image


AWS-CSS Dumps AWS-CSS Braindumps

AWS-CSS Real Questions AWS-CSS Practice Test AWS-CSS Actual Questions


Amazon


AWS-CSS


AWS Certified Security - Specialty ( (SCS-C01)


https://killexams.com/pass4sure/exam-detail/AWS-CSS


QUESTION 58

A company has deployed a custom DNS server in AWS. The Security Engineer wants to ensure that Amazon EC2 instances cannot use the Amazon-provided DNS. How can the Security Engineer block access to the Amazon-provided DNS in the VPC?

  1. Deny access to the Amazon DNS IP within all security groups.

  2. Add a rule to all network access control lists that deny access to the Amazon DNS IP.

  3. Add a route to all route tables that black holes traffic to the Amazon DNS IP.

  4. Disable DNS resolution within the VPC configuration.


Answer: D


image

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html


QUESTION 59

An employee accidentally exposed an AWS access key and secret access key during a public presentation. The company Security Engineer immediately disabled the key. How can the Engineer assess the impact of the key exposure and ensure that the credentials were not misused? (Choose two.)

  1. Analyze AWS CloudTrail for activity.

  2. Analyze Amazon CloudWatch Logs for activity.

  3. Download and analyze the IAM Use report from AWS Trusted Advisor.

  4. Analyze the resource inventory in AWS Config for IAM user activity.

  5. Download and analyze a credential report from IAM.


Answer: AE


QUESTION 60 Which of the following minimizes the potential attack surface for applications?


  1. Use security groups to provide stateful firewalls for Amazon EC2 instances at the hypervisor level.

  2. Use network ACLs to provide stateful firewalls at the VPC level to prevent access to any specific AWS resource.

  3. Use AWS Direct Connect for secure trusted connections between EC2 instances within private subnets.

  4. Design network security in a single layer within the perimeter network (also known as DMZ, demilitarized zone, and screened subnet) to facilitate quicker responses to threats.


Answer: B


QUESTION 61

A distributed web application is installed across several EC2 instances in public subnets residing in two Availability Zones. Apache logs show several intermittent brute-force attacks from hundreds of IP addresses at the layer 7 level over the past six months.


What would be the BEST way to reduce the potential impact of these attacks in the future?


  1. Use custom route tables to prevent malicious traffic from routing to the instances.

  2. Update security groups to deny traffic from the originating source IP addresses.

  3. Use network ACLs.

  4. Install intrusion prevention software (IPS) on each instance.


Answer: C


QUESTION 62

A company plans to move most of its IT infrastructure to AWS. They want to leverage their existing on-premises Active Directory as an identity provider for AWS. Which combination of steps should a Security Engineer take to federate the company’s on-premises Active Directory with AWS? (Choose two.)

  1. Create IAM roles with permissions corresponding to each Active Directory group.

  2. Create IAM groups with permissions corresponding to each Active Directory group.

  3. Configure Amazon Cloud Directory to support a SAML provider.

  4. Configure Active Directory to add relying party trust between Active Directory and AWS.

  5. Configure Amazon Cognito to add relying party trust between Active Directory and AWS.


Answer: AC


QUESTION 63

A security alert has been raised for an Amazon EC2 instance in a customer account that is exhibiting strange behavior. The Security Engineer must first isolate the EC2 instance and then use tools for further investigation. What should the Security Engineer use to isolate and research this event? (Choose three.)

  1. AWS CloudTrail

  2. Amazon Athena

  3. AWS Key Management Service (AWS KMS)

  4. VPC Flow Logs

  5. AWS Firewall Manager

  6. Security groups


Answer: ADF


QUESTION 64

A financial institution has the following security requirements:

image

image

Cloud-based users must be contained in a separate authentication domain. Cloud- based users cannot access on-premises systems.

As part of standing up a cloud environment, the financial institution is creating a number of Amazon managed databases and Amazon EC2 instances. An Active Directory service exists on-premises that has all the administrator accounts, and these must be able to access the databases and instances.


How would the organization manage its resources in the MOST secure manner? (Choose two.)


  1. Configure an AWS Managed Microsoft AD to manage the cloud resources.

  2. Configure an additional on-premises Active Directory service to manage the cloud resources.

  3. Establish a one-way trust relationship from the existing Active Directory to the new Active Directory service.

  4. Establish a one-way trust relationship from the new Active Directory to the existing Active Directory service.

  5. Establish a two-way trust between the new and existing Active Directory services.


Answer: BC


QUESTION 65

An organization wants to be alerted when an unauthorized Amazon EC2 instance in its VPC performs a network port scan against other instances in the VPC. When the Security team performs its own internal tests in a separate account by using pre-approved third-party scanners from the AWS Marketplace, the Security team also then receives multiple Amazon GuardDuty events from Amazon CloudWatch alerting on its test activities.


How can the Security team suppress alerts about authorized security tests while still receiving alerts about the unauthorized activity?


  1. Use a filter in AWS CloudTrail to exclude the IP addresses of the Security team’s EC2 instances.

  2. Add the Elastic IP addresses of the Security team’s EC2 instances to a trusted IP list in Amazon GuardDuty.

  3. Install the Amazon Inspector agent on the EC2 instances that the Security team uses.

  4. Grant the Security team’s EC2 instances a role with permissions to call Amazon GuardDuty API operations.


Answer: C


image

6$03/( 48(67,216


7KHVH TXHVWLRQV DUH IRU GHPR SXUSRVH RQO\ )XOO YHUVLRQ LV XS WR GDWH DQG FRQWDLQV DFWXDO TXHVWLRQV DQG DQVZHUV


.LOOH[DPV FRP LV DQ RQOLQH SODWIRUP WKDW RIIHUV D ZLGH UDQJH RI VHUYLFHV UHODWHG WR FHUWLILFDWLRQ H[DP SUHSDUDWLRQ 7KH SODWIRUP SURYLGHV DFWXDO TXHVWLRQV H[DP GXPSV DQG SUDFWLFH WHVWV WR KHOS LQGLYLGXDOV SUHSDUH IRU YDULRXV FHUWLILFDWLRQ H[DPV ZLWK FRQILGHQFH +HUH DUH VRPH NH\ IHDWXUHV DQG VHUYLFHV RIIHUHG E\ .LOOH[DPV FRP


$FWXDO ([DP 4XHVWLRQV .LOOH[DPV FRP SURYLGHV DFWXDO H[DP TXHVWLRQV WKDW DUH H[SHULHQFHG LQ WHVW FHQWHUV 7KHVH TXHVWLRQV DUH XSGDWHG UHJXODUO\ WR HQVXUH WKH\ DUH XS WR GDWH DQG UHOHYDQW WR WKH ODWHVW H[DP V\OODEXV %\ VWXG\LQJ WKHVH DFWXDO TXHVWLRQV FDQGLGDWHV FDQ IDPLOLDUL]H WKHPVHOYHV ZLWK WKH FRQWHQW DQG IRUPDW RI WKH UHDO H[DP


([DP 'XPSV .LOOH[DPV FRP RIIHUV H[DP GXPSV LQ 3') IRUPDW 7KHVH GXPSV FRQWDLQ D FRPSUHKHQVLYH FROOHFWLRQ RI TXHVWLRQV DQG DQVZHUV WKDW FRYHU WKH H[DP WRSLFV %\ XVLQJ WKHVH GXPSV FDQGLGDWHV FDQ HQKDQFH WKHLU NQRZOHGJH DQG LPSURYH WKHLU FKDQFHV RI VXFFHVV LQ WKH FHUWLILFDWLRQ H[DP


3UDFWLFH 7HVWV .LOOH[DPV FRP SURYLGHV SUDFWLFH WHVWV WKURXJK WKHLU GHVNWRS 9&( H[DP VLPXODWRU DQG RQOLQH WHVW HQJLQH 7KHVH SUDFWLFH WHVWV VLPXODWH WKH UHDO H[DP HQYLURQPHQW DQG KHOS FDQGLGDWHV DVVHVV WKHLU UHDGLQHVV IRU WKH DFWXDO H[DP 7KH SUDFWLFH WHVWV FRYHU D ZLGH UDQJH RI TXHVWLRQV DQG HQDEOH FDQGLGDWHV WR LGHQWLI\ WKHLU VWUHQJWKV DQG ZHDNQHVVHV


*XDUDQWHHG 6XFFHVV .LOOH[DPV FRP RIIHUV D VXFFHVV JXDUDQWHH ZLWK WKHLU H[DP GXPSV 7KH\ FODLP WKDW E\ XVLQJ WKHLU PDWHULDOV FDQGLGDWHV ZLOO SDVV WKHLU H[DPV RQ WKH ILUVW DWWHPSW RU WKH\ ZLOO UHIXQG WKH SXUFKDVH SULFH 7KLV JXDUDQWHH SURYLGHV DVVXUDQFH DQG FRQILGHQFH WR LQGLYLGXDOV SUHSDULQJ IRU FHUWLILFDWLRQ H[DPV


8SGDWHG &RQWHQW .LOOH[DPV FRP UHJXODUO\ XSGDWHV LWV TXHVWLRQ EDQN DQG H[DP GXPSV WR HQVXUH WKDW WKH\ DUH FXUUHQW DQG UHIOHFW WKH ODWHVW FKDQJHV LQ WKH H[DP V\OODEXV 7KLV KHOSV FDQGLGDWHV VWD\ XS WR GDWH ZLWK WKH H[DP FRQWHQW DQG LQFUHDVHV WKHLU FKDQFHV RI VXFFHVV


7HFKQLFDO 6XSSRUW .LOOH[DPV FRP SURYLGHV IUHH [ WHFKQLFDO VXSSRUW WR DVVLVW FDQGLGDWHV ZLWK DQ\ TXHULHV RU LVVXHV WKH\ PD\ HQFRXQWHU ZKLOH XVLQJ WKHLU VHUYLFHV 7KHLU FHUWLILHG H[SHUWV DUH DYDLODEOH WR SURYLGH JXLGDQFH DQG KHOS FDQGLGDWHV WKURXJKRXW WKHLU H[DP SUHSDUDWLRQ MRXUQH\


'PS .PSF FYBNT WJTJU IUUQT LJMMFYBNT DPN WFOEPST FYBN MJTU

.LOO \RXU H[DP DW )LUVW $WWHPSW *XDUDQWHHG