AWS Certified Security - Specialty - Part 42

1. You have setup a set of applications across 2 VPC?s. You have also setup VPC Peering. The applications are still not able to communicate across the Peering connection. Which network troubleshooting steps should be taken to resolve the issue? Please select:

A) Ensure the applications are hosted in a public subnet
B) Check to see if the VPC has an Internet gateway attached.
C) Check to see if the VPC has a NAT gateway attached
D) Check the Route tables for the VPCs



2. You are deivising a policy to allow users to have the ability to access objects in a bucket called appbucket.You define the below custom bucket policy{ 'ID': 'Policy1502987489630','Version': '2012-10-17','Statement': [{'Sid': 'Stmt1502987487640','Action': ['s3:GetObject','s3:GetObjectVersion'],'Effect': 'Allow','Resource': 'arn:aws:s3:::appbucket','Principal': '*'}]}But when you try to apply the policy you get the error'Action does not apply to any resource(s) in statement. What should be done to rectify the error

A) Verify that the policy has the same name as the bucket name. If not, make it the same.
B) Change the IAM permissions by applying PutBucketPolicy permissions.
C) Create the bucket 'appbucket' and then apply the policy. (Incorrect)
D) Change the Resource section to 'arn:aws:s3:::appbucket/*'.



3. Your company has mandated that all calls to the AWS(Amazon Web Service) KMS service be recorded. How can this be achieved?

A) Use Cloudwatch metrics (Incorrect)
B) Enable a trail in Cloudtrail
C) Enable logging on the KMS service
D) Enable Cloudwatch logs



4. A security team is creating a response plan in the event an employee executes unauthorized actions on AWS(Amazon Web Service) infrastructure. They want to include steps to determine if the employee's IAM permissions changed as part of the incident. What steps should the team document In the plan?

A) Use Trusted Advisor to examine the employee's PAM permissions prior to the incident and compare them to the employee's current IAM permissions.
B) Use Made to examine the employee's IAM permissions prior to the incident and compare them to the employee's current IAM permissions.
C) Use Cloud Trail to examine the employee's IAM permissions prior to the incident and compare them to the employee's current IAM permissions
D) Use AWS(Amazon Web Service) Configure to examine the employee's IAM permissions prior to the incident and compare them to the employee's current PAM permissions.



5. You have an instance setup in a test environment in AWS. You installed the required application and the promoted the server to a production environment. Your IT Security team has advised that there maybe traffic flowing in from an unknown IP address to port 22. How can this be mitigated immediately?

A) Remove the rule for incoming traffic on port 22 for the Security Group
B) Shutdown the instance
C) Change the AMI for the instance
D) Change the Instance type for the Instance