A Security Engineer is working with a Product team building a web application on IAM. The application uses Amazon S3 to host the static content, Amazon API Gateway to provide RESTful services; and Amazon DynamoDB as the backend data store. The users already exist in a directory that is exposed through a SAML identity provider.
Which combination of the following actions should the Engineer take to enable users to be authenticated into the web application and call APIs? (Choose three.)

• A.Update API Gateway to use a COGNITO_USER_POOLS authorizer.
• B.Configure the SAML identity provider to add the Amazon Cognito user pool as a relying party.
• C.Configure a SAML identity provider in Amazon Cognito to map attributes to the Amazon Cognito user pool attributes.
• D.Update DynamoDB to store the user email addresses and passwords.
• E.Configure an Amazon Cognito identity pool to integrate with social login providers.
• F.Create a custom authorization service using IAM Lambda.

Comment: *

Name: *

Email: *

Verification: *

A Security Engineer is working with a Product team building a web application on AWS. The application uses Amazon S3 to host the static content, Amazon API Gateway to provide RESTful services; and Amazon DynamoDB as the backend data store. The users already exist in a directory that is exposed through a SAML identity provider.
Which combination of the following actions should the Engineer take to enable users to be authenticated into the web application and call APIs? (Choose three.)

• A.Configure a SAML identity provider in Amazon Cognito to map attributes to the Amazon Cognito user pool attributes.
• B.Create a custom authorization service using AWS Lambda.
• C.Configure the SAML identity provider to add the Amazon Cognito user pool as a relying party.
• D.Update API Gateway to use a COGNITO_USER_POOLSauthorizer.
• E.Update DynamoDB to store the user email addresses and passwords.
• F.Configure an Amazon Cognito identity pool to integrate with social login providers.

Comment: *

Name: *

Email: *

Verification: *

A global company must mitigate and respond to DDoS attacks at Layers 3, 4 and 7 All of the company's IAM applications are serverless with static content hosted on Amazon S3 using Amazon CloudFront and Amazon Route 53 Which solution will meet these requirements?

• A.Use IAM WAF to protect IAM Lambda functions encrypted with IAM KMS and a NACL restricting all Ingress traffic
• B.Use IAM Certificate Manager with an Application Load Balancer configured with an origin access identity
• C.Use IAM WAF with an upgrade to the IAM Business support plan
• D.Use IAM Shield Advanced

Comment: *

Name: *

Email: *

Verification: *

A developer 15 building a serverless application hosted on IAM that uses Amazon Redshift in a data store.
The application has separate modules for read/write and read-only functionality. The modules need their own database users tor compliance reasons.
Which combination of steps should a security engineer implement to grant appropriate access' (Select TWO )

• A.Configure cluster security groups for each application module to control access to database users that are required for read-only and read/write.
• B.Create focal database users for each module
• C.Configure a VPC endpoint for Amazon Redshift Configure an endpoint policy that maps database users to each application module, and allow access to the tables that are required for read-only and read/write
• D.Configure an IAM policy for each module Specify the ARN of an IAM user that allows the GetClusterCredentials API call
• E.Configure an IAM poky for each module Specify the ARN of an Amazon Redshift database user that allows the GetClusterCredentials API call

Comment: *

Name: *

Email: *

Verification: *

You work as an administrator for a company. The company hosts a number of resources using IAM. There is an incident of a suspicious API activity which occurred 11 days ago. The Security Admin has asked to get the API activity from that point in time. How can this be achieved?
Please select:

• A.Search the Cloud Watch logs to find for the suspicious activity which occurred 11 days ago
• B.Search the Cloudtrail event history on the API events which occurred 11 days ago.
• C.Search the Cloud Watch metrics to find for the suspicious activity which occurred 11 days ago
• D.Use IAM Config to get the API calls which were made 11 days ago.

Comment: *

Name: *

Email: *

Verification: *