A company is setting up products to deploy in IAM Service Catalog. Management is concerned that when users launch products, elevated IAM privileges will be required to create resources. How should the company mitigate this concern?

• A.Add a template constraint to each product in the portfolio.
• B.Add a launch constraint to each product in the portfolio.
• C.Define resource update constraints for each product in the portfolio.
• D.Update the IAM CloudFormalion template backing the product to include a service role configuration.

Comment: *

Name: *

Email: *

Verification: *

You have an Ec2 Instance in a private subnet which needs to access the KMS service. Which of the following methods can help fulfil this requirement, keeping security in perspective Please select:

• A.Use a VPC endpoint
• B.Attach an Internet gateway to the subnet
• C.Attach a VPN connection to the VPC
• D.Use VPC Peering

Comment: *

Name: *

Email: *

Verification: *

A company recently experienced a DDoS attack that prevented its web server from serving content. The website is static and hosts only HTML, CSS, and PDF files that users download.
Based on the architecture shown in the image, what is the BEST way to protect the site against future attacks while minimizing the ongoing operational overhead?

• A.Move all the files to an Amazon S3 bucket. Have the web server serve the files from the S3 bucket.
• B.Launch a second Amazon EC2 instance in a new subnet. Launch an Application Load Balancer in front of both instances.
• C.Launch an Application Load Balancer in front of the EC2 instance. Create an Amazon CloudFront distribution in front of the Application Load Balancer.
• D.Move all the files to an Amazon S3 bucket. Create a CloudFront distribution in front of the bucket and terminate the web server.

Comment: *

Name: *

Email: *

Verification: *

A company is using CloudTrail to log all AWS API activity for all regions in all of its accounts. The CISO has asked that additional steps be taken to protect the integrity of the log files.
What combination of steps will protect the log files from intentional or unintentional alteration? Choose 2 answers from the options given below Please select:

• A.Create an S3 bucket in a dedicated log account and grant the other accounts write only access. Deliver all log files from every account to this S3 bucket.
• B.Write a Lambda function that queries the Trusted Advisor Cloud Trail checks. Run the function every
  10 minutes.
• C.Enable CloudTrail log file integrity validation
• D.Use Systems Manager Configuration Compliance to continually monitor the access policies of S3 buckets containing Cloud Trail logs.
• E.Create a Security Group that blocks all traffic except calls from the CloudTrail service. Associate the security group with) all the Cloud Trail destination S3 buckets.

Comment: *

Name: *

Email: *

Verification: *

During a manual review of system logs from an Amazon Linux EC2 instance, a Security Engineer noticed that there are sudo commands that were never properly alerted or reported on the Amazon CloudWatch Logs agent Why were there no alerts on the sudo commands?

• A.The VPC requires that all traffic go through a proxy, and the CloudWatch Logs agent does not support a proxy configuration.
• B.CloudWatch Logs status is set to ON versus SECURE, which prevents it from pulling in OS security event logs
• C.The 1AM instance profile on the EC2 instance was not properly configured to allow the CloudWatch Logs agent to push the logs to CloudWatch
• D.There is a security group blocking outbound port 80 traffic that is preventing the agent from sending the logs

Comment: *

Name: *

Email: *

Verification: *