A security engineer must use IAM Key Management Service (IAM KMS) to design a key management solution for a set of Amazon Elastic Block Store (Amazon EBS) volumes that contain sensitive data. The solution needs to ensure that the key material automatically expires in 90 days.
Which solution meets these criteria?

• A.An IAM managed CMK
• B.Operating system-native encryption that uses GnuPG
• C.A customer managed CMK that uses customer provided key material
• D.A customer managed CMK that uses IAM provided key material

Comment: *

Name: *

Email: *

Verification: *

Your company has defined a set of S3 buckets in AWS. They need to monitor the S3 buckets and know the source IP address and the person who make requests to the S3 bucket. How can this be achieved?
Please select:

• A.Enable VPC flow logs to know the source IP addresses
• B.Monitor the S3 API calls by using Cloudtrail logging
• C.Monitor the S3 API calls by using Cloudwatch logging
• D.Enable AWS Inspector for the S3 bucket

Comment: *

Name: *

Email: *

Verification: *

A company became aware that one of its access keys was exposed on a code sharing website 11 days ago. A Security Engineer must review all use of the exposed access keys to determine the extent of the exposure. The company enabled AWS CloudTrail m an regions when it opened the account
Which of the following will allow (he Security Engineer 10 complete the task?

• A.Use the Access Advisor tab in the IAM console to view all of the access key activity for the past 11 days.
• B.Use the AWS CLI lo generate an IAM credential report Extract all the data from the past 11 days.
• C.Use Amazon Athena to query the CloudTrail logs from Amazon S3 Retrieve the rows for the exposed access key tor the past 11 days.
• D.filter the event history on the exposed access key in the CloudTrail console Examine the data from the past 11 days.

Comment: *

Name: *

Email: *

Verification: *

The Security Engineer for a mobile game has to implement a method to authenticate users so that they
can save their progress. Because most of the users are part of the same OpenID-Connect compatible
social media website, the Security Engineer would like to use that as the identity provider.
Which solution is the SIMPLEST way to allow the authentication of users using their social media
identities?

• A.Amazon Cognito
• B.AssumeRoleWithWebIdentity API
• C.Amazon Cloud Directory
• D.Active Directory (AD) Connector

Comment: *

Name: *

Email: *

Verification: *

A company is using IAM Organizations. The company wants to restrict IAM usage to the eu-west-1 Region for all accounts under an OU that is named "development." The solution must persist restrictions to existing and new IAM accounts under the development OU.

• A.Option C
• B.Option D
• C.Option B
• D.Option A

Comment: *

Name: *

Email: *

Verification: *