Detection

1. Several AWS security services must be matched to the detection task each one performs. (Match each service to its purpose.)

1. Amazon GuardDuty
2. Amazon Macie
3. Amazon Inspector
4. Amazon Detective

1. A Assesses workloads for known software vulnerabilities and unintended network reachability.
2. B Correlates activity into a behaviour graph so an investigator can establish the scope of a finding.
3. C Analyzes account and network telemetry against threat intelligence to detect active threats.
4. D Discovers and classifies sensitive data such as personal information held in Amazon S3.

2. A security team must be alerted whenever the account root user is used, in any member account of an organization. Which solution meets these requirements?

1. A Create an AWS Config rule that reports when root user credentials exist in an account.
2. B Create an Amazon GuardDuty detector in each account and review the findings each day.
3. C Deliver an organization CloudTrail trail to CloudWatch Logs, add a metric filter on the root user identity, and alarm on the resulting metric.
4. D Generate an IAM credential report each week and review the root user row.

3. An organization must detect unusual volumes of management API activity that deviate from an account's established baseline. Which solution meets these requirements?

1. A Create an AWS Config rule that reports when resources are created unusually quickly.
2. B Enable AWS CloudTrail data events for all resources and review the event volume.
3. C Create a CloudWatch alarm on a static threshold for the number of API calls per hour.
4. D Enable AWS CloudTrail Insights so deviations from normal management API call volume generate Insight events.

4. Security findings from Amazon GuardDuty, Amazon Inspector, and Amazon Macie must be normalized, prioritized, and evaluated against a recognised standard across an organization. Which solution meets these requirements?

1. A Enable Amazon Detective with a delegated administrator and review the behaviour graph.
2. B Export each service's findings to Amazon S3 and query them with Amazon Athena.
3. C Create an AWS Config aggregator that collects compliance data from every account.
4. D Enable AWS Security Hub with a delegated administrator and turn on the security standards.

5. An organization must enable Amazon GuardDuty in every account, aggregate the findings centrally, and cover accounts created in future. Which solution meets these requirements?

1. A Create an AWS Lambda function that enables GuardDuty whenever a new account is created.
2. B Designate a delegated administrator for GuardDuty and enable automatic enrolment for new organization accounts.
3. C Enable AWS Security Hub centrally and import GuardDuty findings from each account.
4. D Enable GuardDuty manually in each account and export the findings to a central Amazon S3 bucket.

6. A team must be notified of AWS-side events that affect its own resources, such as a scheduled EC2 retirement. Which solution meets these requirements?

1. A Review the public AWS service status page each morning.
2. B Create a CloudWatch alarm on the affected instances' status check metrics.
3. C Create an AWS Config rule that reports when instance state changes.
4. D Create an Amazon EventBridge rule that matches AWS Health events and routes them to an Amazon SNS topic.

7. An organization must record every object-level read of a specific Amazon S3 bucket for audit purposes. Which solution meets these requirements?

1. A Enable Amazon S3 server access logging on the bucket.
2. B Enable AWS CloudTrail data events for that bucket and select the read event category.
3. C Enable Amazon S3 Storage Lens on the bucket.
4. D Enable AWS CloudTrail management events for the account containing the bucket.

8. An auditor must verify the integrity of CloudTrail logs for a period during which one digest file is missing. What does the missing digest file indicate?

1. A The chain is broken for that period, because each digest file references the previous one and a gap cannot be validated.
2. B The trail was configured for a single Region during that period, because digest files are produced only for multi-Region trails.
3. C The logs for that period were never delivered, because a digest file is written only when log files are delivered.
4. D The logs for that period are unencrypted, because digest files record the encryption key used.

9. Security logs from many AWS accounts and third-party tools must be centralized in a normalized schema for correlation. Which solution meets these requirements?

1. A Stream each account's logs to a central CloudWatch Logs group and query them with Logs Insights.
2. B Export each account's findings to Amazon OpenSearch Service and write a normalization pipeline.
3. C Deliver each account's trail to a shared Amazon S3 bucket and query the objects with Amazon Athena.
4. D Enable Amazon Security Lake with a delegated administrator so sources are normalized into the Open Cybersecurity Schema Framework.

10. Logs written to Amazon CloudWatch Logs by an application sometimes contain payment card numbers that must not be readable. Which solution meets these requirements?

1. A Encrypt the log group with a customer managed AWS KMS key.
2. B Apply a CloudWatch Logs data protection policy so matching sensitive patterns are masked for readers without the unmask permission.
3. C Reduce the log group's retention period so the entries expire sooner.
4. D Restrict which IAM principals may read the log group.

11. An organization must retain security logs in an archive that no account administrator, including in the log archive account, can delete for seven years. Which solution meets these requirements?

1. A Deliver an organization trail to a dedicated log archive account and apply a bucket policy denying delete actions.
2. B Deliver an organization trail to a dedicated log archive account and enable MFA Delete on the bucket.
3. C Deliver an organization trail to a dedicated log archive account and apply S3 Object Lock in compliance mode with a seven-year retention period.
4. D Deliver an organization trail to a dedicated log archive account and enable S3 Versioning on the bucket.

12. A third-party security tool must consume the organization's security data in a vendor-neutral schema. Which solution meets these requirements?

1. A Export the findings to CSV on a schedule and transfer the files to the tool.
2. B Grant the tool read access to the raw AWS CloudTrail objects in Amazon S3.
3. C Forward AWS Security Hub findings to the tool by Amazon SNS email notification.
4. D Subscribe the tool to Amazon Security Lake data, which is published in the Open Cybersecurity Schema Framework format.

13. An expected Amazon GuardDuty finding has not appeared for activity that should have triggered it. Which cause should the team investigate first?

1. A Check whether the account has exceeded its CloudWatch metric quota for the Region.
2. B Check whether a suppression rule or a trusted IP list is filtering the finding before it is surfaced.
3. C Check whether the affected resources carry the required cost allocation tags.
4. D Check whether the detector's finding export frequency has been set too low.

14. CloudTrail events for a Region are not appearing in the expected Amazon S3 bucket. Which cause should the team investigate first?

1. A Check whether the account has enabled AWS Config in the affected Region.
2. B Check whether the destination bucket has S3 Versioning enabled.
3. C Check whether the trail is configured for all Regions and whether the destination bucket policy permits the CloudTrail service to write to it.
4. D Check whether the destination bucket has a lifecycle rule transitioning objects to Glacier.

15. A GuardDuty finding type must stop generating alerts for a known benign source without losing the finding record. Which approach is appropriate?

1. A Create a suppression rule so matching findings are archived automatically while remaining queryable.
2. B Disable the finding type for the detector.
3. C Add the source to the trusted IP list so findings are not generated.
4. D Delete the findings as they arrive.

16. Security Hub findings from a member account stopped appearing in the delegated administrator account. Which cause should be investigated first?

1. A Check whether the administrator account's Region differs from the member's.
2. B Check whether the administrator account has exceeded its findings quota.
3. C Check whether the member account's findings are older than 90 days.
4. D Check whether the member account is still associated with the administrator and whether Security Hub remains enabled there.

17. An alert must fire when a KMS key policy is modified in any account in the organization. Which approach is appropriate?

1. A Create an AWS Config rule that evaluates KMS key policies for changes.
2. B Enable CloudTrail Insights and review the deviations it reports.
3. C Match the PutKeyPolicy event in EventBridge from an organization trail and route it to a notification target.
4. D Review the key policy configuration during the quarterly audit.

18. An organization must know when a member account's security services are disabled by someone inside that account. Which combination of steps meets these requirements? (Select TWO.)

1. A Alert on the disable API events from the organization trail so an attempt is visible.
2. B Increase the retention period of the organization trail.
3. C Review the security services' status in each account monthly.
4. D Enable detailed monitoring on the member accounts' resources.
5. E Prevent the disable actions with a service control policy attached to the organizational unit.

19. An Amazon Detective investigation must begin from a GuardDuty finding. Which prerequisite is required?

1. A The finding must be archived in Security Hub first.
2. B Detective must have been enabled beforehand so the behaviour graph covers the period under investigation.
3. C The GuardDuty finding must be less than 24 hours old.
4. D Detective must be enabled at the time the investigation begins.

20. An organization trail must capture object-level activity for one specific bucket without recording it for every bucket in the account. Which configuration is required?

1. A Enable S3 server access logging on that bucket instead.
2. B Enable management events and filter for object-level calls.
3. C Add a data event selector naming that bucket's ARN prefix rather than selecting all S3 buckets.
4. D Enable data events for all S3 buckets and filter the results downstream.

21. VPC Flow Logs must record whether a specific rejected connection was blocked by a security group or a network ACL. Which statement is correct?

1. A Flow Logs record network ACL rejections only, since security groups are stateful.
2. B Flow Logs record security group rejections only, since network ACLs operate before logging.
3. C Flow Logs include the identifier of the rule that rejected the traffic.
4. D Flow Logs record that the traffic was rejected but do not identify which control rejected it, so the rules must be examined or path analysis used.

22. A CloudTrail trail must deliver to a bucket in another account, and delivery is failing. Which cause should be investigated first?

1. A Check whether the destination bucket has a lifecycle rule.
2. B Check whether the trail is configured as multi-Region.
3. C Check whether the destination bucket has versioning enabled.
4. D Check whether the destination bucket policy permits the CloudTrail service principal to write with the expected source ARN condition.

23. Security Lake must make its data queryable by an analytics team without granting them access to the underlying storage. Which approach is appropriate?

1. A Copy the normalized data into a bucket the team owns.
2. B Create a subscriber with query access so the team queries the data through the catalog rather than the bucket.
3. C Grant the team read access to the Security Lake bucket.
4. D Export the data to the team on a scheduled basis.

24. An investigation requires CloudTrail events from eight months ago, and the account has only the default event history. Which statement is correct?

1. A The default event history retains 90 days, so events from eight months ago are unavailable unless a trail or event data store was configured.
2. B The events are available in CloudTrail Insights regardless of trail configuration.
3. C The default event history retains one year, so the events are available.
4. D The events can be recovered by enabling a trail now with a backdated start.

25. Logs in a dedicated archive account must be readable by investigators but not deletable by anyone. Which combination of steps meets these requirements? (Select TWO.)

1. A Grant investigators read-only access through a role in the archive account.
2. B Apply a bucket policy denying deletes to a named list of principals.
3. C Apply S3 Object Lock in compliance mode with the required retention period.
4. D Grant investigators administrator access in the archive account for flexibility.
5. E Enable MFA Delete on the archive bucket.

26. A metric filter on a CloudWatch log group is not producing data points although matching lines appear in the logs. Which cause should be investigated first?

1. A Check whether the log group is encrypted with a customer managed key.
2. B Check whether the alarm on the metric has been configured.
3. C Check whether the filter pattern matches the actual log format, since a pattern written for JSON will not match plain text.
4. D Check whether the log group's retention period is too short.

27. An Amazon Macie job reports no sensitive data findings for a bucket known to contain personal information. Which cause should be investigated first?

1. A Check whether the findings are older than the retention period.
2. B Check whether the bucket has versioning enabled.
3. C Check whether the job's scope included the relevant prefixes and whether Macie can decrypt the objects with the key protecting them.
4. D Check whether the bucket's storage class is Intelligent-Tiering.

28. A Security Hub finding must be routed to a ticketing system as soon as it is generated. Which approach is appropriate?

1. A Review the Security Hub console each morning.
2. B Match the Security Hub findings imported event in EventBridge and invoke an integration that creates the ticket.
3. C Export findings to Amazon S3 and process them nightly.
4. D Poll the Security Hub API every hour for new findings.

29. An alarm must fire when the number of failed console sign-in attempts exceeds a threshold. Which configuration is required?

1. A Enable IAM Access Analyzer and review its findings.
2. B Enable GuardDuty and alarm on all findings.
3. C Create a metric filter on the CloudTrail log group matching failed ConsoleLogin events and alarm on the resulting metric.
4. D Create a CloudWatch alarm on the account's API call count.

30. GuardDuty must analyse activity within EKS clusters as well as at the account level. Which configuration is required?

1. A Enable the EKS protection feature on the detector so audit log and runtime activity are analysed.
2. B Enable Container Insights on the cluster.
3. C Enable GuardDuty with default settings only.
4. D Enable CloudTrail data events for the EKS cluster.

31. An organization must receive one aggregated notification rather than an alert per account for the same finding type. Which approach is appropriate?

1. A Aggregate findings in the delegated administrator account and alert from there rather than from each member account.
2. B Configure an alert in each member account and filter duplicates downstream.
3. C Disable the finding type in all but one account.
4. D Reduce the finding severity threshold in member accounts.

32. CloudTrail must record events for a Region that was enabled after the trail was created. Which configuration ensures this?

1. A Enable CloudTrail Insights on the trail.
2. B Configure the trail as a multi-Region trail so newly enabled Regions are included automatically.
3. C Create an additional single-Region trail in the new Region.
4. D Recreate the trail after enabling the Region.

33. An organization must retain CloudTrail events in a queryable form for two years without managing an ingestion pipeline. Which approach is appropriate?

1. A Export the events to Amazon OpenSearch Service.
2. B Deliver the trail to Amazon S3 and build Athena tables over it.
3. C Create a CloudTrail Lake event data store with a two-year retention period.
4. D Deliver the trail to CloudWatch Logs with two-year retention.

34. VPC Flow Logs must include the AWS service that the traffic was destined for. Which configuration is required?

1. A Enable DNS query logging on the VPC.
2. B Use the default flow log format.
3. C Enable Traffic Mirroring instead.
4. D Use a custom flow log format including the relevant service and path fields available in the extended format.

35. DNS queries made from a VPC must be recorded for investigation. Which configuration is required?

1. A Enable Route 53 Resolver query logging for the VPC.
2. B Enable GuardDuty on the account.
3. C Enable CloudTrail data events for Route 53.
4. D Enable VPC Flow Logs on the subnets.

36. An S3 bucket receiving CloudTrail logs must be protected so the trail's own deliveries continue while other writes are refused. Which approach is appropriate?

1. A Enable Object Lock on the bucket.
2. B Apply a bucket policy permitting the CloudTrail service principal with a source ARN condition and denying other principals.
3. C Enable Block Public Access on the bucket.
4. D Apply a bucket policy denying all writes.

37. An organization must confirm that every account's CloudTrail delivers to the central archive. Which approach is appropriate?

1. A Review the CloudTrail console in each account quarterly.
2. B Ask each account owner to confirm their trail configuration.
3. C Deploy a trail to each account with StackSets and audit the deployments.
4. D Create an organization trail from the management or delegated administrator account so every member account is covered.

38. A Security Hub standard's control shows as failed although the underlying resource appears correctly configured. Which cause should be investigated first?

1. A Investigate whether the standard is the latest version.
2. B Investigate whether the control depends on a configuration recorder or another service that is not enabled in that Region.
3. C Investigate whether the resource was created recently.
4. D Investigate whether the finding has been archived.

39. An EventBridge rule matching a security finding is not invoking its target. Which cause should be investigated first?

1. A Investigate whether the event pattern matches the actual event structure and whether the rule has permission to invoke the target.
2. B Investigate whether the rule was created recently.
3. C Investigate whether the target is in the same Availability Zone.
4. D Investigate whether the finding's severity is too low.