AWS Certified Security - Specialty - Part 48

1. Your development team has started using AWS(Amazon Web Service) resources for development purposes. The AWS(Amazon Web Service) account has just been created. Your IT Security team is worried about possible leakage of AWS(Amazon Web Service) keys. What is the first level of measure that should be taken to protect the AWS(Amazon Web Service) account.

A) Restrict access using IAM policies (Incorrect)
B) Create IAM Roles
C) Create IAM Groups
D) Delete the AWS(Amazon Web Service) keys for the root account



2. Your current setup in AWS(Amazon Web Service) consists of the following architecture. 2 public subnets, one subnet which has the web servers accessed by users across the internet and the other subnet for the database server. Which of the following changes to the architecture would add a better security boundary to the resources hosted In your setup Please select:

A) Consider moving the web server to a private subnet
B) Consider moving both the web and database server to a private subnet
C) Consider creating a private subnet and adding a NAT instance to that subnet
D) Consider moving the database server to a private subnet



3. You are building a large-scale confidential documentation web server on AWS(Amazon Web Service) and all of the documentation for it will be stored on 53. One of the requirements is that it cannot be publicly accessible from S3 directly, and you will need to use Cloud Front to accomplish this. Which of the methods listed below would satisfy the requirements as outlined? Choose an answer from the options below Please select:

A) Create individual policies for each bucket the documents are stored in and in that policy grant access to only Cloud Front
B) Create an Identity and Access Management (IAM) user for Cloud Front and grant access to the objects in your 53 bucket to that IAM User.
C) Create an 53 bucket policy that lists the Cloud Front distribution ID as the Principal and the target bucket as the Amazon Resource Name
D) Create an Origin Access Identity (CAl) for Cloud Front and grant access to the objects in your S3 bucket to that CAl.



4. You have an instance setup in a test environment in AWS. You installed the required application and the promoted the server to a production environment. Your IT Security team has advised that there maybe traffic flowing In from an unknown IP address to port 22. How can this be mitigated immediately? Please select:

A) Remove the rule for incoming traffic on port 22 for the Security Group
B) Change the Instance type for the Instance
C) Shutdown the instance
D) Change the AMI for the instance



5. You want to get a list of vulnerabilities for an EC2 Instance as per the guidelines set by the Center of Internet Security. How can you go about doing this?

A) Use AWS(Amazon Web Service) Inspector
B) Use AWS(Amazon Web Service) Macie (Incorrect)
C) Use AWS(Amazon Web Service) Trusted Advisor
D) Enable AWS(Amazon Web Service) Guard Duty for the Instance