QUESTION: 93

A company stores sensitive documents in Amazon S3 by using server-side encryption with an IAM Key Management Service (IAM KMS) CMK. A new requirement mandates that the CMK that is used for these documents can be used only for S3 actions.

Which statement should the company add to the key policy to meet this requirement?

Answer(s): A

Reveal Solution Next Question

QUESTION: 94

A security engineer is defining the controls required to protect the IAM account root user credentials in an IAM Organizations hierarchy. The controls should also limit the impact in case these credentials have been compromised.

Which combination of controls should the security engineer propose? (Select THREE.)

Enable multi-factor authentication (MFA) for the root user.
Set a strong randomized password and store it in a secure location.
Create an access key ID and secret access key, and store them in a secure location.
Apply the following permissions boundary to the toot user:

Answer(s): A,C,E

Reveal Solution Next Question

QUESTION: 95

A company is using IAM Organizations. The company wants to restrict IAM usage to the eu-west-1 Region for all accounts under an OU that is named "development." The solution must persist restrictions to existing and new IAM accounts under the development OU.

Answer(s): A

Reveal Solution Next Question

QUESTION: 96

A company is undergoing a layer 3 and layer 4 DDoS attack on its web servers running on IAM.

Which combination of IAM services and features will provide protection in this scenario? (Select THREE).

Amazon Route 53
IAM Certificate Manager (ACM)
Amazon S3
IAM Shield.
Elastic Load Balancer.
Amazon GuardDuty.

Answer(s): D,E,F

Reveal Solution Next Question

Free AWS Certified Security - Specialty Exam Braindumps (page: 24)

QUESTION: 93

QUESTION: 94

QUESTION: 95

QUESTION: 96