AWS-Security-Specialty試験無料問題集「Amazon AWS Certified Security - Specialty 認定」

A. The response plan is complete in its entirety

B. It places too much emphasis on already implemented security controls.

C. The response plan does not cater to new services

D. The response plan is not implemented on a regular basis

A. Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp.

B. Allow Outbound on port 80 for Destination NAT Instance IP

C. Allow Outbound on port 3306 for Destination Web Server Security Group WebSecGrp.

D. Allow Inbound on port 3306 from source 20.0.0.0/16

A. Use IAM Command Line Interface to create an IAM Lambda function to rotate the existing CMK annually.

B. Import new key material to the existing CMK and manually rotate the CMK.

C. Enable automatic key rotation annually for the CMK.

D. Create a new CMK, import new key material to it, and point the key alias to the new CMK.

A. Search the IAM CloudTrail logs for the Terminatelnstances event and note the event time. Review the IAM Access Advisor tab for all federated roles. The last accessed time should match the time when the instance was terminated.

B. Review the IAM CloudTrail event history logs in an Amazon S3 bucket and look for the Terminatelnstances event to identify the federated user from the role session name.

C. Use Amazon Athena to run a SQL query on the IAM CloudTrail logs stored in an Amazon S3 bucket and filter on the Terminatelnstances event. Identify the corresponding role and run another query to filter the AssumeRoleWithWebldentity event for the user name.

D. Filter the IAM CloudTrail event history for the Terminatelnstances event and identify the assumed IAM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username.

A. Enable Amazon GuardDuty and IAM Security Hub in all Regions and all accounts. Designate a master security account to receive all alerts from the child accounts. Create an IAM Organizations SCP that denies access to certain API calls that are on an ignore list.

B. Enable Amazon GuardDuty and IAM Security Hub in all Regions and all accounts. Designate a master security account to receive all alerts from the child accounts. Set up specific rules within Amazon Even;Bridge to trigger an IAM Lambda function for remediation steps.

C. Ingest all IAM CloudTrail logs, VPC Flow Logs, and DNS logs into a single Amazon S3 bucket in a designated security account. Launch an Amazon EC2 instance and install the current SIEM to monitor the logs and send a notification to an Amazon SNS topic to alert the security team of remediation steps.

D. Ingest all IAM CloudTrail logs, VPC Flow Logs, and DNS logs into a single Amazon S3 bucket in a designated security account. Use the current on-premises SIEM to monitor the logs and send a notification to an Amazon SNS topic to alert the security team of remediation steps.

A. Use Cloudtrail API call

B. Create a Cloudwatch Logs Rule

C. Use a Lambda function

D. Create a Cloudwatch Events Rule s

A. Use the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the key if necessary.

B. Use KMS with IAM imported key material and then use the DeletelmportedKeyMaterial API to remove the key material if necessary.

C. Use IAM CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.

D. Use IAM KMS with IAM managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.

A. Create a network ACL that allows outbound connections to the VPC IP range on port 443 only. Associate the network ACL with the VPC's internet gateway.

B. Create a security group with a rule that denies Inbound connections from 0.0.0 0/0 on port 00. Attach this security group to the ALB to overwrite more permissive rules from the ALB's default security group.

C. Create a network ACL that denies inbound connections from 0 0.0.0/0 on port 80 Associate the network ACL with the VPC s internet gateway

D. Create a security group with a single inbound rule that allows connections from 0.0.0 0/0 on port 443. Ensure this security group is the only one associated with the ALB

A. Use IAM WAF to analyze the traffic

B. Use VPC Flow logs to diagnose the traffic

C. Use IAM Guard Duty to analyze the traffic

D. Use the IAM Trusted Advisor to see what can be done.

A. Use IAM Shield to limit the originating traffic hit rate.

B. Add a rule to the Application Load Balancer to route the traffic originating from the IP address in question and show a static webpage.

C. Implement the GeoLocation feature in Amazon Route 53.

D. Implement a rate-based rule with IAM WAF

A. Change the VPC's DHCP domain-name-server's options set to the IP addresses of proxy EC2 instances.

B. Disable source and destination checks on the proxy EC2 instances.

C. Put all the proxy EC2 instances in a cluster placement group.

D. Open all inbound ports on the proxy EC2 instance security group.

A. Change the password for the root account.

B. Delete the root access keys

C. Create an Admin IAM user with the necessary permissions

D. Delete the root access account

A. Use a Lambda@Edge function to add the Strict-Transport-Security response header.

B. Include the X-XSS-Protection header in a custom response headers policy.

C. Use the SecurityHeadersPolicy managed response headers policy.

D. Use the SimpleCORS managed response headers policy.