A company runs a public web application on Amazon EKS behind Amazon CloudFront and an Application Load Balancer (ALB). A security engineer must send a notification to an existing Amazon SNS topic when the application receives 10,000 requests from the same end-user IP address within any 5-minute period.Which solution will meet these requirements?
Answer(s): D
AWS WAF rate-based rules are designed specifically to track the number of requests from a single IP address over a configurable time window. According to AWS Certified Security Specialty guidance, rate-based rules integrate natively with CloudFront and emit CloudWatch metrics that can trigger alarms.CloudFront logs and VPC Flow Logs are not real-time detection tools. ASN match rules do not count request rates.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS WAF Rate-Based RulesCloudFront and AWS WAF Integration
A company needs to build a code-signing solution using an AWS KMS asymmetric key and must store immutable evidence of key creation and usage for compliance and audit purposes.Which solution meets these requirements?
Answer(s): A
AWS CloudTrail provides authoritative records of KMS key creation, origin, and usage. Enabling log file validation ensures tamper detection. S3 Object Lock in compliance mode enforces immutability, which is a core audit requirement cited in AWS Certified Security Specialty materials.CloudWatch and DynamoDB do not provide immutable storage guarantees suitable for compliance evidence.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS CloudTrail Log File ValidationAmazon S3 Object Lock
A company's application team needs a new AWS Key Management Service (AWS KMS) customer managed key to use with Amazon S3. The company's security policy requires separate keys for different AWS services to limit security exposure.How can a security engineer limit the KMS customer managed key to work with only Amazon S3?
Answer(s): B
AWS KMS provides condition keys that can be used to tightly scope how and where a customer managed key can be used. According to the AWS Certified Security Specialty Study Guide, the kms:ViaService condition key is specifically designed to restrict key usage to requests that originate from a particular AWS service in a specific Region.By configuring the key policy to allow KMS cryptographic operations only when kms:ViaService equals s3.<region>.amazonaws.com, the security engineer ensures that the key can be used exclusively by Amazon S3. Even if other IAM principals have permissions to use the key, the key cannot be used by other services such as Amazon EC2, Amazon RDS, or AWS Lambda.Option A is incorrect because AWS services do not assume identities in key policies. Options C and D modify IAM role policies, which do not control how a KMS key is used by AWS services. AWS documentation clearly states that service-level restrictions must be enforced at the KMS key policy level using condition keys.This approach enforces strong separation of duties and limits blast radius, which aligns with AWS security best practices.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS KMS Key Policy Condition KeysAWS KMS Best Practices
A company uses AWS to run a web application that manages ticket sales in several countries. The company recently migrated the application to an architecture that includes Amazon API Gateway, AWS Lambda, and Amazon Aurora Serverless. The company needs the application to comply with Payment Card Industry Data Security Standard (PCI DSS) v4.0. A security engineer must generate a report that shows the effectiveness of the PCI DSS v4.0 controls that apply to the application. The company's compliance team must be able to add manual evidence to the report.Which solution will meet these requirements?
AWS Audit Manager is specifically designed to help organizations continuously audit their AWS usage against compliance frameworks and generate audit-ready reports. According to AWS Certified Security Specialty documentation, Audit Manager includes AWS managed frameworks for compliance standards, including PCI DSS v4.0.Audit Manager automatically collects evidence from AWS services such as API Gateway, Lambda, RDS, CloudTrail, and Config, and maps the evidence directly to PCI DSS controls. Importantly, Audit Manager allows compliance teams to upload and attach manual evidence, which is a key requirement in this scenario.Option C provides visibility into control status but does not support adding manual evidence. Option B evaluates configuration compliance but does not generate formal compliance reports. Option A requires extensive manual effort and is not aligned with PCI reporting workflows.AWS documentation positions Audit Manager as the authoritative service for compliance reporting and audit evidence management.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS Audit Manager PCI DSS FrameworkAWS Compliance Reporting Best Practices
A company is planning to deploy a new log analysis environment. The company needs to analyze logs from multiple AWS services in near real time. The solution must provide the ability to search the logs and must send alerts to an existing Amazon Simple Notification Service (Amazon SNS) topic when specific logs match detection rules.Which solution will meet these requirements?
Amazon OpenSearch Service is designed for near real-time log ingestion, indexing, and search across large volumes of data. According to the AWS Certified Security Specialty Study Guide, OpenSearch supports advanced log analytics use cases and integrates with OpenSearch Security Analytics, which provides prebuilt and custom detection rules.Security Analytics can continuously evaluate incoming logs from multiple AWS services and generate alerts when detection rules are matched. These alerts can be forwarded to Amazon SNS with minimal configuration. OpenSearch also provides powerful search and query capabilities through APIs and dashboards.Option C supports detection but lacks advanced correlation and scalable search capabilities. Option B is not a log analytics service. Option D is a visualization service and does not support real-time detection.AWS guidance recommends OpenSearch Service for centralized, near real-time log analysis and alerting.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon OpenSearch Service Security AnalyticsAWS Logging and Monitoring Architecture
Post your Comments and Discuss Amazon AWS Certified Security - Specialty exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS Certified Security - Specialty content, but please register or login to continue.