AWS Certified Security - Specialty - Part 44

1. You are designing a custom IAM policy that would allow uses to list buckets in S3 only if they are MFA authenticated. Which of the following would best match this requirement?

A) { 'Version': '2012-10-17', 'Statement': { 'Effect': 'Allow', 'Action': [ 's3:ListAllMyBuckets', 's3:GetBucketLocation' ], 'Resource': 'Resource': 'arn:aws:s3:::*', 'Condition': { 'Bool': {'aws:MultiFactorAuthPresent':false} } } }
B) { 'Version': '2012-10-17', 'Statement': { 'Effect': 'Allow', 'Action': [ 's3:ListAllMyBuckets', 's3:GetBucketLocation' ], 'Resource': 'Resource': 'arn:aws:s3:::*', 'Condition': { 'aws:MultiFactorAuthPresent':false } } }
C) { 'Version': '2012-10-17', 'Statement': { 'Effect': 'Allow', 'Action': [ 's3:ListAllMyBuckets', 's3:GetBucketLocation' ], 'Resource': 'Resource': 'arn:aws:s3:::*', 'Condition': { 'aws:MultiFactorAuthPresent':true } } }
D) { 'Version': '2012-10-17', 'Statement': { 'Effect': 'Allow', 'Action': [ 's3:ListAllMyBuckets', 's3:GetBucketLocation' ], 'Resource': 'Resource': 'arn:aws:s3:::*', 'Condition': { 'Bool': {'aws:MultiFactorAuthPresent': true} } } }



2. An application running on EC2 instances must use a username and password to access a database. The developer has stored those secrets in the SSM Parameter Store with type SecureString using the default KMS CMK.Which combination of configuration steps will allow the application to access the secrets via the API? Select 2 answers from the options below(Select 2answers)

A) Add permission to use the KMS key to decrypt to the EC2 instance role
B) Add permission to read the SSM parameter to the EC2 instance role.
C) Add the SSM service role as a trusted service to the EC2 instance role.
D) Add permission to use the KMS key to decrypt to the SSM service role.
E) Add the EC2 instance role as a trusted service to the SSM service role.


3. Your company has defined privileged users for their AWS(Amazon Web Service) Account. These users are administrators for key resources defined in the company. There is now a mandate to enhance the security authentication for these users. How can this be accomplished?

A) Enable accidental deletion for these user accounts
B) Enable MFA for these user accounts
C) Disable root access for the users (Incorrect)
D) Enable versioning for these user accounts



4. A new application will be deployed on EC2 instances in private subnets. The application will transfer sensitive data to and from an S3 bucket. Compliance requirements state that the data must not traverse the public Internet. Which solution meets the compliance requirement?

A) Access the 53 bucket through a NAT gateway.
B) Access the 53 bucket through a VPC endpo Ent for 53
C) Access the 53 bucket through a proxy server
D) Access the 53 bucket through the SSL protected 53 endpoint



5. You have a set of Keys defined using the AWS(Amazon Web Service) KMS service. You want to stop using a couple of keys, but are not sure of which services are currently using the keys. Which of the following would be a safe option to stop using the keys from further usage?

A) Set an alias for the key
B) Change the key material for the key
C) Disable the keys
D) Delete the keys since anyway there is a 7 day waiting period before deletion