Examkin

Security and Compliance

441 soru

Tüm türler441Çoktan seçmeli225Çoklu seçim216
Soru 281Soru →

A logistics company is migrating its supply chain database to AWS. The compliance team requires that all data stored at rest in Amazon S3 be encrypted. The compliance policy specifically mandates that the encryption keys must be generated and stored in a dedicated, single-tenant cryptographic hardware appliance that the company fully controls, while AWS remains responsible for the physical security and maintenance of the appliance hardware. Which service and management model should the company implement?

Cevabı ve açıklamayı göster

Cevap: AWS CloudHSM to manage the keys, where the customer retains exclusive administrative control of the cryptographic users and AWS manages the physical appliance.

Cevap

AWS CloudHSM to manage the keys, where the customer retains exclusive administrative control of the cryptographic users and AWS manages the physical appliance.
The correct option meets the requirement of single-tenancy and correctly maps the shared responsibility model. AWS CloudHSM provides dedicated, single-tenant hardware security modules (HSMs). The customer has sole control over key generation and user administration on the partition, while AWS maintains physical security, power, cooling, and hardware replacement of the HSM appliance.

Adım Adım Çözüm

1
Identify the multi-tenancy and single-tenancy requirements for key management.
The scenario requires a dedicated, single-tenant hardware appliance, which points to AWS CloudHSM rather than AWS Key Management Service (AWS KMS), which is a multi-tenant service.
AWS CloudHSM provides dedicated access to physical HSMs, whereas AWS KMS shares HSM infrastructure across multiple AWS accounts.
2
Apply the AWS Shared Responsibility Model to the chosen service.
AWS is responsible for physical security and hardware maintenance of the CloudHSM appliances, while the customer is responsible for administering HSM users and managing the keys.
Customers cannot physically access AWS data centers, so physical host security and appliance maintenance remain AWS's responsibility under the shared responsibility model.

Anahtar Kavram

AWS CloudHSM vs AWS KMS and the Shared Responsibility Model for Data Protection
Soru 282Soru →

A company's security team is designing a multi-layered auditing and threat detection strategy for their application servers running on Amazon EC2. The team must satisfy three distinct operational security requirements:
1. Audit and record a history of all API calls, including the specific IAM identities, source IP addresses, and timestamps, to determine who modified resources.
2. Monitor active network traffic patterns to detect potential security threats, such as instances communicating with known command-and-control servers.
3. Track performance metrics of the EC2 instances, such as CPU utilization, and trigger automated alerts if resource usage exceeds defined limits.

Which combination of AWS services will successfully address these three requirements?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to audit API calls, Amazon GuardDuty to detect threat patterns and malicious communications, and Amazon CloudWatch to monitor metrics and trigger threshold alarms.

Cevap

AWS CloudTrail to audit API calls, Amazon GuardDuty to detect threat patterns and malicious communications, and Amazon CloudWatch to monitor metrics and trigger threshold alarms.
AWS CloudTrail is designed to audit and record API activity, user identities, and source IP addresses across the AWS account. Amazon GuardDuty uses threat intelligence and machine learning to actively monitor logs (like VPC Flow Logs and DNS logs) for security threats such as command-and-control communications. Amazon CloudWatch monitors performance metrics (like CPU utilization) and can trigger alarms and notifications when specific thresholds are breached.

Adım Adım Çözüm

1
Identify the service responsible for auditing API activity, user identities, and timestamps across the AWS infrastructure.
AWS CloudTrail is determined to be the correct service for recording all account-level API activity.
CloudTrail provides continuous logging of management and data events for compliance and security auditing.
2
Determine the service needed for intelligent threat detection and identifying malicious network traffic like command-and-control communication.
Amazon GuardDuty is selected as the service that monitors network events and uses threat intelligence to detect malicious hosts.
GuardDuty analyzes VPC Flow Logs, DNS logs, and CloudTrail logs to identify active threats, whereas Amazon Inspector is only for static vulnerability scanning.
3
Find the service responsible for collecting resource metrics and triggering notifications based on performance thresholds.
Amazon CloudWatch is selected to monitor CPU utilization and send notifications through alarms.
CloudWatch tracks performance metrics and manages metric-based alerts, which is a customer-managed responsibility under the Shared Responsibility Model.

Anahtar Kavram

Selecting and distinguishing AWS security logging, threat monitoring, and operational alerting services.
Tahmini Süre:2m 0s
Soru 283Soru →

A university is hosting its student registration portal on AWS. The university's compliance department requires a complete history of all API calls and administrative actions taken within the AWS account to audit user activity. Which AWS service should the university use to meet this audit requirement?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail

Cevap

AWS CloudTrail
AWS CloudTrail is specifically designed to enable governance, compliance, operational auditing, and risk auditing of an AWS account. It records API calls and user actions, allowing the university to track changes, investigate security incidents, and ensure compliance requirements are met.

Adım Adım Çözüm

1
Identify the primary requirement in the scenario, which is auditing and tracking a complete history of API calls and user administrative actions in the AWS account.
Recognized that API auditing is required.
This helps determine which service is designed for recording API activity.
2
Evaluate the available AWS services to find the one that logs and records account activity and API requests.
AWS CloudTrail is identified as the service dedicated to logging API calls, while Amazon CloudWatch is for performance metrics and Amazon GuardDuty is for threat detection.
Matching the requirements with the core purpose of each AWS service.

Anahtar Kavram

AWS CloudTrail is the primary service used for auditing API actions and logging user activity across an AWS account.
Tahmini Süre:45s
Soru 284Soru →

A digital marketing agency needs to retrieve the AWS Service Organization Control (SOC) reports to satisfy a client's security questionnaire about the underlying cloud infrastructure. Which AWS tool or service should the agency use to obtain these official documents?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact
AWS Artifact is the central repository that provides customers with free, on-demand access to AWS security and compliance reports (such as SOC and PCI reports) as well as select online agreements. This allows the agency to retrieve and share official documentation about the compliance of the underlying AWS infrastructure.

Adım Adım Çözüm

1
Identify the request for third-party compliance documentation, specifically SOC reports, regarding the underlying AWS infrastructure.
The requirement is to obtain official, pre-audited compliance reports for the cloud platform.
External clients need proof of cloud infrastructure compliance to meet their security requirements.
2
Determine which AWS service acts as a self-service repository for retrieving compliance reports and agreements.
AWS Artifact is identified as the portal providing on-demand access to compliance reports.
AWS Artifact allows customers to download SOC, PCI, and ISO reports directly.

Anahtar Kavram

AWS Artifact provides on-demand, self-service access to AWS compliance reports and security documents.
Soru 285Soru →

A global organization wants to implement a robust security logging and auditing architecture. They need to meet three distinct security and operational monitoring objectives:

1. They must track and log all management events and API calls across their entire AWS Organization for compliance auditing.
2. They need to monitor CPU utilization and disk read/write metrics of their Amazon EC2 instances to dynamically scale resources and trigger operational alerts.
3. They require intelligent threat detection that uses machine learning to continuously analyze metadata logs (such as VPC Flow Logs and DNS logs) to identify potential malicious activity.

Which combination of AWS services should the organization implement to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail for tracking organizational API calls, Amazon CloudWatch for EC2 performance metrics and triggering operational alerts, and Amazon GuardDuty for intelligent threat detection

Cevap

AWS CloudTrail for tracking organizational API calls, Amazon CloudWatch for EC2 performance metrics and triggering operational alerts, and Amazon GuardDuty for intelligent threat detection
The correct service mapping matches each requirement: AWS CloudTrail logs management events and API actions centrally; Amazon CloudWatch monitors resource performance metrics (like CPU and disk read/write) and handles alarms; Amazon GuardDuty provides intelligent, machine learning-driven threat detection by analyzing VPC Flow Logs, DNS logs, and CloudTrail events.

Adım Adım Çözüm

1
Analyze the first requirement: tracking and logging all management events and API calls across the AWS Organization for compliance.
Identify AWS CloudTrail as the service designed to record API calls, console actions, and management events.
AWS CloudTrail provides governance, compliance, operational auditing, and risk auditing of your AWS account actions.
2
Analyze the second requirement: monitoring CPU utilization and disk metrics of Amazon EC2 instances to scale resources and trigger alerts.
Identify Amazon CloudWatch as the monitoring and observability service that collects performance metrics and sets alarms.
Amazon CloudWatch tracks raw metrics from AWS resources and allows the creation of alarms and scaling actions based on those metrics.
3
Analyze the third requirement: intelligent threat detection using machine learning to analyze VPC Flow Logs, DNS logs, and CloudTrail events.
Identify Amazon GuardDuty as the intelligent threat detection service.
Amazon GuardDuty continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior using log sources.

Anahtar Kavram

Selecting appropriate logging, monitoring, and threat detection services in AWS based on functional and security requirements.
Soru 286Soru →

A media streaming platform is implementing a security policy to protect user payment information and video assets on AWS. The security team needs to configure encryption for data at rest in Amazon S3 and data in transit between users and the streaming application. Which of the following statements represent the customer's responsibility under the AWS Shared Responsibility Model for this data protection scenario? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring key policies in AWS Key Management Service (AWS KMS) to restrict access to encryption keys; Enabling HTTPS on the application's load balancers by installing SSL/TLS certificates

Cevap

Configuring key policies in AWS Key Management Service (AWS KMS) to restrict access to encryption keys, and enabling HTTPS on the application's load balancers by installing SSL/TLS certificates.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in the cloud.' In this scenario, this includes managing access controls to their cryptographic resources (such as configuring key policies in AWS KMS) and securing data in transit (such as enabling HTTPS and installing SSL/TLS certificates on the load balancers they deploy). AWS is responsible for security 'of the cloud,' which covers physical infrastructure security, physical host maintenance, and operating system/firmware patching of managed services.

Adım Adım Çözüm

1
Determine the scope of the customer's control over encryption at rest within S3.
The customer is responsible for configuring S3 bucket settings and defining who can use the encryption keys by creating and managing KMS key policies.
Security 'in the cloud' dictates that the customer manages their data configurations and access controls.
2
Determine the scope of the customer's control over encryption in transit.
The customer must secure transport layer traffic by obtaining SSL/TLS certificates and configuring endpoints, such as load balancers, to require HTTPS.
AWS does not automatically enforce transit encryption on customer-managed endpoints; this configuration is the customer's responsibility.
3
Identify and eliminate AWS infrastructure responsibilities.
Tasks involving physical hardware replacement, physical data center operations, and managed service firmware upgrades are classified as security 'of the cloud' and belong to AWS.
AWS handles all operational, physical, and foundational maintenance of cloud infrastructure.

Anahtar Kavram

Shared Responsibility Model for Data Protection and Encryption
Soru 287Soru →

A cloud administrator is configuring security settings for an Amazon S3 bucket that will store proprietary company documents. To protect data at rest, which security action is the cloud administrator responsible for executing?

Cevabı ve açıklamayı göster

Cevap: Enabling server-side encryption on the Amazon S3 bucket

Cevap

Enabling server-side encryption on the Amazon S3 bucket
Enabling server-side encryption is the correct action because under the AWS Shared Responsibility Model, the customer is responsible for data encryption configuration, identity management, and guest operating system security (security 'in' the cloud).

Adım Adım Çözüm

1
Identify the data protection control needed in the scenario.
The goal is to protect data at rest within an S3 bucket.
This determines whether the control applies to user-configured settings or underlying cloud infrastructure.
2
Apply the AWS Shared Responsibility Model to the candidate tasks.
Configuring S3 bucket settings (like enabling server-side encryption) is classified as security 'in' the cloud, which is the customer's responsibility. Tasks like firmware updates, OS patching of hypervisors, and physical disk decommissioning are security 'of' the cloud, which is AWS's responsibility.
This distinguishes between customer-managed tasks and AWS-managed infrastructure tasks.

Anahtar Kavram

Under the AWS Shared Responsibility Model, customers are responsible for security 'in' the cloud (such as configuring data encryption at rest and in transit), while AWS is responsible for security 'of' the cloud (including the physical infrastructure, virtualization layer, and hardware maintenance).
Soru 288Soru →

A gaming company is migrating its leaderboard database to AWS. The company needs to encrypt the database backups stored in Amazon S3 at rest and ensure that all data sent to the database is encrypted in transit. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enabling server-side encryption on the Amazon S3 buckets.; Configuring SSL/TLS on client applications to encrypt data in transit.

Cevap

Enabling server-side encryption on the Amazon S3 buckets and configuring SSL/TLS on client applications to encrypt data in transit.
Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud'. This includes configuring data protection settings such as enabling server-side encryption on Amazon S3 buckets to protect data at rest, and implementing SSL/TLS on client applications to protect data in transit. AWS is responsible for 'security of the cloud', which includes physical security of the infrastructure.

Adım Adım Çözüm

1
Determine which tasks relate to customer-managed configurations in the cloud versus the underlying infrastructure managed by AWS.
Configuring S3 encryption settings and application network protocols are customer tasks, while physical data center security and hardware replacement are managed by AWS.
The AWS Shared Responsibility Model divides tasks into security 'in' the cloud (customer responsibility) and security 'of' the cloud (AWS responsibility).
2
Analyze key management options to identify the correct usage of encryption services.
Standard S3-managed encryption (SSE-S3) does not require provisioning a dedicated single-tenant hardware security module (AWS CloudHSM).
AWS CloudHSM is a dedicated hardware module, whereas default S3 encryption is managed automatically by AWS without infrastructure provisioning.

Anahtar Kavram

Under the AWS Shared Responsibility Model, customers are responsible for encrypting their data in transit (using protocols like SSL/TLS) and configuring encryption at rest (such as enabling server-side encryption on S3 buckets).
Soru 289Soru →

A tourism agency is deploying a customer-facing mobile booking application and decides to use Amazon Cognito for user authentication and directory management. Under the AWS Shared Responsibility Model, which of the following is a responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring password complexity policies and enabling Multi-Factor Authentication (MFA) for the Cognito user pools

Cevap

Configuring password complexity policies and enabling Multi-Factor Authentication (MFA) for the Cognito user pools
Under the AWS Shared Responsibility Model, configuring identity settings (such as password policies and MFA requirements) represents security 'in' the cloud, which is the customer's responsibility.

Adım Adım Çözüm

1
Determine the type of AWS service described in the scenario.
Amazon Cognito is classified as a fully managed service.
Knowing that Amazon Cognito is a managed service helps establish that AWS manages the infrastructure, server patching, and physical security.
2
Identify which security tasks are customer-controlled configurations for the identity provider.
Defining user password complexity and enabling Multi-Factor Authentication (MFA) are configuration settings within the Cognito user pool.
Under the Shared Responsibility Model, the customer is responsible for access policies, identity settings, and data protection inside the managed service.

Anahtar Kavram

Under the AWS Shared Responsibility Model, for managed services like Amazon Cognito, AWS is responsible for physical security and server/infrastructure maintenance, while the customer is responsible for service configuration, data classification, and access policies.
Tahmini Süre:1m 0s
Soru 290Soru →

An application developer is configuring security rules for an Amazon EC2 instance. They notice that when they allow inbound traffic on a specific port, the return outbound traffic is automatically allowed without requiring an explicit outbound rule. Which AWS network security component exhibits this stateful behavior?

Cevabı ve açıklamayı göster

Cevap: Security Groups

Cevap

Security Groups
Security Groups are stateful firewalls operating at the instance level. Any permitted inbound connection automatically allows the corresponding outbound return traffic, regardless of the outbound rules.

Adım Adım Çözüm

1
Analyze the network traffic behavior described in the scenario.
The firewall automatically permits outbound responses to approved inbound requests, showing stateful tracking.
Understanding whether a firewall is stateful or stateless is key to identifying how it manages return traffic.
2
Select the AWS security feature that matches this stateful behavior at the instance level.
Security Groups are the stateful firewalls that operate at the instance level.
This matches the behavior in the scenario, distinguishing it from Network ACLs, which are stateless.

Anahtar Kavram

Stateful and stateless network filtering in AWS (Security Groups vs. Network ACLs)
Tahmini Süre:45s
Soru 291Soru →

A newly formed cloud engineering team needs to perform daily administrative duties, such as configuring network settings and launching Amazon EC2 instances. Which approach represents the AWS-recommended best practice for securing the AWS account root user while enabling these tasks?

Cevabı ve açıklamayı göster

Cevap: Enable multi-factor authentication (MFA) on the root user, lock away its credentials, and create an IAM user with administrative permissions for daily tasks.

Cevap

Enable multi-factor authentication (MFA) on the root user, lock away its credentials, and create an IAM user with administrative permissions for daily tasks.
The correct answer is to enable multi-factor authentication (MFA) on the root user, lock its credentials, and create an IAM user with administrator access for daily tasks. This aligns with the AWS Security best practice of minimizing the use of the root account and ensuring that daily tasks are performed using standard identities with restricted or monitored access.

Adım Adım Çözüm

1
Secure the AWS account root user by enabling Multi-Factor Authentication (MFA) and locking its credentials.
The root account is protected against unauthorized access, even if the primary password is leaked.
The root user has unrestricted access to all resources and billing, making its protection the highest priority.
2
Create individual IAM users for administrative tasks and assign administrative permissions.
Daily operations are performed using identities with auditable actions and permissions that can be restricted if necessary.
AWS recommends limiting root account usage to only a small subset of specific tasks, performing all other administrative operations via IAM.

Anahtar Kavram

AWS Root Account Security and IAM Best Practices
Soru 292Soru →

A cloud engineer has successfully created a new AWS account for a startup. To secure the account immediately, what is the AWS-recommended best practice for performing daily administrative operations?

Cevabı ve açıklamayı göster

Cevap: Create an IAM user with administrative permissions and use it for daily tasks, while restricting the root user.

Cevap

Create an IAM user with administrative permissions and use it for daily tasks, while restricting the root user.
The AWS-recommended best practice is to secure the root user credentials and avoid using them for daily tasks. Instead, an IAM user with administrative permissions should be created and used for day-to-day administrative operations.

Adım Adım Çözüm

1
Identify the AWS security best practices regarding the root user account.
The root user has unrestricted access to all resources and billing information and should not be used for daily tasks.
Restricting root user usage minimizes the risk of accidental configuration changes or credential compromise.
2
Determine the correct entity for daily administrative tasks.
An IAM user with administrative privileges should be created to manage resources day-to-day.
This allows for proper logging, control, and alignment with the principle of least privilege where appropriate.

Anahtar Kavram

AWS Root Account Security and IAM Administration Best Practices
Soru 293Soru →

A financial technology firm wants to enhance its security posture on AWS. The firm needs to meet two specific requirements: first, they want to continuously monitor their AWS accounts, workloads, and data for malicious activity, such as unauthorized API calls or potential data exfiltration. Second, they need an automated way to scan container images stored in Amazon Elastic Container Registry (Amazon ECR) for software vulnerabilities before they are deployed to production.

Which two AWS services should the firm use to satisfy these security requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty; Amazon Inspector

Cevap

The firm should use Amazon GuardDuty for continuous threat monitoring and Amazon Inspector to scan container images for vulnerabilities.
The correct options are the services designed for threat detection and vulnerability scanning. Continuous threat detection is provided by Amazon GuardDuty, which monitors accounts and workloads for malicious activity. Automated vulnerability scanning of container images in Amazon ECR is provided by Amazon Inspector.

Adım Adım Çözüm

1
Identify the service needed for continuous monitoring of accounts, workloads, and data to detect malicious activity or unauthorized behavior.
Amazon GuardDuty uses machine learning and threat intelligence to detect malicious activity (such as resource hijacking, unauthorized access, or unusual API activity) across log sources like VPC Flow Logs, DNS logs, and CloudTrail events.
This directly fulfills the first requirement of threat detection.
2
Identify the service needed to scan container images stored in Amazon ECR for known software vulnerabilities before deployment.
Amazon Inspector automatically scans container images in ECR (as well as EC2 instances and Lambda functions) against vulnerability databases to identify security weaknesses.
This directly fulfills the second requirement of vulnerability management.

Anahtar Kavram

Continuous threat detection and automated software vulnerability scanning on AWS
Soru 294Soru →

A small retail business is deploying a new online storefront using Amazon Lightsail virtual private servers. Under the AWS Shared Responsibility Model, which two security-related tasks are the responsibility of the customer? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Upgrading and patching the guest operating system installed on the instances; Configuring the instance-level firewall rules to control inbound and outbound network traffic

Cevap

The customer is responsible for upgrading and patching the guest operating system installed on the instances, as well as configuring the instance-level firewall rules to control inbound and outbound network traffic.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For virtual private servers like Amazon Lightsail, the customer has control over the guest operating system and the local network configurations. Therefore, patching the guest operating system and configuring the firewall rules to control traffic are both customer responsibilities.

Adım Adım Çözüm

1
Identify the AWS service type in the scenario
Amazon Lightsail is an Infrastructure as a Service (IaaS) resource.
Different service types (IaaS vs. PaaS vs. SaaS/Managed) shift the shared responsibility boundary between AWS and the customer.
2
Determine the customer's responsibility boundary for IaaS resources
For IaaS resources, the customer is responsible for the guest operating system, application software, data configuration, and local network settings (firewalls).
Since the customer maintains administrative access to the OS and network settings, security 'in' the cloud at these layers is their responsibility.
3
Determine the AWS responsibility boundary
AWS is responsible for physical hardware, data centers, virtualization software (hypervisor), and core infrastructure services.
AWS manages the global infrastructure and physical assets that host customer services (security 'of' the cloud).

Anahtar Kavram

The division of security duties between AWS (security of the cloud) and the customer (security in the cloud) under the AWS Shared Responsibility Model, specifically for IaaS/VPS platforms.
Soru 295Soru →

A business is deploying its first application in a Virtual Private Cloud (VPC) and needs to configure basic network security controls. The administrator wants to use both Security Groups and Network Access Control Lists (Network ACLs) to secure their resources.

Which TWO statements correctly describe the characteristics of these security resources?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security groups are stateful, which means return traffic is automatically allowed.; Network Access Control Lists (Network ACLs) are stateless, which means return traffic must be explicitly allowed by an outbound rule.

Cevap

The correct statements are that Security groups are stateful (automatically allowing return traffic) and Network Access Control Lists (Network ACLs) are stateless (requiring explicit outbound rules for return traffic).
Security groups are stateful, meaning they automatically track connections and allow response traffic to flow back without needing a corresponding outbound rule. Conversely, Network Access Control Lists (Network ACLs) are stateless, meaning they do not track connection states, so any return traffic must be explicitly allowed by an outbound rule.

Adım Adım Çözüm

1
Analyze the traffic tracking behavior of Security Groups.
Security Groups are stateful. Once a connection is established inbound, outbound return traffic is automatically permitted.
To determine which network security controls automatically allow return traffic.
2
Analyze the traffic tracking behavior of Network ACLs.
Network ACLs are stateless. Rules must be defined for both inbound and outbound traffic to allow return communication.
To verify how Network ACLs evaluate traffic in both directions.
3
Analyze the boundaries where Security Groups and Network ACLs operate.
Security Groups operate at the instance level (specifically the Elastic Network Interface), while Network ACLs operate at the subnet level.
To reject options that confuse the boundary levels of these security controls.

Anahtar Kavram

Stateful vs. Stateless network firewalls and their operating levels (instance vs. subnet) in AWS VPC.
Tahmini Süre:1m 0s
Soru 296Soru →

A digital healthcare company hosts a patient portal on AWS and must meet strict regulatory compliance requirements for security monitoring and auditing. The compliance and operations teams define three specific requirements:
1. Every API call made by IAM users or AWS services must be recorded, stored securely, and cryptographically validated to ensure the integrity of the audit logs.
2. System administrators must receive real-time alerts if application-level logs on Amazon EC2 instances show a sudden spike in specific error codes.
3. The environment must be continuously analyzed for malicious activity, such as instances scanning for open ports or communicating with known malicious IP addresses.

Which of the following configurations should the company implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS CloudTrail with log file integrity validation enabled to record and verify account-wide API calls, and deploy the Amazon CloudWatch agent on EC2 instances to stream application logs to CloudWatch Logs for metric filtering and alerting.; Enable Amazon GuardDuty to continuously analyze VPC Flow Logs, CloudTrail management events, and DNS logs in order to detect and alert on threat patterns and unauthorized communications.

Cevap

The correct configurations are the ones utilizing AWS CloudTrail for API auditing and log validation, CloudWatch Logs for EC2 log streaming and alerting, and Amazon GuardDuty for threat detection.
The correct configuration combines AWS CloudTrail and Amazon CloudWatch Logs to address API auditing and application error alerting respectively, and uses Amazon GuardDuty for active threat monitoring. AWS CloudTrail provides log file integrity validation to ensure compliance logs remain unaltered, and the CloudWatch agent is used to export application logs to CloudWatch Logs for alerting. Amazon GuardDuty consumes sources like VPC Flow Logs, DNS logs, and CloudTrail events to identify threats like malicious IP communication and port scanning.

Adım Adım Çözüm

1
Identify the service responsible for recording and validating account-wide API calls.
AWS CloudTrail is identified as the service that records API activity and offers log file integrity validation.
This satisfies the first requirement of cryptographically validating all AWS API calls for audit trail integrity.
2
Determine the mechanism for collecting application logs from EC2 instances and triggering real-time alerts on error patterns.
Deploying the CloudWatch agent on EC2 instances allows log streaming to CloudWatch Logs, where metric filters and CloudWatch Alarms handle threshold alerts.
This satisfies the second requirement of alerting system administrators on EC2 application log errors.
3
Determine the service designed to continuously detect threats and malicious behaviors like port scanning or communicating with bad IPs.
Amazon GuardDuty is selected as it continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events for threat detection.
This satisfies the third requirement of intelligent threat analysis and anomalous behavior detection.
4
Synthesize the findings to select the two options that correctly configure these services.
One option correctly pairs CloudTrail and CloudWatch Logs, while another correctly selects Amazon GuardDuty.
This matches the target requirements exactly while avoiding the services that are either misconfigured or mapped to wrong responsibilities.

Anahtar Kavram

AWS security logging, monitoring, and auditing services (CloudTrail, CloudWatch, GuardDuty) and their operational differences.
Soru 297Soru →

A logistics company wants to track activity across its AWS infrastructure. The operations team needs to:
1. Audit all user actions and API calls to identify who deleted an Amazon S3 bucket.
2. Monitor system performance metrics, such as CPU utilization of Amazon EC2 instances, and trigger alarms if they exceed normal thresholds.

Which AWS services should the company use to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail; Amazon CloudWatch

Cevap

AWS CloudTrail and Amazon CloudWatch
The correct services are AWS CloudTrail and Amazon CloudWatch. AWS CloudTrail tracks and logs user activity and API transactions across AWS infrastructure, which satisfies the requirement to audit S3 bucket deletions. Amazon CloudWatch collects and tracks metrics, monitors log files, and sets alarms, which satisfies the requirement to monitor EC2 CPU utilization and trigger alerts.

Adım Adım Çözüm

1
Identify the service needed to audit user actions and API activity, such as identifying who deleted an Amazon S3 bucket.
AWS CloudTrail records a history of API calls and user actions, fulfilling the auditing requirement.
CloudTrail is the primary service for tracking account activity and API usage.
2
Identify the service needed to monitor operational performance metrics (like CPU usage) and configure alarms.
Amazon CloudWatch collects performance metrics and allows the configuration of alarms when thresholds are crossed, fulfilling the monitoring requirement.
CloudWatch is the core service for application and resource monitoring on AWS.

Anahtar Kavram

Distinguishing between AWS CloudTrail for API/user auditing and Amazon CloudWatch for performance monitoring and alerting.
Tahmini Süre:1m 0s
Soru 298Soru →

A retail company wants to secure its AWS infrastructure by auditing all API activities and setting up real-time monitoring for unauthorized access attempts. The security team needs to track who made API calls to modify security group rules and also detect if any Amazon EC2 instances are communicating with known malicious IP addresses.

Which AWS services should the company implement to meet these security requirements? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to track and audit all API operations and console actions.; Amazon GuardDuty to monitor network activity and detect potential threats like communication with malicious IP addresses.

Cevap

AWS CloudTrail to track and audit all API operations and console actions, and Amazon GuardDuty to monitor network activity and detect potential threats like communication with malicious IP addresses.
The correct options are the statements describing AWS CloudTrail and Amazon GuardDuty. AWS CloudTrail is the primary service for auditing, security monitoring, and operational troubleshooting of AWS API activity, making it the correct choice for tracking who modified security groups. Amazon GuardDuty uses intelligent threat detection to continuously monitor for malicious behavior, including identifying when EC2 instances communicate with known malicious IP addresses.

Adım Adım Çözüm

1
Identify the requirement for tracking and auditing API actions (who modified security group rules).
AWS CloudTrail is identified as the service designed to record API calls and user activity across the AWS account.
This directly addresses the requirement of keeping an audit history of configuration changes.
2
Identify the requirement for detecting instances communicating with malicious IP addresses.
Amazon GuardDuty is selected as the intelligent threat detection service that analyzes network logs to detect known malicious communications.
This directly addresses the requirement of network threat detection and finding active compromises.

Anahtar Kavram

AWS security logging and monitoring services have distinct roles: AWS CloudTrail logs API activity for compliance and auditing, while Amazon GuardDuty acts as an intelligent threat detection service using machine learning and threat intelligence feeds.
Soru 299Soru →

A smart home device manufacturer hosts its telemetry processing application on a fleet of Amazon EC2 instances. The security team wants to continuously monitor the AWS environment for potential security threats, such as EC2 instances communicating with known malicious IP addresses or unexpected API calls from unauthorized locations. Which AWS service should the manufacturer use to detect these active threats?

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty

Cevap

Amazon GuardDuty
The correct service is Amazon GuardDuty. It is an intelligent threat detection service that continuously monitors for malicious activity and unauthorized behavior, such as an EC2 instance communicating with a command-and-control server or anomalous API calls from unauthorized locations.

Adım Adım Çözüm

1
Analyze the requirements in the scenario
The scenario requires a service that continuously monitors the AWS environment for active threats, specifically targeting malicious IP communication and unauthorized API calls.
Identifying the target behavior (active threat detection) helps narrow down the service choices.
2
Compare the capabilities of the security services
Amazon GuardDuty provides threat detection by analyzing logs (such as VPC Flow Logs and CloudTrail logs), whereas Amazon Inspector focuses on scanning for software vulnerabilities. AWS CloudTrail and Amazon CloudWatch provide logging and monitoring but lack native intelligent threat intelligence analysis.
This distinguishes between vulnerability scanning (static assessment) and threat detection (runtime analysis).

Anahtar Kavram

Amazon GuardDuty provides intelligent, continuous threat detection and monitoring for AWS workloads, while Amazon Inspector focuses on vulnerability assessment and patch scanning.
Tahmini Süre:1m 0s
Soru 300Soru →

A company is configuring access for two new entities: a monitoring application running on an on-premises server that requires read-only access to Amazon CloudWatch, and a new human administrator who needs full access to manage Amazon EC2 resources. Which IAM identities should the company create to provide secure access for these entities? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An IAM role to provide temporary credentials for the monitoring application; An IAM user to provide access credentials for the human administrator

Cevap

The correct answers are the option to use an IAM role to provide temporary credentials for the monitoring application, and the option to use an IAM user to provide credentials for the human administrator.
The correct options are using an IAM role for the monitoring application and an IAM user for the human administrator. For applications, especially those on-premises, using IAM roles (via AWS IAM Roles Anywhere or federation) allows them to assume temporary credentials, which is a security best practice over using permanent credentials. For human administrators performing daily console tasks, creating dedicated IAM users provides isolated, long-term login credentials with specific policies, adhering to the principle of least privilege.

Adım Adım Çözüm

1
Analyze the requirement for the monitoring application.
The application requires read-only access to Amazon CloudWatch. AWS recommends using IAM roles to provide temporary credentials for applications.
Temporary credentials minimize the security risk of credential leakage compared to long-term access keys.
2
Analyze the requirement for the human administrator.
The human administrator needs full access to Amazon EC2 for daily tasks. AWS recommends creating an IAM user with appropriate permissions for daily activities.
Using the root user for daily tasks violates the principle of least privilege and administrative security best practices.
3
Confirm the selected options.
The correct identities are an IAM role for the application and an IAM user for the human administrator.
These choices align with the AWS recommended practices for managing credentials and user access.

Anahtar Kavram

AWS Identity and Access Management (IAM) entities (Users and Roles) and security best practices.
ÖncekiSayfa 15 / 23Sonraki
Security and Compliance Alıştırma Soruları — AWS Certified Cloud Practitioner — Sayfa 15 | Examkin