AWS-Certified-Security-Specialty Free Practice Test

- (Exam Topic 2)
An application running on EC2 instances must use a username and password to access a database. The developer has stored those secrets in the SSM Parameter Store with type SecureString using the default KMS CMK. Which combination of configuration steps will allow the application to access the secrets via the API? Select 2 answers from the options below
Please select:

1. A. Add the EC2 instance role as a trusted service to the SSM service role.
2. B. Add permission to use the KMS key to decrypt to the SSM service role.
3. C. Add permission to read the SSM parameter to the EC2 instance rol
4. D. .
5. E. Add permission to use the KMS key to decrypt to the EC2 instance role
6. F. Add the SSM service role as a trusted service to the EC2 instance role.

Correct Answer: CD
The below example policy from the AWS Documentation is required to be given to the EC2 Instance in order to read a secure string from AWS KMS. Permissions need to be given to the Get Parameter API and the KMS API call to decrypt the secret.
C:\Users\wk\Desktop\mudassar\Untitled.jpg

Option A is invalid because roles can be attached to EC2 and not EC2 roles to SSM Option B is invalid because the KMS key does not need to decrypt the SSM service role.
Option E is invalid because this configuration is valid For more information on the parameter store, please visit the below URL:
https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.htmll
The correct answers are: Add permission to read the SSM parameter to the EC2 instance role., Add permission to use the KMS key to decrypt to the EC2 instance role
Submit your Feedback/Queries to our Experts

- (Exam Topic 2)
An application makes calls to AWS services using the AWS SDK. The application runs on Amazon EC2 instances with an associated IAM role. When the application attempts to access an object within an Amazon S3 bucket; the Administrator receives the following error message: HTTP 403: Access Denied.
Which combination of steps should the Administrator take to troubleshoot this issue? (Select three.)

1. A. Confirm that the EC2 instance's security group authorizes S3 access.
2. B. Verify that the KMS key policy allows decrypt access for the KMS key for this IAM principle.
3. C. Check the S3 bucket policy for statements that deny access to objects.
4. D. Confirm that the EC2 instance is using the correct key pair.
5. E. Confirm that the IAM role associated with the EC2 instance has the proper privileges.
6. F. Confirm that the instance and the S3 bucket are in the same Region.

Correct Answer: BCE

- (Exam Topic 2)
An organization operates a web application that serves users globally. The application runs on Amazon EC2 instances behind an Application Load Balancer. There is an Amazon CloudFront distribution in front of the load balancer, and the organization uses AWS WAF. The application is currently experiencing a volumetric attack whereby the attacker is exploiting a bug in a popular mobile game.
The application is being flooded with HTTP requests from all over the world with the User-Agent set to the following string: Mozilla/5.0 (compatible; ExampleCorp; ExampleGame/1.22; Mobile/1.0)
What mitigation can be applied to block attacks resulting from this bug while continuing to service legitimate requests?

1. A. Create a rule in AWS WAF rules with conditions that block requests based on the presence of ExampleGame/1.22 in the User-Agent header
2. B. Create a geographic restriction on the CloudFront distribution to prevent access to the application from most geographic regions
3. C. Create a rate-based rule in AWS WAF to limit the total number of requests that the web application services.
4. D. Create an IP-based blacklist in AWS WAF to block the IP addresses that are originating from requests that contain ExampleGame/1.22 in the User-Agent header.

Correct Answer: A
Since all the attack has http header- User-Agent set to string: Mozilla/5.0 (compatible; ExampleCorp;) it would be much more easier to block these attack by simply denying traffic with the header match . HTH ExampleGame/1.22; Mobile/1.0)

- (Exam Topic 3)
An application is designed to run on an EC2 Instance. The applications needs to work with an S3 bucket. From a security perspective , what is the ideal way for the EC2 instance/ application to be configured?
Please select:

1. A. Use the AWS access keys ensuring that they are frequently rotated.
2. B. Assign an IAM user to the application that has specific access to only that S3 bucket
3. C. Assign an IAM Role and assign it to the EC2 Instance
4. D. Assign an IAM group and assign it to the EC2 Instance

Correct Answer: C
The below diagram from the AWS whitepaper shows the best security practicse of allocating a role that has access to the S3 bucket
C:\Users\wk\Desktop\mudassar\Untitled.jpg

Options A,B and D are invalid because using users, groups or access keys is an invalid security practise when giving access to resources from other AWS resources.
For more information on the Security Best practices, please visit the following URL: https://d1.awsstatic.com/whitepapers/Security/AWS Security Best Practices.pdl
The correct answer is: Assign an IAM Role and assign it to the EC2 Instance Submit your Feedback/Queries to our Experts

- (Exam Topic 3)
A company's Chief Security Officer has requested that a Security Analyst review and improve the security posture of each company AWS account The Security Analyst decides to do this by Improving AWS account root user security.
Which actions should the Security Analyst take to meet these requirements? (Select THREE.)

1. A. Delete the access keys for the account root user in every account.
2. B. Create an admin IAM user with administrative privileges and delete the account root user in every account.
3. C. Implement a strong password to help protect account-level access to the AWS Management Console by the account root user.
4. D. Enable multi-factor authentication (MFA) on every account root user in all accounts.
5. E. Create a custom IAM policy to limit permissions to required actions for the account root user and attach the policy to the account root user.
6. F. Attach an IAM role to the account root user to make use of the automated credential rotation in AWS STS.

Correct Answer: ADE