A company has a web application that reads from and writes to an Amazon S3 bucket. The company needs to authenticate all S3 API calls with AWS credentials.Which solution will provide the application with AWS credentials?
Answer(s): B
Amazon Cognito identity pools provide temporary AWS credentials by exchanging web identity tokens with AWS STS using AssumeRoleWithWebIdentity. According to AWS Certified Security Specialty documentation, this is the correct mechanism for granting applications AWS credentials.User pools authenticate users but do not issue AWS credentials. Identity pools integrate with IAM roles and STS, enabling secure, temporary access to AWS services.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon Cognito Identity PoolsAWS STS Web Identity Federation
A company runs ECS services behind an internet-facing ALB that is the origin for CloudFront. An AWS WAF web ACL is associated with CloudFront, but clients can bypass it by accessing the ALB directly.Which solution will prevent direct access to the ALB?
Answer(s): D
AWS best practices recommend using a shared secret header between CloudFront and ALB origins to prevent direct access. CloudFront injects a custom header, and the ALB listener rules validate its presence.IP-based controls are brittle due to CloudFront IP changes. PrivateLink and internal ALBs are not supported as CloudFront origins. Header validation is the most reliable and widely recommended pattern.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideCloudFront Origin ProtectionAWS WAF and ALB Integration
A company creates AWS Lambda functions from container images that are stored in Amazon Elastic Container Registry (Amazon ECR). The company needs to identify any software vulnerabilities in the container images and any code vulnerabilities in the Lambda functions.Which solution will meet these requirements?
Answer(s): C
Amazon Inspector is the AWS service designed specifically for vulnerability management across compute workloads, including Amazon ECR container images and AWS Lambda functions. According to the AWS Certified Security Specialty documentation, Amazon Inspector provides automated vulnerability assessments for container images stored in ECR by performing enhanced image scanning that identifies common vulnerabilities and exposures (CVEs) in operating systems and application dependencies.Inspector also supports Lambda code scanning to analyze function packages and container-based Lambda images for known software vulnerabilities. Findings include severity ratings and remediation guidance, allowing security teams to identify and prioritize risks efficiently.Amazon GuardDuty focuses on threat detection using behavioral analysis and does not perform static vulnerability scanning of container images or Lambda code. AWS Security Hub aggregates findings from other services but does not perform scanning itself.AWS best practices recommend Amazon Inspector for vulnerability detection in container images and serverless workloads.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon Inspector for ECR and LambdaAWS Vulnerability Management Best Practices
A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running in Amazon Elastic Container Service (Amazon ECS). This solution must also handle volatile traffic patterns.Which solution would have the MOST scalability and LOWEST latency?
Network Load Balancers operate at Layer 4 and are optimized for extreme performance, ultra-low latency, and handling sudden traffic spikes. According to AWS Certified Security Specialty documentation, using a TCP listener on an NLB allows TLS traffic to pass through directly to backend containers without termination, preserving true end-to-end encryption.This approach eliminates the overhead of decrypting and re-encrypting traffic at the load balancer, reducing latency and maximizing throughput. NLBs scale automatically to handle volatile traffic patterns and millions of requests per second.Application Load Balancers operate at Layer 7 and introduce additional latency due to TLS termination and HTTP processing. Route 53 multivalue routing does not provide load balancing at the transport layer and does not ensure encryption handling.AWS recommends NLB TCP pass-through for high-performance, end-to-end encrypted container workloads.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideElastic Load Balancing ArchitectureNetwork Load Balancer Performance Characteristics
A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. Each Availability Zone contains one public subnet and one private subnet. Three route tables exist: one for the public subnets and one for each private subnet.The security engineer discovers that all four subnets are routing traffic through the internet gateway that is attached to the VPC.Which combination of steps should the security engineer take to remediate this scenario? (Select TWO.)
Answer(s): A,D
AWS networking best practices require private subnets to access the internet only through NAT gateways located in public subnets. According to the AWS Certified Security Specialty Study Guide, NAT gateways must be provisioned in public subnets and used as the default route for outbound traffic from private subnets.Verifying NAT gateways in each Availability Zone ensures high availability and fault tolerance. Updating the private subnet route tables to send 0.0.0.0/0 traffic to the NAT gateway prevents direct internet access while allowing outbound connectivity.Routing private subnet traffic directly to an internet gateway violates subnet isolation principles. NAT gateways must never be placed in private subnets.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon VPC Routing and NAT GatewaysAWS Network Segmentation Best Practices
Post your Comments and Discuss Amazon AWS Certified Security - Specialty exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS Certified Security - Specialty content, but please register or login to continue.