AWS Security 04

A Developer's unencrypted laptop, which contained the SSH key used to access multiple Amazon EC2 instances, was stolen. The SSH key hasn't been used so far and port 22 to all EC2 instances has been blocked by a Security Engineer. How can the Security Engineer further safeguard the currently running instances?

1 Mark(s)

Remove the key-pair key from the EC2 console and generate a new key pair
Alter the key on any EC2 instance using the key through the modify-instance-attribute API
Use EC2 RunCommand to modify the authorized_keys file on any EC2 instance using the key
Update the key pair in any AMI used to launch the EC2 instances, then reboot the EC2 instances

The DevOps team encounters an error message every time they try to encrypt or decrypt a Secure String parameter from the SSM Parameter Store using an AWS KMS customer managed key (CMK). What could be the underlying issues related to CMK? (Select two.)

2 Mark(s)

The application-specific CMK doesnt exist
The application-specific CMK is currently in use
The application refers to the CMK KeyID instead of CMK Amazon Resource Name
The CMK specified in the application is not enabled

A Software Engineer has developed a custom reporting service for a fleet of Amazon EC2 instances. As per the company security policy, the application logs for the reporting service must be centrally collected. Which solution would be the most efficient for meeting these requirements?

1 Mark(s)

Develop an AWS Lambda function that accesses the EC2 instance, retrieves the application logs and stores them in an Amazon S3 bucket.
Enable AWS CloudTrail logging for the AWS account, create a new Amazon S3 bucket, and set up Amazon CloudWatch Logs to receive the application logs from CloudTrail.
Implement a cron job on the EC2 instances that synchronizes the application logs to an Amazon S3 bucket using rsync.
Install the Amazon CloudWatch Logs Agent on the EC2 instances and configure it to forward the application logs to CloudWatch Logs.

Observe the following AWS Key Management Service (KMS) policy attached to a customer master key (CMK). This policy was configured for the user 'SampleUser' in account '444455556666'. What are the implications of this setup?

1 Mark(s)

The policy allows the SampleUser in account 444455556666 to execute encryption and decryption actions using Amazon WorkMail and Amazon SES services.
This policy permits the SampleUser to carry out encryption and decryption tasks while communicating with AWS.
The policy restricts the CMK to only perform encryption and decryption when the request is triggered by SampleUser through WorkMail or SES in the designated region.
It enables WorkMail or SES to execute encryption or decryption on behalf of any user in the account for any CMK.

A Security Engineer has received an AWS Abuse Notice detailing abuse from certain EC2 instance IDs. Which steps should be taken in response to this situation? Choose three.

3 Mark(s)

Employ AWS Artifact to capture a precise image of the state of each instance.
Create EBS Snapshots of every volume attached to the compromised instances.
Execute a memory dump.
Use administrative credentials to log in to each instance and restart it.
Restrict all network ingress and egress except those to/from a forensics workstation.
Run Auto Recovery for Amazon EC2.

A Security Architect needs to ensure the encryption keys used in an AWS service meet specific regulatory standards. What is the appropriate course of action?

1 Mark(s)

Assess the stipulations in the AWS Customer Agreement
Utilize AWS Artifact for accessing AWS compliance reports
Seek guidance from AWS Discussion Forums
Execute AWS Config and analyze the configuration outcomes

Please examine the following segment of an AWS Key Management Service (KMS) key policy within your AWS account. What permissions does this policy confer?

1 Mark(s)

This policy permits all principals across all AWS accounts to utilize the key.
It only allows the root user from account 444455556666 to access the key.
The policy grants every principal from account 444455556666 access to the key, but solely in conjunction with Amazon S3.
It grants all principals from account 444455556666 with an IAM policy that authorizes key access, the right to use the key.

A Security Administrator is setting up an Amazon S3 bucket and needs to satisfy the following security requirements: Encryption in transit, Encryption at rest, Logging of all object retrievals in AWS CloudTrail. What would meet these requirements? Choose three.

3 Mark(s)

In the S3 bucket policy, specify aws:SecureTransport: true as a condition.
Activate a security group for the S3 bucket that allows port 443 but not port 80.
Establish default encryption for the S3 bucket.
Enable Amazon CloudWatch Logs for the AWS account.
Enable API logging of data events for all S3 objects.
Enable S3 object versioning for the S3 bucket.

An organization has deployed tens of applications on thousands of Amazon EC2 instances. For testing, the Application team needs to know whether the network ACLs and security groups are functioning as expected. What would be an efficient way to meet this requirement?

1 Mark(s)

Enable VPC Flow Logs, redirect the logs to Amazon S3, and use Amazon Athena to query the logs
Install an Amazon Inspector agent on each EC2 instance, transmit the logs to Amazon S3, and use Amazon EMR to query the logs
For each network ACL and security group configuration, create an AWS Config rule, forward the logs to Amazon S3, and use Amazon Athena to query the logs
Activate AWS CloudTrail, transfer the trails to Amazon S3, and employ AWS Lambda to query the trails

Changes were recently made to IAM on an account, and an application that publishes custom metrics to Amazon CloudWatch is no longer able to report metrics. What's the least permissive solution to resume the metric delivery?

1 Mark(s)

Add a statement to the applications IAM policy permitting logs:putLogEvents and logs:createLogStream
Amend the IAM role used by the application by attaching the CloudWatchFullAccess managed policy
Include a statement in the IAM policy of the application allowing cloudwatch:putMetricData
Establish a trust relationship for cloudwatch.amazonaws.com with the IAM role used by the application

AWS Security 04 : Question 1 of 10