HOTSPOT -
A company is building a web application that needs to authenticate external users across multiple microservices that the company hosts on Amazon Elastic Container Service (Amazon ECS). The solution must use temporary credentials and minimize the management overhead required to maintain user databases.
Select and order the correct steps from the following list to implement a secure authentication strategy that meets these requirements. Select each step one time or not at all.
Configure Amazon Cognito user pools for user authentication.
Set up an IAM role for each microservice. Grant each role appropriate permissions.
Implement an Amazon API Gateway HTTP API with AWS Lambda authorizers to validate tokens before forwarding requests to microservices.
Create an Amazon DynamoDB table to store user credentials for each microservice.
Create an Amazon Cognito application client to interact with the web application.
Set up AWS IAM Identity Center to give users access to the microservices.
Explanation
Amazon Cognito user pools are configured for secure and scalable user authentication, eliminating the need to manage user databases directly. An application client is then created within Cognito to enable interaction between the web application and the user pool. Finally, API Gateway with AWS Lambda authorizers ensures that only requests bearing valid tokens from Cognito are forwarded to the microservices hosted on ECS, maintaining security and minimizing management overhead.
An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication:
```json
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
}, {
"Sid": "BlockAnyAccessUnlessSignedInWithMFA",
"Effect": "Deny",
"Action": "ec2:*",
"Resource": "*",
"Condition": {
"BoolIfExists": {
"aws:MultiFactorAuthPresent": false
}
}
}]
}
```
After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI.
What should the administrator do to resolve this problem while still enforcing multi-factor authentication?
A.Change the value of aws:MultiFactorAuthPresent to true.
B.Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.Correct
C.Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
D.Create a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.
Explanation
The correct answer is B because using aws sts get-session-token with multi-factor authentication parameters allows users to obtain temporary credentials that can be used for API/CLI calls, thereby resolving the issue of being unable to perform Amazon EC2 commands while still enforcing MFA. This approach does not require changing existing policies or implementing federated access.
A company is using AWS Organizations with the default SCP. The company needs to restrict AWS usage for all AWS accounts that are in a specific OU.
Except for some desired global services, the AWS usage must occur only in the eu-west-1 Region for all accounts in the OU. A security engineer must create an SCP that applies the restriction to existing accounts and any new accounts in the OU.
Which SCP will meet these requirements?
Option C is correct. It uses a single Deny statement with NotAction that lists the global services (such as IAM, AWS Organizations, AWS STS, Route 53, CloudFront and AWS Support) and a StringNotEquals condition on aws:RequestedRegion for eu-west-1. Every request to any other Region is denied, except requests to the listed global services, which are served from a single global endpoint outside eu-west-1 (for most of them in us-east-1) and would otherwise be blocked. The SCP only restricts; the default FullAWSAccess SCP still allows everything that is not denied, and because the SCP is attached to the OU it applies to the existing accounts and to any account moved into the OU later. Options A, B and D deny all actions outside eu-west-1 without exempting any service. Their Allow statements cannot override an explicit Deny, because an explicit Deny in an SCP always takes precedence, so global services would be blocked and the requirement to keep some global services available is not met.
HOTSPOT -
A security engineer needs to implement AWS IAM Identity Center with an external identity provider (IdP).
Select and order the correct steps from the following list to meet this requirement. Select each step one time or not at all.
Configure the external IdP as the identity source in IAM Identity Center.
Create an IAM role that has a trust policy that specifics the IdP's API endpoint.
Enable automatic provisioning in IAM Identity Center settings
Enable automatic provisioning in the external IdP.
Obtain the SAML metadata from IAM Identity Center.
Obtain the SAML metadata from the external IdP.
Explanation
First, obtain the SAML metadata from IAM Identity Center (Service provider metadata); the external IdP needs it to trust IAM Identity Center. Next, configure the external IdP as the identity source in IAM Identity Center, uploading the IdP's own metadata file so IAM Identity Center trusts the IdP's SAML assertions. Finally, enable automatic provisioning in the IAM Identity Center settings, which provides the SCIM endpoint and access token the IdP uses to sync users and groups. An IAM role trust policy is not part of connecting an IdP to IAM Identity Center.
What is the effect of the following AWS Key Management Service (AWS KMS) key policy that is attached to a customer managed key?
```json
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/ExampleRole"
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:GenerateDataKey*",
"kms:CreateGrant",
"kms:ListGrants"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:ViaService": [
"workmail.us-west-2.amazonaws.com",
"ses.us-west-2.amazonaws.com"
]
}
}
}
```
A.Amazon WorkMail and Amazon Simple Email Service (Amazon SES) have delegated KMS encrypt and decrypt permissions to the ExampleRole principal in the 111122223333 account.
B.The ExampleRole principal can transparently encrypt and decrypt email exchanges specifically between ExampleRole and AWS.
C.The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.Correct
D.The key policy allows Amazon WorkMail or Amazon Simple Email Service (Amazon SES) to encrypt or decrypt on behalf of the ExampleRole for any customer managed key in the account.
Explanation
The correct answer is C because the key policy specifies that only the ExampleRole principal from the specified AWS account can perform KMS actions such as Encrypt and Decrypt, but these actions are restricted to requests originating from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in a specific AWS Region.
A company wants to deny a specific federated user named Bob access to an Amazon S3 bucket named DOC-EXAMPLE-BUCKET. The company wants to meet this requirement by using a bucket policy. The company also needs to ensure that this bucket policy affects Bob's S3 permissions only. Any other permissions that Bob has must remain intact.
Which policy should the company use to meet these requirements?
Option B is correct. A federated user session created with GetFederationToken is identified in a resource-based policy by the principal ARN arn:aws:sts::<account-ID>:federated-user/<user-name>. A Deny statement in the bucket policy for that principal on s3:* for both the bucket and its objects blocks Bob from DOC-EXAMPLE-BUCKET while leaving every other permission he has unchanged, because the bucket policy only governs this bucket. Options A, C and D use a SAML provider in a Federated principal, which is supported only in IAM role trust policies, not in bucket policies; in addition, C would target every user of that provider, D covers only objects and not the bucket itself, and the aws:username key is available only for IAM users, not federated sessions.
HOTSPOT -
A company is designing its security monitoring strategy for an existing sensitive workload on AWS. The security team has identified several scenarios that require monitoring strategies.
Select the correct monitoring scenario from the following list for each monitoring strategy. Select each monitoring scenario one time or not at all.
Explanation
VPC Flow Logs combined with CloudWatch Logs Insights are used for analyzing network traffic, making them ideal for monitoring unusual data transfer activities outside of regular working hours and identifying large data transfers to external IPs. CloudWatch metric filters on application logs help in tracking failed authentication attempts by aggregating hourly data from specific IP addresses. AWS CloudTrail Insights is effective for detecting anomalous API activity patterns by establishing baselines of normal behavior, which helps in spotting when privileged users delete resources at an unusually high rate. AWS Security Hub custom insights with EventBridge rules automate the response to security findings from multiple services, enabling the identification and mitigation of multi-stage attacks through coordinated incident response mechanisms.
A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets.
The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region.
Which solution will meet these requirements?
A.Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
B.Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.Correct
C.Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region.
D.Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 bucket in the secondary Region.
Explanation
Option B is correct because implementing S3 Object Lock in compliance mode prevents any user, including administrators, from deleting or overwriting objects for a specified period. Configuring S3 replication to replicate these objects to an S3 bucket in the secondary Region ensures that the data protection policy extends across Regions.
A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 123456789012. The attack created workloads that are distributed across multiple AWS Regions.
The security engineer contains the attack. The security engineer removes all compute and storage resources from all affected Regions. However, the attacker also created an AWS KMS key. The key policy on the KMS key explicitly allows IAM principal kms:* permissions.
The key was scheduled to be deleted the previous day. However, the key is still enabled and usable. The key has an ARN of arn:aws:kms:us-east-2:123456789012:key/mrk-0bb0212cd9864fdea0dcamzo26efb5670. The security engineer must delete the key as quickly as possible.
Which solution will meet this requirement?
A.Log in to the account by using the account root user credentials. Re-issue the deletion request for the KMS key with a waiting period of 7 days.
B.Identify the other Regions where the KMS key ID is present and schedule the key for deletion in 7 days.Correct
C.Update the IAM principal to allow kms:* permissions on the KMS key ARN. Re-issue the deletion request for the KMS key with a waiting period of 7 days.
D.Disable the KMS key. Re-issue the deletion request for the KMS key in 30 days.
Explanation
The key ID starts with mrk-, so this is a multi-Region primary key. AWS KMS does not delete a primary key while it still has replica keys: you must schedule deletion of every replica key, and the waiting period for the primary key begins only when the last replica has been deleted. That is why the earlier deletion request has not taken effect. Finding the Regions that hold replicas with the same key ID and scheduling them for deletion with the minimum 7-day waiting period is the fastest path. Using the root user or adding kms:* permissions does not help, because permissions were never the problem and re-issuing the request on the primary still waits for the replicas. Disabling the key and waiting 30 days is slower and still leaves the replicas blocking deletion.
A company has installed a third-party application that is distributed on several Amazon EC2 instances and on-premises servers. Occasionally, the company's IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection.
Which solution will meet these requirements?
A.Create a bastion host with port forwarding to connect to the machines.
B.Set up AWS Systems Manager Session Manager to allow temporary connections.Correct
C.Use AWS CloudShell to create serverless connections.
D.Set up an interface VPC endpoint for each machine for private connection.
Explanation
AWS Systems Manager Session Manager allows users to establish a secure, temporary session with managed instances without requiring SSH keys or leaving the instances exposed at all times. This solution meets the requirement of paying only when there is an active SSH connection and ensures that machines are isolated from the network outside maintenance periods.
A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs a solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating system, networking, and file events. The solution must send email alerts for any identified risks to a mailing list that is associated with a security team.
Which solution will meet these requirements?
A.Deploy AWS Security Hub and enable security standards that contain EKS controls. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant Security Hub events to the SNS topic.
B.Enable Amazon Inspector container image scanning. Configure Amazon Detective to analyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Use an AWS Lambda function to process the logs and to send email alerts to the security team.
C.Enable Amazon GuardDuty. Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.Correct
D.Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. Configure Amazon CloudWatch Logs to collect EKS audit logs. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Configure a CloudWatch alarm to publish a message to the SNS topic when new audit logs are generated.
Explanation
The correct answer is C because Amazon GuardDuty provides built-in protection for EKS clusters, including runtime monitoring and detection of security risks by analyzing EKS audit logs. By enabling EKS Protection in GuardDuty, creating an SNS topic for the security team's mailing list, and using EventBridge to route relevant GuardDuty findings to this SNS topic, the solution meets the requirement to detect Kubernetes security risks and send email alerts.
A company allows users to download its mobile app onto their phones. The app is MQTT based and connects to AWS IoT Core to subscribe to specific client-related topics.
Recently, the company discovered that some malicious attackers have been trying to get a Trojan horse onto legitimate mobile phones. The Trojan horse poses as the authentic application and uses a client ID with injected special characters to gain access to topics outside the client's privilege scope.
Which combination of actions should the company take to prevent this threat? (Choose two.)
A.In the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core.Correct
B.In the application, add a client ID check. Disconnect from the server if any special character is detected.
C.Apply an AWS IoT Core policy that allows "AWSIoTWirelessDataAccess" with the principal set to "client/${iot:Connection.Thing.ThingName}"
D.Apply an AWS IoT Core policy to the device to allow "iot:Connect" with the resource set to "client/${iot:ClientId}".
E.Apply an AWS IoT Core policy to the device to allow "iot:Connect" with the resource set to "client/${iot:Connection.Thing.ThingName}".Correct
Explanation
Option A is correct because when the app connects with its IoT thing name as the MQTT client ID, AWS IoT Core can tie the connection to the thing that is attached to the device's certificate. Option E is correct because the ${iot:Connection.Thing.ThingName} policy variable resolves to the thing attached to the authenticated certificate, so iot:Connect is allowed only when the client ID equals that thing name; a client ID with injected special characters no longer matches and the connection is refused. Option D is wrong because ${iot:ClientId} takes whatever client ID the client sends, so it does not stop a spoofed ID. Option B is a client-side check that a malicious app can simply leave out, and option C names a managed IAM policy rather than an IoT Core policy action and does not control iot:Connect.
A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards. However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes.
Which solution will meet this requirement in the MOST operationally efficient way?
A.Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
B.Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.Correct
C.Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
D.Use AWS Cloud Map to detect the configuration changes. Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.
Explanation
Option B is correct. AWS Config detects configuration changes to supported resources and records them as configuration items. With the recording frequency set to daily recording, AWS Config records one configuration item that represents the most recent state of the resource over the last 24 hours (only if it differs from the previous one), so several quick changes are captured as their cumulative result, and rules can evaluate that state for compliance. CloudTrail and CloudWatch (options A and C) record individual API calls, so the engineer would have to work out the resulting configuration. AWS Cloud Map (option D) is a service discovery registry and does not track resource configuration.
A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster.
The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys.
How can the security engineer meet these requirements?
A.To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon Athena.
B.To create the keys, use Amazon S3 and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
C.To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon GuardDuty.
D.To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.Correct
Explanation
The correct answer is D. AWS KMS can create symmetric encryption KMS keys in a custom key store backed by an AWS CloudHSM cluster, so the key material is generated and used inside the HSMs that the company controls. Those KMS keys can then generate symmetric data keys and data key pairs that the applications use locally. AWS CloudTrail records every AWS KMS API call that uses the keys, which meets the auditing requirement. Amazon Athena only queries data and Amazon GuardDuty is a threat detection service, so neither audits key use by itself, and Amazon S3 cannot create keys in a custom key store.
A company is running an application on Amazon EC2 instances in an Auto Scaling group. The application stores logs locally. A security engineer noticed that logs were lost after a scale-in event. The security engineer needs to recommend a solution to ensure the durability and availability of log data. All logs must be kept for a minimum of 1 year for auditing purposes.
What should the security engineer recommend?
A.Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review.
B.Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation. Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system.
C.Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review.Correct
D.Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon Simple Notification Service (Amazon SNS). Configure the hook to remain in the Terminating:Wait state for 1 hour to allow manual review of the security logs prior to instance termination.
Explanation
Option C is correct because the CloudWatch agent sends the application logs off the instance to Amazon CloudWatch Logs as they are written, so the logs survive when Auto Scaling terminates an instance during scale-in. CloudWatch Logs stores the data durably, and a retention policy on the log group (for example 365 days or more, up to 10 years, or never expire) keeps the logs for the 1-year audit requirement. Option A relies on volumes that must be found and reattached manually. Option B copies logs only once a day, so up to a day of logs is lost when an instance is terminated. Option D only delays termination for manual review and does not keep the logs.
A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are deployed in a private subnet of a VPC that does not have internet access. The EC2 instances and the S3 buckets are in the same AWS account.
The EC2 instances access the S3 buckets through an S3 gateway endpoint that has the default access policy. Each EC2 instance is associated with an instance profile role that has a policy that explicitly allows the s3:GetObject action and the s3:PutObject action for only the required S3 buckets.
The company learns that one or more of the EC2 instances are compromised and are exfiltrating data to an S3 bucket that is outside the company's organization in AWS Organizations. A security engineer must implement a solution to stop this exfiltration of data and to keep the EC2 processing job functional.
Which solution will meet these requirements?
A.Update the policy on the S3 gateway endpoint to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company's values.Correct
B.Update the policy on the instance profile role to allow the S3 actions only if the value of the aws:ResourceOrgID condition key matches the company's value.
C.Add a network ACL rule to the subnet of the EC2 instances to block outgoing connections on port 443.
D.Apply an SCP on the AWS account to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company's values.
Explanation
Option A is correct because updating the policy on the S3 gateway endpoint to restrict access based on the aws:ResourceOrgID and aws:PrincipalOrgID condition keys ensures that only resources within the same AWS Organization can be accessed, thereby preventing data exfiltration to external buckets while maintaining functionality for the EC2 processing job.
A company recently experienced a malicious attack on its cloud-based environment. The company successfully contained and eradicated the attack. A security engineer is performing incident response work. The security engineer needs to recover an Amazon RDS database cluster to the last known good version. The database cluster is configured to generate automated backups with a retention period of 14 days. The initial attack occurred 5 days ago at exactly 3:15 PM.
Which solution will meet this requirement?
A.Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the Restore to point in time feature. Set a target time 5 days ago at 3:14 PM.Correct
B.Identify the Regional cluster ARN for the database. List snapshots that have been taken of the cluster. Restore the database by using the snapshot that has a creation time that is closest to 5 days ago at 3:14 PM.
C.List all snapshots that have been taken of all the company's RDS databases. Identify the snapshot that was taken closest to 5 days ago at 3:14 PM and restore it.
D.Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the Restore to point in time feature. Set a target time 14 days ago.
Explanation
Option A is correct because AWS RDS allows restoring a database cluster to a specific point in time within the backup retention period, which in this case is 14 days. Since the attack occurred 5 days ago at 3:15 PM, setting the target time to 5 days ago at 3:14 PM ensures recovery to the last known good state before the attack.
A security engineer for a company needs to design an incident response plan that addresses compromised IAM user account credentials. The company uses an organization in AWS Organizations and AWS IAM Identify Center to manage user access. The company uses a delegated administrator account to implement AWS Security Hub. The delegated administrator account contains an organizational trail in AWS CloudTrail that logs all events to an Amazon S3 bucket. The company has also configured an organizational event data store that captures all events from the trail.
The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident.
The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.
Which solution will meet these requirements?
A.Disable the compromised IAM user in the organization management account. Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.
B.Remove all IAM policies that are attached to the IAM user in the organization management account. Use Security Hub to query the CloudTrail logs for actions that the IAM user performed in the previous 7 days.
C.Remove any permission sets that arc assigned to the IAM user in IAM Identity Center. Use Amazon CloudWatch Logs Insights to directly query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed m the previous 7 days.
D.Disable the IAM user's access in IAM Identity Center. Use CloudTrail to query the organizational event data store for actions that the IAM user performed in the previous 7 days.Correct
Explanation
Disabling the IAM user's access in IAM Identity Center (formerly known as AWS Single Sign-On) prevents the compromised IAM user from being used across all accounts within the organization. Using CloudTrail to query the organizational event data store allows for collecting all actions performed by the compromised IAM user across all accounts in the previous 7 days, meeting the requirements of the incident response plan.
A security engineer is designing security controls for a fleet of Amazon EC2 instances that run sensitive workloads in a VPC. The security engineer needs to implement a solution to detect and mitigate software vulnerabilities on the EC2 instances.
Which solution will meet this requirement?
A.Scan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager.Correct
B.Install host-based firewall and antivirus software on each EC2 instance. Use AWS Systems Manager Run Command to update the firewall and antivirus software.
C.Install the Amazon CloudWatch agent on the EC2 instances. Enable detailed logging. Use Amazon EventBridge to review the software logs for anomalies.
D.Scan the EC2 instances by using Amazon GuardDuty Malware Protection. Apply security patches and updates by using AWS Systems Manager Patch Manager.
Explanation
Amazon Inspector is designed to automatically assess applications for security vulnerabilities and deviations from compliance standards, making it suitable for detecting software vulnerabilities on EC2 instances. AWS Systems Manager Patch Manager can then be used to automate the process of patching these vulnerabilities, ensuring that the EC2 instances are kept secure.
A security engineer uses Amazon Macie to scan a company’s Amazon S3 buckets for sensitive data. The company has many S3 buckets and many objects stored in the S3 buckets. The security engineer must identify S3 buckets that contain sensitive data and must perform additional scanning on those S3 buckets.
Which solution will meet these requirements with the LEAST administrative overhead?
A.Configure S3 Cross-Region Replication (CRR) on the S3 buckets to replicate the objects to a second AWS Region. Configure Macie in the second Region to scan the replicated objects daily.
B.Create an AWS Lambda function as an S3 event destination for the S3 buckets. Configure the Lambda function to start a Macie scan of an object when the object is uploaded to an S3 bucket.
C.Configure Macie automated discovery to continuously sample data from the S3 buckets. Perform full scans of the S3 buckets where Macie discovers sensitive data.Correct
D.Configure Macie scans to run on the S3 buckets. Aggregate the results of the scans in an Amazon DynamoDB table. Use the DynamoDB table for queries.
Explanation
Option C is correct because configuring Macie automated discovery allows continuous sampling of data from S3 buckets with minimal administrative overhead, automatically identifying sensitive data and enabling targeted full scans on those specific buckets as needed.
Verifying access...
Access Required
You need to purchase this exam to access practice mode
Unlock a few more questions every day for 300 points you earn free on
Godlike Academy. Everything you unlock with the Daily Climb stays open for 7 days after your last unlock.