Test 2 Quiz 1

A company has several accounts integrated with AWS Organizations that has enabled all feature sets and consolidated billing. The CTO is planning to restrict the capabilities of the root user accounts to further tighten the infrastructure security. The top-level account is primarily used for billing and administrative purposes while the other accounts are for systems operations. Each department can have one or more AWS accounts. What is the MOST suitable solution to restrict usage of member root user accounts across the organization?

An organization has several web applications hosted in On-Demand Amazon EC2 instances. The InfoSec team has been tasked to set up a monitoring solution that will centrally collect all of the application logs from the instances. What is the MOST efficient way to satisfy this requirement?

A new security policy requires encrypting all communications between the company’s on-premises servers and Amazon EC2 instances behind in transit. The servers communicate using custom proprietary protocols. The EC2 instances must be placed behind a load balancer to improve availability and scalability.

An organization is planning to launch an application that will store sensitive files in three Amazon S3 buckets based on a data classification scheme of Restricted, Private, and Public. The solution must encrypt each object using a unique key, and the AWS KMS must be set to automatically rotate encryption keys annually. Moreover, access to files in the Restricted bucket must be protected by two-factor authentication. Which of the following solutions will satisfy the above requirement?

A company is using hundreds of Linux EC2 instances to run its suite of web applications. The Security team needs to implement a system that verifies that all of the EC2 instances are using the approved Amazon Machine Image (AMI). The solution should notify the team if there are non-compliant EC2 instances in the corporate VPC. Which of the following actions should the team implement?

An organization has a web application hosted in a fleet of EC2 instances that publishes custom metrics to Amazon CloudWatch. After a few days, the IT Operations team noticed that the metrics are no longer sent to CloudWatch. The Security Administrator noticed that there has been a recent change in the IAM policy that is used by the application. The issue must be fixed immediately without compromising security. Which of the following is the LEAST permissive solution that the Administrator should grant in this scenario?

The InfoSec team is designing a solution that allows the Incident Response team to audit any IAM permission changes of any IAM User. In the event of a security incident, the team should be able to track the changes in each user’s IAM permissions. It should also show the permissions that belonged to a user at a specific time. How can this task be accomplished?

A Solutions Architect is designing an application to fetch the RDS database credentials that are stored as Secure String parameters in AWS Systems Manager Parameter Store. The Security Administrator has been tasked to handle the integration, but she always receives an error message every time she tries to encrypt or decrypt a Secure String parameter from the AWS Systems Manager Parameter Store that uses an AWS KMS customer-managed key (CMK). Which of the following options could be responsible for this issue? (Select TWO.)

An organization uses several EC2 instances to manage and push the regular updates to a fleet of 3,000 Internet of Things (IoT) field devices that monitor the city’s air quality. Each IoT device has unique access credentials used to communicate to the instances. The Security Engineer has been instructed to ensure that access to specific credentials are independently auditable. What is the MOST cost-effective way to manage the storage of credentials?

A Security Engineer refactored an application to remove the hardcoded Amazon RDS database credential from the application and store it to AWS Secrets Manager instead. The application works fine after the code change. For improved data security, the Engineer enabled rotation of the credential in Secrets Manager and then set the rotation to change every 30 days. The change was done successfully without any issues but after a short while, the application is getting an authentication error whenever it connects to the database. What is the MOST likely cause of this issue?

A Systems Administrator is configuring the outbound mail of an application through Amazon Simple Email Service (SES). There is a requirement that all connections must be encrypted automatically using Transport Layer Security (TLS) to comply with the company’s IT policy. Which of the following is the correct endpoint and port that the Administrator should use?

A Software Engineer has developed a web application to monitor the pending/processed orders on the corporate sales server. The application needs to be accessed by Delivery, Finance, and Admin teams. The Security Administrator decided to integrate Amazon Cognito to the application to provide user sign-in functionality for the members of each team. The Delivery team should be able to update entries on the application while the Finance team only needs read permissions to verify the flow of orders. Which of the following options will help the Administrator grant distinct permissions for each team member?

A company has a multitier online application hosted in several EC2 instances that is publicly accessible around the world. The Security Administrator has already placed the required network access control lists and security groups in the VPC of the application. The web servers are hosted in public subnets behind a public-facing Application Load Balancer while the application servers are hosted in private subnets. The Administrator needs to enhance the edge security of the cloud architecture to safeguard the EC2 instances against attacks. Which combination of options should be implemented in this scenario? (Select TWO.)

A company is using Amazon CloudWatch to monitor the application logs from multiple Linux EC2 instances via CloudWatch Logs agents installed in each instance. The agent configuration files have been verified and the log files to be pushed are properly configured. However, the Security Administrator identified that a few EC2 instances were not sending any logs at all. Which actions should be taken to troubleshoot this problem? (Select TWO.)