AWS Cloud Security

An organization plans to deploy a three-tier web application where application servers run on Amazon EC2 instances. These instances need access to credentials to authenticate their SQL connections to an Amazon RDS DB instance. AWS Lambda functions must also query the RDS database using the same database credentials. These credentials must be stored in such a way that only the EC2 instances and Lambda functions can access them. Access logs should record the access times and actors. What should the Security Engineer do to fulfill these requirements?

1 Mark(s)

Store the database credentials in AWS Key Management Service (AWS KMS). Create an IAM role with access to AWS KMS by using the EC2 and Lambda service principals in the roles trust policy. Add the role to an EC2 instance profile. Attach the instance profile to the EC2 instances. Set up Lambda to use the new role for execution.
Store the database credentials in AWS KMS. Create an IAM role with access to KMS by using the EC2 and Lambda service principals in the roles trust policy. Add the role to an EC2 instance profile. Attach the instance profile to the EC2 instances and the Lambda function.
Store the database credentials in AWS Secrets Manager. Create an IAM role with access to Secrets Manager by using the EC2 and Lambda service principals in the roles trust policy. Add the role to an EC2 instance profile. Attach the instance profile to the EC2 instances and the Lambda function.
Store the database credentials in AWS Secrets Manager. Create an IAM role with access to Secrets Manager by using the EC2 and Lambda service principals in the roles trust policy. Add the role to an EC2 instance profile. Attach the instance profile to the EC2 instances. Set up Lambda to use the new role for execution.

A risk assessment identifies a potential threat from an internal actor who might exploit sensitive data from a production server, Server X, running within AWS Account 1. The malicious actor could manipulate credentials for an AWS account (Account 2) under their control and upload sensitive data to their Amazon S3 bucket. Server X needs legitimate access to S3 to upload encrypted files via a proxy server, which is blind to server communication due to TLS encryption. What mitigation measures can be taken to alleviate this threat? (Choose two.)

2 Mark(s)

Implement an S3 VPC endpoint with a policy that permits only certain S3 buckets within Account 1, bypassing the proxy.
Restrict outbound access to public S3 endpoints on the proxy server.
Configure Network ACLs on Server X to block access to S3 endpoints.
Alter the S3 bucket policy for the legitimate bucket to authorize access solely from the public IP addresses tied to the application server.

You are the Security Engineer for a water utility company which deploys a fleet of 2,000 IoT devices for water quality monitoring. Each device has unique access credentials and the company policy necessitates independently auditable access to these credentials. Taking into account the operational costs, which AWS service would you employ to manage the storage of these credentials?

1 Mark(s)

Implement AWS Systems Manager to store credentials as Secure Strings Parameters, secured with an AWS KMS key.
Leverage AWS Key Management System to store a master key to encrypt the credentials, with the encrypted credentials stored in an Amazon RDS instance.
Make use of AWS Secrets Manager to store the credentials.
Save the credentials in a JSON file on Amazon S3 using server-side encryption.

As a Security Engineer for a company using Amazon CloudWatch Logs, you notice some Linux EC2 instances are not logging data despite the correct configuration. Which steps would be most effective to identify the cause of the missing logs? (Choose two.)

2 Mark(s)

Use EC2 run command to verify the awslogs service is running on all instances.
Confirm that the permissions assigned to the agent allow creation of log groups/streams and permit log events.
Review /var/cwlogs/rejects.log for any application log entries rejected due to invalid timestamps.
Ensure the trust relationship authorizes the service cwlogs.amazonaws.com to write objects to the Amazon S3 staging bucket.

As a Systems Engineer, you are required to configure an outbound mail operation via AWS Simple Email Service (SES) that is compliant with current Transport Layer Security (TLS) standards. Which endpoint and corresponding port should your mail application connect to for this task?

1 Mark(s)

An endpoint at email.us-east-1.amazonaws.com over port 8080
An endpoint at email-pop3.us-east-1.amazonaws.com over port 995
An endpoint at email-smtp.us-east-1.amazonaws.com over port 587
An endpoint at email-imap.us-east-1.amazonaws.com over port 993

As a Security Engineer, you have recently executed a new vault lock policy for 10TB of data in Amazon S3 Glacier. However, 12 hours after initiating the vault-lock operation, the audit team discovers a typo in the policy which has inadvertently granted unintended access to the vault. What is the most cost-effective solution to rectify this?

1 Mark(s)

Initiate an abort-vault-lock operation, modify the policy, and then initiate the vault-lock operation once more.
Duplicate the vault data to a new S3 bucket, eliminate the original vault, then create a new vault incorporating the data.
Amend the policy while maintaining the vault lock in place.
Revise the policy and re-initiate the vault-lock operation to implement the updated policy.

You are a Security Analyst investigating an incident of potential unauthorized access to AWS resources by a former employee in the last quarter. The former employee is suspected of having used a specific access key. Which method would best support your investigation to uncover the actions performed by this user within AWS?

1 Mark(s)

Leverage the AWS CloudTrail console to analyze user activity.
Filter CloudTrail data by the specific user through the Amazon CloudWatch Logs console.
Utilize AWS Config to evaluate the actions executed by the user.
Deploy Amazon Athena to query CloudTrail logs that are housed in Amazon S3.

Your company plans to store sensitive documents in three Amazon S3 buckets corresponding to data classification levels of Sensitive, Confidential, and Restricted. The security setup must ensure that each object is encrypted with a unique key. Items in the Restricted bucket require two-factor authentication for decryption, and AWS KMS must auto-rotate the encryption keys every year. Which solution would meet these requirements?

1 Mark(s)

Create a Customer Master Key (CMK) for each data classification type, and set it to rotate annually. For the Restricted CMK, set the MFA policy within the key policy. Use S3 SSE-KMS to encrypt the objects.
Create a CMK grant for each data classification type with EnableKeyRotation and MultiFactorAuthPresent set to true. S3 can then use the grants to encrypt each object with a unique CMK.
Create a CMK for each data classification type, and within the CMK policy, enable annual rotation, and define the MFA policy. S3 can then create DEK grants to uniquely encrypt each object within the S3 bucket.
Create a CMK with unique imported key material for each data classification type, and rotate them annually. For the Restricted key material, define the MFA policy in the key policy. Use S3 SSE-KMS to encrypt the objects.

Your company's compliance policy mandates that all traffic between on-premises hosts and EC2 instances must be encrypted while in transit. Custom proprietary protocols are utilized for communication and the EC2 instances must be placed behind a load balancer for enhanced availability. Which solution would comply with these requirements?

1 Mark(s)

Delegate SSL termination to an SSL listener on a Classic Load Balancer, and maintain a TCP connection between the load balancer and the EC2 instances.
Route all traffic through a TCP listener on a Classic Load Balancer, and execute the TLS termination on the EC2 instances.
Establish an HTTPS listener using an Application Load Balancer, and channel all communication through this load balancer.
Offload SSL termination to an SSL listener using an Application Load Balancer, and initiate an SSL connection between the load balancer and the EC2 instances.

An application is secured using network access control lists and security groups. Web servers are housed in public subnets behind an Application Load Balancer (ALB); application servers reside in private subnets. How can perimeter security be enhanced to protect the Amazon EC2 instances against attacks? (Choose two.)

2 Mark(s)

Configure the applications EC2 instances to use NAT gateways for all inbound traffic.
Relocate the web servers to private subnets devoid of public IP addresses.
Leverage AWS WAF to provide DDoS attack protection for the ALB.
Mandate all inbound network traffic to pass through a bastion host in the private subnet.

As a Security Administrator, you are tasked with limiting the capabilities of root user accounts in the organization. The organization employs AWS Organizations with all feature sets activated, including consolidated billing. The top-level account is utilized for billing and administrative purposes, not for operational AWS resource activities. How can you restrict the usage of member root user accounts across the organization?

1 Mark(s)

Disable the root user account usage at the organizational root. Activate multi-factor authentication for the root user account for each organizational member account.
Configure IAM user policies to restrain root account capabilities for each Organizations member account.
Establish an organizational unit (OU) in Organizations with a service control policy that regulates usage of the root user. Add all operational accounts to this new OU.
Set up AWS CloudTrail to integrate with Amazon CloudWatch Logs and then create a metric filter for RootAccountUsage.

A company possesses a customer master key (CMK) with imported key materials. Company policy demands that all encryption keys undergo rotation every year. How can the company implement this policy?

1 Mark(s)

Enable automatic key rotation annually for the CMK.
Use AWS Command Line Interface to create an AWS Lambda function to rotate the existing CMK annually.
Import new key material to the existing CMK and manually rotate the CMK.
Create a new CMK, import new key material to it, and point the key alias to the new CMK.

AWS Cloud Security : Question 1 of 12