AWS Certified Security – Specialty Practice Exam – 12 Questions with Answers – Part 2
Boost your AWS Certified Security – Specialty exam readiness with this practice test. This video presents 12 multiple-choice questions, followed by detailed answer reveals and explanations to deepen your understanding. Topics include serverless application security, secure string parameter access, and AWS WAF integration. Follow CertPunch for more certification prep and visit certpunch.com.
Chapters:
00:00 Intro
00:14 Question 1 of 12
01:36 Question 2 of 12
03:16 Question 3 of 12
05:28 Question 4 of 12
07:10 Question 5 of 12
08:50 Question 6 of 12
10:14 Question 7 of 12
11:17 Question 8 of 12
13:01 Question 9 of 12
14:52 Question 10 of 12
17:08 Question 11 of 12
18:28 Question 12 of 12
What you will practice
- A company has a serverless application that is accessed by internal users. The application consists of an AWS…
- An application running on Amazon EC2 instances reads secrets stored in AWS Systems Manager Parameter Store. T…
- A website runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) whi…
- A company has a critical web application running on a fleet of auto scaling Amazon EC2 instances behind an Ap…
- A company enforces encryption for all Amazon EBS volumes. Following security incidents, EBS snapshots sometim…
- A healthcare institution has developed a cloud-based application that collects and stores confidential patien…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A company has a serverless application that is accessed by internal users. The application consists of an AWS Lambda function that accesses an Amazon DynamoDB table. The security team are concerned that the Lambda function has internet acc…
Answer: A,B. Configure the Lambda function to connect to private subnets in an Amazon VPC. || Configure a VPC endpoint for accessing the DynamoDB table using private addresses.
Placing Lambda in private subnets and using a VPC endpoint for DynamoDB secures the application by removing public internet access. The key is using a VPC endpoint, which is not the same as DynamoDB connecting to a subnet.
Q2. An application running on Amazon EC2 instances reads secrets stored in AWS Systems Manager Parameter Store. The application issued GetParameter API calls for secure string parameters and the calls failed. Which factors could be the cause o…
Answer: C,E. The IAM role assigned to the EC2 instance profile does not have permissions to retrieve parameters in Systems Manager Parameter Store. || The IAM role assigned to the EC2 instance profile does not have decrypt permissions on the AWS KMS key used to encrypt the parameter.
Reading a secure string requires SSM GetParameter and KMS Decrypt permissions on the IAM role. The trap is confusing who needs the KMS permission.
Q3. A website runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) which serves as an origin for an Amazon CloudFront distribution. An AWS WAF is being used to protect against SQL injection attacks. A…
Answer: C. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.
AWS WAF is the correct location for blocking specific IPs as it's designed for web application firewalling. Security groups can't have deny rules, and the ALB sees traffic from the WAF, not the client's original IP address.
Q4. A company has a critical web application running on a fleet of auto scaling Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is associated with an AWS WAF web ACL. The security team has identified suspicious port sca…
Answer: D. Modify the web ACL with an IP set match rule statement and a block action to deny incoming requests from the IP address range.
The IP set match rule in WAF is designed specifically for blocking requests from a list of IP addresses. A rate-based rule is for throttling traffic by volume, not by source IP.
Q5. A company enforces encryption for all Amazon EBS volumes. Following security incidents, EBS snapshots sometimes need to be shared with a forensics account for analysis. The security team must ensure the volumes remain encrypted as much as…
Answer: B. Share an encrypted snapshot, use a customer managed KMS key, and allow the Decrypt and CreateGrant actions for the target account in the key policy.
Shared encrypted snapshots require a customer managed KMS key. The key policy must grant the target account Decrypt and CreateGrant actions for re-encryption. The trap is using an AWS managed key, which cannot be shared across accounts with fine-grained permissions.
Q6. A healthcare institution has developed a cloud-based application that collects and stores confidential patient records in an Amazon DynamoDB table. They need to adopt a solution that ensures end-to-end data protection and the ability to id…
Answer: A. Use the DynamoDB Encryption Client for client-side encryption and to digitally sign the table items.
Client-side encryption with the DynamoDB Encryption Client provides end-to-end protection and digital signatures to detect data tampering. The trap is KMS, which only encrypts at rest and does not provide integrity checks.
Q7. A FinTech company wants to shield its online banking portal from man-in-the-middle attacks, and it's using Amazon CloudFront for content delivery. What would be the most effective method to accomplish this goal with minimal administrative…
Answer: D. Use the SecurityHeadersPolicy managed response headers policy.
The SecurityHeadersPolicy managed policy enforces security best practices like HSTS with minimal overhead. The trap is using Lambda@Edge, which works but adds unnecessary complexity for a standard requirement.
Q8. An e-commerce company receives an AWS Abuse notification stating that an IAM user's access key, used by an inventory management system, may have been compromised. The security manager needs to address the potential security breach while en…
Answer: D. Generate a new access key for the IAM user. Update the inventory management system to utilize the new access key. Subsequently, deactivate the compromised access key.
Generating a new key and updating the app first avoids downtime. The trap is deleting the key immediately, which would break the application until the new key is configured.
Q9. A multinational corporation has a diversified range of services deployed on Amazon EC2 instances. The company has AWS Systems Manager Agent (SSM Agent) installed on their EC2 instances and utilizes AWS Security Hub for consolidating their…
Answer: D. Designate a delegated administrator for Amazon Inspector for the entire organization. Set up automatic scanning for all existing and new member accounts.
Amazon Inspector is the service for vulnerability scanning. A delegated administrator automatically enables scanning across all organization accounts.
Q10. A financial institution employs an on-premises hardware security module (HSM) to generate and administer its encryption keys, according to its stringent security policies. Their transaction processing application uses Amazon RDS to store d…
Answer: D. Create a new customer-managed key in AWS KMS and import the new key material. Provide Amazon RDS permissions to use the key. Create a new RDS instance and choose the new key as the encryption key. Migrate the data into RDS.
You can only import key material into customer-managed KMS keys, not AWS-managed ones. This allows you to use an external HSM for RDS encryption.
Q11. A security engineer has been asked to review an Amazon S3 bucket policy to determine if the data is properly secured against public access. The policy statement is as follows:
Answer: E. The S3 bucket ACL and object ACLs will need to be checked to determine if public access is possible.
S3 bucket policies can be overridden by bucket or object ACLs, which must also be checked to ensure no public access is granted. The exam rule is to check all policy layers for public access, not just the bucket policy.
Q12. A new employee is joining a security team. The employee initially requires access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. All security team members are added to the security team IAM group that provides additional per…
Answer: E. Create an IAM account for the new employee and add the account to the security team IAM group. Set a permissions boundary that grants access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add the additional services to the permissions boundary IAM policy.
Permissions boundaries allow a user to stay in the group while limiting their permissions. It's more efficient than creating separate groups for limited access.
More AWS Certified Security – Specialty drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.