Your company looks at the gaming domain and hosts several Ec2 Instances as game servers. The servers each experience user loads in the thousands. There is a concern of DDos attacks on the EC2 Instances which could cause a huge revenue loss to the company. Which of the following can help mitigate this security concern and also ensure minimum downtime for the servers.
Please select:

• A.Use VPC Flow logs to monitor the VPC and then implement NACL's to mitigate attacks
• B.Use AWS Shield Advanced to protect the EC2 Instances
• C.Use AWS Inspector to protect the EC2 Instances
• D.Use AWS Trusted Advisor to protect the EC2 Instances

Correct Answer: B

Below is an excerpt from the AWS Documentation on some of the use cases for AWS Shield

Comment: *

Name: *

Email: *

Verification: *

You are trying to use the AWS Systems Manager run command on a set of Instances. The run command on a set of Instances. What can you do to diagnose the issue? Choose 2 answers from the options given
Please select:

• A.Ensure that the SSM agent is running on the target machine
• B.Check the /var/log/amazon/ssm/errors.log file
• C.Ensure the right AMI is used for the Instance
• D.Ensure the security groups allow outbound communication for the instance

Comment: *

Name: *

Email: *

Verification: *

Your current setup in AWS consists of the following architecture. 2 public subnets, one subnet which has the web servers accessed by users across the internet and the other subnet for the database server. Which of the following changes to the architecture would add a better security boundary to the resources hosted in your setup Please select:

• A.Consider moving the web server to a private subnet
• B.Consider moving the database server to a private subnet
• C.Consider moving both the web and database server to a private subnet
• D.Consider creating a private subnet and adding a NAT instance to that subnet

Correct Answer: B

Explanation
The ideal setup is to ensure that the web server is hosted in the public subnet so that it can be accessed by users on the internet. The database server can be hosted in the private subnet.
The below diagram from the AWS Documentation shows how this can be setup

Option A and C are invalid because if you move the web server to a private subnet, then it cannot be accessed by users Option D is invalid because NAT instances should be present in the public subnet For more information on public and private subnets in AWS, please visit the following url com/AmazonVPC/latest/UserGuide/VPC Scenario2.
The correct answer is: Consider moving the database server to a private subnet Submit your Feedback/Queries to our Experts

Comment: *

Name: *

Email: *

Verification: *

A Security Engineer launches two Amazon EC2 instances in the same Amazon VPC but in separate Availability Zones. Each instance has a public IP address and is able to connect to external hosts on the internet. The two instances are able to communicate with each other by using their private IP addresses, but they are not able to communicate with each other when using their public IP addresses.
Which action should the Security Engineer take to allow communication over the public IP addresses?

• A.Associate the instances to the same security groups.
• B.Add 0.0.0.0/0 to the egress rules of the instance security groups.
• C.Add the instance IDs to the ingress rules of the instance security groups.
• D.Add the public IP addresses to the ingress rules of the instance security groups.

Comment: *

Name: *

Email: *

Verification: *

Your company has a hybrid environment, with on-premise servers and servers hosted in the AWS cloud. They are planning to use the Systems Manager for patching servers. Which of the following is a pre-requisite for this to work;
Please select:

• A.Ensure that the on-premise servers are running on Hyper-V.
• B.Ensure that an IAM service role is created
• C.Ensure that an IAM User is created
• D.Ensure that an IAM Group is created for the on-premise servers

Comment: *

Name: *

Email: *

Verification: *