CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
AWS Certified Security - Specialty - Part 27
1. You need to have a cloud security device which would allow to generate encryption keys based on FIPS 140-2 Level 3. Which of the following can be used for this purpose?
A) AWS Cloud HSM
B) AWS managed keys
C) AWS Customer Keys
D) AWS KMS
2. A company has resources hosted in their AWS(Amazon Web Service) Account. There is a requirement to monitor all API activity for all regions. The audit needs to be applied for future regions as well. Which of the following can be used to fulfil this requirement.
A) Create a Cloudtrail for each region. Use AWS(Amazon Web Service) Config to enable the trail for all future regions.
B) Ensure one Cloudtrail trail is enabled for all regions.
C) Ensure Cloudtrail for each region. Then enable for each future region.
D) Create a Cloudtrail for each region. Use Cloudformation to enable the trail for all future regions.
3. A company is planning to run a number of Admin related scripts using the AWS(Amazon Web Service) Lambda service. There is a need to understand if there are any errors encountered when the script run. How can this be accomplished in the most effective manner.
A) Use the AWS(Amazon Web Service) Config service to monitor for errors
B) Use the AWS(Amazon Web Service) Inspector service to monitor for errors
C) Use Cloudtrail to monitor for errors
D) Use Cloudwatch metrics and logs to watch for errors
4. You need to ensure that the cloudtrail logs which are being delivered in your AWS(Amazon Web Service) account is encrypted. How can this be achieved in the easiest way possible?
A) Enable S3-KMS for the underlying bucket which receives the log files
B) Don't do anything since Cloud trail logs are automatically encrypted.
C) Enable S3-SSE for the underlying bucket which receives the log files
D) Enable KMS encryption for the logs which are sent to Cloudwatch
5. You have setup a set of applications across 2 VPC's. You have also setup VPC Peering. The applications are still not able to communicate across the Peering connection. Which network troubleshooting steps should be taken to resolve the issue?
A) Check to see if the VPC has a NAT gateway attached.
B) Ensure the applications are hosted in a public subnet
C) Check the Route tables for the VPC's
D) Check to see if the VPC has an Internet gateway attached.
A) AWS Cloud HSM
B) AWS managed keys
C) AWS Customer Keys
D) AWS KMS
2. A company has resources hosted in their AWS(Amazon Web Service) Account. There is a requirement to monitor all API activity for all regions. The audit needs to be applied for future regions as well. Which of the following can be used to fulfil this requirement.
A) Create a Cloudtrail for each region. Use AWS(Amazon Web Service) Config to enable the trail for all future regions.
B) Ensure one Cloudtrail trail is enabled for all regions.
C) Ensure Cloudtrail for each region. Then enable for each future region.
D) Create a Cloudtrail for each region. Use Cloudformation to enable the trail for all future regions.
3. A company is planning to run a number of Admin related scripts using the AWS(Amazon Web Service) Lambda service. There is a need to understand if there are any errors encountered when the script run. How can this be accomplished in the most effective manner.
A) Use the AWS(Amazon Web Service) Config service to monitor for errors
B) Use the AWS(Amazon Web Service) Inspector service to monitor for errors
C) Use Cloudtrail to monitor for errors
D) Use Cloudwatch metrics and logs to watch for errors
4. You need to ensure that the cloudtrail logs which are being delivered in your AWS(Amazon Web Service) account is encrypted. How can this be achieved in the easiest way possible?
A) Enable S3-KMS for the underlying bucket which receives the log files
B) Don't do anything since Cloud trail logs are automatically encrypted.
C) Enable S3-SSE for the underlying bucket which receives the log files
D) Enable KMS encryption for the logs which are sent to Cloudwatch
5. You have setup a set of applications across 2 VPC's. You have also setup VPC Peering. The applications are still not able to communicate across the Peering connection. Which network troubleshooting steps should be taken to resolve the issue?
A) Check to see if the VPC has a NAT gateway attached.
B) Ensure the applications are hosted in a public subnet
C) Check the Route tables for the VPC's
D) Check to see if the VPC has an Internet gateway attached.
1. Right Answer: A
Explanation: The AWS(Amazon Web Service) Documentation mentions the following AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS(Amazon Web Service) Cloud. With CloudHSM, you can manage your own encryption keys using FIPS 140-2 Level 3 validated HSMs. CloudHSM offers you the flexibility to integrate with your applications using industry-standard APIs, such as PKCS#11, Java Cryptography Extensions (JCE), and Microsoft CryptoNG (CNG) libraries. CloudHSM is also standards-compliant and enables you to export all of your keys to most other commercially-available HSMs. It is a fully-managed service that automates time-consuming administrative tasks for you, such as hardware provisioning, software patching, high-availability, and backups. CloudHSM also enables you to scale quickly by adding and removing HSM capacity on-demand, with no up-front costs. All other options are invalid since AWS(Amazon Web Service) Cloud HSM is the prime service that offers FIPS 140-2 Level 3 compliance For more information on CloudHSM, please visit the following url https://aws.amazon.com/cloudhsm/
2. Right Answer: B
Explanation: The AWS(Amazon Web Service) Documentation mentions the following You can now turn on a trail across all regions for your AWS(Amazon Web Service) account. CloudTrail will deliver log files from all regions to the Amazon S3 bucket and an optional CloudWatch Logs log group you specified. Additionally, when AWS(Amazon Web Service) launches a new region, CloudTrail will create the same trail in the new region. As a result, you will receive log files containing API activity for the new region without taking any action. Option A and C is invalid because this would be a maintenance overhead to enable cloudtrail for every region Option D is invalid because this AWS(Amazon Web Service) Config cannot be used to enable trails For more information on this feature, please visit the following url https://aws.amazon.com/about-aws/whats-new/2015/12/turn-on-cloudtrail-across-all-regions-and-support-for-multiple-trails/
3. Right Answer: D
Explanation: The AWS(Amazon Web Service) Documentation mentions the following AWS Lambda automatically monitors Lambda functions on your behalf, reporting metrics through Amazon CloudWatch. To help you troubleshoot failures in a function, Lambda logs all requests handled by your function and also automatically stores logs generated by your code through Amazon CloudWatch Logs. Option B,C and D are all invalid because these services cannot be used to monitor for errors. For more information on Monitoring Lambda functions , please visit the following url https://docs.aws.amazon.com/lambda/latest/dg/monitoring-functions-logs.html
4. Right Answer: B
Explanation: The AWS(Amazon Web Service) Documentation mentions the following By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon server-side encryption with Amazon S3-managed encryption keys (SSE-S3) Option B,C and D are all invalid because by default all logs are encrypted when they sent by Cloudtrail to S3 buckets For more information on AWS(Amazon Web Service) Cloudtrail log encryption, please visit the following url https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
5. Right Answer: C
Explanation: After the VPC peering connection is established, you need to ensure that the route tables are modified to ensure traffic can flow between the VPC's Option A ,B and C are invalid because allowing access the Internet gateway and usage of public subnets can help for Internet access , but not for VPC Peering. For more information on VPC peering routing, please visit the below URL https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/vpc-peering-routing.html
Explanation: The AWS(Amazon Web Service) Documentation mentions the following AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS(Amazon Web Service) Cloud. With CloudHSM, you can manage your own encryption keys using FIPS 140-2 Level 3 validated HSMs. CloudHSM offers you the flexibility to integrate with your applications using industry-standard APIs, such as PKCS#11, Java Cryptography Extensions (JCE), and Microsoft CryptoNG (CNG) libraries. CloudHSM is also standards-compliant and enables you to export all of your keys to most other commercially-available HSMs. It is a fully-managed service that automates time-consuming administrative tasks for you, such as hardware provisioning, software patching, high-availability, and backups. CloudHSM also enables you to scale quickly by adding and removing HSM capacity on-demand, with no up-front costs. All other options are invalid since AWS(Amazon Web Service) Cloud HSM is the prime service that offers FIPS 140-2 Level 3 compliance For more information on CloudHSM, please visit the following url https://aws.amazon.com/cloudhsm/
2. Right Answer: B
Explanation: The AWS(Amazon Web Service) Documentation mentions the following You can now turn on a trail across all regions for your AWS(Amazon Web Service) account. CloudTrail will deliver log files from all regions to the Amazon S3 bucket and an optional CloudWatch Logs log group you specified. Additionally, when AWS(Amazon Web Service) launches a new region, CloudTrail will create the same trail in the new region. As a result, you will receive log files containing API activity for the new region without taking any action. Option A and C is invalid because this would be a maintenance overhead to enable cloudtrail for every region Option D is invalid because this AWS(Amazon Web Service) Config cannot be used to enable trails For more information on this feature, please visit the following url https://aws.amazon.com/about-aws/whats-new/2015/12/turn-on-cloudtrail-across-all-regions-and-support-for-multiple-trails/
3. Right Answer: D
Explanation: The AWS(Amazon Web Service) Documentation mentions the following AWS Lambda automatically monitors Lambda functions on your behalf, reporting metrics through Amazon CloudWatch. To help you troubleshoot failures in a function, Lambda logs all requests handled by your function and also automatically stores logs generated by your code through Amazon CloudWatch Logs. Option B,C and D are all invalid because these services cannot be used to monitor for errors. For more information on Monitoring Lambda functions , please visit the following url https://docs.aws.amazon.com/lambda/latest/dg/monitoring-functions-logs.html
4. Right Answer: B
Explanation: The AWS(Amazon Web Service) Documentation mentions the following By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon server-side encryption with Amazon S3-managed encryption keys (SSE-S3) Option B,C and D are all invalid because by default all logs are encrypted when they sent by Cloudtrail to S3 buckets For more information on AWS(Amazon Web Service) Cloudtrail log encryption, please visit the following url https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
5. Right Answer: C
Explanation: After the VPC peering connection is established, you need to ensure that the route tables are modified to ensure traffic can flow between the VPC's Option A ,B and C are invalid because allowing access the Internet gateway and usage of public subnets can help for Internet access , but not for VPC Peering. For more information on VPC peering routing, please visit the below URL https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/vpc-peering-routing.html
Tags:
aws cloud awc cloud cerification certified aws aws certifications aws cloud practitioner aws solution architect aws training aws certified cloud practitioner aws exam aws certification exam aws practice exams aws 2023 aws updated questions aws questions aws cert aws certified solutions architect aws solution architect associate aws training and certification aws certified developer associate certification for devops0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment