AWS Security 05

A company is using AWS Organization to manage 50 AWS accounts. The finance staff members need to read the consolidated billing information in the MasterPayer AWS account while being restricted from viewing any other resources. IAM access to billing has been enabled in the MasterPayer account. How can the finance staff be granted the necessary permissions without any excessive permissions?

1 Mark(s)

Create an IAM group for the finance users in the FinanceDept account, then attach the AWS managed ReadOnlyAccess IAM policy to the group.
Create an IAM group for the finance users in the MasterPayer account, then attach the AWS managed ReadOnlyAccess IAM policy to the group.
Create an IAM role in the FinanceDept account with the ViewBilling permission, then grant the finance users in the MasterPayer account the permission to assume that role.
Create an IAM role in the MasterPayer account with the ViewBilling permission, then grant the finance users in the FinanceDept account the permission to assume that role.

The Amazon CloudWatch Logs agent is effectively delivering logs to the CloudWatch Logs service. However, after a particular number of hours, logs stop being delivered. Which steps should be taken to identify the cause of this issue? Choose two.

3 Mark(s)

Verify if the file permissions for monitored files, allowing the CloudWatch Logs agent to read the file, have been altered.
Confirm that the operating systems log rotation rules align with the configuration requirements for agent streaming.
Set up an Amazon Kinesis producer to first deposit the logs into Amazon Kinesis Streams.
Create a CloudWatch Logs metric to isolate a value that changes at least once during the period before logging stops.

A cybersecurity specialist is tasked with investigating an issue where one web server among several others is not accepting inbound connections from the internet. After confirming the accuracy of the rule sets in the Security Groups, network ACLs, and virtual appliance, what additional elements should the specialist inspect to resolve this issue? Choose two.

2 Mark(s)

Confirm that the route table for the web servers subnet directs 0.0.0.0/0 traffic towards a NAT gateway.
Inspect the Security Group attached to the specific web servers Elastic Network Interface (ENI).
Check that the route table for the web servers subnet directs 0.0.0.0/0 traffic towards the virtual security appliance.
Validate the registered targets within the Application Load Balancer (ALB).

A Software Engineer is struggling with network connectivity issues to an Amazon EC2 instance. The instance's security group permits inbound HTTP traffic from 0.0.0.0/0, and the outbound rules are default. The subnet's custom network ACL also allows inbound HTTP traffic from 0.0.0.0/0 but has no outbound rules. What's the solution to this connectivity problem?

1 Mark(s)

The security groups outbound rules dont allow the response to be sent to the client on the ephemeral port range.
The security groups outbound rules dont allow the response to be sent to the client on the HTTP port.
An outbound rule must be added to the network ACL to allow the response to be sent to the client on the ephemeral port range.
An outbound rule must be added to the network ACL to allow the response to be sent to the client on the HTTP port.

As a Security Engineer, you're tasked with developing an automated process to disable IAM user access keys that are older than three months. Which option would be the most effective?

1 Mark(s)

In the AWS Console, navigate to the IAM service and select Users. Check the Access Key Age column.
Create an IAM policy that denies access if the key age is more than three months and apply it to all users.
Use a script that implements the GenerateCredentialReport, GetCredentialReport, and UpdateAccessKey APIs.
Set up an Amazon CloudWatch alarm to detect aged access keys and use an AWS Lambda function to disable keys older than 90 days.

The InfoSec team at your organization has mandated that only approved Amazon Machine Images (AMIs) can be used in the future. What is the most efficient way for the InfoSec team to ensure this compliance?

1 Mark(s)

Terminate all Amazon EC2 instances and restart them with approved AMIs.
Patch all running instances using AWS Systems Manager.
Implement AWS Config rules and verify compliance for all running instances.
Define a metric filter in Amazon CloudWatch Logs to confirm compliance.

In a scenario where a company has deployed a custom DNS server in AWS, a security engineer wishes to restrict Amazon EC2 instances from using the Amazon-provided DNS. What approach should the engineer take to block access to the Amazon-provided DNS within the VPC?

1 Mark(s)

Restrict access to the Amazon DNS IP within all security groups.
Add a rule to all network access control lists that deny access to the Amazon DNS IP.
Add a route to all route tables that black holes traffic to the Amazon DNS IP.
Disable DNS resolution within the VPC configuration.

A security engineer has just created an AWS Key Management Service (AWS KMS) key with a specific policy. The key policy includes permissions to perform all "kms:" actions for the principal identified as the root user of the AWS account 111122223333. What would be the implications of this key policy? (Choose two.)

2 Mark(s)

The policy allows the AWS account 111122223333 to manage key access through IAM policies.
The policy permits all IAM users in account 111122223333 to fully access the KMS key.
The policy grants full access to the KMS key to the root user in account 111122223333.
The policy grants full access to the KMS key to the KMS service-linked role in account 111122223333.

A company has set up multiple production AWS accounts, each with AWS CloudTrail configured to log to a single Amazon S3 bucket in a central account. However, two of the production accounts are not logging anything to the S3 bucket. What steps should be taken to troubleshoot this issue? Choose three.

3 Mark(s)

Verify that the log file prefix corresponds to the name of the S3 bucket where the logs should be sent.
Check if the S3 bucket policy permits access for CloudTrail from the production AWS account IDs.
Set up a new CloudTrail configuration in the account and set it to log to the accounts S3 bucket.
In the CloudTrail Console, verify that each trail is active and healthy.
In the master account, open the global CloudTrail configuration and confirm that the storage location is set to the correct S3 bucket.
In the CloudTrail Console, verify that the S3 bucket name is set correctly.

AWS Security 05 : Question 1 of 9