AWS Certified Security – Specialty Practice Exam Questions and Answers – Part 1/2
Test your AWS Certified Security – Specialty knowledge with 13 exam-style questions, clean answer reveals, and concise explanations. Topics include: A financial firm receives a warning from the AWS Trust and Safety team about a potential security threat. An IAM access . Follow @CertPunch and visit certpunch.com for more certification practice videos and study content.
Chapters:
00:00 Intro
00:13 Question 1 of 13
02:47 Question 2 of 13
04:16 Question 3 of 13
05:40 Question 4 of 13
07:27 Question 5 of 13
08:57 Question 6 of 13
10:24 Question 7 of 13
12:02 Question 8 of 13
13:35 Question 9 of 13
14:47 Question 10 of 13
15:59 Question 11 of 13
17:30 Question 12 of 13
19:24 Question 13 of 13
What you will practice
- A financial firm receives a warning from the AWS Trust and Safety team about a potential security threat. An…
- A company has multiple accounts that are managed using AWS Organizations. A security engineer must setup a sh…
- A DevOps engineer has deployed several custom-built images provided by the development team using Amazon Elas…
- A developer is deploying a website hosted in an Amazon S3 bucket. An Amazon CloudFront distribution will be d…
- A company has several AWS accounts that use a combination of the following identity provider:
- A developer who was recently fired by a company has a personal laptop that contains the SSH keys used to acce…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A financial firm receives a warning from the AWS Trust and Safety team about a potential security threat. An IAM access key linked to an IT administrator seems to have been compromised. This key is employed in an automated process that use…
Answer: E. Disable or delete the compromised IAM access key. Stop using static IAM access keys and instead, create a new IAM role for the Lambda automation process. Assign this role to the AWS Lambda functions. Respond to the AWS Trust and Safety team detailing the remediation actions.
The best practice is to replace static IAM keys with an IAM role for Lambda. This eliminates long-term credentials. This option directly follows security best practices.
Q2. A company has multiple accounts that are managed using AWS Organizations. A security engineer must setup a shared S3 bucket in a central account and grant read-only access for all users in any account within the AWS Organization. There sho…
Answer: D. 1. Specify '' as the principal and aws:PrincipalOrgld as a condition.
Specifying '' as the principal and aws:PrincipalOrgId as a condition allows any AWS principal access while restricting it only to accounts within the specified AWS Organization. Using the organization ID as a condition is more scalable and efficient than listing each account individually.
Q3. A DevOps engineer has deployed several custom-built images provided by the development team using Amazon Elastic Container Service (ECS) with the Fargate launch type. The engineer now needs to aggregate the logs from all the containers int…
Answer: B. Enable the awslogs log driver by including awslogs-group and awslogs-region parameters in the LogConfiguration property.
The awslogs log driver is the native and most efficient method for Fargate containers to send logs directly to a specified CloudWatch log group. The CloudWatch agent cannot be used on Fargate as it runs on a separate EC2 instance, which is not available in the Fargate launch type.
Q4. A developer is deploying a website hosted in an Amazon S3 bucket. An Amazon CloudFront distribution will be deployed in front of the S3 bucket to cache the content. The developer requires that users may only access the website using the Cl…
Answer: B,C. Create an origin access identity (OAI) and associate it with the CloudFront distribution. || Configure the S3 bucket permissions so that only the origin access identity can access the bucket contents.
Creating and associating an Origin Access Identity (OAI) with CloudFront and then configuring the S3 bucket policy to grant access only to that OAI ensures all requests must go through the CloudFront distribution. Direct S3 access is blocked because the OAI is not a standard AWS user.
Q5. A company has several AWS accounts that use a combination of the following identity provider:
Answer: F,G,H. Configure a password policy in Active Directory for the federation scenario. || Configure an IAM password policy for the IAM user scenario. || Configure a password policy in the Amazon Cognito user pool.
Password policies must be configured at the source of the identity: Active Directory for federation, IAM for IAM users, and Cognito user pools for managed Cognito users. IAM policies do not apply to federated users, and Cognito identity pools are for temporary credentials, not user management.
Q6. A developer who was recently fired by a company has a personal laptop that contains the SSH keys used to access multiple Amazon EC2 instances. The security team need to ensure the developer is unable to access the EC2 instances. How can a…
Answer: D. Connect to each EC2 instance and replace the public key information in the authorized_keys file.
Connecting to the EC2 instance and editing the .ssh/authorized_keys file is the only way to revoke a compromised key. AWS does not provide a way to change an instance's key pair after it's launched; you must manage the keys at the operating system level.
Q7. A company runs an application behind an Application Load Balancer (ALB). A security engineer has noticed many suspicious HTTP requests hitting the ALB. There is an Amazon CloudFront distribution in front of the ALB. Users are reporting per…
Answer: E. Create an AWS WAF rate-based rule to block this traffic when it exceeds a defined threshold.
AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a configured request threshold in a 5-minute window, providing the least effort solution for mitigating suspicious traffic originating from a series of source IPs.
Q8. A company requires that all traffic to a specific application is captured and inspected for network and security anomalies. The application runs on several Amazon EC2 instances. The detection software has been installed on an intrusion det…
Answer: C. Configure VPC traffic mirroring to send traffic to the intrusion detection EC2 instance using a Network Load Balancer.
VPC traffic mirroring is the correct AWS service to copy live network traffic from an elastic network interface and send it to a security appliance, such as an EC2-based intrusion detection system. This provides full packet capture for inspection.
Q9. A company requires data encryption for sensitive data. The security has requested that the solution must allow cryptographic erasure of all resources protected by the encryption key within 15 minutes. Which AWS Key Management Service (AWS…
Answer: A. Use imported key material with an AWS KMS key.
Imported key material in AWS KMS can be deleted immediately, rendering the encrypted data cryptographically erased. Other key types require a waiting period of at least 7 days for scheduled deletion, which does not meet the 15-minute requirement.
Q10. A financial services company has an organization in AWS organizations with several member accounts. Amazon S3 buckets are used to store sensitive data backups from common applications within each AWS account. The company needs to restrict…
Answer: B. Service Control Policies (SCPs)
Service Control Policies (SCPs) in AWS Organizations provide a scalable way to apply permissions across all member accounts automatically. S3 bucket policies or ACLs would need to be configured on every bucket in every account, making them less scalable.
Q11. A financial institution uses Amazon API Gateway to provide REST APIs for their mobile application. A data analyst wants to study the usage patterns of the APIs without having to sift through log files. Which pair of actions will fulfill th…
Answer: D,E. Enable access logging for the appropriate API stage. || Use Amazon CloudWatch Logs Insights for analyzing API usage data.
Enabling access logging sends detailed request logs to CloudWatch, and CloudWatch Logs Insights provides powerful query capabilities to analyze the data without manual file parsing. This is more direct than using S3 and Athena or just CloudTrail.
Q12. A bespoke application consisting of three tiers is being deployed in a VPC. You need to create three security groups. You have configured the WebSG (web server) security group and now need to configure the AppSG (application tier) and DBSG…
Answer: B,C. On the DBSG security group, create a custom TCP rule for TCP 3306 and configure the AppSG security group as the source. || On the AppSG security group, create a custom TCP rule for TCP 1030 and configure the WebSG security group as the source.
Application tier security group must allow traffic from the web tier on port 1030. Database tier security group must allow traffic from the application tier on port 3306. This follows the principle of least privilege.
Q13. In response to an incident a security engineer locked down an Amazon S3 bucket with a policy that denies access to all users. Subsequently, the engineer attempted to grant access to a forensic analyst. After updating the bucket policy the…
Answer: D. An explicit deny will always override an explicit allow.
An explicit deny in the bucket policy takes precedence over any new explicit allow statements, preventing access for the forensic analyst.
More AWS Certified Security – Specialty drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.