Question 1

A security engineer wants to use Amazon Simple Notification Service (Amazon SNS) to send email alerts to a company's security team for Amazon GuardDuty findings that have a High severity level. The security engineer also wants to deliver these findings to a visualization tool for further examination. Which solution will meet these requirements?

Accepted Answer

Correct answer: C

Question 2

A Security Engineer is asked to update an AWS CloudTrail log file prefix for an existing trail. When attempting to save the change in the CloudTrail con Security Engineer receives the following error message: `There is a problem with the bucket policy.` What will enable the Security Engineer to save the

Accepted Answer

The correct answer is C. Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in CloudTrail console.

According to the AWS documentation1, a bucket policy is a resource-based policy that you can use to grant access permissions to your Amazon S3 bucket an the objects in it. Only the bucket owner can associate a policy with a bucket. The permissions attached to the bucket apply to all of the objects in the are owned by the bucket owner.

When you create a trail in CloudTrail, you can specify an existing S3 bucket or create a new one to store your log files. CloudTrail automatically creat policy for your S3 bucket that grants CloudTrail write-only access to deliver log files to your bucket. The bucket policy also grants read-only access t services that you can use to view and analyze your log data, such as Amazon Athena, Amazon CloudWatch Logs, and Amazon QuickSight.

If you want to update the log file prefix for an existing trail, you must also update the existing bucket policy in the S3 console with the new log file prefix is part of the resource ARN that identifies the objects in your bucket that CloudTrail can access. If you don't update the bucket policy with the prefix, CloudTrail will not be able to deliver log files to your bucket, and you will receive an error message when you try to save the change in the Cl console.

The other options are incorrect because:

- A. Creating a new trail with the updated log file prefix, and then deleting the original trail is not necessary and may cause data loss or inconsist simply update the existing trail and its associated bucket policy with the new log file prefix.
- B. Updating the existing bucket policy in the S3 console to allow the Security Engineer's Principal to perform PutBucketPolicy is not relevant to th PutBucketPolicy action allows you to create or replace a policy on a bucket, but it does not affect CloudTrail's ability to deliver log files to your bu need to update the existing bucket policy with the new log file prefix.
- D. Updating the existing bucket policy in the S3 console to allow the Security Engineer's Principal to perform GetBucketPolicy is not relevant to th GetBucketPolicy action allows you to retrieve a policy on a bucket, but it does not affect CloudTrail's ability to deliver log files to your bucket. You update the existing bucket policy with the new log file prefix. References:
4. 1: Using bucket policies - Amazon Simple Storage Service

Question 3

A security engineer is creating an AWS Lambda function. The Lambda function needs to use a role that is named LambdaAuditRole to assume a role that is named AcmeAuditFactoryRole in a different AWS account.

When the code is processed, the following error message appears: "An error oc-curred (AccessDenied) when calling the AssumeRole operation." Which combination of steps should the security engineer take to resolve this er-ror? (Select TWO.)

Accepted Answer

Correct answer: AC

Question 4

A company wants to monitor the deletion of customer managed CMKs A security engineer must create an alarm that will notify the company before a CMK is deleted The security engineer has configured the integration of IAM CloudTrail with Amazon CloudWatch

What should the security engineer do next to meet this requirement?

Accepted Answer

Correct answer: A

Question 5

A recent security audit found that IAM CloudTrail logs are insufficiently protected from tampering and unauthorized access Which actions must the Securi Engineer take to address these audit findings? (Select THREE )

Accepted Answer

Correct answer: ADE

Question 6

A company's engineering team is developing a new application that creates IAM Key Management Service (IAM KMS) CMK grants for users immediately after a grant IS created users must be able to use the CMK tu encrypt a 512-byte payload. During load testing, a bug appears |intermittently where AccessDeniedExceptions are occasionally triggered when a user rst attempts to encrypt using the CMK Which solution should the c0mpany's security specialist recommend'?

Accepted Answer

To avoid AccessDeniedExceptions when users first attempt to encrypt using the CMK, the security specialist should recommend the following solution:

Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. This allows the engineering team to use the gra as a form of temporary authorization for the grant.

- Instruct users to use that grant token in their call to encrypt. This allows the users to use the grant token as a proof that they have permission t and to avoid any eventual consistency issues with the grant creation.

Question 7

A company wants to establish separate IAM Key Management Service (IAM KMS) keys to use for different IAM services. The company's security engineer creat the following key policy lo allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructureDeployment IAM role:

100% Valid and Newest Version AWS-Certified-Security-Specialty Questions & Answers shared by Certleader https://www.certleader.com/AWS-Certified-Security-Specialty-dumps.html (589 Q&As)

```
"Version":"201z-10-17" "Td":"key-policy-ebs" "statement":1 "sld":"EnabletAMUserPernlssioris" "Ettcct":"Ailow" "principal":{ "action":"kms:*" "sourco":" "gfd:Allowuneofthekey "Effect":"Allow" "principal":f "Aws": "a1n:aws:lam::123456769012:role/aws=reserved/ss0anazonaws:com/InfzastruceureDeploymenit "Actlon": "kms:Encrypt" "kms:Decrypt", "kns:ReEncrypL*", "kms:GenerateDataKey*" "kms:Iescribekey", "kmo:sreatetsrant" "kms:Listcraats", "kms:kevoketstatit" "condition": "StrirqEquals":1 "kms:ViaService":"ec2.us=xest-2amazonawscom"
```

The security engineer recently discovered that IAM roles other than the InfrastructureDeployment role used this key (or other services. Which change to should the security engineer make to resolve these issues?

Accepted Answer

To resolve the issues, the security engineer should make the following change to the policy:

- In the statement block that contains the Sid 'Allow use of the key', under the 'Condition' block, change the Kms:ViaService value to ec2.useast-1.amazonaws.com. This allows the security engineer to restrict the use of the key to only EC2 service in the us-east-1 region, and prevent other se

using the key.

Question 8

A company has a batch-processing system that uses Amazon S3, Amazon EC2, and AWS Key Management Service (AWS KMS). The system uses two AWS accounts: Account A and Account B.

Account A hosts an S3 bucket that stores the objects that will be processed. The S3 bucket also stores the results of the processing. All the S3 bucket encrypted by a KMS key that is managed in

Account A.

Account B hosts a VPC that has a fleet of EC2 instances that access the S3 buck-et in Account A by using statements in the bucket policy. The VPC was cr with DNS hostnames enabled and DNS resolution enabled.

A security engineer needs to update the design of the system without changing any of the system's code. No AWS API calls from the batch-processing EC2 i stances can travel over the internet.

Which combination of steps will meet these requirements? (Select TWO.)

A. In the Account B VPC, create a gateway VPC endpoint for Amazon S3. For the gateway VPC endpoint,create a resource policy that allows the s3:GetObject s3:ListBucket, s3:PutObject, and s3:PutObjectAcl actions for the S3 bucket.

Accepted Answer

Correct answer: BC

Question 9

A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS account.

Which solutions will provide the Lambda function this access? (Select TWO.)

Accepted Answer

Correct answer: CD

Question 10

A developer has created an AWS Lambda function in a company's development account. The Lambda function requires the use of an AWS Key Management Service (AWS KMS) customer managed key that exists in a security account that the company's security team controls. The developer obtains the ARN of the KMS key from a previous Lambda function in the development account. The previous Lambda function had been working properly with the KMS key. When the developer uses the ARN and tests the new Lambda function an error message states that access is denied to the KMS key in the security account. developer tests the previous Lambda function that uses the same KMS key and discovers that the previous Lambda function still can encrypt data as expect A security engineer must resolve the problem so that the new Lambda function in the development account can use the KMS key from the security account. Which combination of steps should the security engineer take to meet these requirements? (Select TWO.)

Accepted Answer

To allow cross-account access to a KMS key, the key policy of the KMS key must grant permission to the external account or principal, and the IAM policy external account or principal must delegate the key policy permission. In this case, the new Lambda function in the development account needs to use the key in the security account, so the key policy of the KMS key must allow access to the IAM role of the new Lambda function in the development account (o and the IAM role of the new Lambda function in the development account must have an IAM policy that allows access to the KMS key in the security account (option C). Option A is incorrect because it creates an IAM role for the new Lambda function in the security account, not in the development account. Op incorrect because it attaches a key policy to an IAM role, which is not valid. Option D is incorrect because it allows access to the IAM role of the new function in the security account, not in the development account. Verified References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html