A company uses HTTP Live Streaming (HLS) to stream live video content to paying subscribers by using Amazon CloudFront. HLS splits the video content into chunks so that the user can request the right chunk based on different conditions Because the video events last for several hours, the total video is made up of thousands of chunks The origin URL is not disclosed and every user is forced to access the CloudFront URL The company has a web application that authenticates the paying users against an internal repository and a CloudFront key pair that is already issued.
What is the simplest and MOST effective way to protect the content?

• A.Develop the application to issue a security token that Lambda@Edge will receive to authenticate and authorize access to the content
• B.Develop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content.
• C.Keep the CloudFront URL encrypted inside the application, and use AWS KMS to resolve the URL on-the-fly after the user is authenticated.
• D.Develop the application to use the CloudFront key pair to create signed URLs that users will use to access the content.

Comment: *

Name: *

Email: *

Verification: *

You are working for a company and been allocated the task for ensuring that there is a federated authentication mechanism setup between AWS and their On-premise Active Directory. Which of the following are important steps that need to be covered in this process? Choose 2 answers from the options given below.
Please select:

• A.Ensure the right match is in place for On-premise AD Groups and IAM Roles.
• B.Ensure the right match is in place for On-premise AD Groups and IAM Groups.
• C.Configure AWS as the relying party in Active Directory
• D.Configure AWS as the relying party in Active Directory Federation services The AWS Documentation mentions some key aspects with regards to the configuration of On-premise AD with AWS One is the Groups configuration in AD Active Directory Configuration Determining how you will create and delineate your AD groups and IAM roles in AWS is crucial to how you secure access to your account and manage resources. SAML assertions to the AWS environment and the respective IAM role access will be managed through regular expression (regex) matching between your on-premises AD group name to an AWS IAM role.

Correct Answer: A,D

One approach for creating the AD groups that uniquely identify the AWS IAM role mapping is by selecting a common group naming convention. For example, your AD groups would start with an identifier, for example, AWS-, as this will distinguish your AWS groups from others within the organization. Next include the 12-digitAWS account number. Finally, add the matching role name within the AWS account. Here is an example:

And next is the configuration of the relying party which is AWS
ADFS federation occurs with the participation of two parties; the identity or claims provider (in this case the owner of the identity repository - Active Directory) and the relying party, which is another application that wishes to outsource authentication to the identity provider; in this case Amazon Secure Token Service (STS). The relying party is a federation partner that is represented by a claims provider trust in the federation service.
Option B is invalid because AD groups should not be matched to IAM Groups Option C is invalid because the relying party should be configured in Active Directory Federation services For more information on the federated access, please visit the following URL:
1 https://aws.amazon.com/blogs/security/aws-federated-authentication-with-active-directory-federation-services-ad-fs/ The correct answers are: Ensure the right match is in place for On-premise AD Groups and IAM Roles., Configure AWS as the relying party in Active Directory Federation services Submit your Feedback/Queries to our Experts

Comment: *

Name: *

Email: *

Verification: *

A Software Engineer wrote a customized reporting service that will run on a fleet of Amazon EC2 instances.
The company security policy states that application logs for the reporting service must be centrally collected.
What is the MOST efficient way to meet these requirements?

• A.Write an AWS Lambda function that logs into the EC2 instance to pull the application logs from the EC2 instance and persists them into an Amazon S3 bucket.
• B.Enable AWS CloudTrail logging for the AWS account, create a new Amazon S3 bucket, and then configure Amazon CloudWatch Logs to receive the application logs from CloudTrail.
• C.Create a simple cron job on the EC2 instances that synchronizes the application logs to an Amazon S3 bucket by using rsync.
• D.Install the Amazon CloudWatch Logs Agent on the EC2 instances, and configure it to send the application logs to CloudWatch Logs.

Comment: *

Name: *

Email: *

Verification: *

A company has decided to use encryption in its IAM account to secure the objects in Amazon S3 using server-side encryption. Object sizes range from 16.000 B to 5 MB. The requirements are as follows:
* The key material must be generated and stored in a certified Federal Information Processing Standard (FIPS)
140-2 Level 3 machine.
* The key material must be available in multiple Regions.
Which option meets these requirements?

• A.Use an IAM KMS customer managed key and store the key material in IAM with replication across Regions
• B.Use an IAM KMS custom key store backed by IAM CloudHSM clusters, and copy backups across Regions
• C.Use IAM CloudHSM to generate the key material and backup keys across Regions Use the Java Cryptography Extension (JCE) and Public Key Cryptography Standards #11 (PKCS #11) encryption libraries to encrypt and decrypt the data.
• D.Use an IAM customer managed key, import the key material into IAM KMS using in-house IAM CloudHSM. and store the key material securely in Amazon S3.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the correct sequence of how KMS manages the keys when used along with the Redshift cluster service Please select:

• A.The master keys encrypts the cluster key. The cluster key encrypts the database key. The database key encrypts the data encryption keys.
• B.The master keys encrypts the database key. The database key encrypts the data encryption keys.
• C.The master keys encrypts the data encryption keys. The data encryption keys encrypts the database key
• D.The master keys encrypts the cluster key, database key and data encryption keys This is mentioned in the AWS Documentation Amazon Redshift uses a four-tier, key-based architecture for encryption. The architecture consists of data encryption keys, a database key, a cluster key, and a master key.

Comment: *

Name: *

Email: *

Verification: *