QUESTION: 69

A company needs a security engineer to implement a scalable solution for multi-account authentication and authorization. The solution should not introduce additional user-managed architectural components. Native IAM features should be used as much as possible The security engineer has set up IAM Organizations w1th all features activated and IAM SSO enabled.

Which additional steps should the security engineer take to complete the task?

Use AD Connector to create users and groups for all employees that require access to IAM accounts. Assign AD Connector groups to IAM accounts and link to the IAM roles in accordance with the employees`job functions and access requirements Instruct employees to access IAM accounts by using the IAM Directory Service user portal.
Use an IAM SSO default directory to create users and groups for all employees that require access to IAM accounts. Assign groups to IAM accounts and link to permission sets in accordance with the employees`job functions and access requirements. Instruct employees to access IAM accounts by using the IAM SSO user portal.
Use an IAM SSO default directory to create users and groups for all employees that require access to IAM accounts. Link IAM SSO groups to the IAM users present in all accounts to inherit existing permissions. Instruct employees to access IAM accounts by using the IAM SSO user portal.
Use IAM Directory Service tor Microsoft Active Directory to create users and groups for all employees that require access to IAM accounts Enable IAM Management Console access in the created directory and specify IAM SSO as a source cl information tor integrated accounts and permission sets. Instruct employees to access IAM accounts by using the IAM Directory Service user portal.

Answer(s): B

Reveal Solution Next Question

QUESTION: 70

A company deployed IAM Organizations to help manage its increasing number of IAM accounts. A security engineer wants to ensure only principals in the Organization structure can access a specific Amazon S3 bucket. The solution must also minimize operational overhead.

Which solution will meet these requirements?

1 Put all users into an IAM group with an access policy granting access to the J bucket.
Have the account creation trigger an IAM Lambda function that manages the bucket policy, allowing access to accounts listed in the policy only.
Add an SCP to the Organizations master account, allowing all principals access to the bucket.
Specify the organization ID in the global key condition element of a bucket policy, allowing all principals access.

Answer(s): D

Reveal Solution Next Question

QUESTION: 71

A company's engineering team is developing a new application that creates IAM Key Management Service (IAM KMS) CMK grants for users immediately after a grant IS created users must be able to use the CMK tu encrypt a 512-byte payload. During load testing, a bug appears |intermittently where AccessDeniedExceptions are occasionally triggered when a user first attempts to encrypt using the CMK

Which solution should the c0mpany`s security specialist recommend`?

Instruct users to implement a retry mechanism every 2 minutes until the call succeeds.
Instruct the engineering team to consume a random grant token from users, and to call the CreateGrant operation, passing it the grant token. Instruct use to use that grant token in their call to encrypt.
Instruct the engineering team to create a random name for the grant when calling the CreateGrant operation. Return the name to the users and instruct them to provide the name as the grant token in the call to encrypt.
Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. Instruct users to use that grant token in their call to encrypt.

Answer(s): D

Explanation:

To avoid AccessDeniedExceptions when users first attempt to encrypt using the CMK, the security specialist should recommend the following solution:

Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. This allows the engineering team to use the grant token as a form of temporary authorization for the grant.

Instruct users to use that grant token in their call to encrypt. This allows the users to use the grant token as a proof that they have permission to use the CMK, and to avoid any eventual consistency issues with the grant creation.

Reveal Solution Next Question

QUESTION: 72

A website currently runs on Amazon EC2, wan mostly statics content on the site. Recently the site was subjected to a DDoS attack a security engineer was (asked was redesigning the edge security to help.

Mitigate this risk in the future.

What are some ways the engineer could achieve this (Select THREE)?

Use IAM X-Ray to inspect the traffic going to the EC2 instances.
Move the static content to Amazon S3, and front this with an Amazon Cloud Front distribution.
Change the security group configuration to block the source of the attack traffic.
Use IAM WAF security rules to inspect the inbound traffic.
Use Amazon Inspector assessment templates to inspect the inbound traffic.
Use Amazon Route 53 to distribute traffic.

Answer(s): B,D,F

Explanation:

To redesign the edge security to help mitigate the DDoS attack risk in the future, the engineer could do the following:

Move the static content to Amazon S3, and front this with an Amazon CloudFront distribution. This allows the engineer to use a global content delivery network that can cache static content at edge locations and reduce the load on the origin servers.

Use AWS WAF security rules to inspect the inbound traffic. This allows the engineer to use web application firewall rules that can filter malicious requests based on IP addresses, headers, body, or URI strings, and block them before they reach the web servers.

Use Amazon Route 53 to distribute traffic. This allows the engineer to use a scalable and highly available DNS service that can route traffic based on different policies, such as latency, geolocation, or health checks.

Reveal Solution Next Question

Free AWS Certified Security - Specialty Exam Braindumps (page: 18)

QUESTION: 69

QUESTION: 70

QUESTION: 71

Explanation:

QUESTION: 72

Explanation: