A company discovers that some IAM users have been storing their AWS access keys in configuration files that have been pushed to a Git repository hosting service.
Which solution will require the LEAST amount of management overhead while preventing the exposed AWS access keys from being used?

• A.Build an application that will create a list of all AWS access keys in the account and search each key on Git repository hosting services. If a match is found, configure the application to disable the associated access key. Then deploy the application to an AWS Elastic Beanstalk worker environment and define a periodic task to invoke the application every hour.
• B.Create an AWS Config rule to detect when a key is exposed online. Haw AWS Config send change notifications to an SNS topic. Configure an AWS Lambda function that is subscribed to the SNS topic to check the notification sent by AWS Config, and then disable the access key so it cannot be used.
• C.Configure AWS Trusted Advisor and create an Amazon CloudWatch Events rule that uses Trusted Advisor as the event source. Configure the CloudWatch Events rule to invoke an AWS Lambda function as the target. If the Lambda function finds the exposed access keys, then have it disable the access key so that it cannot be used.
• D.Use Amazon Inspector to detect when a key has been exposed online. Have Amazon Inspector send a notification to an Amazon SNS topic when a key has been exposed. Create an AWS Lambda function subscribed to the SNS topic to disable the IAM user to whom the key belongs, and then delete the key so that it cannot be used.

Comment: *

Name: *

Email: *

Verification: *

You have created a DynamoDB table for an application that needs to support thousands of users. You need to
ensure that each user can only access their own data in a particular table. Many users already have accounts
with a third-party identity provider, such as Facebook, Google, or Login with Amazon. How would you
implement this requirement?
Choose 2 answers from the options given below.

• A.Createan 1AM User for all users so that they can access the application.
• B.UseWeb identity federation and register your application with a third-partyidentity provider such as
  Google, Amazon, or Facebook.
• C.Createan 1AM role which has specific access to the DynamoDB table.
• D.Usea third-party identity provider such as Google, Facebook or Amazon so users canbecome an
  AWS1AM User with access to the application.

Comment: *

Name: *

Email: *

Verification: *

Your finance supervisor has set a budget of 2000 USD for the resources in AWS. Which of the following is
the simplest way to ensure that you know when this threshold is being reached.

• A.Use Cloudwatch events to notify you when you reach the threshold value
• B.Use the Cloudwatch billing alarm to to notify you when you reach the threshold value
• C.Use Cloudwatch logs to notify you when you reach the threshold value
• D.Use SQS queues to notify you when you reach the threshold value

Comment: *

Name: *

Email: *

Verification: *

A user is defining a policy for an IAM user. Which of the below mentioned options is a valid version defined for the policy?

• A."Version":"2014-01-01"
• B."Version":"2011-10-17"
• C."Version":"2013-10-17"
• D."Version":"2012-10-17"

Comment: *

Name: *

Email: *

Verification: *

You're building a mobile application game. The application needs permissions for each user to communicate and store data in DynamoDB tables. What is the best method for granting each mobile device that installs your application to access DynamoDB tables for storage when required? Choose the correct answer from the options below

• A.During the install and game configuration process, have each user create an 1AM credential and assign the 1AM user to a group with proper permissions to communicate with DynamoDB.
• B.Create an 1AM group that only gives access to your application and to the DynamoDB tables. Then, when writing to DynamoDB, simply include the unique device ID to associate the data with that specific user.
• C.Create an 1AM role with the proper permission policy to communicate with the DynamoDB table. Use web identity federation, which assumes the 1AM role using AssumeRoleWithWebldentity, when the user signs in, granting temporary security credentials using STS.
• D.Create an Active Directory server and an AD user for each mobile application user. When the user signs in to the AD sign-on, allow the AD server to federate using SAML 2.0 to 1AM and assign a role to the AD user which is the assumed with AssumeRoleWithSAML

Comment: *

Name: *

Email: *

Verification: *