Free Amazon AWS-Security-Specialty Exam Dumps Questions & Answers

A company's security team is building a solution for logging and visualization. The solution will assist the company with the large variety and velocity of data that it receives from IAM across multiple accounts. The security team has enabled IAM CloudTrail and VPC Flow Logs in all of its accounts. In addition, the company has an organization in IAM Organizations and has an IAM Security Hub master account.
The security team wants to use Amazon Detective However the security team cannot enable Detective and is unsure why What must the security team do to enable Detective?

• A.  Disable IAM Key Management Service (IAM KMS) encryption on CtoudTrail logs in every member account of the organization
• B.  Enable Amazon Macie so that Secunty H jb will allow Detective to process findings from Macie.
• C.  Ensure that the principal that launches Detective has the organizations ListAccounts permission
• D.  Enable Amazon GuardDuty on all member accounts Try to enable Detective in 48 hours

While securing the connection between a company's VPC and its on-premises data center, a Security Engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). The ping command did not return a response. The flow log in the VPC showed the following:
2 123456789010 eni-1235b8ca 203.0.113.12 172.31.16.139 0 0 1 4 336 1432917027 1432917142 ACCEPT OK
2 123456789010 eni-1235b8ca 172.31.16.139 203.0.113.12 0 0 1 4 336 1432917094 1432917142 REJECT OK What action should be performed to allow the ping to work?

• A.  In the security group of the EC2 instance, allow outbound ICMP traffic.
• B.  In the VPC's NACL, allow inbound ICMP traffic.
• C.  In the security group of the EC2 instance, allow inbound ICMP traffic.
• D.  In the VPC's NACL, allow outbound ICMP traffic.

A company is hosting a website that must be accessible to users for HTTPS traffic. Also port 22 should be open for administrative purposes. The administrator's workstation has a static IP address of 203.0.113.1/32. Which of the following security group configurations are the MOST secure but still functional to support these requirements? Choose 2 answers from the options given below Please select:

• A.  Port 22 coming from 0.0.0.0/0
• B.  Port 443 coming from 0.0.0.0/0
• C.  Port 443 coming from 10.0.0.0/16
• D.  Port 22 coming from 203.0.113.1/32

A company has several critical applications running on a large fleet of Amazon EC2 instances. As part of a security operations review, the company needs to apply a critical operating system patch to EC2 instances within 24 hours of the patch becoming available from the operating system vendor. The company does not have a patching solution deployed on IAM, but does have IAM Systems Manager configured. The solution must also minimize administrative overhead.
What should a security engineer recommend to meet these requirements?

• A.  Use an IAM Systems Manager Patch Manager predefined baseline to patch affected instances.
• B.  Use the IAM Systems Manager Run Command to patch affected instances.
• C.  Use IAM Systems Manager Session Manager to log in to each affected instance and apply the patch.
• D.  Create an IAM Config rule defining the patch as a required configuration for EC2 instances.

A security engineer configures Amazon S3 Cross-Region Replication (CRR) for all objects that are in an S3 bucket in the us-east-1. Region Some objects in this S3 bucket use server-side encryption with AWS KMS keys (SSE-KMS) for encryption at test. The security engineer creates a destination S3 bucket in the us-west-2 Region. The destination S3 bucket is in the same AWS account as the source S3 bucket.
The security engineer also creates a customer managed key in us-west-2 to encrypt objects at rest in the destination S3 bucket. The replication configuration is set to use the key in us-west-2 to encrypt objects in the destination S3 bucket. The security engineer has provided the S3 replication configuration with an IAM role to perform the replication in Amazon S3.
After a day, the security engineer notices that no encrypted objects from the source S3 bucket are replicated to the destination S3 bucket. However, all the unencrypted objects are replicated.
Which combination of steps should the security engineer take to remediate this issue? (Select THREE.)

• A.  Change the replication configuration to use the key in us-east-1 to encrypt the objects that are in the destination S3 bucket.
• B.  Grant the IAM role the kms. Encrypt permission for the key in us-east-1 that encrypts source objects.
• C.  Grant the IAM role the kms. Decrypt permission for the key in us-east-1 that encrypts source objects.
• D.  Grant the IAM role the s3 GetObjectVersionForReplication permission for objects that are in the source S3 bucket.
• E.  Change the key policy of the key in us-east-1 to grant the kms. Decrypt permission to the security engineer's IAM account.
• F.  Grant the IAM role the kms Encrypt permission for the key in us-west-2 that encrypts objects that are in the destination S3 bucket.