A security team is responsible for reviewing AWS API call activity in the cloud environment for security violations. These events must be recorded and retained in a centralized location for both current and future AWS regions.
What is the SIMPLEST way to meet these requirements?

• A.Enable AWS CloudTrail by creating a new trail and applying the trail to all regions. Specify a single Amazon S3 bucket as the storage location.
• B.Enable AWS Trusted Advisor security checks in the AWS Console, and report all security incidents for all regions.
• C.Enable AWS CloudTrail by creating individual trails for each region, and specify a single Amazon S3 bucket to receive log files for later analysis.
• D.Enable Amazon CloudWatch logging for all AWS services across all regions, and aggregate them to a single Amazon S3 bucket for later analysis.

Comment: *

Name: *

Email: *

Verification: *

A company has a set of resources defined in AWS. It is mandated that all API calls to the resources be monitored. Also all API calls must be stored for lookup purposes. Any log data greater than 6 months must be archived. Which of the following meets these requirements? Choose 2 answers from the options given below. Each answer forms part of the solution.
Please select:

• A.Enable CloudTrail logging in all accounts into S3 buckets
• B.Enable CloudTrail logging in all accounts into Amazon Glacier
• C.Ensure a lifecycle policy is defined on the S3 bucket to move the data to EBS volumes after 6 months.
• D.Ensure a lifecycle policy is defined on the S3 bucket to move the data to Amazon Glacier after 6 months.

Comment: *

Name: *

Email: *

Verification: *

Developers in an organization have moved from a standard application deployment to containers. The Security Engineer is tasked with ensuring that containers are secure.
Which strategies will reduce the attack surface and enhance the security of the containers? (Choose two.)

• A.Segregate container by host, function, and data classification.
• B.Use the containers to automate security deployments.
• C.Enable container breakout at the host kernel.
• D.Limit resource consumption (CPU, memory), networking connections, ports, and unnecessary container libraries.
• E.Use Docker Notary framework to sign task definitions.

Comment: *

Name: *

Email: *

Verification: *

For compliance reasons, an organization limits the use of resources to three specific AWS regions. It wants to be alerted when any resources are launched in unapproved regions.
Which of the following approaches will provide alerts on any resources launched in an unapproved region?

• A.Monitor Amazon S3 Event Notifications for objects stored in buckets in unapproved regions.
• B.Use AWS Trusted Advisor to alert on all resources being created.
• C.Develop an alerting mechanism based on processing AWS CloudTrail logs.
• D.Analyze Amazon CloudWatch Logs for activities in unapproved regions.

Comment: *

Name: *

Email: *

Verification: *

An auditor needs access to logs that record all API events on AWS. The auditor only needs read-only access to the log files and does not need access to each AWS account. The company has multiple AWS accounts, and the auditor needs access to all the logs for all the accounts. What is the best way to configure access for the auditor to view event logs from all accounts? Choose the correct answer from the options below Please select:

• A.Configure the CloudTrail service in each AWS account, and have the logs delivered to an AWS bucket on each account, while granting the auditor permissions to the bucket via roles in the secondary accounts and a single primary 1AM account that can assume a read-only role in the secondary AWS accounts.
• B.Configure the CloudTrail service in the primary AWS account and configure consolidated billing for all the secondary accounts. Then grant the auditor access to the S3 bucket that receives the CloudTrail log files.
• C.Configure the CloudTrail service in each AWS account and enable consolidated logging inside of CloudTrail.
• D.Configure the CloudTrail service in each AWS account and have the logs delivered to a single AWS bucket in the primary account and erant the auditor access to that single bucket in the orimarv account.

Comment: *

Name: *

Email: *

Verification: *