A company runs a web application on a fleet of Amazon EC2 instances in an Auto Scaling group. Amazon GuardDuty and AWS Security Hub are enabled. The security engineer needs an automated response to anomalous traffic that follows AWS best practices and minimizes application disruption.Which solution will meet these requirements?
Answer(s): B
AWS incident response best practices emphasize isolating compromised resources rather than immediately terminating them. According to AWS Certified Security Specialty documentation, removing an instance from an Auto Scaling group prevents replacement loops, while applying a restrictive security group isolates the instance for forensic analysis.Using Amazon EventBridge to trigger an AWS Lambda function enables automated, consistent responses to GuardDuty findings. This approach minimizes disruption to the application because healthy instances continue serving traffic while the affected instance is isolated.Disabling credentials or modifying network ACLs can have broader impact on unrelated workloads. SNS notifications alone do not provide response automation.AWS recommends isolate-and-investigate patterns for EC2 incident response.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon GuardDuty Automated ResponsesAWS Incident Response Playbooks
A company's security engineer receives an alert that indicates that an unexpected principal is accessing a company-owned Amazon Simple Queue Service (Amazon SQS) queue. All the company's accounts are within an organization in AWS Organizations. The security engineer must implement a mitigation solution that minimizes compliance violations and investment in tools outside of AWS.What should the security engineer do to meet these requirements?
Answer(s): C
Amazon SQS is a regional service that supports AWS PrivateLink through interface VPC endpoints. According to AWS Certified Security Specialty documentation, the most secure and compliant way to restrict access to AWS services is by using VPC endpoints combined with resource-based policies.By creating interface VPC endpoints for Amazon SQS in all VPCs, traffic to SQS remains on the AWS network and does not traverse the public internet. Using the aws:SourceVpce condition in the SQS queue policy ensures that only requests originating from approved VPC endpoints can access the queue. Adding the aws:PrincipalOrgId condition further restricts access to principals that belong to the same AWS Organization.Security groups and network ACLs do not apply to SQS because SQS is not deployed inside a VPC. Third-party CASB tools add cost and operational overhead.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon SQS Security and VPC EndpointsAWS Organizations Condition Keys
A company needs to deploy AWS CloudFormation templates that configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager.Which solution will meet the requirements?
Answer(s): A
AWS CloudFormation supports dynamic references to AWS Secrets Manager, which allow sensitive values to be retrieved securely at stack runtime. According to AWS Certified Security Specialty guidance, dynamic references prevent secrets from being stored in plaintext in templates, stack metadata, or logs.Using dynamic references ensures that secrets remain encrypted at rest and are accessed only when required. CloudFormation does not support SecureString parameters for Secrets Manager references, and encrypting templates does not prevent exposure during execution.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS CloudFormation Dynamic ReferencesAWS Secrets Manager Best Practices
A company must immediately disable compromised IAM users across all AWS accounts and collect all actions performed by the user in the last 7 days.Which solution will meet these requirements?
Answer(s): D
AWS IAM Identity Center centrally manages user access across an AWS Organization. Disabling the user in Identity Center immediately revokes access to all AWS accounts. According to AWS Certified Security Specialty documentation, organizational CloudTrail event data stores provide centralized, queryable access to all events across accounts.Using CloudTrail Lake enables direct querying of activity without exporting logs. Disabling the user at the Identity Center level ensures full containment.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS IAM Identity Center Incident ResponseAWS CloudTrail Lake
A company detects bot activity targeting Amazon Cognito user pool endpoints. The solution must block malicious requests while maintaining access for legitimate users.Which solution meets these requirements?
Amazon Cognito threat protection is purpose-built to detect and mitigate malicious authentication activity such as credential stuffing and bot traffic. It uses adaptive risk-based analysis without disrupting legitimate users.AWS WAF cannot be directly associated with Cognito user pools.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon Cognito Threat Protection
Post your Comments and Discuss Amazon AWS Certified Security - Specialty exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS Certified Security - Specialty content, but please register or login to continue.