2021 Valid AWS-Security-Specialty test answers & Amazon Exam PDF
Free Amazon AWS-Security-Specialty Exam Questions & Answer from Training Expert GetValidTest
How much Amazon SCS-C01: AWS Certified Security - Specialty Exam Cost
The cost of the Amazon SCS-C01: AWS Certified Security - Specialty Exam is $300. For more information related to exam price, please visit the official website AWS Website as the cost of exams may be subjected to vary county-wise.
Topics of Amazon AWS-Security-Specialty: AWS Certified Security - Specialty Exam
Candidates must know the exam topics before they start preparation. Because it will help them in hitting the core. AWS certified security - specialty dumps will include the following topics:
Domain 1: Incident Response
- 1.3 Evaluate the configuration of automated alerting, and execute possible remediation of security-related incidents and emerging issues.
- 1.1 Given an AWS abuse notice, evaluate the suspected compromised instance or exposed access keys.
- 1.2 Verify that the Incident Response plan includes relevant AWS services.
Domain 2: Logging and Monitoring
- 2.1 Design and implement security monitoring and alerting.
- 2.2 Troubleshoot security monitoring and alerting.
- 2.4 Troubleshoot logging solutions.
- 2.3 Design and implement a logging solution.
Domain 3: Infrastructure Security
- 3.2 Design and implement a secure network infrastructure.
- 3.4 Design and implement host-based security.
- 3.3 Troubleshoot a secure network infrastructure.
- 3.1 Design edge security on AWS.
Domain 4: Identity and Access Management
- 4.2 Troubleshoot an authorization and authentication system to access AWS resources.
- 4.1 Design and implement a scalable authorization and authentication system to access AWS resources.
Domain 5: Data Protection
- 5.2 Troubleshoot key management.
- 5.3 Design and implement a data encryption solution for data at rest and data in transit.
- 5.1 Design and implement key management and use.
NEW QUESTION 67
A Software Engineer is trying to figure out why network connectivity to an Amazon EC2 instance does not appear to be working correctly. Its security group allows inbound HTTP traffic from 0.0.0.0/0, and the outbound rules have not been modified from the default. A custom network ACL associated with its subnet allows inbound HTTP traffic from 0.0.0.0/0 and has no outbound rules.
What would resolve the connectivity issue?
- A. The outbound rules on the security group do not allow the response to be sent to the client on the HTTP port.
- B. The outbound rules on the security group do not allow the response to be sent to the client on the ephemeral port range.
- C. An outbound rule must be added to the network ACL to allow the response to be sent to the client on the ephemeral port range.
- D. An outbound rule must be added to the network ACL to allow the response to be sent to the client on the HTTP port.
Answer: C
NEW QUESTION 68
You have several S3 buckets defined in your AWS account. You need to give access to external AWS accounts to these S3 buckets. Which of the following can allow you to define the permissions for the external accounts? Choose 2 answers from the options given below Please select:
- A. Buckets ACL's
- B. IAM users
- C. IAM policies
- D. Bucket policies
Answer: A,D
Explanation:
The AWS Security whitepaper gives the type of access control and to what level the control can be given
Options A and C are incorrect since for external access to buckets, you need to use either Bucket policies or Bucket ACL's or more information on Security for storage services role please refer to the below URL:
https://d1.awsstatic.com/whitepapers/Security/Security Storage Services Whitepaper.pdf The correct answers are: Buckets ACL's, Bucket policies Submit your Feedback/Queries to our Experts
NEW QUESTION 69
A company's Developers plan to migrate their on-premises applications to Amazon EC2 instances running Amazon Linux AMIs. The applications are accessed by a group of partner companies The Security Engineer needs to implement the following host-based security measures for these instances:
* Block traffic from documented known bad IP addresses
* Detect known software vulnerabilities and CIS Benchmarks compliance.
Which solution addresses these requirements?
- A. Launch the EC2 instances with an 1AM role attached Include a user data script that uses the AWS CLl to create and attach security groups that only allow an allow listed source IP address range inbound. Use Amazon Inspector to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance
- B. Launch the EC2 instances with an 1AM role attached Include a user data script that creates a cron job to periodically retrieve the list of bad IP addresses from Amazon S3, and configures iptabies on the instances blocking the list of bad IP addresses Use Amazon inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance.
- C. Launch the EC2 instances with an 1AM role attached. Include a user data script that uses the AWS CLI to retrieve the list of bad IP addresses from AWS Secrets Manager and uploads it as a threat list in Amazon GuardDuty Use Amazon Inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance
- D. Launch the EC2 instances with an 1AM role attached Include a user data script that uses the AWS CLl to create NACLs blocking ingress traffic from the known bad IP addresses in the EC2 instance's subnets Use AWS Systems Manager to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance
Answer: B
NEW QUESTION 70
An organization wants to be alerted when an unauthorized Amazon EC2 instance in its VPC performs a network port scan against other instances in the VPC. When the Security team performs its own internal tests in a separate account by using pre-approved third-party scanners from the AWS Marketplace, the Security team also then receives multiple Amazon GuardDuty events from Amazon CloudWatch alerting on its test activities.
How can the Security team suppress alerts about authorized security tests while still receiving alerts about the unauthorized activity?
- A. Grant the Security team's EC2 instances a role with permissions to call Amazon GuardDuty API operations.
- B. Install the Amazon Inspector agent on the EC2 instances that the Security team uses.
- C. Use a filter in AWS CloudTrail to exclude the IP addresses of the Security team's EC2 instances.
- D. Add the Elastic IP addresses of the Security team's EC2 instances to a trusted IP list in Amazon GuardDuty.
Answer: D
Explanation:
Trusted IP lists consist of IP addresses that you have whitelisted for secure communication with your AWS infrastructure and applications. GuardDuty does not generate findings for IP addresses on trusted IP lists. At any given time, you can have only one uploaded trusted IP list per AWS account per region. Threat lists consist of known malicious IP addresses. GuardDuty generates findings based on threat lists. At any given time, you can have up to six uploaded threat lists per AWS account per region. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_upload_lists.html
NEW QUESTION 71
A company has a VPC with an IPv6 address range and a public subnet with an IPv6 address block. The VPC currently hosts some public Amazon EC2 instances but a Security Engineer needs to migrate a second application into the VPC that also requires IPv6 connectivity.
This new application will occasionally make API requests to an external, internet-accessible endpoint to receive updates However, the Security team does not want the application's EC2 instance exposed directly to the internet The Security Engineer intends to create a private subnet with a custom route table and to associate the route table with the private subnet What else does the Security Engineer need to do to ensure the application will not be exposed directly to the internet, but can still communicate as required''
- A. Add a managed NAT gateway to the VPC Update the custom route table with a new route to the gateway
- B. Add an egress-only internet gateway to the VPC. Update the custom route table with a new route to the gateway
- C. Launch a NAT instance in the public subnet Update the custom route table with a new route to the NAT instance
- D. Remove the internet gateway, and add AWS PrivateLink to the VPC Then update the custom route table with a new route to AWS PrivateLink
Answer: B
NEW QUESTION 72
During a security event, it is discovered that some Amazon EC2 instances have not been sending Amazon CloudWatch logs.
Which steps can the Security Engineer take to troubleshoot this issue? (Choose two.)
- A. Connect to the EC2 instances that are not sending the appropriate logs and verify that the CloudWatch Logs agent is running.
- B. Verify that the network access control lists and security groups of the EC2 instances have the access to send logs over SNMP.
- C. Verify that the EC2 instances have a route to the public AWS API endpoints.
- D. Connect to the EC2 instances that are not sending logs. Use the command prompt to verify that the right permissions have been set for the Amazon SNS topic.
- E. Log in to the AWS account and select CloudWatch Logs. Check for any monitored EC2 instances that are in the "Alerting" state and restart them using the EC2 console.
Answer: A,E
NEW QUESTION 73
You are responsible to deploying a critical application onto AWS. Part of the requirements for this application is to ensure that the controls set for this application met PCI compliance. Also there is a need to monitor web application logs to identify any malicious activity. Which of the following services can be used to fulfil this requirement. Choose 2 answers from the options given below Please select:
- A. Amazon Cloudtrail
- B. Amazon AWS Config
- C. Amazon VPC Flow Logs
- D. Amazon Cloudwatch Logs
Answer: A,D
Explanation:
The AWS Documentation mentions the following about these services
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting.
Option B is incorrect because VPC flow logs can only check for flow to instances in a VPC Option C is incorrect because this can check for configuration changes only For more information on Cloudtrail, please refer to below URL:
https://aws.amazon.com/cloudtrail;
You can use Amazon CloudWatch Logs to monitor, store, and access your log files from Amazon Elastic Compute Cloud (Amazon EC2) instances, AWS CloudTrail, Amazon Route 53, and other sources. You can then retrieve the associated log data from CloudWatch Logs.
For more information on Cloudwatch logs, please refer to below URL:
http://docs.aws.amazon.com/AmazonCloudWatch/latest/loes/WhatisCloudWatchLoES.htmll The correct answers are: Amazon Cloudwatch Logs, Amazon Cloudtrail
NEW QUESTION 74
A company Is building a data lake on Amazon S3. The data consists of millions of small files containing sensitive information. The security team has the following requirements for the architecture:
* Data must be encrypted in transit.
* Data must be encrypted at rest.
* The bucket must be private, but if the bucket is accidentally made public, the data must remain confidential.
Which combination of steps would meet the requirements? (Select THREE.)
- A. Enable default encryption with server-side encryption with AWS KMS-managed keys (SSE-KMS) on the S3 bucket.
- B. Enable Amazon Macie to monitor and act on changes to the data lake's S3 bucket.
- C. Enable AES-256 encryption using server-side encryption with Amazon S3-managed encryption keys (SSE-S3) on the S3 bucket
- D. Add a bucket policy that includes a deny if a PutObject request does not include awsiSecureTcanspoct.
- E. Add a bucket policy with ws: Sourcelpto Allow uploads and downloads from the corporate intranet only.
- F. Add a bucket policy that includes a deny if a PutObject request does not include s3:x-amz-sairv9r-side-enctyption: "aws: kms".
Answer: A,B,E
NEW QUESTION 75
You have been given a new brief from your supervisor for a client who needs a web application set up on AWS. The a most important requirement is that MySQL must be used as the database, and this database must not be hosted in the public cloud, but rather at the client's data center due to security risks. Which of the following solutions would be the ^ best to assure that the client's requirements are met? Choose the correct answer from the options below Please select:
- A. Build the application server on a public subnet and build the database in a private subnet with a secure ssh connection to the private subnet from the client's data center.
- B. Build the application server on a public subnet and the database on a private subnet with a NAT instance between them.
- C. Use the public subnet for the application server and use RDS with a storage gateway to access and synchronize the data securely from the local data center.
- D. Build the application server on a public subnet and the database at the client's data center. Connect them with a VPN connection which uses IPsec.
Answer: D
Explanation:
Explanation
Since the database should not be hosted on the cloud all other options are invalid.
The best option is to create a VPN connection for securing traffic as shown below.
Option B is invalid because this is the incorrect use of the Storage gateway Option C is invalid since this is the incorrect use of the NAT instance Option D is invalid since this is an incorrect configuration For more information on VPN connections, please visit the below URL
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.htmll
The correct answer is: Build the application server on a public subnet and the database at the client's data center. Connect them with a VPN connection which uses IPsec Submit your Feedback/Queries to our Experts
NEW QUESTION 76
You have setup a set of applications across 2 VPC's. You have also setup VPC Peering. The applications are still not able to communicate across the Peering connection. Which network troubleshooting steps should be taken to resolve the issue?
Please select:
- A. Check the Route tables for the VPC's
- B. Check to see if the VPC has an Internet gateway attached.
- C. Check to see if the VPC has a NAT gateway attached.
- D. Ensure the applications are hosted in a public subnet
Answer: A
Explanation:
After the VPC peering connection is established, you need to ensure that the route tables are modified to ensure traffic can between the VPCs Option A ,B and C are invalid because allowing access the Internet gateway and usage of public subnets can help for Inter, access, but not for VPC Peering.
For more information on VPC peering routing, please visit the below URL:
.com/AmazonVPC/latest/Peeri
The correct answer is: Check the Route tables for the VPCs Submit your Feedback/Queries to our Experts
NEW QUESTION 77
A Security Analyst attempted to troubleshoot the monitoring of suspicious security group changes. The Analyst was told that there is an Amazon CloudWatch alarm in place for these AWS CloudTrail log events. The Analyst tested the monitoring setup by making a configuration change to the security group but did not receive any alerts.
Which of the following troubleshooting steps should the Analyst perform?
- A. Verify that a metric filter was created and then mapped to an alarm. Check the alarm notification action.
- B. Ensure that CloudTrail and S3 bucket access logging is enabled for the Analyst's AWS account.
- C. Verify that the Analyst's account is mapped to an IAM policy that includes permissions for cloudwatch: GetMetricStatistics and Cloudwatch: ListMetrics.
- D. Check the CloudWatch dashboards to ensure that there is a metric configured with an appropriate dimension for security group changes.
Answer: A
Explanation:
MetricFilter:
Type: 'AWS::Logs::MetricFilter'
Properties:
LogGroupName: ''
FilterPattern: >-
{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName =
AuthorizeSecurityGroupEgress) || ($.eventName =
RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress)
|| ($.eventName = CreateSecurityGroup) || ($.eventName =
DeleteSecurityGroup) }
MetricTransformations:
- MetricValue: '1'
MetricNamespace: CloudTrailMetrics
MetricName: SecurityGroupEventCount
NEW QUESTION 78
A Security Engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled.
While testing the solution, the Security Engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?
- A. The bucket is set up to use server-side encryption with Amazon S3-managed keys (SSE-S3) as the default and does not allow SSE-KMS-encrypted files.
- B. The log files fail integrity validation and automatically are marked as unavailable.
- C. An IAM policy applicable to the Security Engineer's IAM user or role denies access to the "CloudTrail/" prefix in the Amazon S3 bucket
- D. The KMS key policy does not grant the Security Engineer's IAM user or role permissions to decrypt with it.
Answer: C
NEW QUESTION 79
Which of the following is the correct sequence of how KMS manages the keys when used along with the Redshift cluster service Please select:
- A. The master keys encrypts the cluster key, database key and data encryption keys
- B. The master keys encrypts the cluster key. The cluster key encrypts the database key. The database key encrypts the data encryption keys.
- C. The master keys encrypts the database key. The database key encrypts the data encryption keys.
- D. The master keys encrypts the data encryption keys. The data encryption keys encrypts the database key
Answer: B
Explanation:
Explanation
This is mentioned in the AWS Documentation
Amazon Redshift uses a four-tier, key-based architecture for encryption. The architecture consists of data encryption keys, a database key, a cluster key, and a master key.
Data encryption keys encrypt data blocks in the cluster. Each data block is assigned a randomly-generated AES-256 key. These keys are encrypted by using the database key for the cluster.
The database key encrypts data encryption keys in the cluster. The database key is a randomly-generated AES-256 key. It is stored on disk in a separate network from the Amazon Redshift cluster and passed to the cluster across a secure channel.
The cluster key encrypts the database key for the Amazon Redshift cluster.
Option B is incorrect because the master key encrypts the cluster key and not the database key Option C is incorrect because the master key encrypts the cluster key and not the data encryption keys Option D is incorrect because the master key encrypts the cluster key only For more information on how keys are used in Redshift, please visit the following URL:
https://docs.aws.amazon.com/kms/latest/developereuide/services-redshift.html The correct answer is: The master keys encrypts the cluster key. The cluster key encrypts the database key.
The database key encrypts the data encryption keys.
Submit your Feedback/Queries to our Experts
NEW QUESTION 80
Your IT Security team has advised to carry out a penetration test on the resources in their company's AWS Account. This is as part of their capability to analyze the security of the Infrastructure. What should be done first in this regard?
Please select:
- A. Turn on Cloud trail and carry out the penetration test
- B. Use a custom AWS Marketplace solution for conducting the penetration test
- C. Turn on VPC Flow Logs and carry out the penetration test
- D. Submit a request to AWS Support
Answer: D
Explanation:
This concept is given in the AWS Documentation
How do I submit a penetration testing request for my AWS resources?
Issue
I want to run a penetration test or other simulated event on my AWS architecture. How do I get permission from AWS to do that?
Resolution
Before performing security testing on AWS resources, you must obtain approval from AWS. After you submit your request AWS will reply in about two business days.
AWS might have additional questions about your test which can extend the approval process, so plan accordingly and be sure that your initial request is as detailed as possible.
If your request is approved, you'll receive an authorization number.
Option A.B and D are all invalid because the first step is to get prior authorization from AWS for penetration tests For more information on penetration testing, please visit the below URL
* https://aws.amazon.com/security/penetration-testing/
* https://aws.amazon.com/premiumsupport/knowledge-center/penetration-testing/ ( The correct answer is: Submit a request to AWS Support Submit your Feedback/Queries to our Experts
NEW QUESTION 81
A company recently experienced a DDoS attack that prevented its web server from serving content. The website is static and hosts only HTML, CSS, and PDF files that users download.
Based on the architecture shown in the image, what is the BEST way to protect the site against future attacks while minimizing the ongoing operational overhead?
- A. Move all the files to an Amazon S3 bucket. Create a CloudFront distribution in front of the bucket and terminate the web server.
- B. Move all the files to an Amazon S3 bucket. Have the web server serve the files from the S3 bucket.
- C. Launch an Application Load Balancer in front of the EC2 instance. Create an Amazon CloudFront distribution in front of the Application Load Balancer.
- D. Launch a second Amazon EC2 instance in a new subnet. Launch an Application Load Balancer in front of both instances.
Answer: A
Explanation:
Explanation
https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html
NEW QUESTION 82
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB).
The instances are in an EC2 Auto Scaling group across multiple Availability Zones. The website is under a DDoS attack by a specific loT device brand that is visible in the user agent A security engineer needs to mitigate the attack without impacting the availability of the public website.
What should the security engineer do to accomplish this?
- A. Configure an Amazon CloudFront distribution to use the ALB as an origin. Configure a web ACL rule for AWS WAF to block requests with a string match condition for the user agent of the loT device.
Associate the web ACL with the ALB Change the public DNS entry of the website to point to the CloudFront distribution. - B. Activate AWS Shield Advanced to enable DDoS protection. Apply an AWS WAF ACL to the ALB.
and configure a listener rule on the ALB to block loT devices based on the user agent. - C. Configure an Amazon CloudFront distribution to use a new ALB as an origin. Configure a web ACL rule for AWS WAF to block requests with a string match condition for the user agent of the loT device.
Change the ALB security group to alow access from CloudFront IP address ranges only Change the public DNS entry of the website to point to the CloudFront distribution. - D. Configure a web ACL rule for AWS WAF to block requests with a string match condition for the user agent of the loT device. Associate the v/eb ACL with the ALB.
Answer: B
NEW QUESTION 83
A company needs to encrypt all of its data stored in Amazon S3. The company wants to use AWS Key Management Service (AWS KMS) to create and manage its encryption keys. The company's security policies require the ability to Import the company's own key material for the keys, set an expiration date on the keys, and delete keys immediately, if needed.
How should a security engineer set up AWS KMS to meet these requirements?
- A. Configure AWS KMS and use a custom key store. Create an AWS managed CMK with no key material. Import the company's key material into the CMK.
- B. Configure AWS KMS and use the default key store Create a customer managed CMK with no key material import the company's key material into the CMK
- C. Configure AWS KMS and use the default Key store Create an AWS managed CMK with no key material Import the company's key material into the CMK
- D. Configure AWS KMS and use a custom key store. Create a customer managed CMK with no key material Import the company's keys and key material into the CMK
Answer: D
NEW QUESTION 84
You are designing a custom 1AM policy that would allow uses to list buckets in S3 only if they are MFA authenticated. Which of the following would best match this requirement?
- A. Option
- B. Option
- C. Option
- D. Option
Answer: C
Explanation:
The Condition clause can be used to ensure users can only work with resources if they are MFA authenticated.
Option B and C are wrong since the aws:MultiFactorAuthPresent clause should be marked as true. Here you are saying that onl if the user has been MFA activated, that means it is true, then allow access.
Option D is invalid because the "boor clause is missing in the evaluation for the condition clause.
Boolean conditions let you construct Condition elements that restrict access based on comparing a key to "true" or "false." Here in this scenario the boot attribute in the condition element will return a value True for option A which will ensure that access is allowed on S3 resources.
For more information on an example on such a policy, please visit the following URL:
NEW QUESTION 85
An application uses Amazon Cognito to manage end users' permissions when directly accessing AWS resources, including Amazon DynamoDB. A new feature request reads as follows:
Provide a mechanism to mark customers as suspended pending investigation or suspended permanently.
Customers should still be able to log in when suspended, but should not be able to make changes.
The priorities are to reduce complexity and avoid potential for future security issues.
Which approach will meet these requirements and priorities?
- A. Create a new database field "suspended_status" and modify the application logic to validate that field when processing requests.
- B. Move suspended customers to a second Cognito group and define an appropriate IAM access policy for the group.
- C. Use Amazon Cognito Sync to push out a "suspension_status" parameter and split the IAM policy into normal users and suspended users.
- D. Add suspended customers to second Cognito user pool and update the application login flow to check both user pools.
Answer: A
NEW QUESTION 86
A company is planning on using AWS for hosting their applications. They want complete separation and isolation of their production , testing and development environments. Which of the following is an ideal way to design such a setup?
Please select:
- A. Use separate VPCs for each of the environments
- B. Use separate AWS accounts for each of the environments
- C. Use separate 1AM Roles for each of the environments
- D. Use separate 1AM Policies for each of the environments
Answer: B
Explanation:
Explanation
A recommendation from the AWS Security Best practices highlights this as well
option A is partially valid, you can segregate resources, but a best practise is to have multiple accounts for this setup.
Options B and C are invalid because from a maintenance perspective this could become very difficult For more information on the Security Best practices, please visit the following URL:
https://dl.awsstatic.com/whitepapers/Security/AWS_Security_Best_Practices.pdf The correct answer is: Use separate AWS accounts for each of the environments Submit your Feedback/Queries to our Experts
NEW QUESTION 87
A company deployed AWS Organizations to help manage its increasing number of AWS accounts. A security engineer wants to ensure only principals in the Organization structure can access a specific Amazon S3 bucket. The solution must also minimize operational overhead Which solution will meet these requirements?
- A. 1 Put all users into an IAM group with an access policy granting access to the J bucket.
- B. Specify the organization ID in the global key condition element of a bucket policy, allowing all principals access.
- C. Have the account creation trigger an AWS Lambda function that manages the bucket policy, allowing access to accounts listed in the policy only.
- D. Add an SCP to the Organizations master account, allowing all principals access to the bucket.
Answer: B
NEW QUESTION 88
A company is hosting a website that must be accessible to users for HTTPS traffic. Also port 22 should be open for administrative purposes. The administrator's workstation has a static IP address of 203.0.113.1/32.
Which of the following security group configurations are the MOST secure but still functional to support these requirements? Choose 2 answers from the options given below Please select:
- A. Port 22 coming from 203.0.113.1/32
- B. Port 443 coming from 10.0.0.0/16
- C. Port 443 coming from 0.0.0.0/0
- D. Port 22 coming from 0.0.0.0/0
Answer: A,C
Explanation:
Explanation
Since HTTPS traffic is required for all users on the Internet, Port 443 should be open on all IP addresses. For port 22, the traffic should be restricted to an internal subnet.
Option B is invalid, because this only allow traffic from a particular CIDR block and not from the internet Option C is invalid because allowing port 22 from the internet is a security risk For more information on AWS Security Groups, please visit the following UR
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/usins-network-secunty.htmll The correct answers are: Port 443 coming from 0.0.0.0/0, Port 22 coming from 203.0.113.1 /32 Submit your Feedback/Queries to our Experts
NEW QUESTION 89
A company hosts a popular web application that connects to an Amazon RDS MySQL DB instance running in a private VPC subnet that was created with default ACL settings. The IT Security department has a suspicion that a DDos attack is coming from a suspecting IP. How can you protect the subnets from this attack?
Please select:
- A. Change the Inbound NACL to deny access from the suspecting IP
- B. Change the Outbound Security Groups to deny access from the suspecting IP
- C. Change the Inbound Security Groups to deny access from the suspecting IP
- D. Change the Outbound NACL to deny access from the suspecting IP
Option A and B are invalid because by default the Security Groups already block traffic. You can use NACL's as an additional security layer for the subnet to deny traffic.
Option D is invalid since just changing the Inbound Rules is sufficient The AWS Documentation mentions the following A network access control list (ACLJ is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC.
The correct answer is: Change the Inbound NACL to deny access from the suspecting IP
Answer: A
NEW QUESTION 90
An organization is using Amazon CloudWatch Logs with agents deployed on its Linux Amazon EC2
instances. The agent configuration files have been checked and the application log files to be pushed are
configured correctly. A review has identified that logging from specific instances is missing.
Which steps should be taken to troubleshoot the issue? (Choose two.)
- A. Use an EC2 run command to confirm that the "awslogs" service is running on all instances.
- B. Check whether any application log entries were rejected because of invalid time stamps by reviewing /
var/cwlogs/rejects.log. - C. Verify that the time zone on the application servers is in UTC.
- D. Verify that the permissions used by the agent allow creation of log groups/streams and to put log
events. - E. Check that the trust relationship grants the service "cwlogs.amazonaws.com" permission to write
objects to the Amazon S3 staging bucket.
Answer: B,D
NEW QUESTION 91
......
Top Amazon AWS-Security-Specialty Courses Online: https://www.getvalidtest.com/AWS-Security-Specialty-exam.html
AWS-Security-Specialty Practice Dumps - Verified By GetValidTest Updated 530 Questions: https://drive.google.com/open?id=1OsZd75KlIA2ZIH4U6_dPVaun61Efg0Mv