QUESTION: 33

A corporation is preparing to acquire several companies. A Security Engineer must design a solution to ensure that newly acquired IAM accounts follow the corporation's security best practices. The solution should monitor each Amazon S3 bucket for unrestricted public write access and use IAM managed services.

What should the Security Engineer do to meet these requirements?

Configure Amazon Macie to continuously check the configuration of all S3 buckets.
Enable IAM Config to check the configuration of each S3 bucket.
Set up IAM Systems Manager to monitor S3 bucket policies for public write access.
Configure an Amazon EC2 instance to have an IAM role and a cron job that checks the status of all S3 buckets.

Answer(s): C

Explanation:

because this is a solution that can monitor each S3 bucket for unrestricted public write access and use IAM managed services. S3 is a service that provides object storage in the cloud. Systems Manager is a service that helps you automate and manage your AWS resources. You can use Systems Manager to monitor S3 bucket policies for public write access by using a State Manager association that runs a predefined document called AWS-FindS3BucketWithPublicWriteAccess. This document checks each S3 bucket in an account and reports any bucket that has public write access enabled. The other options are either not suitable or not feasible for meeting the requirements.

Reveal Solution Next Question

QUESTION: 34

A Security Engineer is troubleshooting an issue with a company's custom logging application. The application logs are written to an Amazon S3 bucket with event notifications enabled to send events lo an Amazon SNS topic. All logs are encrypted at rest using an IAM KMS CMK. The SNS topic is subscribed to an encrypted Amazon SQS queue. The logging application polls the queue for new messages that contain metadata about the S3 object. The application then reads the content of the object from the S3 bucket for indexing.

The Logging team reported that Amazon CloudWatch metrics for the number of messages sent or received is showing zero. No togs are being received.

What should the Security Engineer do to troubleshoot this issue?

Add the following statement to the IAM managed CMKs:
Add the following statement to the CMK key policy:
Add the following statement to the CMK key policy:
Add the following statement to the CMK key policy:

Answer(s): D

Reveal Solution Next Question

QUESTION: 35

Developers in an organization have moved from a standard application deployment to containers. The Security Engineer is tasked with ensuring that the containers are secure.
Which strategies will reduce the attack surface and enhance the security of the containers? (Select TWO.)

Use the containers to automate security deployments.
Limit resource consumption (CPU, memory), networking connections, ports, and unnecessary container libraries.
Segregate containers by host, function, and data classification.
Use Docker Notary framework to sign task definitions.
Enable container breakout at the host kernel.

Answer(s): A,C

Explanation:

these are the strategies that can reduce the attack surface and enhance the security of the containers. Containers are a method of packaging and running applications in isolated environments. Using containers to automate security deployments can help ensure that security patches and updates are applied consistently and quickly across the container fleet. Segregating containers by host, function, and data classification can help limit the impact of a compromise and enforce the principle of least privilege. The other options are either irrelevant or risky for securing containers.

Reveal Solution Next Question

QUESTION: 36

An organization wants to log all IAM API calls made within all of its IAM accounts, and must have a central place to analyze these logs.
What steps should be taken to meet these requirements in the MOST secure manner? (Select TWO)

Turn on IAM CloudTrail in each IAM account.
Turn on CloudTrail in only the account that will be storing the logs.
Update the bucket ACL of the bucket in the account that will be storing the logs so that other accounts can log to it.
Create a service-based role for CloudTrail and associate it with CloudTrail in each account.
Update the bucket policy of the bucket in the account that will be storing the logs so that other accounts can log to it.

Answer(s): A,E

Explanation:

these are the steps that can meet the requirements in the most secure manner. CloudTrail is a service that records AWS API calls and delivers log files to an S3 bucket. Turning on CloudTrail in each IAM account can help capture all IAM API calls made within those accounts. Updating the bucket policy of the bucket in the account that will be storing the logs can help grant other accounts permission to write log files to that bucket. The other options are either unnecessary or insecure for logging and analyzing IAM API calls.

Reveal Solution Next Question

Free AWS Certified Security - Specialty Exam Braindumps

QUESTION: 33

Explanation:

QUESTION: 34

QUESTION: 35

Explanation:

QUESTION: 36

Explanation: