(Test2)Quiz #3

A company wants to launch a multitier web application in which the application servers are hosted on Amazon EC2 instances behind an Application Load Balancer. These EC2 instances require access to credentials that they will use to authenticate their SQL connections to an Amazon RDS database. The application is also using several AWS Lambda functions to issue queries to the database using the same database credentials. The Security Engineer is instructed to store the credentials so that both EC2 instances and the Lambda functions can access them. For audit purposes, access logs must also be recorded to track when the credentials were accessed and by whom. What should the Engineer do to satisfy the above requirements?

An organization has created multiple accounts in AWS to support the rapid growth of its cloud services. The multiple accounts are used to separate their various departments such as finance, human resources, engineering, and many others. Each account is managed by a Systems Administrator which has the root access for that specific account only. There is a requirement to centrally manage policies across multiple AWS accounts by allowing or denying particular AWS services for individual accounts, or for groups of accounts. Which is the most suitable solution that Security Engineer should implement with the LEAST amount of complexity?

A company is using Amazon Athena query with Amazon QuickSight to visualize the AWS CloudTrail logs. The Security Administrator created a custom Athena query that reads the CloudTrail logs and checks if there are IAM user accounts or credentials created in the past 29, 30 or 31 days (depending on the current month). However, the Administrator always gets an Insufficient Permissions error whenever she tries to run the query from Amazon QuickSight. What is the MOST suitable solution that the Administrator should do to fix this issue?

The Security team has been tasked to simplify the management of AWS WAF, AWS Shield Advanced, and Amazon VPC security groups as well maintenance tasks across multiple accounts and resources. Which of the following is the MOST suitable service that the team should use?

A company wants to block all traffic to their Amazon S3 bucket except for the traffic coming from an EC2 instance in their VPC or from an authorized external IP address that its Security Administrator specifies. Which steps could be taken to accomplish this task without incurring any extra costs? (Select TWO.)

An organization is planning to launch its web application with an Amazon RDS MariaDB database to serve its clients worldwide. The application will run on both on-premises servers as well as Reserved EC2 instances. The database credentials must be encrypted both at rest and in transit. Their Security Engineer is tasked to manage all of the security aspects of the application architecture. How should the Engineer automate the deployment process of the application in the MOST secure manner?

A financial company is using hundreds of Amazon S3 buckets to store sensitive corporate files. There is a requirement to improve the security of the data stored in S3 buckets. The files must be encrypted in transit and also at rest. Any object retrievals must be logged using AWS CloudTrail for audit purposes. What should the Security Engineer implement to satisfy the above security requirements? (Select THREE.)

You have created a Lambda function that requires access to an RDS MySQL database. You did not store the database password inside your function code, but instead, you stored it as a “SecureString” type parameter on AWS Systems Manager Parameter Store. You’ve also added the ssm:GetParameter permission on the IAM execution role of your function to enable the retrieval of the database password. Upon testing, your API does not function properly, and you suspected that the database password is not retrieved when the function runs. Which of the following is the possible reason for this?

A media company runs a Python script that uses the AWS CLI command aws s3 cp to upload a large file to an Amazon S3 bucket, which includes an AWS KMS key. An Access Denied error always shows up whenever their developers upload a file with a size of 10 GB or more. However, when they tried to upload a smaller file with the KMS key, the upload succeeds. Which of the following are potential reasons why this issue is happening? (Select TWO.)

A company has an application hosted in an Auto Scaling group of On-Demand EC2 instances behind a Classic Load Balancer (CLB). The Security Administrator is tasked to secure the application by allowing multiple domains to serve SSL traffic over the same IP address. Which of the following should the Administrator implement to satisfy this requirement?

The IT Security team of an organization recently discovered that several employees placed restricted data in various S3 buckets without any authorization. The team needs to identify all possible S3 objects that contain personally identifiable information (PII) and then determine whether this information has been accessed or not. Any data that may have been exposed would have serious consequences for the organization. What should the Security team do in this situation?

You are storing sensitive information for each user on a DynamoDB table. The entries are encrypted using a customer managed CMK to ensure that they are not easily readable from other users. However, other privileged users may have permissions to both read and write to the DynamodDB table. These users could possibly swap encrypted entries inside the table and view them as their own. To prevent this, you want to enable authenticated encryption by including additional authenticated data (AAD) such as email address and username on the ciphertext. Which of the following options will help you achieve this?

The InfoSec team is responsible for reviewing AWS API call activities to detect security violations across all AWS Regions wherein the company’s cloud resources are used. The events must be recorded and stored in a centralized location for both current and future AWS regions. Which of the following is the SIMPLEST solution to satisfy the above requirements?

The Security team wants to delegate user creation duties to the SysOps Administrator. However, the team must ensure that the SysOps Administrator creates users that adhere to the following company rules: – Users cannot use IAM to create or manage users, groups, roles, or policies. – Users are denied access to the Amazon S3 logs bucket and cannot access production EC2 instances. How can the team fulfill this task?

An application is hosted in multiple EC2 instances behind an Application Load Balancer that allows a number of remote employees to send and process corporate data files. The Security Engineer noticed that data files are not encrypted while in transit over the public Internet. What is the EASIEST solution to resolve this security risk?