NEW
Font size
WorksheetsAWS-491-461
Total questions: 31
Worksheet time: 16mins
Does Amazon RDS support SSL encryption for SQL Server DB Instances?
Yes, for all supported SQL Server editions
No
Yes, but only when the instances are in a single region
No, encryption using SSL is supported only in the GovCloud.
In Amazon CloudFront, if you have chosen On for Logging, the access logs are stored in _______________.
Amazon S3 bucket.
Amazon EBS
Amazon Edge locations.
Amazon EC2 instance.
Is it possible to create an S3 bucket accessible only by a certain IAM user using policies in a Cloud-Formation template?
Yes, all these resources can be created using a CloudFormation template
S3 is not supported by CloudFormation.
No, you can only create the S3 bucket but not the IAM user.
No, in the same template you can only create the S3 bucket and the relative policy.
A user has configured two security groups which allow traffic as given below:
1: SecGrp1:
Inbound on port 80 for 0.0.0.0/0
Inbound on port 22 for 0.0.0.0/0
2: SecGrp2:
Inbound on port 22 for 10.10.10.1/32
If both the security groups are associated with the same instance, which of the below mentioned statements is true?
It is not possible to have more than one security group assigned to a single instance
It allows inbound traffic for everyone on both ports 22 and 80
It is not possible to create the security group with conflicting rules. AWS will reject the request
It allows inbound traffic on port 22 for IP 10.10.10.1 and for everyone else on port 80
A company wants to review the security requirements of Glacier. Which of the below mentioned statements is true with respect to the AWS Glacier data security?
The user can set the serverside encryption flag to encrypt the data stored on Glacier.
All data stored on Glacier is protected with AES-256 server-side encryption.
All data stored on Glacier is protected with AES-128 server-side encryption.
The data stored on Glacier is not encrypted by default.
The ______ IAM policy element describes the specific action or actions that will be allowed or de-nied.
Principal
Action
Vendor
Not Principal
For IAM user, a virtual Multi-Factor Authentication (MFA) device uses an application that gener-ates ______-digit authentication codes that are compatible with the time-based one-time password (TOTP) standard.
three
four
six
five
An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants a particular group of IAM users to access only the test instances and not the production ones. They want to deploy the instances in various locations based on the factors that will change from time to time, especially in the test group. They expect instances will often need to be churned, i.e. deleted and replaced, especially in the testing group. This means the five instances they have created now will soon be replaced by a different set of five instances. The members of each group, produc-tion and testing, will not change in the foreseeable future. Given the situation, what choice below is the most efficient and time-saving strategy to define the IAM policy?
By creating an IAM policy with a condition that allows access to only small instances
By defining the IAM policy that allows access based on the instance ID
By launching the test and production instances in separate regions and allowing region wise ac-cess to the group
By defining the tags on the test and production team members IAM user IDs, and adding a con-dition to the IAM policy that allows access to specific tags
An IAM user has two conflicting policies as part of two separate groups. One policy allows him to access an S3 bucket, while another policy denies him the access. Can the user access that bucket?
Yes, always
No
Yes, provided he accesses with the group which has S3 access
Yes, but just read only access of the bucket
In AWS Identity and Access Management (IAM), you can make use of the ______ APIs to grant users temporary access to your resources.
AWS Security Transport Service (STS)
AWS Security Tree Service (STS)
AWS Security Task Service (STS)
AWS Security Token Service (STS)
Your customers are concerned about the security of their sensitive data and their inquiry asks about what happens to old storage devices on AWS. What would be the best answer to this question?
AWS uses a 3rd party security organization to destroy data as part of the decommissioning pro-cess.
AWS uses the techniques detailed in DoD 5220.22-M to destroy data as part of the decommis-sioning process.
AWS reformats the disks and uses them again.
AWS uses their own proprietary software to destroy data as part of the decommissioning pro-cess.
The AWS Key Management Service (AWS KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data. AWS KMS is integrated with oth-er AWS services including Amazon EBS, Amazon S3, Amazon Redshift, Elastic Transcoder, Ama-zon WorkMail, and Amazon RDS to make it simple to encrypt your data with encryption keys that you manage. AWS KMS is also integrated with AWS CloudTrail to provide you with key usage logs to help meet your regulatory and compliance needs. Which of the following types of cryptog-raphy keys is supported by AWS KMS currently?
Private ephemeral key agreement cryptography
Symmetric and asymmetric random number generation key cryptography
Asymmetric key cryptography and symmetric key cryptography
Only symmetric key cryptography
You need to determine what encryption operations were taken with which key in AWS KMS to ei-ther encrypt or decrypt data in the AWS CodeCommit repository. Which of the following actions will best help you accomplish this?
Searching for the AWS CodeCommit repository ID in AWS CloudTrail logs
Searching for the encryption key ID in AWS CloudTrail logs
Searching for the AWS CodeCommit repository ID in AWS CloudWatch
Searching for the encryption key ID in AWS CloudWatch
Is it possible to protect the connections between your application servers and your MySQL instances using SSL encryption?
Yes, it is possible but only in certain regions.
Yes
No
Yes, it is possible but only in VPC.
You have been asked to design a layered security solution for protecting your organization's net-work infrastructure. You research several options and decide to deploy a network-level security con-trol appliance, inline, where traffic is intercepted and analyzed prior to being forwarded to its final destination, such as an application server. Which of the following is NOT considered an inline threat protection technology?
Intrusion prevention systems
Third-party firewall devices installed on Amazon EC2 instances
Data loss management gateways
Augmented security groups with Network ACLs
Can you use the AWS Identity and Access Management (IAM) to assign permissions determining who can manage or modify RDS resources?
No, AWS IAM is used only to assign IDs to AWS users.
No, this permission cannot be assigned by AWS IAM.
Yes, you can.
No, AWS IAM is used only to assign activities.
What does Amazon IAM stand for?
Amazon Identity and Authentication Mechanism
Amazon Integrated Access Management
Amazon Identity and Access Management
None of these
You need to set up security for your VPC and you know that Amazon VPC provides two features that you can use to increase security for your VPC: Security groups and network access control lists (ACLs). You start to look into security groups first. Which statement below is incorrect in relation to security groups?
Are stateful: Return traffic is automatically allowed, regardless of any rules.
Support addition of individual allow and deny rules in both inbound and outbound.
Security Groups can be added or removed from EC2 instances in a VPC at any time.
Evaluate all rules before deciding whether to allow traffic.
The Statement element, of an AWS IAM policy, contains an array of individual statements. Each individual statement is a(n) ______ block enclosed in braces { }.
JSON
AJAX
JavaScript
jQuery
What does the Server-side encryption provide in Amazon S3?
Server-side encryption doesn't exist for Amazon S3, but only for Amazon EC2.
Server-side encryption protects data at rest using Amazon S3-managed encryption keys (SSE-S3).
Server-side encryption provides an encrypted virtual disk in the cloud
Server-side encryption allows to upload files using an SSL endpoint for a secure transfer.
A user is planning to schedule a backup for an existing EBS volume. The user wants the backup to be created through snapshot, and for it to be encrypted. How can the user achieve data encryption with a snapshot?
Encrypt the existing EBS volumes so that the snapshot will be encrypted by AWS when it is cre-ated
By default the snapshot is encrypted by AWS
While creating a snapshot select the snapshot with encryption
Enable server side encryption for the snapshot using S3
Could you use IAM to grant access to Amazon DynamoDB resources and API actions?
In DynamoDB there is no need to grant access
Depended to the type of access
No
Yes
Which of the following statements is true of IAM?
If you are configuring MFA for a user who will use a smartphone to generate an OTP, you must have the smartphone available in order to finish the wizard.
If you are configuring MFA for a user who will use a smartphone to generate an OTP, the smartphone is not required in order to finish the wizard.
If you are configuring MFA for a user who will use a smartphone to generate an OTP, you can finish the wizard on any device and later use the smartphone for authentication.
None of these are correct.
AWS Cloud Hardware Security Modules (HSMs) are designed to _____.
store your AWS keys safely
provide another level of login security specifically for LDAP
allow AWS to audit your infrastructure
securely store cryptographic key material and use the key material without exposing it outside the cryptographic boundary of the appliance
In AWS KMS, which of the following is NOT a mode of server-side encryption that you can use to protect data at rest in Amazon S3?
SSE-S3
SSE-K
SSE-C
SSE-KMS
Amazon S3 provides a number of security features for protection of data at rest, which you can use or not, depending on your threat profile. What feature of S3 allows you to create and manage your own encryption keys for sending data?
Client-side Encryption
Network traffic protection
Data integrity compromise
Server-side Encryption
In IAM, a policy has to include the information about who (user) is allowed to access the resource, known as the _____.
permission
role
license
principal
In a hardware security module (HSM), what is the function of a Transparent Data Encryption (TDE)?
To reduce the risk of confidential data theft
To decrease latency
To store SSL certificates
To provide backup
A user has enabled instance protection for his Auto Scaling group that has spot instances. If Auto Scaling wants to terminate an instance in this Auto Scaling group due to a CloudWatch trigger unre-lated to bid price, what will happen?
Auto Scaling will notify the user for the next action
Auto Scaling will remove the instance from the Auto Scaling Group
Auto Scaling overwrites the instance termination attribute and terminates the instances
The EC2 instance will not be terminated since instance protection from scale-in is enabled.
You can create a CloudWatch alarm that watches a single metric. The alarm performs one or more actions based on the value of the metric relative to a threshold over a number of time periods. Which of the following states is possible for the CloudWatch alarm?
OK
ALERT
THRESHOLD
ERROR
What is Amazon CloudFront?
A global Content Delivery Network
An encrypted endpoint to upload files to the Cloud
A web service to schedule regular data movement
A development front-end to Amazon Web Services
