AWS Certified Security - Specialty - Part 33

1. A web application runs in a VPC on EC2 instances behind an ELB Application Load Balancer. The application stores data in an RDS MySQL DB instance. A Linux bastion host is used to apply schema updates to the database ' administrators connect to the host via SSH from a corporate workstation. The following security groups are applied to the infrastructure-sgLB ' associated with the ELBsgWeb ' associated with the EC2 instances.sgDB ' associated with the databasesgBastion ' associated with the bastion host Which security group configuration will allow the application to be secure and functional?

A) sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from 0.0.0.0/0 sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the corporate IP address range (Incorrect)
B) sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the corporate IP address range
C) sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the VPC IP address range
D) sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgLB sgBastion: allow port 22 traffic from the VPC IP address range



2. A company wishes to enable Single Sign On (SSO) so its employees can login to the management console using their corporate directory identity. Which steps below are required as part of the process? Select 2 answers from the options given below.(Select 2answers)

A) Create a Lambda function to assign IAM roles to the temporary security tokens provided to the users.
B) Create a Direct Connect connection between the corporate network and the AWS(Amazon Web Service) region with the company's infrastructure.
C) Create IAM policies that can be mapped to group memberships in the corporate directory.
D) Create an IAM role that establishes a trust relationship between IAM and the corporate directory identity provider (IdP)
E) Create IAM users that can be mapped to the employees' corporate identities (Incorrect)


3. A large organization is planning on AWS(Amazon Web Service) to host their resources. They have a number of autonomous departments that wish to use AWS. What could be the strategy to adopt for managing the accounts. Please select:

A) Use multiple VPC?s in the account each VPC for each department
B) Use multiple AWS(Amazon Web Service) accounts, each account for each department
C) Use multiple lAM groups. each group for each department
D) Use multiple lAM roles, each group for each department



4. You have an S3 bucket hosted in AWS. This is used to host promotional videos uploaded by yourself. You need to provide access to users for a limited duration of time. How can this be achieved?

A) Use IAM Roles with a timestamp to limit the access
B) Use IAM policies with a timestamp to limit the access
C) Use Pre signed URL?s
D) Use versioning and enable a time starnp for each version



5. An application running on EC2 instances in a VPC must access sensitive data in the data center. The access must be encrypted in transit and have consistent low latency. Which hybrid architecture will meet these requirements?

A) A VPN between the VPC and the data center.
B) Expose the data with a public HTTPS endpoint.
C) A Direct Connect connection between the VPC and data center. (Incorrect)
D) A VPN between the VPC and the data center over a Direct Connect connection