You need to have a requirement to store objects in an S3 bucket with a key that is automatically managed and rotated. Which of the following can be used for this purpose?
Please select:

• A.IAM KMS
• B.IAM S3 Server side encryption
• C.IAM Customer Keys
• D.IAM Cloud HSM

Comment: *

Name: *

Email: *

Verification: *

A company hosts a critical web application on the AWS Cloud. This is a key revenue generating application for the company. The IT Security team is worried about potential DDos attacks against the web site. The senior management has also specified that immediate action needs to be taken in case of a potential DDos attack. What should be done in this regard?
Please select:

• A.Consider using the AWS Shield Service
• B.Consider using VPC Flow logs to monitor traffic for DDos attack and quickly take actions on a trigger of a potential attack.
• C.Consider using the AWS Shield Advanced Service
• D.Consider using Cloudwatch logs to monitor traffic for DDos attack and quickly take actions on a trigger of a potential attack.

Comment: *

Name: *

Email: *

Verification: *

A company has external vendors that must deliver files to the company. These vendors have cross-account that gives them permission to upload objects to one of the company's S3 buckets.
What combination of steps must the vendor follow to successfully deliver a file to the company? Select 2 answers from the options given below Please select:

• A.Attach an 1AM role to the bucket that grants the bucket owner full permissions to the object
• B.Add a grant to the objects ACL giving full permissions to bucket owner.
• C.Encrypt the object with a KMS key controlled by the company.
• D.Add a bucket policy to the bucket that grants the bucket owner full permissions to the object
• E.Upload the file to the company's S3 bucket

Correct Answer: B,E

Explanation
This scenario is given in the AWS Documentation
A bucket owner can enable other AWS accounts to upload objects. These objects are owned by the accounts that created them. The bucket owner does not own objects that were not created by the bucket owner.
Therefore, for the bucket owner to grant access to these objects, the object owner must first grant permission to the bucket owner using an object ACL. The bucket owner can then delegate those permissions via a bucket policy. In this example, the bucket owner delegates permission to users in its own account.

Option A and D are invalid because bucket ACL's are used to give grants to bucket Option C is not required since encryption is not part of the requirement For more information on this scenario please see the below Link:
https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroushs-manaeing-access-example3.htmll The correct answers are: Add a grant to the objects ACL giving full permissions to bucket owner., Upload the file to the company's S3 bucket Submit your Feedback/Queries to our Experts

Comment: *

Name: *

Email: *

Verification: *

A Web Administrator for the website example.com has created an Amazon CloudFront distribution for dev.example.com, with a requirement to configure HTTPS using a custom TLS certificate imported to IAM Certificate Manager.
Which combination of steps is required to ensure availability of the certificate in the CloudFront console?
(Choose two.)

• A.Ensure that the certificate, private key, and certificate chain are PKCS #12-encoded.
• B.Call UploadServerCertificate with /cloudfront/dev/ in the path parameter.
• C.Ensure that the certificate, private key, and certificate chain are PEM-encoded.
• D.Import the certificate in the us-east-1 (N. Virginia) Region.
• E.Import the certificate with a 4,096-bit RSA public key.

Comment: *

Name: *

Email: *

Verification: *

A company has deployed a custom DNS server in AWS. The Security Engineer wants to ensure that Amazon EC2 instances cannot use the Amazon-provided DNS.
How can the Security Engineer block access to the Amazon-provided DNS in the VPC?

• A.Deny access to the Amazon DNS IP within all security groups.
• B.Add a rule to all network access control lists that deny access to the Amazon DNS IP.
• C.Add a route to all route tables that black holes traffic to the Amazon DNS IP.
• D.Disable DNS resolution within the VPC configuration.

Comment: *

Name: *

Email: *

Verification: *