Security Engineering on AWS (Final test)

Can an Service Control Policy (SCP) effects to permission of an individual account in its AWS Organizations?

• Yes, it can

• No, it can't

Which AWS service can rotate, manage, and retrieve database credentials throughout their lifecycle?

• KMS

• Secrets Manager

• API Gateway

• AWS Config

What AWS services/features help you to troubleshoot network security? (Select TWO.)

• Cloudwatch

• VPC traffic mirorring

• VPC flow log

• S3 access logging

A secure web application runs in an Amazon VPC that has a public subnet and a private subnet. An Application Load Balancer is deployed into the public subnet. Each subnet has a separate Network ACL.

The public subnet CIDR range is 10.1.0.0/24 and the private subnet CIDR range is 10.1.1.0/24.

The web application is deployed on Amazon EC2 instances in the private subnet. Which combination of rules should be defined on the private subnet’s Network ACL to allow access from internet-based clients?

(Select TWO.)

• An inbound rule for port 443 from source 10.1.0.0/24

• An outbound rule for port 443 to destination 10.1.0.0/24

• An outbound rule for ports 1024 through 65535 to destination 10.1.0.0/24." is also a correct answer

• An inbound rule for port 443 from source 0.0.0.0/0

• An outbound rule for port 443 to destination 0.0.0.0/0

Which of the following AWS services can help you implement DDoS mitigation? (Choose THREE.)

• Amazon Route 53

• VPC Flow Logs

• Amazon RDS

• Amazon CloudFront

• AWS Shield

Alice has currently permission to access all actions of S3, EC2 services. When she assume a role which allows all actions of EC2 and Lambda, then what services Alice can access to?

• S3, EC2

• EC2, Lambda

• S3, EC2, Lambda

• Nothing

Amazon Detective is a service used in what following stage of Layered Security Services?

• Identify

• Protect

• Detect

• Investigate

• Respond

Which of the following data storage services supports Amazon Macie for sensitive data monitoring?

• Amazon DynamoDB

• Amazon EBS

• Amazon S3

The following diagram represents how you have organized your company’s AWS accounts using AWS Organizations. You now want to apply a policy to organizational unit #4 (OU4) that prevents only users from within that OU from deleting Amazon Elastic Compute Cloud (Amazon EC2) Flow Logs. What is the most effective way of accomplishing this? 

• Apply an IAM policy to users within OU4

• Apply a SCP to OU2

• Apply a service control policy to the root account

• Apply a service control policy directly to OU4

We can apply an IAM role to IAM group(s). True or False?

• True

• False