AWS Certified Security - Specialty - Part 39

1. Every application in a company's portfolio has a separate AWS(Amazon Web Service) account for development and production. The security team wants to prevent the root user and all IAM users in the production accounts from accessing a specific set of unneeded services. How can they control this functionality?

A) Create an IAM policy that denies access to the services. Associate the policy with an IAM group and enlist all users and the root users in this group. (Incorrect)
B) Create an IAM policy that denies access to the services. Create a Config Rule that checks that all users have the policy assigned. Trigger a Lambda function that adds the policy when found missing.
C) Create a Service Control Policy that denies access to the services. Assemble all production accounts in an organizational unit. Apply the policy to that organizational unit.
D) Create a Service Control Policy that denies access to the services. Apply the policy to the root account.



2. You want to track access requests for a particular 53 bucket. How can you achieve this in the easiest possible way?

A) Enable server access logging for the bucket
B) Enable Cloud watch logs for the bucket
C) Enable AWS(Amazon Web Service) Config for the 53 bucket
D) Enable Cloud watch metrics for the bucket



3. Your company makes use of S3 buckets for storing data. There is a company policy that all services should have logging enabled. How can you ensure that logging is always enabled for created S3 buckets in the AWS(Amazon Web Service) Account?

A) Use AWS(Amazon Web Service) Config Rules to check whether logging is enabled for buckets
B) Use AWS(Amazon Web Service) Inspector to inspect all S3 buckets and enable logging for those where it is not enabled
C) Use AWS(Amazon Web Service) Cloudwatch metrics to check whether logging is enabled for buckets
D) Use AWS(Amazon Web Service) Cloudwatch logs to check whether logging is enabled for buckets (Incorrect)



4. Your company has confidential documents stored in the simple storage service. Due to compliance requirements, you have to ensure that the data in the S3 bucket is available in a different geographical location. As an architect what is the change you would make to comply with this requirement.

A) Enable Cross region replication for the S3 bucket
B) Create a snapshot of the S3 bucket and copy it to another region
C) Copy the data to an EBS Volume in another Region
D) Apply Multi-AZ for the underlying S3 bucket



5. A company hosts a popular web application that connects to an Amazon RDS MySQL DB instance running in a private VPC subnet that was created with default ACL settings. The IT Security department has a suspicion that a DDos attack is coming from a suspecting IP. How can you protect the subnets from this attack? Please select:

A) Change the In bound Security Groups to deny access from the suspecting IP
B) Change the Outbound Security Groups to deny access from the suspecting IP
C) Change the Inbound NACL to deny access from the suspecting IP
D) Change the Outbound NACL to deny access from the suspecting lP