AWS Certified Security - Specialty - Part 40

1. A company requires that data stored in AWS(Amazon Web Service) be encrypted at rest. Which of the following approaches achieve this requirement? Select 2 answers from the options given below.(Select 2answers)

A) When storing data in S3, enable server-side encryption.
B) When storing data in Amazon EBS, use only EBS - optimized Amazon EC2 instances.
C) When storing data in Amazon S3, use object versioning and MFA Delete.
D) When storing data in Amazon EC2 Instance Store, encrypt the volume by using KMS. (Incorrect)
E) When storing data in EBS, encrypt the volume by using AWS(Amazon Web Service) KMS.


2. A company has a set of resources defined in AWS. It is mandated that all API calls to the resources be monitored. Also all API calls must be stored for lookup purposes. Any log data greater than 6 months must be archived. Which of the following meets these requirements? Choose 2 answers from the options given below. Each answer forms part of the solution.(Select 2answers)

A) Enable CloudTrail logging in all accounts into S3 buckets
B) Enable CloudTrail logging in all accounts into Amazon Glacier
C) Ensure a lifecycle policy is defined on the S3 bucket to move the data to EBS volumes after 6 months.
D) Ensure a lifecycle policy is defined on the S3 bucket to move the data to Amazon Glacier after 6 months.



3. You have a bucket and a VPC defined in AWS. You need to ensure that the bucket can only be accessed by the VPC endpoint. How can you accomplish this? Please select:

A) Modify the route tables to allow access for the VPC endpoint
B) Modify the bucket Policy for the bucket to allow access for the VPC endpoint
C) Modify the security groups for the VPC to allow access to the S3 bucket
D) Modify the lAM Policy for the bucket to allow access for the VPC endpoint



4. Company policy requires that all insecure server protocols, such as FTP, Telnet, HTTP, etc be disabled on all servers. The security team would like to regularly check all servers to ensure compliance with this requirement by using a scheduled CloudWatch event to trigger a review of the current infrastructure. What process will check compliance of the company's EC2 instances?

A) Query the Trusted Advisor API for all best practice security checks and check for 'action recommened status.
B) Enable a GuardDuty threat detection analysis targeting the port configuration on every EC2 instance. (Incorrect)
C) Trigger an AWS(Amazon Web Service) Config Rules evaluation of the restricted-common-ports rule against every EC2 instance.
D) Run an Amazon Inspector assessment using the Runtime Behavior Analysis rules package against every EC2 instance.



5. Your company makes use of S3 buckets for storing data. There is a company policy that all services should have logging enabled. How can you ensure that logging is always enabled for created 53 buckets in the AWS(Amazon Web Service) Account?

A) Use AWS(Amazon Web Service) Cloud watch metrics to check whether logging is enabled for buckets
B) Use AWS(Amazon Web Service) Cloud watch logs to check whether logging is enabled for buckets
C) Use AWS(Amazon Web Service) Inspector to inspect all S3 buckets and enable logging for those where it is not enabled
D) Use AWS(Amazon Web Service) Configure Rules to check whether logging is enabled for buckets