A Solutions Architect is designing a web application that uses Amazon CloudFront, an Elastic Load Balancing Application Load Balancer, and an Auto Scaling group of Amazon EC2 instances. The load balancer and EC2 instances are in the US West (Oregon) region. It has been decided that encryption in transit is necessary by using a customer-branded domain name from the client to CloudFront and from CloudFront to the load balancer.
Assuming that AWS Certificate Manager is used, how many certificates will need to be generated?

• A.Two in the US East (Virginia) region and none in the US West (Oregon) region.
• B.Two in the US West (Oregon) region and none in the US East (Virginia) region.
• C.One in the US West (Oregon) region and none in the US East (Virginia) region.
• D.One in the US West (Oregon) region and one in the US East (Virginia) region.

Comment: *

Name: *

Email: *

Verification: *

The Information Technology department has stopped using Classic Load Balancers and switched to Application Load Balancers to save costs. After the switch, some users on older devices are no longer able to connect to the website.
What is causing this situation?

• A.The cipher suites on the Application Load Balancers are blocking connections.
• B.Application Load Balancers do not support older web browsers.
• C.The intermediate certificate is installed within the Application Load Balancer.
• D.The Perfect Forward Secrecy settings are not configured correctly.

Comment: *

Name: *

Email: *

Verification: *

An application is currently secured using network access control lists and security groups. Web servers are located in public subnets behind an Application Load Balancer (ALB); application servers are located in private subnets.
How can edge security be enhanced to safeguard the Amazon EC2 instances against attack? (Choose two.)

• A.Require all inbound and outbound network traffic to route through an IAM Direct Connect connection.
• B.Move the web servers to private subnets without public IP addresses.
• C.Require all inbound network traffic to route through a bastion host in the private subnet.
• D.Configure IAM WAF to provide DDoS attack protection for the ALB.
• E.Configure the application's EC2 instances to use NAT gateways for all inbound traffic.

Comment: *

Name: *

Email: *

Verification: *

A company has several Customer Master Keys (CMK), some of which have imported key material. Each CMK must be
rotated annually.
What two methods can the security team use to rotate each key? Select 2 answers from the options given below
Please select:

• A.Enable automatic key rotation for a CMK
• B.Import new key material to an existing CMK
• C.Use the CLI or console to explicitly rotate an existing CMK
• D.Import new key material to a new CMK; Point the key alias to the new CMK.
• E.Delete an existing CMK and a new default CMK will be created.

Comment: *

Name: *

Email: *

Verification: *

You have been given a new brief from your supervisor for a client who needs a web application set up on IAM. The a most important requirement is that MySQL must be used as the database, and this database must not be hosted in the public cloud, but rather at the client's data center due to security risks. Which of the following solutions would be the ^ best to assure that the client's requirements are met? Choose the correct answer from the options below Please select:

• A.Build the application server on a public subnet and the database at the client's data center. Connect them with a VPN connection which uses IPsec.
• B.Use the public subnet for the application server and use RDS with a storage gateway to access and synchronize the data securely from the local data center.
• C.Build the application server on a public subnet and the database on a private subnet with a NAT instance between them.
• D.Build the application server on a public subnet and build the database in a private subnet with a secure ssh connection to the private subnet from the client's data center.

Correct Answer: A

Explanation
Since the database should not be hosted on the cloud all other options are invalid.
The best option is to create a VPN connection for securing traffic as shown below.

Option B is invalid because this is the incorrect use of the Storage gateway Option C is invalid since this is the incorrect use of the NAT instance Option D is invalid since this is an incorrect configuration For more information on VPN connections, please visit the below URL
http://docs.IAM.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.htmll
The correct answer is: Build the application server on a public subnet and the database at the client's data center. Connect them with a VPN connection which uses IPsec Submit your Feedback/Queries to our Experts

Comment: *

Name: *

Email: *

Verification: *