QUESTION: 77

A company deployed Amazon GuardDuty In the us-east-1 Region. The company wants all DNS logs that relate to the company's Amazon EC2 instances to be inspected.
What should a security engineer do to ensure that the EC2 instances are logged?

Use IPv6 addresses that are configured for hostnames.
Configure external DNS resolvers as internal resolvers that are visible only to IAM.
Use IAM DNS resolvers for all EC2 instances.
Configure a third-party DNS resolver with logging for all EC2 instances.

Answer(s): C

Explanation:

To ensure that the EC2 instances are logged, the security engineer should do the following:

Use AWS DNS resolvers for all EC2 instances. This allows the security engineer to use Amazon- provided DNS servers that resolve public DNS hostnames to private IP addresses within their VPC, and that log DNS queries in Amazon CloudWatch Logs.

Reveal Solution Next Question

QUESTION: 78

A company wants to establish separate IAM Key Management Service (IAM KMS) keys to use for different IAM services. The company's security engineer created the following key policy lo allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructureDeployment IAM role:

The security engineer recently discovered that IAM roles other than the InfrastructureDeployment role used this key (or other services.
Which change to the policy should the security engineer make to resolve these issues?

In the statement block that contains the Sid "Allow use of the key", under the "Condition" block, change StringEquals to StringLike.
In the policy document, remove the statement Dlock that contains the Sid "Enable IAM User Permissions". Add key management policies to the KMS policy.
In the statement block that contains the Sid "Allow use of the Key", under the "Condition" block, change the Kms:ViaService value to ec2.us-east-1 .amazonIAM com.
In the policy document, add a new statement block that grants the kms:Disable' permission to the security engineer's IAM role.

Answer(s): C

Explanation:

To resolve the issues, the security engineer should make the following change to the policy:

In the statement block that contains the Sid "Allow use of the key", under the "Condition" block, change the Kms:ViaService value to ec2.us-east-1.amazonaws.com. This allows the security engineer to restrict the use of the key to only EC2 service in the us-east-1 region, and prevent other services from using the key.

Reveal Solution Next Question

QUESTION: 79

A company stores images for a website in an Amazon S3 bucket. The company is using Amazon CloudFront to serve the images to end users. The company recently discovered that the images are being accessed from countries where the company does not have a distribution license.

Which actions should the company take to secure the images to limit their distribution? (Select TWO.)

Update the S3 bucket policy to restrict access to a CloudFront origin access identity (OAI).
Update the website DNS record to use an Amazon Route 53 geolocation record deny list of countries where the company lacks a license.
Add a CloudFront geo restriction deny list of countries where the company lacks a license.
Update the S3 bucket policy with a deny list of countries where the company lacks a license.
Enable the Restrict Viewer Access option in CloudFront to create a deny list of countries where the company lacks a license.

Answer(s): A,C

Explanation:

To secure the images to limit their distribution, the company should take the following actions:

Update the S3 bucket policy to restrict access to a CloudFront origin access identity (OAI). This allows the company to use a special CloudFront user that can access objects in their S3 bucket, and prevent anyone else from accessing them directly.

Add a CloudFront geo restriction deny list of countries where the company lacks a license. This allows the company to use a feature that controls access to their content based on the geographic location of their viewers, and block requests from countries where they do not have a distribution license.

Reveal Solution Next Question

QUESTION: 80

A company maintains an open-source application that is hosted on a public GitHub repository.
While creating a new commit to the repository, an engineer uploaded their IAM access key and secret access key. The engineer reported the mistake to a manager, and the manager immediately disabled the access key.

The company needs to assess the impact of the exposed access key. A security engineer must recommend a solution that requires the least possible managerial overhead.

Which solution meets these requirements?

Analyze an IAM Identity and Access Management (IAM) use report from IAM Trusted Advisor to see when the access key was last used.
Analyze Amazon CloudWatch Logs for activity by searching for the access key.
Analyze VPC flow logs for activity by searching for the access key.
Analyze a credential report in IAM Identity and Access Management (IAM) to see when the access key was last used.

Answer(s): A

Explanation:

To assess the impact of the exposed access key, the security engineer should recommend the following solution:

Analyze an IAM use report from AWS Trusted Advisor to see when the access key was last used. This allows the security engineer to use a tool that provides information about IAM entities and credentials in their account, and check if there was any unauthorized activity with the exposed access key.

Reveal Solution Next Question

Free AWS Certified Security - Specialty Exam Braindumps (page: 20)

QUESTION: 77

Explanation:

QUESTION: 78

Explanation:

QUESTION: 79

Explanation:

QUESTION: 80

Explanation: