[Aug 05, 2022] Valid AWS-Security-Specialty Test Answers & AWS-Security-Specialty Exam PDF
Valid AWS Certified Security AWS-Security-Specialty Dumps Ensure Your Passing
Difficulty in Writing Amazon AWS-Security-Specialty: AWS Certified Security - Specialty Exam
As everybody knows, this examination can not be quickly completed because the AWS certified security - specialty exam dumps requires to pass the examinations these exam dumps requires a lot of time and accurate and up to date content to pass the exam effectively. Many applicants are doubted about the type of questions posed in the exam and the complexity of questions and the time taken to complete the questions before writing a credential AWS Accredited Developer Professional certification. The best way to pass the Professional Test is to question and prepare with AWS certified security - specialty exam dumps. AWS Accredited Developer Candidates are evaluating their education and finding places for change in the real review style. The best approach is to practice the Professional Credential Review with an AWS Certified Developer, as the examination is a key factor of the AWS Certified Developer.
Partner Professional Exam Research Plan that helps applicants to explore their strengths and faults to develop their time management skills and to get an understanding of the score they should receive. AWS Accredited Developer Professional review is the new issue to the review, that applicants without difficulties should understand. Professional AWS certified security - specialty practice exams research material from Amazon AWS-Security-Specialty: AWS Certified Security - Specialty Exam is ideally suited to busy practitioners who have no money to spare on training and want to do so within one week. Following a thorough review of AWS certified solutions, architect-professional practice evaluation has been properly prepared by the expert team. We periodically update our content. The aim is to keep candidates up-to-date and we shall automatically amend the material when and when the Offensive Protection reports any changes in the AWS certified security - specialty practice test.
NEW QUESTION 114
A company needs a security engineer to implement a scalable solution for multi-account authentication and authorization. The solution should not introduce additional user-managed architectural components. Native AWS features should be used as much as possible The security engineer has set up AWS Organizations w1th all features activated and AWS SSO enabled.
Which additional steps should the security engineer take to complete the task?
- A. Use AD Connector to create users and groups for all employees that require access to AWS accounts. Assign AD Connector groups to AWS accounts and link to the IAM roles in accordance with the employees'job functions and access requirements Instruct employees to access AWS accounts by using the AWS Directory Service user portal.
- B. Use an AW5 SSO default directory to create users and groups for all employees that require access to AWS accounts. Assign groups to AWS accounts and link to permission sets in accordance with the employees'job functions and access requirements. Instruct employees to access AWS accounts by using the AWS SSO user portal.
- C. Use AWS Directory Service tor Microsoft Active Directory to create users and groups for all employees that require access to AWS accounts Enable AWS Management Console access in the created directory and specify AWS SSO as a source cl information tor integrated accounts and permission sets. Instruct employees to access AWS accounts by using the AWS Directory Service user portal.
- D. Use an AWS SSO default directory to create users and groups for all employees that require access to AWS accounts. Link AWS SSO groups to the IAM users present in all accounts to inherit existing permissions. Instruct employees to access AWS accounts by using the AW5 SSO user portal.
Answer: B
NEW QUESTION 115
A Security Engineer has created an Amazon CloudWatch event that invokes an AWS Lambda function daily.
The Lambda function runs an Amazon Athena query that checks AWS CloudTrail logs in Amazon S3 to detect whether any IAM user accounts or credentials have been created in the past 30 days. The results of the Athena query are created in the same S3 bucket. The Engineer runs a test execution of the Lambda function via the AWS Console, and the function runs successfully.
After several minutes, the Engineer finds that his Athena query has failed with the error message: "Insufficient Permissions". The IAM permissions of the Security Engineer and the Lambda function are shown below:
Security Engineer
Lambda function execution role
What is causing the error?
- A. The Lambda function does not have permissions to start the Athena query execution.
- B. The Lambda function does not have permissions to access the CloudTrail S3 bucket.
- C. The Athena service does not support invocation through Lambda.
- D. The Security Engineer does not have permissions to start the Athena query execution.
Answer: D
NEW QUESTION 116
A Developer signed in to a new account within an AWS Organizations organizational unit (OU) containing multiple accounts. Access to the Amazon S3 service is restricted with the following SCP:
How can the Security Engineer provide the Developer with Amazon S3 access without affecting other accounts?
- A. Move the SCP to the root OU of Organizations to remove the restriction to access Amazon S3.
- B. Add an IAM policy for the Developer, which grants S3 access.
- C. Add an allow list for the Developer account for the S3 service.
- D. Create a new OU without applying the SCP restricting S3 access. Move the Developer account to this new OU.
Answer: D
NEW QUESTION 117
A company hosts a critical web application on the AWS Cloud. This is a key revenue generating application for the company. The IT Security team is worried about potential DDos attacks against the web site. The senior management has also specified that immediate action needs to be taken in case of a potential DDos attack. What should be done in this regard?
Please select:
- A. Consider using Cloudwatch logs to monitor traffic for DDos attack and quickly take actions on a trigger of a potential attack.
- B. Consider using the AWS Shield Advanced Service
- C. Consider using the AWS Shield Service
- D. Consider using VPC Flow logs to monitor traffic for DDos attack and quickly take actions on a trigger of a potential attack.
Answer: B
Explanation:
Explanation
Option A is invalid because the normal AWS Shield Service will not help in immediate action against a DDos attack. This can be done via the AWS Shield Advanced Service Option B is invalid because this is a logging service for VPCs traffic flow but cannot specifically protect against DDos attacks.
Option D is invalid because this is a logging service for AWS Services but cannot specifically protect against DDos attacks.
The AWS Documentation mentions the following
AWS Shield Advanced provides enhanced protections for your applications running on Amazon EC2. Elastic Load Balancing (ELB), Amazon CloudFront and Route 53 against larger and more sophisticated attacks. AWS Shield Advanced is available to AWS Business Support and AWS Enterprise Support customers. AWS Shield Advanced protection provides always-on, flow-based monitoring of network traffic and active application monitoring to provide near real-time notifications of DDoS attacks. AWS Shield Advanced also gives customers highly flexible controls over attack mitigations to take actions instantly. Customers can also engage the DDoS Response Team (DRT) 24X7 to manage and mitigate their application layer DDoS attacks.
For more information on AWS Shield, please visit the below URL:
https://aws.amazon.com/shield/faqs;
The correct answer is: Consider using the AWS Shield Advanced Service Submit your Feedback/Queries to our Experts
NEW QUESTION 118
Your company looks at the gaming domain and hosts several Ec2 Instances as game servers. The servers each experience user loads in the thousands. There is a concern of DDos attacks on the EC2 Instances which could cause a huge revenue loss to the company. Which of the following can help mitigate this security concern and also ensure minimum downtime for the servers.
Please select:
- A. Use AWS Shield Advanced to protect the EC2 Instances
- B. Use AWS Trusted Advisor to protect the EC2 Instances
- C. Use AWS Inspector to protect the EC2 Instances
- D. Use VPC Flow logs to monitor the VPC and then implement NACL's to mitigate attacks
Answer: A
Explanation:
Below is an excerpt from the AWS Documentation on some of the use cases for AWS Shield
NEW QUESTION 119
While analyzing a company's security solution, a Security Engineer wants to secure the AWS account root user.
What should the Security Engineer do to provide the highest level of security for the account?
- A. Create a new IAM user that has administrator permissions in the AWS account. Enable multi-factor authentication for the AWS account root user.
- B. Create a new IAM user that has administrator permissions in the AWS account. Delete the password for the AWS account root user.
- C. Replace the access key for the AWS account root user. Delete the password for the AWS account root user.
- D. Create a new IAM user that has administrator permissions in the AWS account. Modify the permissions for the existing IAM users.
Answer: A
Explanation:
Explanation
If you continue to use the root user credentials, we recommend that you follow the security best practice to enable multi-factor authentication (MFA) for your account. Because your root user can perform sensitive operations in your account, adding an additional layer of authentication helps you to better secure your account. Multiple types of MFA are available.
NEW QUESTION 120
A company wants to have an Intrusion detection system available for their VPC in AWS. They want to have complete control over the system. Which of the following would be ideal to implement?
Please select:
- A. Use AWS WAF to catch all intrusions occurring on the systems in the VPC
- B. Use a custom solution available in the AWS Marketplace
- C. Use AWS Cloudwatch to monitor all traffic
- D. Use VPC Flow logs to detect the issues and flag them accordingly.
Answer: B
Explanation:
Sometimes companies want to have custom solutions in place for monitoring Intrusions to their systems. In such a case, you can use the AWS Marketplace for looking at custom solutions.
Option A.C and D are all invalid because they cannot be used to conduct intrusion detection or prevention.
For more information on using custom security solutions please visit the below URL
https://d1.awsstatic.com/Marketplace/security/AWSMP_Security_Solution%200verview.pdf
For more information on using custom security solutions please visit the below URL:
https://d1.awsstatic.com/Marketplace/security/AWSMP Security Solution%20Overview.pd1
The correct answer is: Use a custom solution available in the AWS Marketplace Submit your Feedback/Queries to our Experts
NEW QUESTION 121
A Developer who is following AWS best practices for secure code development requires an application to encrypt sensitive data to be stored at rest, locally in the application, using AWS KMS. What is the simplest and MOST secure way to decrypt this data when required?
- A. Use the Encrypt API to store an encrypted version of the data key with another customer managed key.
Decrypt the data key and use it to decrypt the data when required. - B. Request KMS to provide the stored unencrypted data key and then use the retrieved data key to decrypt the data.
- C. Keep the plaintext data key stored in Amazon DynamoDB protected with IAM policies. Query DynamoDB to retrieve the data key to decrypt the data
- D. Store the encrypted data key alongside the encrypted data. Use the Decrypt API to retrieve the data key to decrypt the data when required.
Answer: D
NEW QUESTION 122
A company has an AWS account and allows a third-party contractor who uses another AWS account, to assume certain 1AM roles. The company wants to ensure that IAM roles can be assumed by the contractor only if the contractor has multi-factor authentication enabled on their IAM user accounts What should the company do to accomplish this?
A)
B)
C)
D)
- A. Option C
- B. Option A
- C. Option B
- D. Option D
Answer: B
NEW QUESTION 123
An organization is using AWS CloudTrail, Amazon CloudWatch Logs, and Amazon CloudWatch to send alerts when new access keys are created. However, the alerts are no longer appearing in the Security Operations mail box.
Which of the following actions would resolve this issue?
- A. In CloudWatch, verify that the alarm threshold "consecutive periods" value is equal to, or greater than 1.
- B. In SNS, ensure that the subscription used by these alerts has not been deleted.
- C. In CloudTrail, verify that the trail logging bucket has a log prefix configured.
- D. In Amazon SNS, determine whether the "Account spend limit" has been reached for this alert.
Answer: A
NEW QUESTION 124
A corporate cloud security policy states that communications between the company's VPC and KMS must travel entirely within the AWS network and not use public service endpoints.
Which combination of the following actions MOST satisfies this requirement? (Choose two.)
- A. Add the following condition to the AWS KMS key policy: "aws:SourceIp": "10.0.0.0/16".
- B. Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.
- C. Add the aws:sourceVpce condition to the AWS KMS key policy referencing the company's VPC endpoint ID.
- D. Create a VPC endpoint for AWS KMS with private DNS enabled.
- E. Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.
Answer: C,D
Explanation:
Explanation
Explanation
An IAM policy can deny access to KMS except through your VPC endpoint with the following condition statement:
"Condition": {
"StringNotEquals": {
"aws:sourceVpce": "vpce-0295a3caf8414c94a"
}
}
If you select the Enable Private DNS Name option, the standard AWS KMS DNS hostname (https://kms.<region>.amazonaws.com) resolves to your VPC endpoint.
NEW QUESTION 125
The AWS Systems Manager Parameter Store is being used to store database passwords used by an AWS Lambda function. Because this is sensitive data, the parameters are stored as type SecureString and protected by an AWS KMS key that allows access through IAM. When the function executes, this parameter cannot be retrieved as the result of an access denied error.
Which of the following actions will resolve the access denied error?
- A. Update the ssm.amazonaws.com principal in the KMS key policy to allow kms: Decrypt.
- B. Add a policy to the role that the Lambda function uses, allowing kms: Decrypt for the KMS key.
- C. Update the Lambda configuration to launch the function in a VPC.
- D. Add lambda.amazonaws.com as a trusted entity on the IAM role that the Lambda function uses.
Answer: A
Explanation:
Explanation/Reference: https://aws.amazon.com/blogs/compute/sharing-secrets-with-aws-lambda-using-aws-systems- manager-parameter-store/
NEW QUESTION 126
Auditors tor a health care company have mandated mat all data volumes be encrypted at rest Infrastructure is deployed mainly via AWS CloudFormation however third-party frameworks and manual deployment are required on some legacy systems What is the BEST way to monitor, on a recurring basis, whether all EBS volumes are encrypted?
- A. On a recurring basis, update an IAM user policies to require that EC2 instances are created with an encrypted volume
- B. Use CloudWatch Logs to determine whether instances were created with an encrypted volume
- C. Configure an AWS Config rule lo run on a recurring basis 'or volume encryption
- D. Set up Amazon Inspector rules tor volume encryption to run on a recurring schedule
Answer: A
NEW QUESTION 127
A distributed web application is installed across several EC2 instances in public subnets residing in two
Availability Zones. Apache logs show several intermittent brute-force attacks from hundreds of IP
addresses at the layer 7 level over the past six months.
What would be the BEST way to reduce the potential impact of these attacks in the future?
- A. Update security groups to deny traffic from the originating source IP addresses.
- B. Use network ACLs.
- C. Install intrusion prevention software (IPS) on each instance.
- D. Use custom route tables to prevent malicious traffic from routing to the instances.
Answer: B
NEW QUESTION 128
A company has a serverless application for internal users deployed on AWS. The application uses AWS Lambda for the front end and for business logic. The Lambda function accesses an Amazon RDS database inside a VPC. The company uses AWS Systems Manager Parameter Store for storing database credentials.
A recent security review highlighted the following issues:
* The Lambda function has internet access.
* The relational database is publicly accessible.
* The database credentials are not stored in an encrypted state.
Which combination of steps should the company take to resolve these security issues? (Choose three.)
- A. Edit the IAM role used by RDS to restrict internet access.
- B. Move all the Lambda functions inside the VPC.
- C. Create a VPC endpoint for Systems Manager. Store the credentials as a string parameter. Change the parameter type to an advanced parameter.
- D. Disable public access to the RDS database inside the VPC.
- E. Edit the IAM role used by Lambda to restrict internet access.
- F. Create a VPC endpoint for Systems Manager. Store the credentials as a SecureString parameter.
Answer: A,B,C
Explanation:
Explanation/Reference: https://docs.amazonaws.cn/en_us/config/latest/developerguide/operational-best-practices-for- hipaa_security.html (guidance)
NEW QUESTION 129
Which of the following bucket policies will ensure that objects being uploaded to a bucket called 'demo' are encrypted.
Please select:
- A. Option
- B. Option
- C. Option
- D. Option
Answer: D
Explanation:
Explanation
The condition of "s3:x-amz-server-side-encryption":"aws:kms" ensures that objects uploaded need to be encrypted.
Options B,C and D are invalid because you have to ensure the condition of ns3:x-amz-server-side-encryption":"aws:kms" is present For more information on AWS KMS best practices, just browse to the below URL:
https://dl.awsstatic.com/whitepapers/aws-kms-best-praaices.pdf
Submit your Feedback/Queries to our Expert
NEW QUESTION 130
......
AWS-Security-Specialty Dumps Real Exam Questions Test Engine Dumps Training: https://www.realvalidexam.com/AWS-Security-Specialty-real-exam-dumps.html
AWS-Security-Specialty exam dumps and online Test Engine: https://drive.google.com/open?id=1-TA3xmd8AXQhFkixUgwqF45yVwB3LxEC
