AWS Certified Security – Specialty Practice Test – 75 Free Exam Questions with Answers

Correct answer: E. Disable or delete the compromised IAM access key. Stop using static IAM access keys and instead, create a new IAM role for the Lambda automation process. Assign this role to the AWS Lambda functions. Respond to the AWS Trust and Safety team detailing the remediation actions.

The best practice is to replace static IAM keys with an IAM role for Lambda. This eliminates long-term credentials. This option directly follows security best practices.

Correct answer: D. 1. Specify '*' as the principal and aws:PrincipalOrgld as a condition.

Specifying '*' as the principal and aws:PrincipalOrgId as a condition allows any AWS principal access while restricting it only to accounts within the specified AWS Organization. Using the organization ID as a condition is more scalable and efficient than listing each account individually.

Correct answer: B. Enable the awslogs log driver by including awslogs-group and awslogs-region parameters in the LogConfiguration property.

The awslogs log driver is the native and most efficient method for Fargate containers to send logs directly to a specified CloudWatch log group. The CloudWatch agent cannot be used on Fargate as it runs on a separate EC2 instance, which is not available in the Fargate launch type.

Correct answer: B. Create an origin access identity (OAI) and associate it with the CloudFront distribution. · C. Configure the S3 bucket permissions so that only the origin access identity can access the bucket contents.

Creating and associating an Origin Access Identity (OAI) with CloudFront and then configuring the S3 bucket policy to grant access only to that OAI ensures all requests must go through the CloudFront distribution. Direct S3 access is blocked because the OAI is not a standard AWS user.

Correct answer: F. Configure a password policy in Active Directory for the federation scenario. · G. Configure an IAM password policy for the IAM user scenario. · H. Configure a password policy in the Amazon Cognito user pool.

Password policies must be configured at the source of the identity: Active Directory for federation, IAM for IAM users, and Cognito user pools for managed Cognito users. IAM policies do not apply to federated users, and Cognito identity pools are for temporary credentials, not user management.

Correct answer: D. Connect to each EC2 instance and replace the public key information in the authorized_keys file.

Connecting to the EC2 instance and editing the .ssh/authorized_keys file is the only way to revoke a compromised key. AWS does not provide a way to change an instance's key pair after it's launched; you must manage the keys at the operating system level.

Correct answer: E. Create an AWS WAF rate-based rule to block this traffic when it exceeds a defined threshold.

AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a configured request threshold in a 5-minute window, providing the least effort solution for mitigating suspicious traffic originating from a series of source IPs.

Correct answer: C. Configure VPC traffic mirroring to send traffic to the intrusion detection EC2 instance using a Network Load Balancer.

VPC traffic mirroring is the correct AWS service to copy live network traffic from an elastic network interface and send it to a security appliance, such as an EC2-based intrusion detection system. This provides full packet capture for inspection.

Correct answer: A. Use imported key material with an AWS KMS key.

Imported key material in AWS KMS can be deleted immediately, rendering the encrypted data cryptographically erased. Other key types require a waiting period of at least 7 days for scheduled deletion, which does not meet the 15-minute requirement.

Correct answer: B. Service Control Policies (SCPs)

Service Control Policies (SCPs) in AWS Organizations provide a scalable way to apply permissions across all member accounts automatically. S3 bucket policies or ACLs would need to be configured on every bucket in every account, making them less scalable.

Correct answer: D. Enable access logging for the appropriate API stage. · E. Use Amazon CloudWatch Logs Insights for analyzing API usage data.

Enabling access logging sends detailed request logs to CloudWatch, and CloudWatch Logs Insights provides powerful query capabilities to analyze the data without manual file parsing. This is more direct than using S3 and Athena or just CloudTrail.

Correct answer: B. On the DBSG security group, create a custom TCP rule for TCP 3306 and configure the AppSG security group as the source. · C. On the AppSG security group, create a custom TCP rule for TCP 1030 and configure the WebSG security group as the source.

Application tier security group must allow traffic from the web tier on port 1030. Database tier security group must allow traffic from the application tier on port 3306. This follows the principle of least privilege.

Correct answer: D. An explicit deny will always override an explicit allow.

An explicit deny in the bucket policy takes precedence over any new explicit allow statements, preventing access for the forensic analyst.

Correct answer: A. Use AWS Config to detect any existing and new unencrypted databases. Configure an Amazon SNS notification to alert the security team. · B. Create a snapshot of unencrypted databases. Copy the unencrypted snapshots to created encrypted snapshots. Restore the databases from the encrypted snapshots.

AWS Config detects unencrypted RDS databases and SNS notifications alert the team. Creating an encrypted snapshot copy is the only way to enable encryption on an existing database, as direct encryption toggle is impossible.

Correct answer: E. Use AWS Systems Manager Session Manager to access the EC2 instances. Set up Amazon CloudWatch Logs for session logging. Choose the option to upload session logs and select the option to enforce encryption.

AWS Systems Manager Session Manager provides secure access without SSH keys or bastion hosts. It logs sessions to CloudWatch Logs, and you can enforce encryption for these logs.

Correct answer: B. Configure the key policy with a kms:ViaService condition key that limits use of the KMS key to the Amazon S3 service name.

The kms:ViaService condition key restricts a KMS key to be used only by a specific AWS service. This is the correct way to separate keys by service.

Correct answer: A. Create an organization trail in the management account and specify a central S3 bucket.

An organization trail in AWS Organizations automatically configures CloudTrail in all accounts, sending logs to a central S3 bucket. This prevents member account admins from modifying the configuration.

Correct answer: B. The state of the customer-managed key specified within the application is set to 'Disabled'. · D. The application lacks the kms:Encrypt permission for the custom-managed key.

Parameter Store needs kms:Encrypt permission to use a CMK. If the key is disabled, it cannot encrypt data, causing errors. Both are valid causes for the issue.

Correct answer: E. Modify the route table of the database subnets to remove the default route to the NAT gateway.

The correct approach is to remove the 0.0.0.0/0 route to the NAT gateway from the database subnets' route table. Network ACLs and modifying the NAT gateway itself are incorrect methods.

Correct answer: B. Configure the trust policy on the IAM role AWS Config uses to allow "config.amazonaws.com" to assume the role. · D. Configure the role policy on the IAM role AWS Config uses to allow write access to the Amazon S3 bucket. · E. Configure the access policy for the Amazon SNS topic to allow "sns:publish" access to "config.amazonaws.com".

The IAM role for AWS Config must trust config.amazonaws.com and have permissions to write to the S3 bucket. The SNS topic policy must allow config.amazonaws.com to publish, not sns:write.

Correct answer: C. Setup a Virtual Private Gateway (VGW).

AWS Direct Connect does not provide encryption. A Virtual Private Gateway (VGW) must be set up to enable a Site-to-Site VPN connection over the Direct Connect link for encryption.

Correct answer: B. Create an Amazon EventBridge rule uses the "AWS API Call via CloudTrail" event source and the "s3:PutBucketPolicy" event pattern. Generate an alert using Amazon SNS.

EventBridge is the ideal service for detecting the s3:PutBucketPolicy API call via CloudTrail and triggering an SNS alert. This is a direct and efficient event-driven solution.

Correct answer: C. Create a landing zone using AWS Control Tower. Integrate AWS Single Sign-On (SSO) with the company's existing identity provider. Grant Active Directory users access to accounts and applications.

AWS Control Tower and AWS SSO provide a centralized, scalable solution to federate on-premises AD and grant users access to multiple AWS accounts.

Correct answer: B. Use the AWS Web Application Firewall (WAF) service to inspect and manage web requests. · E. Migrate the static content to an Amazon S3 bucket and create an Amazon CloudFront distribution.

WAF can inspect and block malicious web traffic to mitigate DDoS attacks. Migrating content to S3 with CloudFront adds AWS Shield Standard, which helps with DDoS protection.

Correct answer: D. Call the AbortVaultLock operation. Update the policy. Call the initiate-vault-lock operation again.

Once a Glacier vault lock is in progress, it must be aborted with AbortVaultLock before the policy can be corrected. This is a required step in the locking process.

Correct answer: D. Verify that the S3 bucket and prefix defined in CloudTrail exists. · E. Verify that the S3 bucket policy grants CloudTrail the s3:PutObject permission.

The correct answers identify the core requirements: a valid S3 location for the log files and the proper IAM permissions via the bucket policy. This avoids common mistakes like confusing IAM roles with service principals or relying on bucket ACLs.

Correct answer: A. AWS CloudFormation · C. AWS Step Functions

CloudFormation automates the setup of the secure forensic environment, and Step Functions orchestrates the incident response workflow. This directly addresses the automation requirement, unlike services like GuardDuty which only detect threats.

Correct answer: A. Generate a credential report in each account in the Organization. Consolidate the reports and identify the users the access key IDs belong to. Rotate the access key IDs.

IAM Access Analyzer is for resource sharing, not for finding compromised credentials. You must generate a credential report in each account because reports are scoped to a single account, not an entire organization.

Correct answer: C. Use AWS Secrets Manager to store the SSH key pairs. Create an AWS Lambda function that rotates the SSH keys every 90 days. Create an AWS CloudTrail trail that logs to an S3 bucket.

Secrets Manager with a Lambda function provides the rotation logic required for SSH keys, which isn't available through its built-in automatic rotation feature. CloudTrail is needed for the audit trail, as Secret Manager doesn't provide S3 audit logs itself.

Correct answer: A. Modify the endpoint policies on all VPC endpoints. Specify the SQS and DynamoDB resources that the application uses. · C. Create an interface VPC endpoint for Amazon SQS. · D. Create a gateway VPC endpoint for Amazon DynamoDB.

VPC endpoints provide private connectivity within the VPC without exposing resources to the internet. Using interface and gateway endpoints and their policies ensures private, secure communication for SQS and DynamoDB.

Correct answer: D. Trust policy

A trust policy defines which principals can assume the role, which is a core requirement when an EC2 instance needs to assume an IAM role. Inline and managed policies grant permissions, but the trust policy enables the assumption.

Correct answer: A. Use AWS Systems Manager Session Manager. Grant the IAM user accounts permissions to use Systems Manager Session Manager.

Session Manager provides secure, auditable CLI access without opening SSH ports or managing keys. This directly meets all requirements, unlike Run Command, bastion hosts, or Secrets Manager.

Correct answer: B. Create a second access key and modify applications to use the new key. Disable the old access key and check applications are working correctly before deleting the old access key.

Creating a second key first allows for a safe, phased rotation. It prevents breaking applications by enabling you to disable the old key and test with the new one before removing the old one completely.

Correct answer: F. Create a new OU without the SCP restricting EC2 access. Move the data analytics account to the new OU.

An explicit deny in an SCP overrides any allow, and the root user is also restricted. The only way to grant access is to place the account in an OU without the deny policy. The trap is an allow statement with conditions, which are invalid in SCPs.

Correct answer: A. The network ACL denies outbound traffic on ephemeral ports. · B. The route table of the subnet is missing a route to the internet gateway. · D. The host-based firewall of the instance operating system is denying traffic.

The VPC route table for the instance's subnet must direct internet traffic to the gateway. Network ACLs are stateless and can block return traffic, and a host firewall can also block connections. The elimination cue is that security groups are stateful and automatically allow response traffic.

Correct answer: C. AWS CloudHSM.

CloudHSM provides single-tenant HSMs within a VPC, satisfying the requirement for on-premise-like key management with access logging and high availability. The exam differentiates this from KMS, which is multi-tenant.

Correct answer: B. Amazon Route 53 · C. Elastic Load Balancer · F. AWS Shield

AWS Shield provides L3/L4 DDoS protection, Route 53 handles DNS-based attacks and scales traffic, and ELB distributes traffic to prevent instance overload. GuardDuty is for detection, not protection.

Correct answer: B. Use AWS Signer to verify code integrity when code packages are deployed to Lambda. · D. Use IAM policies to enforce that developers can only create functions that have code signing enabled.

AWS Signer verifies code integrity, and IAM policies can enforce that functions require code signing, preventing developers from bypassing the check. The exam requires both validation and enforcement.

Correct answer: A. Configure the Lambda function to connect to private subnets in an Amazon VPC. · B. Configure a VPC endpoint for accessing the DynamoDB table using private addresses.

Placing Lambda in private subnets and using a VPC endpoint for DynamoDB secures the application by removing public internet access. The key is using a VPC endpoint, which is not the same as DynamoDB connecting to a subnet.

Correct answer: C. The IAM role assigned to the EC2 instance profile does not have permissions to retrieve parameters in Systems Manager Parameter Store. · E. The IAM role assigned to the EC2 instance profile does not have decrypt permissions on the AWS KMS key used to encrypt the parameter.

Reading a secure string requires SSM GetParameter and KMS Decrypt permissions on the IAM role. The trap is confusing who needs the KMS permission.

Correct answer: C. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.

AWS WAF is the correct location for blocking specific IPs as it's designed for web application firewalling. Security groups can't have deny rules, and the ALB sees traffic from the WAF, not the client's original IP address.

Correct answer: D. Modify the web ACL with an IP set match rule statement and a block action to deny incoming requests from the IP address range.

The IP set match rule in WAF is designed specifically for blocking requests from a list of IP addresses. A rate-based rule is for throttling traffic by volume, not by source IP.

Correct answer: B. Share an encrypted snapshot, use a customer managed KMS key, and allow the Decrypt and CreateGrant actions for the target account in the key policy.

Shared encrypted snapshots require a customer managed KMS key. The key policy must grant the target account Decrypt and CreateGrant actions for re-encryption. The trap is using an AWS managed key, which cannot be shared across accounts with fine-grained permissions.

Correct answer: A. Use the DynamoDB Encryption Client for client-side encryption and to digitally sign the table items.

Client-side encryption with the DynamoDB Encryption Client provides end-to-end protection and digital signatures to detect data tampering. The trap is KMS, which only encrypts at rest and does not provide integrity checks.

Correct answer: D. Use the SecurityHeadersPolicy managed response headers policy.

The SecurityHeadersPolicy managed policy enforces security best practices like HSTS with minimal overhead. The trap is using Lambda@Edge, which works but adds unnecessary complexity for a standard requirement.

Correct answer: D. Generate a new access key for the IAM user. Update the inventory management system to utilize the new access key. Subsequently, deactivate the compromised access key.

Generating a new key and updating the app first avoids downtime. The trap is deleting the key immediately, which would break the application until the new key is configured.

Correct answer: D. Designate a delegated administrator for Amazon Inspector for the entire organization. Set up automatic scanning for all existing and new member accounts.

Amazon Inspector is the service for vulnerability scanning. A delegated administrator automatically enables scanning across all organization accounts.

Correct answer: D. Create a new customer-managed key in AWS KMS and import the new key material. Provide Amazon RDS permissions to use the key. Create a new RDS instance and choose the new key as the encryption key. Migrate the data into RDS.

You can only import key material into customer-managed KMS keys, not AWS-managed ones. This allows you to use an external HSM for RDS encryption.

Correct answer: E. The S3 bucket ACL and object ACLs will need to be checked to determine if public access is possible.

S3 bucket policies can be overridden by bucket or object ACLs, which must also be checked to ensure no public access is granted. The exam rule is to check all policy layers for public access, not just the bucket policy.

Correct answer: E. Create an IAM account for the new employee and add the account to the security team IAM group. Set a permissions boundary that grants access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add the additional services to the permissions boundary IAM policy.

Permissions boundaries allow a user to stay in the group while limiting their permissions. It's more efficient than creating separate groups for limited access.

Correct answer: C. Configure the restricted-ssh managed rule in AWS Config. When the rule is NON_COMPLIANT, use the AWS Config remediation feature to publish a notification to an Amazon SNS topic.

AWS Config's 'restricted-ssh' managed rule is designed specifically for this purpose, offering a low-overhead way to detect and remediate non-compliant security group configurations.

Correct answer: B. Deploy the AWS Systems Manager Agent on the EC2 instances. Access the EC2 instances using Session Manager restricting access to users with permission to manage the instances.

Systems Manager Session Manager provides secure, auditable access without exposing RDP or SSH ports, making it the most secure solution for managing instances remotely.

Correct answer: D. Create an Amazon S3 bucket in the management account and create an Organization trail in the management account that logs to the S3 bucket.

An organization trail in the management account logging to a single S3 bucket provides centralized auditing with minimal overhead.

Correct answer: D. Configure AWS WAF to send its log files directly to an Amazon S3 bucket for later analysis.

WAF can send logs directly to S3, which is the most operationally efficient method for long-term storage without additional services.

Correct answer: D. Create a Web ACL with a string match condition that matches the value in the User-Agent header. Configure WAF to block requests that match the condition.

AWS WAF's string match condition is designed to inspect request headers like User-Agent and block based on their content, mitigating Layer 7 attacks.

Correct answer: B. Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack. · D. Create rule statements in AWS WAF web ACLs to block matching requests relating to the attack traffic.

AWS Shield Advanced provides expert DDoS mitigation and support, while AWS WAF gives you the granular control to block malicious traffic. GuardDuty is for detection, not blocking, and VPC Flow Logs don't auto-remediate.

Correct answer: C. Create an Amazon Athena table that uses the S3 bucket containing the access logs. Run SQL queries using Athena.

Athena is the most direct, serverless service for running ad-hoc SQL queries on data stored in S3 with minimal setup. The other options require more complex scripting or data movement.

Correct answer: A. Use AWS Secrets Manager and configure automatic rotation of the credentials.

Secrets Manager is the dedicated AWS service for secure credential storage and automatic rotation for databases like RDS, with encryption in transit and at rest built-in.

Correct answer: D. Disable source/destination checks on the EC2 proxy instances.

Proxy servers must disable source/destination checks to act as a middleman, forwarding traffic that is not addressed to the instance itself. This is a fundamental networking configuration.

Correct answer: A. Install the unified Amazon CloudWatch agent on the EC2 instances. Configure the agent to collect the application log files and send them to Amazon CloudWatch Logs.

The unified CloudWatch agent is the standard AWS-managed solution for collecting logs from EC2 instances and sending them to CloudWatch Logs for analysis with minimal effort.

Correct answer: F. Maintain the API endpoint type as PRIVATE. Attach a resource policy to the REST API permitting access from vpc-beta.

For a PRIVATE API Gateway endpoint, a resource policy is required to grant access to other VPCs, as the endpoint policy alone is insufficient. Peering or changing to REGIONAL adds unnecessary exposure.

Correct answer: C. Deploy the AWS Config rule "approved_ami_by_id" and specify the approved AMI IDs.

AWS Config's 'approved_ami_by_id' rule is a managed service that continuously checks EC2 instances against a list of approved AMIs, identifying non-compliance for both new and existing instances.

Correct answer: E. Enable logging in AWS WAF settings, associate the web ACL with an Amazon Kinesis Data Firehose delivery stream. · F. Create an Amazon Kinesis Data Firehose delivery stream in the same AWS Region as the web ACL. Specify the S3 bucket as the destination for the delivery stream.

Enabling WAF logging and using Kinesis Firehose to deliver logs to S3 is the standard AWS method for centralized, scalable logging of WAF activity.

Correct answer: A. Security group TCP port 80 inbound and TCP port 80 outbound. · E. Network ACL: TCP port 80 inbound and TCP ports 1024-65535 outbound.

The security group must allow inbound traffic on port 80. Network ACLs are stateless, so a rule for the high return port range is necessary.

Correct answer: C. Associate the Gateway VPC Endpoint with the route table of the private subnet, where the EC2 instance resides.

EC2 instances use the route table to determine traffic destinations. Associating the endpoint with the route table forces DynamoDB traffic through the private endpoint.

Correct answer: B. Create a new KMS key, import new key material, and point the key alias to the new KMS key.

KMS keys with imported material cannot be automatically rotated. You must create a new key and update the alias to point to the new key.

Correct answer: D. Check if an Amazon SQS policy explicitly denies access to the IAM role used by the instances. · E. Check the configuration of the IAM role attached to the instance profile to ensure it has sufficient permissions.

First, check the IAM role's permissions for sqs:ReceiveMessage. Second, check the SQS policy for an explicit deny that might override the IAM permissions.

Correct answer: A. Create an SCP that includes a Deny rule for the s3:DeleteBucket action. Apply this SCP to all the OUs in the organization.

SCPs are designed for centralized governance across multiple AWS accounts, making this the ideal solution for enforcing an organization-wide S3 deletion block. The other options are either impossible or require impractical per-account management.

Correct answer: B. Create an origin access identity (OAI) for the CloudFront distribution and update the S3 bucket policy to restrict access to the OAI. · C. Update the distribution settings in CloudFront and configure restrictions based on the geography of the request.

CloudFront's geo-restriction feature directly blocks countries, and using an Origin Access Identity ensures requests can't bypass CloudFront to access S3 directly. IP-based restrictions in S3 are hard to manage against proxies.

Correct answer: A. Use AWS Config with Auto Remediation to remediate any changes to S3 bucket policies. Configure alerting with AWS Config and Amazon SNS.

AWS Config is specifically built for continuous monitoring and automated remediation of resource configurations, which perfectly meets the requirement for the least effort. Custom solutions like Lambda require more development.

Correct answer: E. "Action": "sts:AssumeRole"

The sts:AssumeRole action is the correct API call for an IAM user to assume a role, as it's part of the Security Token Service. The 'ec2' action is a common trap.

Correct answer: C. Implement an SCP that uses the "aws:RequestedRegion" condition to deny actions outside the approved region. Attach the SCP to the AWS account under AWS Organizations.

AWS Organizations SCPs enforce region restrictions at the organizational level, providing the minimum overhead compared to manually applying IAM policies to individual users.

Correct answer: D. Change the existing single-region trail to log all regions and capture API activity in a single central Amazon S3 bucket.

Modifying an existing trail to log all regions is the simplest method to centralize CloudTrail logs, as it avoids managing multiple trails.

Correct answer: C. Check the SCPs set at the organizational units (OUs). · E. Check for the permissions boundaries set for the IAM user.

SCPs restrict all accounts in an OU, while permissions boundaries set the maximum permissions for an identity, both could cause 'access denied'.

Correct answer: C. Download the AWS-provided root certificates. Use the certificates when connecting to the RDS DB instance.

AWS provides root certificates for clients to use when connecting to RDS with TLS encryption. Option A is a trap as KMS is for encryption at rest, not in transit. Option B is wrong because self-signed certificates are not supported.