CloudFormation stack deployments fail for some users due to permission inconsistencies.Which combination of steps will ensure consistent deployments MOST securely? (Select THREE.)
Answer(s): B,E,F
AWS best practices require CloudFormation to assume a dedicated service role. This ensures consistent permissions regardless of the user. Users must have iam:PassRole permission to pass the role. Updating stacks to use the service role enforces uniform deployment behavior.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS CloudFormation Service Roles
A company needs centralized log monitoring with automatic detection across hundreds of AWS accounts.Which solution meets these requirements with the LEAST operational effort?
Answer(s): A
Amazon GuardDuty provides fully managed threat detection across accounts when configured with delegated administration. EKS and RDS protections enable workload-aware detection with minimal setup.Other solutions require custom pipelines and higher operational overhead.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon GuardDuty Multi-Account Architecture
A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually.The company often needs to query the logs to produce results about application sessions and user issues. The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in.Which combination of steps should a security engineer take to meet these requirements MOST cost- effectively? (Select TWO.)
Answer(s): C,D
Amazon CloudWatch Logs is designed to collect, store, and analyze log data from ephemeral compute resources such as EC2 instances in Auto Scaling groups. According to the AWS Certified Security Specialty Study Guide, using the CloudWatch agent to stream logs off instances ensures log durability even when instances are terminated during scale-in events.CloudWatch Logs Insights provides a fully managed, serverless query engine that enables ad hoc querying, filtering, and aggregation of log data without requiring additional infrastructure. This directly satisfies the requirement to query logs for application sessions and user troubleshooting.Option A introduces operational risk because logs could be lost between cron executions. Option B requires additional services and data pipelines, increasing cost and complexity. Option E adds storage cost and management overhead and is not necessary for log analytics.AWS best practices recommend CloudWatch Logs and Logs Insights as the most cost-effective and scalable solution for centralized log retention and analysis in Auto Scaling environments.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon CloudWatch Logs and Logs InsightsAWS Logging Best Practices
A company's security engineer receives an abuse notification from AWS indicating that malware is being hosted from the company's AWS account. The security engineer discovers that an IAM user created a new Amazon S3 bucket without authorization.Which combination of steps should the security engineer take to MINIMIZE the consequences of this compromise? (Select THREE.)
Answer(s): B,D,F
AWS incident response guidance emphasizes immediate containment, credential invalidation, and removal of malicious resources. According to the AWS Certified Security Specialty documentation, compromised credentials must be rotated or deleted immediately to prevent further unauthorized actions. Rotating or deleting access keys directly mitigates ongoing abuse.Deleting unrecognized or unauthorized resources, such as the malicious S3 bucket, removes the active threat and limits further damage. Enabling Amazon GuardDuty provides continuous monitoring and helps identify additional compromised resources or malicious behavior that may not yet be visible.Changing passwords for all IAM users is disruptive and unnecessary if compromise scope is limited. Encrypting CloudTrail logs does not reduce active impact. Taking EBS snapshots is primarily for forensic investigation, not immediate consequence minimization.AWS best practices recommend GuardDuty activation, credential rotation, and removal of malicious resources as first-response actions.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS Incident Response Best PracticesAmazon GuardDuty Threat Detection
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack from a specific IoT device brand that uses a unique user agent. A security engineer is creating an AWS WAF web ACL and will associate it with the ALB.Which rule statement will mitigate the current attack and future attacks from these IoT devices without blocking legitimate customers?
Answer(s): D
AWS WAF string match rule statements allow inspection of HTTP headers, including the User-Agent header. According to AWS Certified Security Specialty guidance, when malicious traffic can be uniquely identified by a consistent request attribute, such as a device-specific user agent, a string match rule provides precise mitigation with minimal false positives.IP-based blocking is ineffective for globally distributed botnets. Geographic blocking risks denying access to legitimate users. Rate-based rules limit request volume but do not prevent low-and-slow attacks.By matching the unique IoT device brand in the User-Agent header, the security engineer can block only malicious requests while preserving customer access.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS WAF Rule StatementsAWS DDoS Mitigation Best Practices
Post your Comments and Discuss Amazon AWS Certified Security - Specialty exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS Certified Security - Specialty content, but please register or login to continue.