AWS Certified Security - Specialty practice questions

Question 1

A platform team is designing edge protection for a public web application and must summarize which AWS resource types AWS WAF web ACLs can attach to, before resource policy authoring begins. Per the AWS WAF Developer Guide, which option matches?

Accepted Answer

You can protect Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, AWS Amplify, Amazon CloudWatch, and AWS Verified Access resources with AWS WAF web ACLs.

Answer

AWS WAF web ACLs can attach only to Amazon CloudFront distributions and never to Application Load Balancers, API Gateway, AppSync, Cognito, App Runner, Amplify, or Verified Access resources in any AWS Region of any account.

Answer

AWS WAF web ACLs can attach only to Application Load Balancers and never to Amazon CloudFront, API Gateway, AppSync, Cognito, App Runner, Amplify, or Verified Access resources, so non-ALB workloads need a different L7 protection layer entirely.

Answer

AWS WAF web ACLs can attach only to EC2 instances and Lambda function URLs and never to CloudFront, API Gateway, AppSync, Cognito, App Runner, Amplify, or Verified Access resources, regardless of resource-policy authorization.

Question 2

A security architect is evaluating which actors most commonly create KMS grants in a customer account in practice, so the team can interpret CloudTrail CreateGrant events. Per the AWS KMS Developer Guide, which option matches?

Accepted Answer

Grants are commonly used by AWS services that integrate with AWS KMS to encrypt your data at rest; the service creates a grant on behalf of a user in the account, uses its permissions, and retires the grant as soon as its task is complete.

Answer

KMS grants are created only by Amazon EventBridge as part of routine event routing in the customer account, and have no documented relationship to AWS services encrypting customer data at rest using customer-managed KMS keys in the account.

Answer

KMS grants are created only by the AWS account root user manually from the AWS console and never by any AWS service integration that encrypts customer data at rest in the customer account, so CreateGrant in CloudTrail always means root activity.

Answer

KMS grants are created only by customer-managed Lambda functions and never by AWS-managed services, so CreateGrant entries in CloudTrail always reflect customer-authored code in the customer's own AWS Lambda functions inside the AWS account.

Question 3

A platform team is rolling out VPC Flow Logs to diagnose security-group and network-ACL misconfigurations across a multi-account landing zone and the architect must explain why understanding statefulness matters when reading flow log records. Per the VPC Flow Logs documentation, which option matches?

Accepted Answer

If you're using flow logs to diagnose overly restrictive or permissive security group rules or network ACL rules, be aware of the statefulness of these resources, since security groups and NACLs differ in how they treat return traffic.

Answer

Flow logs treat security groups and network ACLs identically with respect to statefulness, so administrators can ignore any difference between the two resource types when diagnosing overly restrictive or permissive rules in a VPC.

Answer

Flow logs are not suitable for diagnosing overly restrictive or permissive security group rules or network ACL rules at all, since flow log records do not include any information about which rule made the ACCEPT or REJECT decision.

Answer

Flow logs only ever record packet drops caused by AWS Network Firewall and never reflect security group or NACL rule decisions in any record, so they are not useful for diagnosing overly restrictive or permissive rules in a VPC.

Question 4

A security engineer is evaluating how IAM Identity Center actually delivers permission set entitlements into each AWS account in the organization, and the architect must summarize the documented provisioning model. Per the IAM Identity Center user guide, which option matches?

Accepted Answer

When you assign a permission set, IAM Identity Center creates corresponding IAM Identity Center-controlled IAM roles in each account, and attaches the policies specified in the permission set to those roles for the authorized users to assume.

Answer

IAM Identity Center never provisions any IAM resources inside member accounts and instead relies on every member account administrator manually replicating each permission set as IAM users in that member account for the assigned users to log into.

Answer

When you assign a permission set, IAM Identity Center creates only a long-lived IAM access key for each user in the member account and never creates any IAM role for the assigned user to assume on sign-in to the AWS Management Console.

Answer

When you assign a permission set, IAM Identity Center creates only an entry in CloudFormation StackSets and does not actually create any IAM Identity Center-controlled IAM roles in member accounts for the assigned users to assume on sign-in.

Question 5

A regulated workload owner is evaluating which compliance regimes AWS GovCloud (US) Regions are designed to support, so the security team can map workloads to the right Region. Per the AWS GovCloud (US) user guide, which option matches?

Accepted Answer

AWS GovCloud (US) Regions are designed to allow U.S. government agencies and customers move sensitive workloads into the cloud by addressing regulatory and compliance requirements, including FedRAMP High, DoD SRG Impact Levels 4 and 5, and CJIS.

Answer

AWS GovCloud (US) Regions are designed only for academic research workloads and are not documented to support any FedRAMP High, DoD SRG Impact Levels 4 and 5, or CJIS compliance regime for any U.S. government agency or its customers in the AWS cloud.

Answer

AWS GovCloud (US) Regions are designed only for consumer-facing media streaming workloads and are not documented to support any FedRAMP High, DoD SRG Impact Levels 4 and 5, or CJIS compliance regime for any U.S. government agency or its customers.

Answer

AWS GovCloud (US) Regions are designed only for general-purpose enterprise SaaS workloads with no documented compliance posture beyond standard commercial AWS Regions, so customers cannot rely on FedRAMP High, DoD SRG ILs, or CJIS in AWS GovCloud (US).

Question 6

A platform team is evaluating how often Amazon Inspector evaluates network reachability for EC2 instances behind security groups, route tables, and network ACLs, and the architect must summarize the documented behavior. Per the Inspector user guide, which option matches?

Accepted Answer

Amazon Inspector performs network reachability scans once every 12 hours, evaluating EC2 metadata against rules collected from security advisories and surfacing network reachability findings on a documented recurring cadence.

Answer

Amazon Inspector performs network reachability scans only when an administrator triggers a manual reachability assessment from the console, and never on a recurring schedule across the EC2 instances in scope.

Answer

Amazon Inspector performs network reachability scans only once per AWS Region per quarter, regardless of how often security groups, NACLs, or route tables change in the customer's VPCs supporting the EC2 instances under scope.

Answer

Amazon Inspector performs network reachability scans continuously every five seconds, generating a steady stream of new reachability findings for every EC2 instance in scope regardless of any actual change in configuration.

Question 7

A security architect is designing protection for sensitive form-field data such as credit card numbers as they flow from clients through CloudFront into backend application servers. Per the CloudFront Developer Guide, which option matches the documented field-level encryption capability?

Accepted Answer

Field-level encryption adds an additional layer of security that lets you protect specific data throughout system processing so that only certain applications can see it, encrypting sensitive information at the edge close to the user.

Answer

Field-level encryption is a feature of Amazon S3 server-side encryption that operates only on objects stored at rest and has no documented relationship to data fields flowing through CloudFront edge locations toward backend application servers.

Answer

Field-level encryption is a customer-managed JavaScript snippet executed in the browser before any data reaches CloudFront, with no native CloudFront feature involved at the edge layer between clients and the backend application servers.

Answer

Field-level encryption only applies to HTTP headers and never to request body fields, so sensitive form data submitted by a user cannot be encrypted at the CloudFront edge between the client and the customer's backend application servers.

Question 8

A regulated financial services company is choosing between AWS KMS and AWS CloudHSM for cryptographic key custody and the architect must explain what AWS CloudHSM is at a service level. Per the AWS CloudHSM user guide, which option matches?

Accepted Answer

AWS CloudHSM combines the benefits of the AWS cloud with the security of hardware security modules (HSMs), a computing device that processes cryptographic operations and provides secure storage for cryptographic keys in the customer's AWS account.

Answer

AWS CloudHSM is an AWS Lambda function that emulates a hardware security module in software and has no documented relationship to any physical HSM hardware, so customers cannot rely on FIPS-validated hardware key custody from AWS CloudHSM.

Answer

AWS CloudHSM is an Amazon S3 bucket configuration option and has no documented relationship to any hardware security module, so customers cannot rely on FIPS-validated hardware key custody from AWS CloudHSM inside the customer's AWS account.

Answer

AWS CloudHSM is an Amazon Aurora database feature for encrypting database backups and has no documented relationship to any hardware security module, so customers cannot rely on FIPS-validated hardware key custody from AWS CloudHSM at all.

Question 9

A platform team is evaluating whether ALB access logs are captured by default for new Application Load Balancers, and the architect must summarize the documented default behavior. Per the Application Load Balancer documentation, which option matches?

Accepted Answer

Access logs is an optional feature of Elastic Load Balancing that is disabled by default, so administrators must explicitly enable access logs on each ALB before any request-level audit records are captured by the service.

Answer

Access logs is a feature of Elastic Load Balancing that is enabled by default only on Network Load Balancers and is not available at all for Application Load Balancers, so ALB administrators must rely on VPC flow logs only.

Answer

Access logs is a mandatory feature of Elastic Load Balancing that is enabled by default on every new Application Load Balancer in every AWS Region and cannot be disabled by administrators after the load balancer has been created.

Answer

Access logs is a feature of Elastic Load Balancing that is enabled by default on every Application Load Balancer but only retains data for 24 hours, after which records are permanently deleted by AWS without any extension option.

Question 10

A mobile platform team is evaluating how Amazon Cognito identity pools deliver temporary AWS access to authenticated users, and the architect must explain how IAM roles fit into the model. Per the Amazon Cognito Developer Guide, which option matches?

Accepted Answer

Amazon Cognito identity pools assign your authenticated users a set of temporary, limited-privilege credentials to access your AWS resources, with permissions for each user controlled through IAM roles that you create for the application.

Answer

Amazon Cognito identity pools assign authenticated users a permanent IAM access key and never issue any temporary security credentials, so mobile applications must distribute long-lived AWS credentials to every signed-in user across devices.

Answer

Amazon Cognito identity pools do not interact with IAM at all and only issue Amazon Cognito user pool tokens, so authenticated mobile users cannot call any AWS resource API with credentials obtained from an Amazon Cognito identity pool ever.

Answer

Amazon Cognito identity pools assign authenticated users only AWS Lambda@Edge function URLs and never assign IAM-role-backed AWS credentials, so authenticated mobile users cannot directly access any AWS resource using IAM-role-based access.

Question 11

A platform team is evaluating how Customizations for AWS Control Tower keeps deployed resources in sync with the AWS Organizations service control policy posture, and the architect must summarize what the customization framework integrates. Per the AWS Control Tower user guide, which option matches?

Accepted Answer

This infrastructure-as-code customization process integrates AWS CloudFormation templates with AWS service control policies (SCPs) and AWS Control Tower lifecycle events, so that your resource deployments remain synchronized with your landing zone over time.

Answer

This infrastructure-as-code customization process integrates only Amazon S3 bucket policies with AWS Identity Center permission sets and has no documented integration with AWS service control policies (SCPs) or AWS Control Tower lifecycle events in the organization.

Answer

This infrastructure-as-code customization process integrates only Amazon EventBridge rules with AWS Lambda functions and has no documented integration with AWS service control policies (SCPs) or AWS Control Tower lifecycle events in any AWS account in the organization.

Answer

This infrastructure-as-code customization process integrates only Amazon GuardDuty findings with AWS Trusted Advisor recommendations and has no documented integration with AWS service control policies (SCPs) or AWS Control Tower lifecycle events in the organization.

Question 12

An incident responder is designing the triage workflow for GuardDuty alerts and the security architect must list the AWS surfaces officially documented for viewing and managing findings, before the on-call team writes its runbook. Per the GuardDuty user guide, which option matches?

Accepted Answer

You can view and manage your GuardDuty findings on the Findings page in the GuardDuty console, or by using the AWS CLI or API operations, giving responders three documented surfaces for triage automation.

Answer

GuardDuty findings can only be viewed in the GuardDuty console; CLI and API operations are not exposed for findings, so responders must always sign in to the console for any kind of finding query or management.

Answer

GuardDuty findings can only be retrieved by subscribing an SNS topic to a CloudWatch Events rule; there is no API, CLI, or console-based surface available for listing or updating findings directly.

Answer

GuardDuty findings are only exposed through AWS Security Hub aggregated insights; the GuardDuty service itself does not retain findings beyond delivery and provides no console, CLI, or API view of them.

Question 13

A platform team is evaluating what AWS WAF actually controls once a web ACL is attached to a protected resource, and the architect must summarize the documented scope of control. Per the AWS WAF Developer Guide, which option matches?

Accepted Answer

A protection pack web ACL gives you fine-grained control over all of the HTTP(S) web requests that your protected resource responds to, supporting allow and block decisions on requests across the supported AWS resource types.

Answer

A protection pack web ACL gives you control only over the database connection traffic from the protected resource toward Amazon RDS or Aurora and never over any HTTP(S) request that the resource responds to from external clients.

Answer

A protection pack web ACL gives you control only over outbound DNS queries from the protected resource and never over the HTTP(S) web requests that the protected resource responds to, regardless of how the web ACL was configured.

Answer

A protection pack web ACL only emits CloudWatch metrics and provides no documented fine-grained control over the HTTP(S) web requests that the protected resource responds to, regardless of any matching rule on the request.

Question 14

A compliance team is evaluating which operating modes AWS CloudHSM clusters can run in, so the team can map the service to FIPS 140-2 requirements for the application. Per the AWS CloudHSM user guide, which option matches?

Accepted Answer

AWS CloudHSM offers clusters in two modes: FIPS and non-FIPS, so customers can choose between a FIPS-validated configuration for compliance-sensitive workloads and a non-FIPS configuration for workloads that do not require FIPS validation.

Answer

AWS CloudHSM offers operating modes only inside AWS GovCloud (US) Regions and not in commercial AWS Regions, so commercial AWS customers cannot use AWS CloudHSM clusters for any cryptographic operations against any KMS key at all.

Answer

AWS CloudHSM offers only a single non-FIPS operating mode with no documented FIPS mode at all, so customers needing FIPS 140-2 validation cannot use AWS CloudHSM and must use a different cryptographic service for FIPS-validated workloads.

Answer

AWS CloudHSM offers only a single FIPS operating mode with no non-FIPS mode at all, so customers cannot opt out of the documented FIPS mode for any workload running against AWS CloudHSM clusters in their AWS account.

Question 15

A security architect is evaluating how CloudTrail Insights decides what counts as anomalous in a customer's account, and must explain the documented baselining mechanism. Per the AWS CloudTrail user guide, which option matches?

Accepted Answer

CloudTrail Insights analyzes the past management and data events to establish normal patterns of API call rates and API error rates, called the baseline, and then generates Insights events when current rates deviate from the baseline.

Answer

CloudTrail Insights does not establish any baseline of normal activity in the account and instead alerts on every CloudTrail event whose API call rate or error rate is above an AWS-published static threshold for every account.

Answer

CloudTrail Insights uses only customer-authored threshold rules defined in the CloudTrail console and never analyzes past management or data events to establish what is normal for the account under monitoring.

Answer

CloudTrail Insights uses Amazon Macie's data classification models to baseline normal API usage and never inspects historical CloudTrail management or data events for either API call rate or error rate baseline establishment.

AWS Certified Security - Specialty

Sample questions

Sources

Similar exams