A company's security team wants to receive near-real-time email notifications about AWS abuse reports related to DoS attacks. An Amazon SNS topic already exists and is subscribed to by the security team.What should the security engineer do next?
Answer(s): B
AWS abuse notifications are delivered as AWS Health events. According to the AWS Certified Security Specialty Study Guide, Amazon EventBridge integrates natively with AWS Health and can be used to detect specific event types such as AWS_ABUSE_DOS_REPORT in near real time.By creating an EventBridge rule that filters for the abuse report event type and publishes directly to Amazon SNS, the solution remains fully managed, low latency, and cost effective.Polling APIs introduces delay and complexity. CloudTrail does not log abuse notifications. EventBridge with AWS Health is the recommended mechanism for reacting to AWS service events.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS Health and EventBridge IntegrationAWS Abuse Notification Handling
A security engineer discovers that a company's user passwords have no required minimum length. The company uses the following identity providers (IdPs):· AWS Identity and Access Management (IAM) federated with on-premises Active Directory· Amazon Cognito user pools that contain the user database for an AWS Cloud applicationWhich combination of actions should the security engineer take to implement a required minimum password length? (Select TWO.)
Answer(s): B,C
Password policies are enforced at the identity provider where authentication occurs. According to the AWS Certified Security Specialty Study Guide, when IAM is federated with an external identity provider such as on-premises Active Directory, IAM does not manage or enforce password policies. Instead, password requirements such as minimum length must be enforced directly in Active Directory Group Policy Objects.Amazon Cognito user pools maintain their own user directory and authentication logic. Cognito provides configurable password policies, including minimum length, complexity, and expiration. To enforce a minimum password length for application users, the Cognito user pool password policy must be updated.IAM password policies apply only to IAM users that authenticate directly with IAM and do not affect federated users or Cognito users. SCPs and IAM policies cannot enforce password length requirements.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study Guide AWS IAM Federation and Password PoliciesAmazon Cognito User Pool Security Settings
A company's web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. Instance logs are lost after reboots. The operations team suspects malicious activity targeting a specific PHP file.Which set of actions will identify the suspect attacker's IP address for future occurrences?
Answer(s): D
AWS WAF logs contain detailed request-level information, including source IP addresses, requested URIs, and rule matches. According to AWS Certified Security Specialty guidance, enabling AWS WAF logging provides the most reliable and tamper-resistant method to investigate web-based attacks, especially when instance-level logs are unavailable.By streaming WAF logs through Amazon Kinesis Data Firehose to Amazon S3, the company ensures durable, centralized log storage that is independent of EC2 lifecycle events. Amazon Athena can then query the logs efficiently to identify repeated requests to the new-user-creation.php endpoint and extract attacker IP addresses.VPC Flow Logs do not capture HTTP-level details. ALB access logs alone may not capture blocked requests. WAF logs provide the best forensic visibility for future detection.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS WAF Logging and MonitoringAmazon Athena Log Analysis
A company has security requirements for Amazon Aurora MySQL databases regarding encryption, deletion protection, public access, and audit logging. The company needs continuous monitoring and real-time visibility into compliance status.Which solution will meet these requirements?
AWS Config is the AWS service designed to continuously evaluate resource configurations against defined rules. According to the AWS Certified Security Specialty Study Guide, AWS Config managed rules exist specifically to check database encryption, public accessibility, deletion protection, and log exports for Amazon RDS and Aurora.AWS Config provides a real-time compliance timeline and displays the compliance state of each resource against each rule at any point in time. This granular visibility is required to assess ongoing compliance with security policies.Audit Manager generates reports but does not provide continuous compliance monitoring. Security Hub aggregates findings but does not track configuration drift. EventBridge and Lambda introduce unnecessary complexity.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAWS Config Managed Rules for RDSAWS Continuous Compliance Monitoring
A company runs a global ecommerce website using Amazon CloudFront. The company must block traffic from specific countries to comply with data regulations.Which solution will meet these requirements MOST cost-effectively?
Answer(s): C
Amazon CloudFront includes a built-in geo restriction feature that allows content to be allowed or denied based on the viewer's country. According to AWS Certified Security Specialty documentation, CloudFront geo restriction is the most cost-effective method for country-based blocking because it does not require AWS WAF or additional rule processing.AWS WAF geo match rules incur additional cost and are more appropriate when advanced inspection or layered security controls are required. IP-based blocking is impractical due to frequent IP changes.Geolocation headers do not enforce access control.CloudFront geo restriction is evaluated at the edge and efficiently blocks disallowed countries with minimal latency and cost.Referenced AWS Specialty Documents:AWS Certified Security Specialty Official Study GuideAmazon CloudFront Geo RestrictionAWS Edge Security Best Practices
Post your Comments and Discuss Amazon AWS Certified Security - Specialty exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS Certified Security - Specialty content, but please register or login to continue.