Compliance requirements state that all communications between company on-premises hosts and EC2 instances be encrypted in transit. Hosts use custom proprietary protocols for their communication, and EC2 instances need to be fronted by a load balancer for increased availability.
Which of the following solutions will meet these requirements?

• A.Offload SSL termination onto an SSL listener on a Classic Load Balancer, and use a TCP connection between the load balancer and the EC2 instances.
• B.Route all traffic through a TCP listener on a Classic Load Balancer, and terminate the TLS connection on the EC2 instances.
• C.Create an HTTPS listener using an Application Load Balancer, and route all of the communication through that load balancer.
• D.Offload SSL termination onto an SSL listener using an Application Load Balancer, and re-spawn and SSL connection between the load balancer and the EC2 instances.

Comment: *

Name: *

Email: *

Verification: *

An organization has a system in AWS that allows a large number of remote workers to submit data files.
File sizes vary from a few kilobytes to several megabytes. A recent audit highlighted a concern that data
files are not encrypted while in transit over untrusted networks.
Which solution would remediate the audit finding while minimizing the effort required?

• A.Use AWS Certificate Manager to provision a certificate on an Elastic Load Balancing in front of the web
  service's servers.
• B.Create a new VPC with an Amazon VPC VPN endpoint, and update the web service's DNS record.
• C.Upload an SSL certificate to IAM, and configure Amazon CloudFront with the passphrase for the
  private key.
• D.Call KMS.Encrypt()in the client, passing in the data file contents, and call KMS.Decrypt()server-
  side.

Comment: *

Name: *

Email: *

Verification: *

A company became aware that one of its access keys was exposed on a code sharing website 11 days ago. A Security Engineer must review all use of the exposed keys to determine the extent of the exposure. The company enabled AWS CloudTrail in all regions when it opened the account.
Which of the following will allow the Security Engineer to complete the task?

• A.Filter the event history on the exposed access key in the CloudTrail console. Examine the data from the past 11 days.
• B.Use the AWS CLI to generate an IAM credential report. Extract all the data from the past 11 days.
• C.Use Amazon Athena to query the CloudTrail logs from Amazon S3. Retrieve the rows for the exposed access key for the past 11 days.
• D.Use the Access Advisor tab in the IAM console to view all of the access key activity for the past 11 days.

Comment: *

Name: *

Email: *

Verification: *

You work as an administrator for a company. The company hosts a number of resources using AWS. There is an incident of a suspicious API activity which occurred 11 days ago. The Security Admin has asked to get the API activity from that point in time. How can this be achieved?
Please select:

• A.Search the Cloud Watch logs to find for the suspicious activity which occurred 11 days ago
• B.Search the Cloudtrail event history on the API events which occurred 11 days ago.
• C.Search the Cloud Watch metrics to find for the suspicious activity which occurred 11 days ago
• D.Use AWS Config to get the API calls which were made 11 days ago.

Comment: *

Name: *

Email: *

Verification: *

A Security Engineer is implementing a solution to allow users to seamlessly encrypt Amazon S3 objects without having to touch the keys directly. The solution must be highly scalable without requiring continual management. Additionally, the organization must be able to immediately delete the encryption keys.
Which solution meets these requirements?

• A.Use KMS with AWS imported key material and then use the DeletelmportedKeyMaterial API to remove the key material if necessary.
• B.Use the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the key if necessary.
• C.Use AWS KMS with AWS managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.
• D.Use AWS CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.

Comment: *

Name: *

Email: *

Verification: *