AWS Certified Security - Specialty Free Sample Questions

Use the containers to automate security deployment

Limit resource consumption (CPU, memory), networking connections, ports, and unnecessary container libraries

Segregate container by host, function, and data classification.

Use Docker Notary framework to sign task definitions.

Enable container breakout at the host kerne

Using Amazon Inspector, review all of the API calls and configure the inspector agent to leverage SNS topics to notify security of the change to AWS CloudTrail, and revoke the new API keys for the root user.

Using AWS Config, create a config rule that detects when AWS CloudTrail is disabled, as well as any calls to the root user create-api-key. Then use a Lambda function to re-enable CloudTrail logs and deactivate the root API keys.

Using Amazon CloudWatch, create a CloudWatch event that detects AWS CloudTrail deactivation and a separate Amazon Trusted Advisor check to automatically detect the creation of root API keys. Then use a Lambda function to enable AWS CloudTrail and deactivate the root API keys.

Using Amazon CloudTrail, create a new CloudTrail event that detects the deactivation of CloudTrail logs, and a separate CloudTrail event that detects the creation of root API keys. Then use a Lambda function to enable CloudTrail and deactivate the root API keys.

Associate an origin access identity with the CloudFront distribution

Implement a “Principal”: “cloudfront.amazonaws.com” condition in the S3 bucket policy.

Modify the S3 bucket permissions so that only the origin access identity can access the bucket contents.

Implement security groups so that the S3 bucket can be accessed only by using the intended CloudFront distribution.

Configure the S3 bucket policy so that it is accessible only through VPC endpoints, and place the CloudFront distribution into the specified VPC

Amazon Elasticsear

Amazon Kines

Amazon SQS

Amazon Cloud Watch

Amazon Athena

Use AWS KMS with AWS managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.

Use KMS with AWS imported key material and then use the DeletelmportedKeyMaterial API to remove the key material if necessary.

Use AWS CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.

Use the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the key if necessary.

Create a new CMK. Download a new wrapping key and a new import token to import the original key material.

Create a new CMK. Use the original wrapping key and import token to import the original key material.

Download a new wrapping key and a new import token. Import the original key material into the existing CMK.

Use the original wrapping key and import token. Import the original key material into the existing CMK.

Delete the internet gateway associated with the VPC.

Use network access control lists to block source IP addresses matching 0.0.0.0/0.

Use a host-based firewall to prevent access from all but the organization’s firewall IP.

Use AWS Config rules to detect 0.0.0.0/0 and invoke an AWS Lambda function to update the security group with the organization's firewall IP.

On a recurring basis, update all 1AM user policies to require that EC2 instances are created with an encrypted volume.

Configure an AWS Config rule to run on a recurring basis for volume encryption.

set up Amazon Inspector rules for volume encryption to run on a recurring schedule.

Use CloudWatch Logs to determine whether instances were created with an encrypted volume.

A Create 1AM roles with permissions corresponding to each Active Directory group.

Create 1AM groups with permissions corresponding to each Active Directory group

Create a SAML provider with 1A

Create a SAML provider with Amazon Cloud Directory

Configure AWS as a trusted relying party for the Active Directory

Configure 1AM as a trusted relying party for Amazon Cloud Directory.

An HTTPS listener that uses a certificate that is managed by Amazon Certification Manager.

An HTTPS listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.

An HTTPS listener that uses the latest AWS predefined ELBSecurityPolicy-TLS-1-2-2017-01 security policy.

A TCP listener that uses a custom security policy that allows only perfect forward secrecy cipher suites.