initiating the first level of security.
C:\Users\wk\Desktop\mudassar\Untitled.jpg

Option D is invalid because as per the dashboard, this is not part of the security recommendation For more information on best security practices please visit the URL:
https://aws.amazon.com/whitepapers/aws-security-best-practices;
The correct answers are: Create individual IAM users, Configure MFA on the root account and for privileged IAM users. Assign IAM users and groups configured with policies granting least privilege access
Submit your Feedback/Queries to our Experts