Security and Compliance

108. An organization must be alerted when a security group is modified to allow unrestricted inbound access, and the change must be reverted automatically. Which solution meets these requirements?

1. A Create a CloudWatch alarm on the VPC's network traffic volume and notify the security team.
2. B Review Amazon GuardDuty findings for the account on a weekly basis.
3. C Create an AWS Config rule for the condition and attach a Systems Manager Automation remediation action.
4. D Create an AWS Lambda function that scans all security groups on a monthly schedule.

109. A security team must prove which IAM principal terminated an EC2 instance last week and from which source address. Which solution meets these requirements?

1. A Query Amazon CloudWatch Logs for the instance's system logs from the affected period.
2. B Review the AWS Config configuration timeline for the terminated instance.
3. C Query AWS CloudTrail for the TerminateInstances event and read the identity and source address from the record.
4. D Review the VPC Flow Logs for the subnet that contained the instance.

110. An organization must ensure that a mandatory set of AWS Config rules is deployed in every member account and cannot be deleted locally. Which combination of steps meets these requirements? (Select TWO.)

1. A Ask each account owner to deploy the rules during account onboarding.
2. B Create an AWS Lambda function that recreates any rule that is deleted.
3. C Apply a service control policy that denies the Config rule delete actions in member accounts.
4. D Enable AWS Trusted Advisor in every member account.
5. E Deploy the rules as an organization conformance pack from the delegated administrator account.

111. An operations engineer must be able to start and stop specific EC2 instances but must never be able to terminate any instance. Which solution meets these requirements?

1. A Attach an IAM policy that allows only ec2:StartInstances and ec2:StopInstances, scoped by resource tag.
2. B Create an AWS Config rule that reports any instance termination.
3. C Enable termination protection on every instance in the account.
4. D Attach an IAM policy that allows ec2:* and denies ec2:TerminateInstances by tag condition.

112. A company must identify IAM roles and resource policies in an account that grant access to principals outside its AWS Organization. Which solution meets these requirements?

1. A Enable IAM Access Analyzer with the organization as the zone of trust and review the external access findings.
2. B Enable IAM Access Analyzer with the account as the zone of trust and review the findings.
3. C Create an AWS Config rule that evaluates IAM policies for external principals.
4. D Enable Amazon GuardDuty and review findings for anomalous cross-account activity.

113. An organization must apply a consistent security baseline and account provisioning process as it scales from 20 to 300 accounts. Which solution meets these requirements with the LEAST custom engineering?

1. A Publish a written onboarding checklist for account owners to follow.
2. B Create one account per business unit and rely on IAM policies for separation.
3. C Write shell scripts that an administrator runs for each new account.
4. D Deploy AWS Control Tower and provision accounts through Account Factory with its preventive and detective controls.

114. An operations team must verify that the account has addressed the security findings raised by AWS Trusted Advisor. Which solution meets these requirements?

1. A Review AWS Config rule compliance and remediate the non-compliant resources.
2. B Review Amazon GuardDuty findings and remediate the highest severity items.
3. C Review Amazon Inspector findings and patch the affected instances.
4. D Review the Trusted Advisor security checks and remediate each flagged item, then confirm the check status changes.

115. An organization must restrict which AWS Regions member accounts may use, and the restriction must survive local administrator action. Which solution meets these requirements?

1. A Attach an IAM policy with an aws:RequestedRegion condition to every role in each account.
2. B Apply a service control policy with an aws:RequestedRegion condition, allowing global services through a NotAction exception.
3. C Create an AWS Config rule that reports resources created in unapproved Regions.
4. D Disable the unapproved Regions in each account's account settings.

116. Workforce users must access many AWS accounts using existing corporate credentials, with permissions assigned centrally. Which solution meets these requirements?

1. A Configure a SAML identity provider and roles separately in each member account.
2. B Create an Amazon Cognito user pool and federate it to each member account.
3. C Configure AWS IAM Identity Center with the corporate provider as the identity source and assign permission sets across the accounts.
4. D Create IAM users in each account and synchronize them from the corporate directory.

117. A compliance requirement states that every new Amazon EBS volume and snapshot in an account must be encrypted, without depending on the requester. Which solution meets these requirements?

1. A Apply a tag policy that requires an encryption tag on every volume.
2. B Enable EBS encryption by default in each Region of the account.
3. C Create an AWS Config rule that reports and remediates unencrypted volumes.
4. D Attach an IAM policy that denies ec2:CreateVolume when the encrypted parameter is false.

118. A customer managed AWS KMS key must have its cryptographic material changed annually without re-encrypting existing data. Which solution meets these requirements?

1. A Create an alias that points to a new key each year.
2. B Create a new customer managed key each year and re-encrypt the data with it.
3. C Enable automatic key rotation on the customer managed key.
4. D Schedule the existing key for deletion and create a replacement key.

119. Database credentials stored in an EC2 user data script must be moved to a managed store with automatic rotation. Which solution meets these requirements?

1. A Store the credentials on an encrypted Amazon EBS volume attached to the instance.
2. B Store the credentials in AWS Secrets Manager with rotation enabled and grant the instance role permission to retrieve them.
3. C Store the credentials in Systems Manager Parameter Store as a String parameter and grant the instance role read access.
4. D Store the credentials as environment variables defined in the launch template.

120. An auditor requires proof that delivered AWS CloudTrail log files have not been altered since delivery. Which solution meets these requirements?

1. A Enable default encryption with an AWS KMS key on the bucket that receives the trail.
2. B Enable Amazon S3 server access logging on the bucket that receives the trail.
3. C Apply a bucket policy that denies delete actions on the trail's objects.
4. D Enable CloudTrail log file validation so signed digest files are produced for the delivered logs.

121. An organization must aggregate and prioritize findings from Amazon GuardDuty, Amazon Inspector, and Amazon Macie across many accounts. Which solution meets these requirements?

1. A Create an AWS Config aggregator that collects compliance data from the accounts.
2. B Export the findings from each service to Amazon S3 and query them with Amazon Athena.
3. C Enable Amazon Detective with a delegated administrator account and review the behaviour graph.
4. D Enable AWS Security Hub with a delegated administrator account and enable the security standards.

122. An Amazon S3 bucket must never permit public access regardless of any bucket policy or ACL applied later. Which solution meets these requirements?

1. A Create an AWS Config rule that detects public buckets and removes the public grants.
2. B Apply a bucket policy that denies s3:PutBucketPolicy and s3:PutBucketAcl.
3. C Enable S3 Block Public Access on each existing bucket individually.
4. D Enable S3 Block Public Access at the account level so it applies to existing and future buckets.

123. An instance in a private subnet cannot reach the internet through a NAT gateway. Which cause should be investigated first?

1. A Investigate whether the NAT gateway is in the private subnet.
2. B Investigate whether the private subnet's route table has a default route pointing at the NAT gateway.
3. C Investigate whether the instance has a public IP address.
4. D Investigate whether the instance's security group permits inbound traffic.

124. Two VPCs are peered but instances cannot communicate. Which cause should be investigated first?

1. A Investigate whether the VPCs have internet gateways.
2. B Investigate whether the peering connection is encrypted.
3. C Investigate whether the VPCs are in the same Availability Zone.
4. D Investigate whether both VPCs' route tables have routes to the other's CIDR through the peering connection.

125. A VPC endpoint for Amazon S3 is configured but instances still reach S3 through the NAT gateway. Which cause should be investigated first?

1. A Investigate whether the subnet's route table includes the endpoint's prefix list route, since traffic follows the most specific route.
2. B Investigate whether the bucket is in a different Region.
3. C Investigate whether the instances have the S3 client installed.
4. D Investigate whether the endpoint has a public IP address.

126. A private hosted zone's records are not resolving from instances in the VPC. Which cause should be investigated first?

1. A Investigate whether the zone is also a public hosted zone.
2. B Investigate whether the hosted zone is associated with the VPC and whether DNS hostnames and resolution are enabled on it.
3. C Investigate whether the instances have public IP addresses.
4. D Investigate whether the records have a long time to live.

127. A CloudFront distribution is serving stale content after the origin was updated. Which action is appropriate?

1. A Increase the origin's instance size.
2. B Disable the distribution and re-enable it.
3. C Reduce the distribution's price class.
4. D Create an invalidation for the affected paths, or use versioned object names so each update has a new path.

128. A Route 53 alias record must point at an Application Load Balancer. Which advantage does an alias record provide over a CNAME?

1. A An alias record can be created at the zone apex and incurs no charge for queries to AWS resources.
2. B An alias record can point at any external domain.
3. C An alias record supports a longer time to live.
4. D An alias record resolves faster than a CNAME.

129. A CloudFront distribution must serve different cache behaviour for a specific URL path. Which configuration is appropriate?

1. A Add an origin for that path only.
2. B Change the default cache behaviour for the whole distribution.
3. C Create a second distribution for that path.
4. D Add a cache behaviour with a path pattern matching that path and its own cache policy.

130. An operator must confirm that IAM policies across an account grant no more access than intended. Which tool is appropriate?

1. A IAM Access Analyzer, which evaluates policies for access outside the defined zone of trust and reports unused permissions.
2. B Amazon Inspector, which assesses software vulnerabilities.
3. C AWS Trusted Advisor, which reports best-practice checks.
4. D Amazon CloudWatch, which collects metrics.

131. An AWS Config rule reports a resource as non-compliant, and the operator must correct it without manual intervention. Which configuration is appropriate?

1. A Attach an automatic remediation action to the rule so the resource is corrected when found non-compliant.
2. B Create a CloudWatch alarm on the rule's compliance status.
3. C Review the compliance dashboard each morning.
4. D Increase the rule's evaluation frequency.

132. An S3 bucket must block public access regardless of any bucket policy or access control list applied to it. Which configuration is appropriate?

1. A Remove all bucket policies from the bucket.
2. B Enable default encryption on the bucket.
3. C Enable S3 Versioning on the bucket.
4. D Enable S3 Block Public Access at the bucket or account level, which overrides permissive policies and access control lists.

133. An operator must rotate a customer managed KMS key's material automatically each year. Which configuration is appropriate?

1. A Enable automatic key rotation on the key, which generates new material while retaining the previous material for decryption.
2. B Create a new key each year and re-encrypt all data.
3. C Disable and re-enable the key annually.
4. D Delete the key and recreate it annually.

134. An EBS volume must be encrypted, and the volume already exists unencrypted with data on it. Which sequence is required?

1. A Enable encryption on the existing volume through the console.
2. B Enable EBS encryption by default and restart the instance.
3. C Snapshot the volume, copy the snapshot with encryption enabled, create a volume from the encrypted copy, and attach it.
4. D Attach the volume to a new instance with encryption enabled.

135. Secrets used by an application must be retrieved at run time rather than stored on the instance. Which approach is appropriate?

1. A Store them in the instance's user data.
2. B Store them in an environment variable set at launch.
3. C Store them in an encrypted file on the instance's volume.
4. D Store them in AWS Secrets Manager and grant the instance role permission to retrieve them.

136. An operator must ensure that an S3 bucket's objects cannot be deleted for a defined retention period, including by an administrator. Which configuration is appropriate?

1. A Enable MFA Delete on the bucket.
2. B Enable S3 Object Lock in governance mode with the required retention.
3. C Enable S3 Object Lock in compliance mode with the required retention on a versioned bucket.
4. D Apply a bucket policy denying delete actions.

137. An operator must confirm that data in transit to an RDS database is encrypted. Which configuration is appropriate?

1. A Enable storage encryption on the database instance.
2. B Require SSL through the database's parameter group so unencrypted connections are refused.
3. C Place the database in a private subnet.
4. D Enable automated backups on the database.