Practice workspace
Try 25 supported questions from the 730-question bank. Check each answer when you are ready and keep this preview’s progress privately in your browser.
Free preview
This sample includes answers, available explanations, official references and curated community discussion. An Exam Pass unlocks the private complete bank for this exam.
Answer support
Unexplained marked answers are community claims, not independently verified teaching. Check uncertain or contested items against the official sources below.
25 questions in this bank
A security engineer wants to use Amazon Simple Notification Service (Amazon SNS) to send email alerts to a company's security team for Amazon GuardDuty findings that have a High severity level. The security engineer also wants to deliver these findings to a visualization tool for further examination. Which solution will meet these requirements?
How others answered
A company needs complete encryption of the traffic between external users and an application. The company hosts the application on a fleet of Amazon EC2 instances that run in an Auto Scaling group behind an Application Load Balancer (ALB). How can a security engineer meet these requirements?
How others answered
Explanation
Because of the wording of this question, I did not first know which of the options B and D is correct. However, my conviction that you can't directly install Amazon-issued certificates on EC2 instances (refer to - https://repost.aws/knowledge-center/associate-acm-certificate-alb-nlb for more information) made me to study a few documentations to be sure D is the correct answer. Please check the Accepted answer in the following thread - https://repost.aws/questions/QUIo7PWvZ3T6aFYCByhZ5f0A/load-certificate-on-alb-and-ec2
Adapted from community discussion by AgboolaKun · 2024-05-27 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A security engineer recently rotated all IAM access keys in an AWS account. The security engineer then configured AWS Config and enabled the following AWS Config managed rules: mfa-enabled-for-iam-console-access, iam-user-mfa-enabled, access-keys-rotated, and iam-user-unused-credentials-check. The security engineer notices that all resources are displaying as noncompliant after the IAM GenerateCredentialReport API operation is invoked. What could be the reason for the noncompliant status?
How others answered
Explanation
When these AWS Config rules are triggered, they rely on the latest IAM credential report to evaluate compliance. If the IAM credential report has been generated within the past 4 hours, it might not reflect the most recent changes, such as the rotation of access keys. To address this, it's a good practice to ensure that the IAM credential report is generated and updated at regular intervals, and AWS Config rules are then evaluated against the most recent report. You can schedule the generation of the IAM credential report and the evaluation of AWS Config rules accordingly. A &C are incorrect because the noncompliance is related to the timeliness of the IAM credential report rather than permissions. Option D is incorrect because the MaximumExecutionFrequency value doesn't affect the initial evaluation of the rules; it determines how often the rule is re-evaluated after its first evaluation.
Adapted from community discussion by vikasj1in · 2024-07-15 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company has AWS accounts in an organization in AWS Organizations. The organization includes a dedicated security account. All AWS account activity across all member accounts must be logged and reported to the dedicated security account. The company must retain all the activity logs in a secure storage location within the dedicated security account for 2 years. No changes or deletions of the logs are allowed. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
How others answered
Only 64% agreed on this answer — treat it as contested rather than settled.
Explanation
I go with BD, because each Member Account has to write into the security Account S3 bucket, not only the Organization Management Account. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-set-bucket-policy-for-multiple-accounts.html
Adapted from community discussion by ahrentom · 2023-11-30 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installs the Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2 instances launch with an IAM role that has an IAM policy attached. The policy provides access to publish custom metrics to CloudWatch. The EC2 instances run in a private subnet inside a VPC The VPC provides access to the internet for private subnets through a NAT gateway. A security engineer notices that no logs are being published to CloudWatch Logs for the EC2 instances that the Auto Scaling group launches. The security engineer validates that the CloudWatch Logs agent is running and is configured properly on the EC2 instances. In addition, the security engineer validates that network communications are working properly to AWS services. What can the security engineer do to ensure that the logs are published to CloudWatch Logs?
How others answered
Only 52% agreed on this answer — treat it as contested rather than settled.
Explanation
A. Configure the IAM policy in use by the IAM role to have access to the required cloudwatch: API actions that will publish logs. (Most Voted) Explanation: IAM Permissions Issue: Since the CloudWatch agent is running properly, the issue is likely related to insufficient IAM permissions for the EC2 instances' IAM role. Correct CloudWatch API Actions B. Adjust the Auto Scaling service-linked role ❌ → The Auto Scaling service-linked role does not affect CloudWatch Logs; it is only needed for managing EC2 instances. C. Configure the IAM policy for AWS logs: API actions ❌ → AWS Logs is not a valid service namespace; the CloudWatch agent requires logs: and cloudwatch: API actions. D. Add a VPC Endpoint ❌ → The question states that network communications are working fine via the NAT gateway, so connectivity to CloudWatch is not an issue.
Adapted from community discussion by AWSLoverLoverLoverLoverLover · 2025-02-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company uses Amazon Elastic Container Service (Amazon ECS) containers that have the Fargate launch type. The containers run web and mobile applications that are written in Java and Node.js. To meet network segmentation requirements, each of the company’s business units deploys applications in its own dedicated AWS account. Each business unit stores container images in an Amazon Elastic Container Registry (Amazon ECR) private registry in its own account. A security engineer must recommend a solution to scan ECS containers and ECR registries for vulnerabilities in operating systems and programming language libraries. The company’s audit team must be able to identify potential vulnerabilities that exist in any of the accounts where applications are deployed. Which solution will meet these requirements?
How others answered
Explanation
Amazon Inspector: Amazon Inspector is a tool specifically designed to scan containers and registries for vulnerabilities in operating systems and programming language libraries. Integration with AWS Security Hub: Configuring Amazon Inspector to send vulnerability findings to AWS Security Hub in a central security account allows for centralized visibility and facilitates access for the audit team to review the findings. Account configuration: Updating each ECR registry in each account to use Amazon Inspector ensures that all registries and containers are properly scanned in each business account.
Adapted from community discussion by 5409b91 · 2024-05-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company has a large fleet of Linux Amazon EC2 instances and Windows EC2 instances that run in private subnets. The company wants all remote administration to be performed as securely as possible in the AWS Cloud. Which solution will meet these requirements?
How others answered
Explanation
Answer is A Definitely not C or D because EC2 Instance Connect supports only linux instances https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-linux-inst-eic.html Session Manager provides secure and auditable node management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys. Session Manager provides support for Windows, Linux, and macOS from a single tool. https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html
Adapted from community discussion by Zek · 2024-05-13 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company runs workloads in the us-east-1 Region. The company has never deployed resources to other AWS Regions and does not have any multi-Region resources. The company needs to replicate its workloads and infrastructure to the us-west-1 Region. A security engineer must implement a solution that uses AWS Secrets Manager to store secrets in both Regions. The solution must use AWS Key Management Service (AWS KMS) to encrypt the secrets. The solution must minimize latency and must be able to work if only one Region is available. The security engineer uses Secrets Manager to create the secrets in us-east-1. What should the security engineer do next to meet the requirements?
How others answered
Only 54% agreed on this answer — treat it as contested rather than settled.
Explanation
D. Encrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1. Customer Managed KMS Key: Encrypting secrets in us-east-1 with a customer managed KMS key allows greater control over key rotation policies and permissions, ensuring higher security and compliance. Replication of secrets to us-west-1: Replicating the secrets to us-west-1 ensures that the secrets are available in both regions, meeting the requirement to function even if only one region is available. Using the same customer managed KMS key in us-west-1: Encrypting the secrets in us-west-1 using the KMS key from us-east-1 ensures consistency in encryption and secret management across regions. Additionally, this can help minimize latency, as the same key is used for both regions, making the replication process more efficient.
Adapted from community discussion by 5409b91 · 2024-05-21 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company uses AWS Organizations and has production workloads across multiple AWS accounts. A security engineer needs to design a solution that will proactively monitor for suspicious behavior across all the accounts that contain production workloads. The solution must automate remediation of incidents across the production accounts. The solution also must publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when a critical security finding is detected. In addition, the solution must send all security incident logs to a dedicated account. Which solution will meet these requirements?
How others answered
Explanation
I would say it is C as Guardduty must be turned on even for the security hub options. Also you can aggregate GuardDuty Findings and trigger Events. https://aws.amazon.com/blogs/security/how-to-manage-amazon-guardduty-security-findings-across-multiple-accounts/ https://repost.aws/knowledge-center/guardduty-eventbridge-sns-rule
Adapted from community discussion by bhui · 2023-10-27 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company has AWS accounts in an organization in AWS Organizations. The company needs to install a corporate software package on all Amazon EC2 instances for all the accounts in the organization. A central account provides base AMIs for the EC2 instances. The company uses AWS Systems Manager for software inventory and patching operations. A security engineer must implement a solution that detects EC2 instances that do not have the required software. The solution also must automatically install the software if the software is not present. Which solution will meet these requirements?
How others answered
Explanation
My answer is C. Detecting Missing Software: AWS Config with the ec2-managedinstance-applications-required rule continuously monitors EC2 instances and identifies ones without the required software. Automated Installation: The EventBridge rule automatically triggers upon a Config non-compliance event. Centralized Management: The solution operates centrally from the organization's master account, ensuring consistent enforcement across all member accounts. Flexibility: This approach allows for future software updates by simply modifying the Lambda function logic or the package definition in Systems Manager Distributor.
Adapted from community discussion by aescudero51 · 2024-06-09 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company has a batch-processing system that uses Amazon S3, Amazon EC2, and AWS Key Management Service (AWS KMS). The system uses two AWS accounts: Account A and Account B. Account A hosts an S3 bucket that stores the objects that will be processed. The S3 bucket also stores the results of the processing. All the S3 bucket objects are encrypted by a KMS key that is managed in Account A. Account B hosts a VPC that has a fleet of EC2 instances that access the S3 bucket in Account A by using statements in the bucket policy. The VPC was created with DNS hostnames enabled and DNS resolution enabled. A security engineer needs to update the design of the system without changing any of the system's code. No AWS API calls from the batch-processing EC2 instances can travel over the internet. Which combination of steps will meet these requirements? (Choose two.)
How others answered
Explanation
I will going to AC, when I look at the question , I saw "fleet of EC2" this means Account B have many EC2. Go to link. you will see many topology, and you will understand what I mean. https://aws.amazon.com/tr/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/
Adapted from community discussion by komik_101 · 2024-10-29 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company uses several AWS CloudFormation stacks to handle the deployment of a suite of applications. The leader of the company's application development team notices that the stack deployments fail with permission errors when some team members try to deploy the stacks. However, other team members can deploy the stacks successfully. The team members access the account by assuming a role that has a specific set of permissions that are necessary for the job responsibilities of the team members. All team members have permissions to perform operations on the stacks. Which combination of steps will ensure consistent deployment of the stacks MOST securely? (Choose three.)
How others answered
Only 43% agreed on this answer — treat it as contested rather than settled.
Explanation
B. Create a service role that has cloudformation.amazonaws.com as the service principal. Configure the role to allow the sts action. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html D. For each required set of permissions, add a separate policy to the role to allow those permissions. Add the ARN of each service that needs the permissions in the resource field of the corresponding policy. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html#using-iam-servicerole-add E. Update each stack to use the service role. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html
Adapted from community discussion by cumzle_com · 2024-06-18 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company used a lift-and-shift approach to migrate from its on-premises data centers to the AWS Cloud. The company migrated on-premises VMs to Amazon EC2 instances. Now the company wants to replace some of components that are running on the EC2 instances with managed AWS services that provide similar functionality. Initially, the company will transition from load balancer software that runs on EC2 instances to AWS Elastic Load Balancers. A security engineer must ensure that after this transition, all the load balancer logs are centralized and searchable for auditing. The security engineer must also ensure that metrics are generated to show which ciphers are in use. Which solution will meet these requirements?
How others answered
Only 66% agreed on this answer — treat it as contested rather than settled.
Explanation
You can't send ELB access logs into CloudWatch Logs, but to S3 only: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-access-logging.html Regarding the alarm, natively there is no way to use query result as a metric.We could use a Lambda Function for this. C remains the most valid option.
Adapted from community discussion by Ghe · 2024-03-16 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
A company uses AWS Organizations to manage a multi-account AWS environment in a single AWS Region. The organization's management account is named management-01. The company has turned on AWS Config in all accounts in the organization. The company has designated an account named security-01 as the delegated administrator for AWS Config. All accounts report the compliance status of each account's rules to the AWS Config delegated administrator account by using an AWS Config aggregator. Each account administrator can configure and manage the account's own AWS Config rules to handle each account's unique compliance requirements. A security engineer needs to implement a solution to automatically deploy a set of 10 AWS Config rules to all existing and future AWS accounts in the organization. The solution must turn on AWS Config automatically during account creation. Which combination of steps will meet these requirements? (Choose two.)
How others answered
Explanation
Supplementing my thoughts with this blog. https://aws.amazon.com/blogs/mt/org-aggregator-delegated-admin/ 1. To enable AWS Config access to AWS Organizations - Run the following command from your organization management account: 2. To set up an aggregator using delegated admin
Adapted from community discussion by bhui · 2023-10-27 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store's application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account. The company uses AWS Organizations and has an OU that is used only for these accounts. The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company's deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access. The security engineer already has created an AWS CloudFormation template that implements the deployment plan. What should the security engineer do next to meet the requirements in the MOST secure way?
How others answered
Explanation
To use Service Catalog with multiple AWS accounts, you need to enable AWS Organizations with all features enabled. This allows you to centrally manage your accounts and apply policies across your organization. You can also use Service Catalog as a service principal for AWS Organizations, which lets you share your portfolios with organizational units (OUs) or accounts in your organization. To create a Service Catalog portfolio, you need to use an administrator account, such as the organization's management account. You can upload your CloudFormation template as a product in your portfolio, and define constraints and tags for it. You can then share your portfolio with the OU that contains the accounts for the web applications. This will allow the developers in those accounts to launch products from the shared portfolio using the Service Catalog end user console.
Adapted from community discussion by Christina666 · 2024-05-19 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
An ecommerce company has a web application architecture that runs primarily on containers. The application containers are deployed on Amazon Elastic Container Service (Amazon ECS). The container images for the application are stored in Amazon Elastic Container Registry (Amazon ECR). The company's security team is performing an audit of components of the application architecture. The security team identifies issues with some container images that are stored in the container repositories. The security team wants to address these issues by implementing continual scanning and on-push scanning of the container images. The security team needs to implement a solution that makes any findings from these scans visible in a centralized dashboard. The security team plans to use the dashboard to view these findings along with other security-related findings that they intend to generate in the future. There are specific repositories that the security team needs to exclude from the scanning process. Which solution will meet these requirements?
How others answered
Explanation
Amazon Inspector supports the configuration of inclusion rules to select which ECR repositories are scanned. Please see more information here - https://aws.amazon.com/inspector/faqs/
Adapted from community discussion by AgboolaKun · 2023-10-18 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company that uses AWS Organizations is using AWS IAM Identity Center (AWS Single Sign-On) to administer access to AWS accounts. A security engineer is creating a custom permission set in IAM Identity Center. The company will use the permission set across multiple accounts. An AWS managed policy and a customer managed policy are attached to the permission set. The security engineer has full administrative permissions and is operating in the management account. When the security engineer attempts to assign the permission set to an IAM Identity Center user who has access to multiple accounts, the assignment fails. What should the security engineer do to resolve this failure?
How others answered
Explanation
Give this a read y'all. Answer indeed is A. You must create the CMP in each account unlike the AWS Managed Policies https://aws.amazon.com/blogs/security/how-to-use-customer-managed-policies-in-aws-single-sign-on-for-advanced-use-cases/#:~:text=Configure%20an%20IAM%20Identity%20Center%20permission%20set%20to%20use%20a%20CMP
Adapted from community discussion by [Removed] · 2023-11-22 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company has several petabytes of data. The company must preserve this data for 7 years to comply with regulatory requirements. The company's compliance team asks a security officer to develop a strategy that will prevent anyone from changing or deleting the data. Which solution will meet this requirement MOST cost-effectively?
How others answered
Explanation
To meet the requirement of preserving several petabytes of data for 7 years in a cost-effective manner while ensuring that the data cannot be changed or deleted, option C is the most suitable solution. Here's why: Creating a vault in Amazon S3 Glacier and implementing a Vault Lock policy ensures that the data is stored using a write-once-read-many (WORM) model, which prevents any changes or deletions during the specified retention period. S3 Glacier is designed for long-term storage of infrequently accessed data, making it a cost-effective choice for this use case. The Vault Lock policy will enforce compliance with regulatory requirements by ensuring that the data remains immutable for the entire retention period. This approach leverages the cost benefits of S3 Glacier for long-term storage while providing the necessary security and compliance features to meet the company's requirements.
Adapted from community discussion by IPLogic · 2024-12-03 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are deployed in a private subnet of a VPC that does not have internet access. The EC2 instances and the S3 buckets are in the same AWS account. The EC2 instances access the S3 buckets through an S3 gateway endpoint that has the default access policy. Each EC2 instance is associated with an instance profile role that has a policy that explicitly allows the s3:GetObject action and the s3:PutObject action for only the required S3 buckets. The company learns that one or more of the EC2 instances are compromised and are exfiltrating data to an S3 bucket that is outside the company's organization in AWS Organizations. A security engineer must implement a solution to stop this exfiltration of data and to keep the EC2 processing job functional. Which solution will meet these requirements?
How others answered
Only 41% agreed on this answer — treat it as contested rather than settled.
Explanation
Blocking at the network layer would allow you still have other workloads that can talk to other buckets outside of the account whereas the option D as others have suggested would mean no workload in the account would ever be able to talk to a bucket outside the org which is IMO too restrictive and the solution is not asking for a general solution just to this specific problem. You can also create additional VPC endpoints and bound them to other route tables which don't have this policy as to allow for other architectural possibilities mentioned above,
Adapted from community discussion by 9bb8cb3 · 2024-04-23 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A security engineer logs in to the AWS Lambda console with administrator permissions. The security engineer is trying to view logs in Amazon CloudWatch for a Lambda function that is named myFunction. When the security engineer chooses the option in the Lambda console to view logs in CloudWatch, an "error loading Log Streams" message appears. The IAM policy for the Lambda function's execution role contains the following:
How should the security engineer correct the error?
How others answered
Explanation
Action "logs:GetLogEvents" gets log events from log stream (https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html), but there no log stream on first place! Correct answer is allowing the function to create log stream (through logs:CreateLogStream). D.
Adapted from community discussion by Raphaello · 2024-02-20 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company is using Amazon Route 53 Resolver for its hybrid DNS infrastructure. The company has set up Route 53 Resolver forwarding rules for authoritative domains that are hosted on on-premises DNS servers. A new security mandate requires the company to implement a solution to log and query DNS traffic that goes to the on-premises DNS servers. The logs must show details of the source IP address of the instance from which the query originated. The logs also must show the DNS name that was requested in Route 53 Resolver. Which solution will meet these requirements?
How others answered
Explanation
C is the only answer as you need to config resolver query logging on all vpc, and cloudwatch log insight indeed allow you to query the source IP address. https://aws.amazon.com/blogs/aws/log-your-vpc-dns-queries-with-route-53-resolver-query-logs/
Adapted from community discussion by Daniel76 · 2024-01-01 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company has deployed Amazon GuardDuty and now wants to implement automation for potential threats. The company has decided to start with RDP brute force attacks that come from Amazon EC2 instances in the company's AWS environment. A security engineer needs to implement a solution that blocks the detected communication from a suspicious instance until investigation and potential remediation can occur. Which solution will meet these requirements?
How others answered
Only 73% agreed on this answer — treat it as contested rather than settled.
Explanation
Let Guardduty detections be sent to Security Hub as findings is a simple and elegant way. https://docs.aws.amazon.com/guardduty/latest/ug/securityhub-integration.html Use eventbridge to respond by invoke Lambda. Amazon Kinesis data stream not needed. https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cloudwatch-events.html Suggest to only block specific port 389 against thse suspicious EC2 instance instead of isolate it in a security group, to minimize the impact while it has not been verified as a confirmed attack.
Adapted from community discussion by Daniel76 · 2024-09-24 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A security engineer is trying to use Amazon EC2 Image Builder to create an image of an EC2 instance. The security engineer has configured the pipeline to send logs to an Amazon S3 bucket. When the security engineer runs the pipeline, the build fails with the following error: "AccessDenied: Access Denied status code: 403". The security engineer must resolve the error by implementing a solution that complies with best practices for least privilege access. Which combination of steps will meet these requirements? (Choose two.)
How others answered
Explanation
Please note that an instance profile is an IAM role for the EC2 instance. Therefore, the option A which states that "IAM role attached to the engineer" is wrong. Please check this link for more information - https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html#ts-access-denied
Adapted from community discussion by AgboolaKun · 2024-05-27 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A security engineer must use AWS Key Management Service (AWS KMS) to design a key management solution for a set of Amazon Elastic Block Store (Amazon EBS) volumes that contain sensitive data. The solution needs to ensure that the key material automatically expires in 90 days. Which solution meets these criteria?
How others answered
Explanation
You may set an expiration period for an imported key. AWS KMS will automatically delete the key material after the expiration period. You can also delete imported key material on demand. In both cases the key material itself is deleted but the KMS key reference in AWS KMS and associated metadata are retained so that the key material can be re-imported in the future. Keys generated by AWS KMS do not have an expiration time and cannot be deleted immediately; there is a mandatory 7 to 30 day wait period. All customer managed KMS keys, regardless of whether the key material was imported, can be manually disabled or scheduled for deletion. In this case the KMS key itself is deleted, not just the underlying key material. https://aws.amazon.com/kms/faqs/
Adapted from community discussion by rahav · 2023-12-24 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
A company has an AWS account that hosts a production application. The company receives an email notification that Amazon GuardDuty has detected an Impact:IAMUser/AnomalousBehavior finding in the account. A security engineer needs to run the investigation playbook for this security incident and must collect and analyze the information without affecting the application. Which solution will meet these requirements MOST quickly?
How others answered
Explanation
Using CloudTrail (Insights & Lake) is not entirely wrong for the the aforementioned case, however, since the ask is to analyze the events "QUICKLY", I think Detective provides a good integration with GuardDuty to correlate data and analyze them. I would go with B only for this.."quickly"!
Adapted from community discussion by Raphaello · 2024-02-09 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SCS-C02 practice, question 1 of 25
Compiled from exam discussions posted publicly by other people on ExamTopics. Copyright in each contribution rests with its original author; it is reproduced here for study. Not verified by us — most items carry no explanation. To request removal, see our content policy.
Compiled from ExamTopics community discussions
Compiled from publicly posted community exam discussions. Contributed by third parties rather than written here, so accuracy varies and most items carry no explanation.
Across the private full bank: 150 explanations, 730 questions with candidate context and 151 questions with direct citations.
Version 1.0.0 · bank updated . How we source questions