CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
AWS Certified Security - Specialty - Part 40
1. A company requires that data stored in AWS(Amazon Web Service) be encrypted at rest. Which of the following approaches achieve this requirement? Select 2 answers from the options given below.(Select 2answers)
A) When storing data in S3, enable server-side encryption.
B) When storing data in Amazon EBS, use only EBS - optimized Amazon EC2 instances.
C) When storing data in Amazon S3, use object versioning and MFA Delete.
D) When storing data in Amazon EC2 Instance Store, encrypt the volume by using KMS. (Incorrect)
E) When storing data in EBS, encrypt the volume by using AWS(Amazon Web Service) KMS.
2. A company has a set of resources defined in AWS. It is mandated that all API calls to the resources be monitored. Also all API calls must be stored for lookup purposes. Any log data greater than 6 months must be archived. Which of the following meets these requirements? Choose 2 answers from the options given below. Each answer forms part of the solution.(Select 2answers)
A) Enable CloudTrail logging in all accounts into S3 buckets
B) Enable CloudTrail logging in all accounts into Amazon Glacier
C) Ensure a lifecycle policy is defined on the S3 bucket to move the data to EBS volumes after 6 months.
D) Ensure a lifecycle policy is defined on the S3 bucket to move the data to Amazon Glacier after 6 months.
3. You have a bucket and a VPC defined in AWS. You need to ensure that the bucket can only be accessed by the VPC endpoint. How can you accomplish this? Please select:
A) Modify the route tables to allow access for the VPC endpoint
B) Modify the bucket Policy for the bucket to allow access for the VPC endpoint
C) Modify the security groups for the VPC to allow access to the S3 bucket
D) Modify the lAM Policy for the bucket to allow access for the VPC endpoint
4. Company policy requires that all insecure server protocols, such as FTP, Telnet, HTTP, etc be disabled on all servers. The security team would like to regularly check all servers to ensure compliance with this requirement by using a scheduled CloudWatch event to trigger a review of the current infrastructure. What process will check compliance of the company's EC2 instances?
A) Query the Trusted Advisor API for all best practice security checks and check for 'action recommened status.
B) Enable a GuardDuty threat detection analysis targeting the port configuration on every EC2 instance. (Incorrect)
C) Trigger an AWS(Amazon Web Service) Config Rules evaluation of the restricted-common-ports rule against every EC2 instance.
D) Run an Amazon Inspector assessment using the Runtime Behavior Analysis rules package against every EC2 instance.
5. Your company makes use of S3 buckets for storing data. There is a company policy that all services should have logging enabled. How can you ensure that logging is always enabled for created 53 buckets in the AWS(Amazon Web Service) Account?
A) Use AWS(Amazon Web Service) Cloud watch metrics to check whether logging is enabled for buckets
B) Use AWS(Amazon Web Service) Cloud watch logs to check whether logging is enabled for buckets
C) Use AWS(Amazon Web Service) Inspector to inspect all S3 buckets and enable logging for those where it is not enabled
D) Use AWS(Amazon Web Service) Configure Rules to check whether logging is enabled for buckets
A) When storing data in S3, enable server-side encryption.
B) When storing data in Amazon EBS, use only EBS - optimized Amazon EC2 instances.
C) When storing data in Amazon S3, use object versioning and MFA Delete.
D) When storing data in Amazon EC2 Instance Store, encrypt the volume by using KMS. (Incorrect)
E) When storing data in EBS, encrypt the volume by using AWS(Amazon Web Service) KMS.
2. A company has a set of resources defined in AWS. It is mandated that all API calls to the resources be monitored. Also all API calls must be stored for lookup purposes. Any log data greater than 6 months must be archived. Which of the following meets these requirements? Choose 2 answers from the options given below. Each answer forms part of the solution.(Select 2answers)
A) Enable CloudTrail logging in all accounts into S3 buckets
B) Enable CloudTrail logging in all accounts into Amazon Glacier
C) Ensure a lifecycle policy is defined on the S3 bucket to move the data to EBS volumes after 6 months.
D) Ensure a lifecycle policy is defined on the S3 bucket to move the data to Amazon Glacier after 6 months.
3. You have a bucket and a VPC defined in AWS. You need to ensure that the bucket can only be accessed by the VPC endpoint. How can you accomplish this? Please select:
A) Modify the route tables to allow access for the VPC endpoint
B) Modify the bucket Policy for the bucket to allow access for the VPC endpoint
C) Modify the security groups for the VPC to allow access to the S3 bucket
D) Modify the lAM Policy for the bucket to allow access for the VPC endpoint
4. Company policy requires that all insecure server protocols, such as FTP, Telnet, HTTP, etc be disabled on all servers. The security team would like to regularly check all servers to ensure compliance with this requirement by using a scheduled CloudWatch event to trigger a review of the current infrastructure. What process will check compliance of the company's EC2 instances?
A) Query the Trusted Advisor API for all best practice security checks and check for 'action recommened status.
B) Enable a GuardDuty threat detection analysis targeting the port configuration on every EC2 instance. (Incorrect)
C) Trigger an AWS(Amazon Web Service) Config Rules evaluation of the restricted-common-ports rule against every EC2 instance.
D) Run an Amazon Inspector assessment using the Runtime Behavior Analysis rules package against every EC2 instance.
5. Your company makes use of S3 buckets for storing data. There is a company policy that all services should have logging enabled. How can you ensure that logging is always enabled for created 53 buckets in the AWS(Amazon Web Service) Account?
A) Use AWS(Amazon Web Service) Cloud watch metrics to check whether logging is enabled for buckets
B) Use AWS(Amazon Web Service) Cloud watch logs to check whether logging is enabled for buckets
C) Use AWS(Amazon Web Service) Inspector to inspect all S3 buckets and enable logging for those where it is not enabled
D) Use AWS(Amazon Web Service) Configure Rules to check whether logging is enabled for buckets
1. Right Answer: A,E
Explanation: The AWS(Amazon Web Service) Documentation mentions the following To create an encrypted Amazon EBS volume, select the appropriate box in the Amazon EBS section of the Amazon EC2 console. You can use a custom customer master key (CMK) by choosing one from the list that appears below the encryption box. If you do not specify a custom CMK, Amazon EBS uses the AWS-managed CMK for Amazon EBS in your account. If there is no AWS-managed CMK for Amazon EBS in your account, Amazon EBS creates one. Data protection refers to protecting data while in-transit (as it travels to and from Amazon S3) and at rest (while it is stored on disks in Amazon S3 data centers). You can protect data in transit by using SSL or by using client-side encryption. You have the below options of protecting data at rest in Amazon S3. Use Server-Side Encryption ' You request Amazon S3 to encrypt your object before saving it on disks in its data centers and decrypt it when you download the objects. Use Client-Side Encryption ' You can encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools. Option A is invalid because using EBS'optimized Amazon EC2 instances alone will not guarantee protection of instances at rest. Option C is invalid because this will not encrypt data at rest for S3 objects. Option D is invalid because you don't store data in Instance store For more information on EBS encryption, please visit the below URL https://docs.aws.amazon.com/kms/latest/developerguide/services-ebs.html For more information on S3 encryption, please visit the below URL https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html
2. Right Answer: A,D
Explanation: Cloudtrail publishes the trail of API logs to an S3 bucket Option B is invalid because you cannot put the logs into Glacier from CloudTrail Option C is invalid because lifecycle policies cannot be used to move data to EBS volumes For more information on Cloudtrail logging, please visit the below URL https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-find-log-files.html You can then use Lifecycle policies to transfer data to Amazon Glacier after 6 months For more information on S3 lifecycle policies, please visit the below URL https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html
3. Right Answer: B
Explanation:
4. Right Answer: C
Explanation: Option B is incorrect because querying Trusted Advisor API's are not possible Option C is incorrect because GuardDuty should be used to detect threats and not check the compliance of security protocols. Option D is incorrect because Amazon Inspector can be used to check for vulnerabilities only One of the Inbuilt AWS(Amazon Web Service) Config Rules is built specifically for this purpose For more information on AWS(Amazon Web Service) Config managed rules , please refer to below URL https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html
5. Right Answer: D
Explanation:
Explanation: The AWS(Amazon Web Service) Documentation mentions the following To create an encrypted Amazon EBS volume, select the appropriate box in the Amazon EBS section of the Amazon EC2 console. You can use a custom customer master key (CMK) by choosing one from the list that appears below the encryption box. If you do not specify a custom CMK, Amazon EBS uses the AWS-managed CMK for Amazon EBS in your account. If there is no AWS-managed CMK for Amazon EBS in your account, Amazon EBS creates one. Data protection refers to protecting data while in-transit (as it travels to and from Amazon S3) and at rest (while it is stored on disks in Amazon S3 data centers). You can protect data in transit by using SSL or by using client-side encryption. You have the below options of protecting data at rest in Amazon S3. Use Server-Side Encryption ' You request Amazon S3 to encrypt your object before saving it on disks in its data centers and decrypt it when you download the objects. Use Client-Side Encryption ' You can encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools. Option A is invalid because using EBS'optimized Amazon EC2 instances alone will not guarantee protection of instances at rest. Option C is invalid because this will not encrypt data at rest for S3 objects. Option D is invalid because you don't store data in Instance store For more information on EBS encryption, please visit the below URL https://docs.aws.amazon.com/kms/latest/developerguide/services-ebs.html For more information on S3 encryption, please visit the below URL https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html
2. Right Answer: A,D
Explanation: Cloudtrail publishes the trail of API logs to an S3 bucket Option B is invalid because you cannot put the logs into Glacier from CloudTrail Option C is invalid because lifecycle policies cannot be used to move data to EBS volumes For more information on Cloudtrail logging, please visit the below URL https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-find-log-files.html You can then use Lifecycle policies to transfer data to Amazon Glacier after 6 months For more information on S3 lifecycle policies, please visit the below URL https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html
3. Right Answer: B
Explanation:
4. Right Answer: C
Explanation: Option B is incorrect because querying Trusted Advisor API's are not possible Option C is incorrect because GuardDuty should be used to detect threats and not check the compliance of security protocols. Option D is incorrect because Amazon Inspector can be used to check for vulnerabilities only One of the Inbuilt AWS(Amazon Web Service) Config Rules is built specifically for this purpose For more information on AWS(Amazon Web Service) Config managed rules , please refer to below URL https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html
5. Right Answer: D
Explanation:
Tags:
aws cloud awc cloud cerification certified aws aws certifications aws cloud practitioner aws solution architect aws training aws certified cloud practitioner aws exam aws certification exam aws practice exams aws 2023 aws updated questions aws questions aws cert aws certified solutions architect aws solution architect associate aws training and certification aws certified developer associate certification for devops0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment