A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company's AWS resources.Which additional step will meet these requirements?
Answer(s): B
Amazon S3 pre-signed URLs grant temporary access based on the permissions of the principal that generates them. AWS Certified Security Specialty documentation explains that fine-grained authorization can be enforced by combining pre-signed URLs with IAM policy conditions.By tagging each invoice object with a client identifier and adding a condition to the EC2 instance role policy using s3:ResourceTag/ClientId, the role can generate pre-signed URLs only for objects associated with a specific client. This ensures that each client can access only their own invoices, even though the URLs are temporary and unauthenticated.Option A over-permissions clients. Option C is unnecessary because instance profiles already use temporary credentials. Option D violates AWS best practices by using long-term credentials.AWS recommends resource tagging with IAM policy conditions for scalable, secure access control.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon S3 Pre-Signed URLsIAM Policy Conditions and Resource Tags
A company is running an application in the eu-west-1 Region. The application uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt sensitive dat
Answer(s): C
AWS KMS keys are regional resources and cannot be used across Regions. According to AWS Certified Security Specialty documentation, applications that are deployed in multiple Regions should use region-specific customer managed keys while referencing keys by alias instead of key ID.By creating a new customer managed key in eu-north-1 and assigning it the same alias as the key in eu-west-1, the application code can continue to reference the alias without modification. Each Region resolves the alias to the correct local key, ensuring encryption continues to function correctly.Option A is invalid because KMS keys are regional. Option B requires application changes. Option D introduces unsupported alias patterns.AWS best practices recommend alias-based key references for multi-Region deployments.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS KMS Regional Keys and AliasesAWS KMS Best Practices
A company that uses AWS Organizations is using AWS IAM Identity Center to administer access to AWS accounts. A security engineer is creating a custom permission set in IAM Identity Center. The company will use the permission set across multiple accounts. An AWS managed policy and a customer managed policy are attached to the permission set. The security engineer has full administrative permissions and is operating in the management account.When the security engineer attempts to assign the permission set to an IAM Identity Center user who has access to multiple accounts, the assignment fails.What should the security engineer do to resolve this failure?
Answer(s): A
AWS IAM Identity Center permission sets that include customer managed policies require those policies to exist in each target account. According to the AWS Certified Security Specialty Study Guide, customer managed policies are account-scoped and are not automatically propagated across accounts by Identity Center.When assigning a permission set across multiple accounts, Identity Center attempts to attach the referenced customer managed policy in each account. If the policy does not exist, the assignment fails. Creating the same customer managed policy with identical name and permissions in every target account resolves the issue.Option B increases complexity. Option C does not address the root cause. Option D violates Identity Center management best practices.AWS documentation clearly states that customer managed policies must be present in all accounts where permission sets are applied.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS IAM Identity Center Permission SetsAWS Organizations and Identity Center Policy Management
A company has a single AWS account and uses an Amazon EC2 instance to test application code. The company recently discovered that the instance was compromised and was serving malware. Analysis showed that the instance was compromised 35 days ago. A security engineer must implement a continuous monitoring solution that automatically notifies the security team by email for high severity findings as soon as possible.Which combination of steps should the security engineer take to meet these requirements? (Select THREE.)
Answer(s): B,C,E
Amazon GuardDuty provides continuous threat detection for compromised instances by analyzing VPC Flow Logs, DNS logs, and CloudTrail events. According to AWS Certified Security Specialty guidance, GuardDuty is the fastest service to enable for detecting malware and compromised EC2 instances.To notify the security team, Amazon SNS provides a native email notification mechanism with minimal setup. Amazon EventBridge integrates directly with GuardDuty findings and can filter based on severity. Creating an EventBridge rule that matches high severity GuardDuty findings and publishes to SNS ensures immediate notification.Security Hub is not required for this use case and adds additional setup time. Amazon SQS does not support email subscriptions.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon GuardDuty Findings and SeverityAmazon EventBridge Integration with GuardDuty
A company has a PHP-based web application that uses Amazon S3 as an object store for user files. The S3 bucket is configured for server-side encryption with Amazon S3 managed keys (SSE-S3). New requirements mandate full control of encryption keys.Which combination of steps must a security engineer take to meet these requirements? (Select THREE.)
Answer(s): A,E,F
SSE-S3 uses AWS-managed keys and does not provide customer control. AWS Certified Security Specialty documentation states that SSE-KMS with customer managed keys allows full control,auditing, and key rotation. The security engineer must first create a customer managed KMS key, then update the bucket to use SSE-KMS. Existing objects must be re-encrypted to ensure compliance.SSE-C requires the application to manage keys, increasing complexity and risk. AWS managed keys do not meet the requirement for customer-controlled encryption.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon S3 Encryption OptionsAWS KMS Customer Managed Keys
Post your Comments and Discuss Amazon AWS Certified Security - Specialty exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS Certified Security - Specialty content, but please register or login to continue.