Question 1

Company A has an AWS account that is named Account A. Company A recently acquired Company B, which has an AWS account that is named Account B. Company B stores its files in an Amazon S3 bucket.

The administrators need to give a user from Account A full access to the S3 bucket in Account B.

After the administrators adjust the IAM permissions for the user in AccountA to access the S3 bucket in Account B, the user still cannot access any file bucket.

Which solution will resolve this issue?

Accepted Answer

A bucket policy is a resource-based policy that defines permissions for a specific S3 bucket. It can be used to grant cross-account access to another AW or an IAM user or role in another account. A bucket policy can also specify which actions, resources, and conditions are allowed or denied.

A bucket ACL is an access control list that grants basic read or write permissions to predefined groups of users. It cannot be used to grant cross-accou a specific IAM user or role in another account.

An object ACL is an access control list that grants basic read or write permissions to predefined groups of users for a specific object in an S3 bucket. used to grant cross-account access to a specific IAM user or role in another account.

A user policy is an IAM policy that defines permissions for an IAM user or role in the same account. It cannot be used to grant cross-account access to AWS account or an IAM user or role in another account.

For more information, see Provide cross-account access to objects in Amazon S3 buckets and Example 2: Bucket owner granting cross-account bucket permissions.

Question 2

A company has retail stores The company is designing a solution to store scanned copies of customer receipts on Amazon S3 Files will be between 100 KB a MB in Prep Exam Each retail store must have a unique encryption key Each object must be encrypted with a unique key

Which solution will meet these requirements?

Accepted Answer

To meet the requirements of storing scanned copies of customer receipts on Amazon S3, where files will be between 100 KB and 5 MB in Prep Exam, each re store must have a unique encryption key, and each object must be encrypted with a unique key, the most appropriate solution would be to create a dedicat Key Management Service (AWS KMS) customer managed key for each retail store. Then, use the S3 Put operation to upload the objects to Amazon S3, specifying server-side encryption with AWS KMS keys (SSE-KMS) and the key ID of the store's key.

References: : Amazon S3 - Amazon Web Services : AWS Key Management Service - Amazon Web

Services : Amazon S3 - Amazon Web Services : AWS Key Management Service - Amazon Web Service

Question 3

A company deploys a set of standard IAM roles in AWS accounts. The IAM roles are based on job functions within the company. To balance operational effic and security, a security engineer implemented AWS Organizations SCPs to restrict access to critical security services in all company accounts.

All of the company's accounts and OUs within AWS Organizations have a default FullAWSAccess SCP that is attached. The security engineer needs to ensure that no one can disable Amazon GuardDuty and AWS Security Hub. The security engineer also must not override other permissions that are granted by IAM policies that are defined in the accounts.

Which SCP should the security engineer attach to the root of the organization to meet these requirements? A)

```
B) "Version": "2012-10-17", "statement"": [ 1 "Effect": "Deny", "Action":[ "guardduty:DeleteDetector" "securityhub:DisableSecurityHub" 1 "Resource":[ 1 1 1
```

```
C) D) "version": "2012-10-17", "Statement"": [ 1 "Effect": "Deny", "Action":"*", "Resource": "Effect":"Allow" "NotAction":[ "guardduty:DeleteDetector" "guardduty:UpdateDetector", "securityhub:DisableSecurityHub" "Resource": [ 1 "Version": "2012-10-17", "Statement"": [ "Effect": "Allow", "Action":"*" "Resource": 1 "Effect": "Deny", "NotAction": [ "guardduty:DeleteDetector", "guardduty:UpdateDetector", "securityhub:DisableSecurityHub" 1r "Resource":[ { "Version": "2012-10-17", "statement"": [ 1 "Effect": "Allow", "NotAction":[ "guardduty:DeleteDetector", "guardduty:UpdateDetector", "securityhub:DisableSecurityHub" "Resource":[
```

Accepted Answer

Correct answer: A

Question 4

A company has a set of EC2 Instances hosted in IAM. The EC2 Instances have EBS volumes which is used to store critical information. There is a business continuity requirement to ensure high availability for the EBS volumes. How can you achieve this?

Accepted Answer

Data stored in Amazon EBS volumes is redundantly stored in multiple physical locations as part of normal operation of those services and at no additiona However, Amazon EBS replication is stored within the same availability zone, not across multiple zones; therefore, it is highly recommended that you con regular snapshots to Amazon S3 for long-term data durability Option A is invalid because there is no lifecycle policy for EBS volumes Option C is invali there is no EBS volume replication Option D is invalid because EBS volume encryption will not ensure business continuity For information on security for Resources, please visit the below URL: https://d1.awsstatic.com/whitepapers/Security/Security\_Compute\_Services\_Whitepaper.pdf

Question 5

A company wants to migrate its static primary domain website to AWS. The company hosts the website and DNS servers internally. The company wants the website to enforce SSL/TLS encryption block IP addresses from outside the United States (US), and take advantage of managed services whenever possible. Which solution will meet these requirements?

Accepted Answer

To migrate the static website to AWS and meet the requirements, the following steps are required:

- Migrate the website to Amazon S3, which is a highly scalable and durable object storage service that can host static websites. To do this, create an with the same name as the domain name of the website, enable static website hosting for the bucket, upload the website files to the bucket, and configur bucket policy to allow public read access to the objects. For more information, see Hosting a static website on Amazon S3.
- Import a public SSL certificate that is created by AWS Certificate Manager (ACM) to Amazon CloudFront, which is a global content delivery network (C service that can improve the performance and security of web applications. To do this, request or import a public SSL certificate for the domain name of website using ACM, create a CloudFront distribution with the S3 bucket as the origin, and associate the SSL certificate with the distribution. For more see Using alternate domain names and HTTPS.
- Configure CloudFront to block traffic from outside the US, which is one of the requirements. To do this, create a CloudFront web ACL using AWS WAF, is a web application firewall service that lets you control access to your web applications. In the web ACL, create a rule that uses a geo match conditi requests that originate from countries other than the US. Associate the web ACL with the CloudFront distribution. For more information, see How AWS WAF with Amazon CloudFront features.
- Migrate DNS to Amazon Route 53, which is a highly available and scalable cloud DNS service that can route traffic to various AWS services. To do thi register or transfer your domain name to Route 53, create a hosted zone for your domain name, and create an alias record that points your domain name to CloudFront distribution. For more information, see Routing traffic to an Amazon CloudFront web distribution by using your domain name. The other options are incorrect because they either do not implement SSL/TLS encryption for the website (A), do not use managed services whenever possib

(B), or do not block IP addresses from outside the US ©.Verified References:

- https://docs.aws.amazon.com/AmazonS3/latest/userguide/HostingWebsiteOnS3Setup.html
- https://docs.aws.amazon.com/waf/latest/developerguide/waf-cloudfront.html
- https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html

Question 6

A company is using AWS Organizations to create OUs for its accounts. The company has more than 20 accounts that are all part of the OUs. A security engi must implement a solution to ensure that no account can stop to file delivery to AWS CloudTrail. Which solution will meet this requirement?

Accepted Answer

This SCP prevents users or roles in any affected account from disabling a CloudTrail log, either directly as a command or through the console. https://asecure.cloud/a/scp\_cloudtrail/

Question 7

A company has a large fleet of Linux Amazon EC2 instances and Windows EC2 instances that run in private subnets. The company wants all remote administration to be performed as securely as possible in the AWS Cloud.

Which solution will meet these requirements?

Accepted Answer

AWS Systems Manager Session Manager is a fully managed service that allows you to securely and remotely administer your EC2 instances without the need t open inbound ports, maintain bastion hosts, or manage SSH keys. Session Manager provides an interactive browser-based shell or CLI access to your instan as well as port forwarding and auditing capabilities. Session Manager works with both Linux and Windows instances, and supports hybrid environments and devices.

EC2 Instance Connect is a feature that allows you to use SSH to connect to your Linux instances using short-lived keys that are generated on demand and delivered securely through the AWS metadata service. EC2 Instance Connect does not require any additio software installation or configuration on the instance, but it does require you to use SSH-RSA keys during the launch of new instances.

The correct answer is to use Session Manager, as it provides more security and flexibility than EC2 Instance Connect, and does not require SSH-RSA keys inbound ports. Session Manager also works with Windows instances, while EC2 Instance Connect does not.

Verified References:

- https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Connect-using-EC2-Instance-Connect.html
- https://repost.aws/questions/QUnV4R9EoeSdW0GT3cKBUR7w/what-is-the-difference-between-ec-2-ins

Question 8

A company's engineering team is developing a new application that creates IAM Key Management Service (IAM KMS) CMK grants for users immediately after a grant IS created users must be able to use the CMK tu encrypt a 512-byte payload. During load testing, a bug appears |intermittently where

AccessDeniedExceptions are occasionally triggered when a user rst attempts to encrypt using the CMK

Which solution should the c0mpany's security specialist recommend'?

Accepted Answer

To avoid AccessDeniedExceptions when users first attempt to encrypt using the CMK, the security specialist should recommend the following solution:

- Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. This allows the engineering team to use the gra as a form of temporary authorization for the grant.
- Instruct users to use that grant token in their call to encrypt. This allows the users to use the grant token as a proof that they have permission t and to avoid any eventual consistency issues with the grant creation.

Question 9

A company wants to establish separate IAM Key Management Service (IAM KMS) keys to use for different IAM services. The company's security engineer creat the following key policy lo allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructureDeployment IAM role:

```
"Version":"201z-10-17" "Td":"key-policy-ebs" "statement": "sld":"EnabletAM UaerPernlssionis" "Ettcct":"Ailow" "principal":{ "Aws":"arn:aws:iam::123456789012:r0ot" "action":"kms:*" "sourco":" "gfd:Allowuneofthekey "Etfect"."Allow" "principal":{ "Aws": "a1n:aws:lam::123456769012:role/aws=reserved/ss0anazonawscom/InfzastruceureDeplcymenit" "Actlon": "kms:Encrypt" "kms:Decrypt", "kns:ReEncrypL*", "kms:GenerateDataKey*" "kms:IeseribeKey", "kmo:sreatetsrant" "kms:Listcraats", "kms:kevoketstatit" "toadition": "StrirqEquals":1 "kms:ViaService:"ec2.us=west-2amazonawscom"
```

The security engineer recently discovered that IAM roles other than the InfrastructureDeployment role used this key (or other services. Which change to should the security engineer make to resolve these issues?

Accepted Answer

To resolve the issues, the security engineer should make the following change to the policy:

- In the statement block that contains the Sid 'Allow use of the key', under the 'Condition' block, change the Kms:ViaService value to ec2.useast-1.amazonaws.com. This allows the security engineer to restrict the use of the key to only EC2 service in the us-east-1 region, and prevent other se using the key.

Question 10

A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that stor Each store's application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS accoun

The company uses AWS Organizations and has an OU that is used only for these accounts.

The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company's deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access. The secur engineer already has created an AWS CloudFormation template that implements the deployment plan.

What should the security engineer do next to meet the requirements in the MOST secure way?

Accepted Answer

The correct answer is A. Create an AWS Service Catalog portfolio in the organization's management account. Upload the CloudFormation template. Add the template to the portfolio's product list. Share the portfolio with the OU.

According to the AWS documentation, AWS Service Catalog is a service that allows you to create and manage catalogs of IT services that are approved for AWS. You can use Service Catalog to centrally manage commonly deployed IT services and help achieve consistent governance and compliance requirements, while enabling users to quickly deploy only the approved IT services they need.

To use Service Catalog with multiple AWS accounts, you need to enable AWS Organizations with all features enabled. This allows you to centrally manage y accounts and apply policies across your organization. You can also use Service Catalog as a service principal for AWS Organizations, which lets you shar portfolios with organizational units (OUs) or accounts in your organization.

To create a Service Catalog portfolio, you need to use an administrator account, such as the organization's management account. You can upload your CloudFormation template as a product in your portfolio, and define constraints and tags for it. You can then share your portfolio with the OU that conta accounts for the web applications. This will allow the developers in those accounts to launch products from the shared portfolio using the Service Catal console.

Option B is incorrect because CloudFormation modules are reusable components that encapsulate one or more resources and their configurations. They are n meant to be used as templates for deploying entire stacks of resources. Moreover, sharing a module with an OU does not grant access to launch stacks fro Option C is incorrect because creating an IAM role that has a trust policy that allows cross-account access to the portfolio is not secure. It would all the OU accounts to assume the role and access the portfolio, regardless of their job function or access requirements.

Option D is incorrect because sharing a module with an OU does not grant access to launch stacks from it. It also does not limit access to the deploymen only the developers who need access.