Question 1

A company needs to build a code-signing solution using an AWS KMS asymmetric key andmust store immutable evidence of key creation and usage for compliance and auditpurposes.Which solution meets these requirements?

A. Create an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrailtrail with log file validation enabled for KMS events. Store logs in the bucket and grantauditors access.

B. Log application events to Amazon CloudWatch Logs and export them.

C. Capture KMS API calls using EventBridge and store them in DynamoDB.

D. Track KMS usage with CloudWatch metrics and dashboards.

Answer: A

Question 2

A consultant agency needs to perform a security audit for a company's production AWSaccount. Several consultants need access to the account. The consultant agency alreadyhas its own AWS account. The company requires multi-factor authentication (MFA) for allaccess to its production account. The company also forbids the use of long-termcredentials.Which solution will provide the consultant agency with access that meets theserequirements?

A. Create an IAM group. Create an IAM user for each consultant. Add each user to thegroup. Turn on MFA for each consultant.

B. Configure Amazon Cognito on the company’s production account to authenticateagainst the consultant agency's identity provider (IdP). Add MFA to a Cognito user pool

C. Create an IAM role in the consultant agency's AWS account. Define a trust policy thatrequires MFA. In the trust policy, specify the company's production account as theprincipal. Attach the trust policy to the role

D. Create an IAM role in the company’s production account. Define a trust policy thatrequires MFA. In the trust policy, specify the consultant agency's AWS account as theprincipal. Attach the trust policy to the role.

Answer: D

Question 3

A company uses an organization in AWS Organizations to manage multiple AWS accounts.The company uses AWS IAM Identity Center to manage access to the accounts. Thecompany uses AWS Directory Service as an identity source. Employees access the AWSconsole and specific AWS accounts and permissions through the AWS access portal.A security engineer creates a new permissions set in IAM Identity Center and assigns thepermissions set to one of the member accounts in the organization. The security engineerassigns the permissions set to a user group for developers namedDevOpsin the memberaccount. The security engineer expects all the developers to see the new permissions setlisted for the member account in the AWS access portal. All the developers except for onecan see the permissions set. The security engineer must ensure that the remainingdeveloper can see the permissions set in the AWS access portal.Which solution will meet this requirement?

A. Add the remaining developer to the DevOps group in Directory Service.

B. Remove and then re-add the permissions set in the member account.

C. Add the service-linked role for organization to the member account.

D. Update the permissions set to allow console access for the remaining developer.

Answer: A

Question 4

A company has an AWS Lambda function that requires access to an Amazon S3 bucket.The company’s security policy requires that connections to Amazon S3 are over a privatenetwork and are secure.The company has configured a gateway VPC endpoint in the VPC to allow access toAmazon S3. The company has configured the Lambda function to run inside the VPC.Additionally, the company has configured the Lambda function to use a private subnet thathas a route to the internet through a NAT gateway. Other resources in the VPC use thisprivate subnet to access the internet successfully. When the Lambda function runs, it usesthe NAT gateway instead of the gateway VPC endpoint to access Amazon S3.What can a security engineer do to ensure that the Lambda function uses the gatewayVPC endpoint for Amazon S3?

A. Remove the route to the NAT gateway within the route table of the private subnet thatthe Lambda function uses.

B. Associate the gateway VPC endpoint with the route table of the private subnet that theLambda function uses.

C. Adjust the gateway VPC endpoint policy to allow access from the Lambda function’snetwork interface address.

D. Configure the Lambda function’s security group to allow connections to the S3 networkaddress space.

Answer: B

Question 5

A security engineer received an Amazon GuardDuty alert indicating a finding involving theAmazon EC2 instance that hosts the company's primary website. The GuardDuty findingreceived read:UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The securityengineer confirmed that a malicious actor used API access keys intended for the EC2instance from a country where the company does not operate. The security engineer needsto deny access to the malicious actor.What is the first step the security engineer should take?

A. Open the EC2 console and remove any security groups that allow inbound traffic from0.0.0.0/0.

B. Install the AWS Systems Manager Agent on the EC2 instance and run an inventoryreport.

C. Install the Amazon Inspector agent on the host and run an assessment with the CVErules package

D. Open the IAM console and revoke all IAM sessions that are associated with the instanceprofile.

Answer: D