1. An application is designed to run on an EC2 Instance. The applications needs to work with an S3 bucket. From a security perspective , what is the ideal way for the EC2 instance/ application to be configured?

A) Assign an IAM Role and assign it to the EC2 Instance
B) Use the AWS(Amazon Web Service) access keys ensuring that they are frequently rotated.
C) Assign an IAM group and assign it to the EC2 Instance
D) Assign an IAM user to the application that has specific access to only that S3 bucket



2. Your company has created a set of keys using the AWS(Amazon Web Service) KMS service. They need to ensure that each key is only used for certain services. For example, they want one key to be used only for the S3 service. How can this be achieved? Please select:

A) Create a bucket policy that allows the key to be accessed by only the S3 service.
B) Create an lAM policy that allows the key to be accessed by only the S3 service.
C) Use the kms:ViaService condition in the Key policy
D) Define an lAM user, allocate the key and then assign the permissions to the required service



3. An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that one particular group of IAM users should only access the test instances and not the production ones. How can the organization set that as a part of the policy?

A) Create an IAM policy with a condition which allows access to only small instances
B) Define the IAM policy which allows access based on the instance ID
C) Launch the test and production instances in separate regions and allow region wise access to the group
D) Define the tags on the test and production servers and add a condition to the IAM policy which allows access to specific tags



4. Your company has an EC2 Instance hosted in AWS. This EC2 Instance hosts an application. Currently this application is experiencing a number of issues. You need to inspect the network packets to see what the type of error that is occurring? Which one of the below steps can help address this issue?

A) Use the VPC Flow Logs.
B) Use Cloudwatch metric
C) Use another instance. Setup a port to 'promiscuous mode and sniff the traffic to analyze the packets.
D) Use a network monitoring tool provided by an AWS(Amazon Web Service) partner.



5. You currently have an S3 bucket hosted in an AWS(Amazon Web Service) Account. It holds information that needs be accessed by a partner account. Which is the MOST secure way to allow the partner account to access the S3 bucket in your account? Select 3 options. Please select:(Select 3answers)

A) Ensure an lAM user Is created which can be assumed by the partner account.
B) Ensure an AM role is created which can be assumed by the partner account.
C) Provide the Account Id to the partner account
D) Provide the ARN for the role to the partner account
E) Ensure the partner uses an external Id when making the request
F) Provide access keys for your account to the partner account