AWS Certified Security - Specialty

Question 1

A security team runs a public-facing web application behind an Application Load Balancer (ALB) that terminates TLS using a certificate provisioned by AWS Certificate Manager (ACM). A PCI DSS audit requires that the application no longer negotiate TLS 1.0 or TLS 1.1 and must reject weak ciphers, while still supporting modern browsers. What is the MOST appropriate action to enforce this requirement?

Accepted Answer

Update the HTTPS listener on the ALB to use a predefined ELB security policy that only permits TLS 1.2 and above.

Answer

Reissue the ACM certificate with a stronger key algorithm so that older TLS versions are automatically disabled.

Answer

Attach an AWS WAF rule to the ALB that inspects the TLS handshake and blocks connections using TLS 1.0 or 1.1.

Answer

Enable AWS Config managed rules to detect and automatically remediate the certificate's supported protocol versions.

Question 2

A media company hosts a static website in an S3 bucket served through a CloudFront distribution. The web team, which operates primarily in the eu-west-1 Region, requests an ACM certificate for their custom domain so that the distribution can serve HTTPS traffic. They created a public certificate in ACM in eu-west-1, validated it via DNS, and confirmed its status is 'Issued'. However, the certificate does not appear as a selectable option when they attempt to associate it with the CloudFront distribution. What is the cause and correct remediation?

Accepted Answer

CloudFront only supports certificates that are stored in ACM in the us-east-1 (N. Virginia) Region; request or import the certificate in us-east-1 and associate it with the distribution.

Answer

The certificate must be exported from ACM and manually uploaded to CloudFront, because CloudFront cannot reference ACM-managed certificates directly.

Answer

CloudFront requires certificates issued by AWS Private CA rather than public ACM certificates; reissue the certificate using a private CA.

Answer

The certificate's DNS validation must be redone using email validation, because CloudFront ignores DNS-validated ACM certificates.

Question 3

A company runs a public-facing application behind an Application Load Balancer. The security team uses an SSL/TLS certificate that was issued by the company's existing third-party certificate authority and then imported into AWS Certificate Manager (ACM). During an audit, the team is concerned about a repeat of a past incident where the certificate expired and caused an outage. Which approach ensures they are proactively warned before this imported certificate expires?

Accepted Answer

Use the ACM-provided Amazon CloudWatch metric 'DaysToExpiry' and configure a CloudWatch alarm (or an EventBridge rule for the ACM expiration event) to notify the team before expiry.

Answer

Rely on ACM to automatically renew the imported certificate 60 days before expiration, as it does for all certificates in ACM.

Answer

Enable AWS Config managed rule 'acm-certificate-rsa-check' to force renewal of the imported certificate automatically.

Answer

Migrate the certificate's private key into AWS Secrets Manager and enable automatic rotation to replace the certificate before it expires.

Question 4

A company runs a public-facing REST API behind an Application Load Balancer (ALB). Security requires that the TLS private key used to terminate connections is never exportable or accessible to administrators, and that certificate renewal happens automatically without operator intervention. The team currently uses a certificate issued by a public third-party certificate authority that they trust. Which approach best meets all requirements?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) for the domain and associate it with the ALB listener, allowing ACM to manage the private key and renewal.

Answer

Import the existing third-party certificate and private key into ACM and associate it with the ALB, relying on ACM to rotate the key automatically.

Answer

Store the third-party private key in AWS Secrets Manager, enable automatic rotation, and reference the secret from the ALB listener configuration.

Answer

Upload the certificate and private key to IAM as a server certificate and attach it to the ALB, using IAM access policies to prevent administrators from reading the key.

Question 5

A financial services company runs a fleet of internal microservices on EC2 instances behind internal Application Load Balancers within a private VPC. Security policy requires mutual TLS between all internal services using X.509 certificates issued by a certificate authority the company controls. The certificates must be short-lived and automatically renewed, and the CA's root must NOT be publicly trusted. Which solution best meets these requirements?

Accepted Answer

Deploy AWS Private CA (ACM Private CA) as the internal root/subordinate hierarchy, issue certificates through ACM for the ALBs, and distribute the private CA root to services for trust validation.

Answer

Use AWS Certificate Manager (ACM) public certificates for each service and configure the internal ALBs to require client certificates.

Answer

Store self-signed certificates in AWS Secrets Manager and configure a Lambda rotation function to replace them every 24 hours on each service.

Answer

Purchase certificates from a third-party public CA and import them into ACM, then attach them to the internal ALBs for mutual TLS.

Question 6

A security engineer stores several years of CloudTrail logs in an S3 bucket organized by the standard prefix pattern (AWSLogs//CloudTrail/////). Analysts run frequent Athena queries filtered to a specific account, region, and date range, but queries are slow and scan far more data than expected, driving up cost. The engineer wants to reduce data scanned and query time without running a crawler or manually adding partitions each day. Which approach best meets these requirements?

Accepted Answer

Enable partition projection on the Athena table by defining partition keys (region, date) with projection type and ranges in the table properties so partitions are calculated at query time.

Answer

Convert all existing CloudTrail JSON logs to a single uncompressed CSV file and re-create the Athena table pointing at it.

Answer

Schedule an AWS Glue crawler to run every hour to discover and register new partitions in the Data Catalog.

Answer

Increase the Athena query result location storage class to S3 Intelligent-Tiering to lower scan costs.

Question 7

A healthcare company operates a public web application behind CloudFront and an Application Load Balancer. A form collects patients' credit card numbers and Social Security numbers. Compliance requires that these specific fields remain encrypted from the moment they enter the AWS edge, so that even the application servers and downstream microservices cannot read them — only a dedicated payment processing service holding a private key may decrypt them. The rest of the request must remain readable for normal application processing. Which CloudFront capability meets this requirement with the least change to backend components?

Accepted Answer

Enable CloudFront field-level encryption with a public key configuration so the specified sensitive fields are encrypted at the edge before forwarding to the origin.

Answer

Attach an AWS WAF web ACL to the distribution with a rule that masks the sensitive form fields before they reach the origin.

Answer

Require HTTPS between the viewer and CloudFront and between CloudFront and the origin using a custom ACM certificate to protect the fields in transit.

Answer

Use a CloudFront Function on the viewer request event to hash the sensitive fields with SHA-256 before they are forwarded to the ALB.

Question 8

A media company streams licensed video content through Amazon CloudFront. Licensing agreements require that content be accessible only from viewers in Canada and the United States. Additionally, the security team wants to block a specific list of malicious IP addresses regardless of their geographic origin, and they want both controls applied at the edge with the lowest possible latency and cost. Which combination of controls should the security engineer implement?

Accepted Answer

Use CloudFront geographic restrictions (geo-blocking) to allow only Canada and the US, and associate an AWS WAF web ACL with an IP set rule to block the malicious IPs

Answer

Use AWS WAF geo-match rules to allow only Canada and the US, and configure security groups on the origin to block the malicious IP addresses

Answer

Use CloudFront geographic restrictions for both the country allow-list and the malicious IP blocking, since geo-restriction supports CIDR deny lists

Answer

Use a Lambda@Edge function to inspect the CloudFront-Viewer-Country header and the source IP, rejecting requests that do not match policy

Question 9

A company serves static content from a private S3 bucket through a CloudFront distribution. Security review reveals that the S3 objects can still be downloaded directly using their public S3 URLs, bypassing CloudFront (and its attached WAF web ACL). The team must ensure content is only reachable through CloudFront while following current AWS best practices. What should they implement?

Accepted Answer

Configure an Origin Access Control (OAC) on the CloudFront origin and update the S3 bucket policy to allow only the distribution's service principal, while keeping public access blocked.

Answer

Enable S3 Block Public Access on the bucket and rely on CloudFront's default behavior to make direct object access impossible.

Answer

Attach the WAF web ACL directly to the S3 bucket so the same Layer 7 rules are enforced regardless of access path.

Answer

Make the S3 bucket public and add a bucket policy that only allows requests originating from CloudFront edge location IP ranges.

Question 10

A media company serves video thumbnails and metadata through CloudFront backed by an Application Load Balancer in a single AWS Region. During viral traffic spikes, they observe that origin request volume overwhelms the ALB even though most objects are cacheable, because CloudFront has many regional edge caches making independent requests to the origin on cache misses. The security team also wants to minimize the origin's exposure to direct request bursts. Which CloudFront configuration change most directly reduces redundant origin fetches and consolidates requests to the origin?

Accepted Answer

Enable CloudFront Origin Shield in the Region closest to the origin so cache misses are consolidated through a single additional caching layer

Answer

Attach an AWS WAF rate-based rule to the CloudFront distribution to throttle requests before they reach the origin

Answer

Increase the default TTL to the maximum and rely on regional edge caches to independently serve traffic without contacting the origin

Answer

Replace the ALB origin with an Origin Access Control configuration to authenticate all origin requests

Question 11

A media company stores premium video files in an S3 bucket and serves them to paying subscribers through a CloudFront distribution. The security team requires that each video link works only for a specific authenticated subscriber and automatically stops working after 6 hours. Direct S3 access must remain blocked, and links must not be shareable in a way that grants indefinite access. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable CloudFront signed URLs with a time-limited expiration policy, and use Origin Access Control (OAC) so the S3 bucket only accepts requests from the distribution.

Answer

Attach an AWS WAF web ACL to the distribution with a rate-based rule that limits each subscriber to a fixed number of requests per 6 hours.

Answer

Enable S3 presigned URLs generated by the application and point subscribers directly to the S3 object URLs instead of using CloudFront.

Answer

Configure a CloudFront geo-restriction allow list and require subscribers to log in through Cognito before each playback session.

Question 12

A security engineer configured a CloudTrail trail to deliver events to a CloudWatch Logs log group so that metric filters and alarms can be created. Events are successfully delivered to the S3 bucket, but no log streams or events are appearing in the CloudWatch Logs log group. The trail shows no obvious errors in the console. What is the MOST likely cause?

Accepted Answer

The IAM role that CloudTrail assumes to write to CloudWatch Logs lacks the logs:CreateLogStream and logs:PutLogEvents permissions for the target log group

Answer

The CloudWatch Logs log group retention period is set too low, causing events to be deleted before they can be viewed

Answer

The S3 bucket policy is missing the required s3:GetBucketAcl permission for the CloudTrail service principal

Answer

Data events are not enabled on the trail, so no management events are forwarded to CloudWatch Logs

Question 13

A security engineer configured an organization trail in CloudTrail to log all management events to a central S3 bucket. During an investigation, the team notices that API calls made in the us-west-2 region for a member account are appearing in the logs, but Amazon S3 object-level GetObject and PutObject calls made against buckets in that account are completely absent from the delivered log files. The trail is confirmed to be logging and delivering files successfully. What is the MOST likely reason the S3 object-level activity is missing?

Accepted Answer

The trail is only configured to log management events; data events for S3 must be explicitly enabled on the trail.

Answer

S3 object-level operations are only captured by VPC Flow Logs, not by CloudTrail.

Answer

The organization trail does not apply to member accounts, so their S3 activity is never recorded.

Answer

CloudTrail log file integrity validation stripped the S3 object-level events because they failed digest verification.

Question 14

A security team must be alerted within seconds whenever any IAM policy is attached to a user, group, or role across a single account. They already have an organization CloudTrail delivering management events to an S3 bucket and to a CloudWatch Logs log group. The team wants the lowest-latency, most operationally efficient way to trigger an SNS notification when these specific API calls occur. Which approach best meets the requirement?

Accepted Answer

Create an EventBridge rule that matches the AttachUserPolicy, AttachGroupPolicy, and AttachRolePolicy CloudTrail events and targets an SNS topic.

Answer

Create a CloudWatch Logs metric filter on the log group for the policy-attach events, publish a metric, and configure a CloudWatch alarm that notifies SNS.

Answer

Schedule an Athena query every minute against the CloudTrail S3 bucket and send results to SNS when matches are found.

Answer

Enable CloudTrail Insights to detect the policy-attach events and route Insights findings to SNS.

Question 15

A security team wants to detect unusual patterns in API call volume and error rates across their AWS account, such as a sudden spike in IAM policy modifications or an unusual burst of TerminateInstances calls that could indicate compromised credentials. They already have a management events trail enabled but no automated way to surface anomalous behavior. They do not want to build and maintain custom baselining logic or manually tune CloudWatch metric filters for every API. Which approach best meets this requirement with the least operational overhead?

Accepted Answer

Enable CloudTrail Insights events on the existing trail to automatically detect and log unusual write API call rate and error rate activity.

Answer

Create CloudWatch Logs metric filters for every sensitive API action and configure alarms with static thresholds for each one.

Answer

Schedule an Athena query against the CloudTrail S3 bucket every hour and compare call counts against manually maintained baselines.

Answer

Enable CloudTrail data events for all resources and route them to a Lambda function that computes rolling averages of API call rates.

Question 16

A security team must run ad hoc SQL queries against 18 months of CloudTrail management events to investigate historical API activity. Currently, CloudTrail delivers logs to an S3 bucket, and the team queries them using Athena. However, they find that maintaining Athena table partitions and re-running the AWS Glue crawler as new log prefixes arrive is error-prone, and some queries return incomplete results because partitions were not updated. The team wants a managed solution that requires no partition management and lets them query events with SQL for up to 7 years. Which approach best meets these requirements with the least ongoing maintenance?

Accepted Answer

Create a CloudTrail Lake event data store with an extended retention period and run SQL queries directly against it.

Answer

Enable Athena partition projection on the existing CloudTrail table and configure a longer S3 lifecycle retention.

Answer

Send CloudTrail logs to CloudWatch Logs and use CloudWatch Logs Insights to query the 18-month history.

Answer

Schedule a daily AWS Glue crawler run via EventBridge to keep the Athena partitions current and store logs in S3 Glacier.

Question 17

A security analyst configured a multi-Region CloudTrail trail delivering management events to an S3 bucket. During an incident investigation, they notice that an API call known to have occurred at 14:02 UTC does not appear in the S3 bucket when they check at 14:08 UTC. The trail is enabled, the S3 bucket policy is correct, and log file validation shows no gaps once files arrive. What is the MOST likely explanation, and what should the analyst do?

Accepted Answer

CloudTrail typically delivers log files to S3 within about 15 minutes of an API call; the analyst should wait and recheck, as this delay is expected behavior.

Answer

The trail is missing an SNS notification configuration, which is required before any events can be written to S3.

Answer

Management events are not captured by default and must be explicitly enabled with a data event selector before they appear in the bucket.

Answer

The event was a global service event that is only delivered to the trail's home Region bucket prefix, so it will never appear in a multi-Region trail.

Question 18

A security engineer must prove to auditors that CloudTrail log files stored in an S3 bucket have not been modified or deleted since delivery. The organization already has a multi-Region trail delivering logs to a dedicated central logging account. During a compliance review, the auditors ask for a mechanism that can cryptographically verify whether any log file was altered or removed after CloudTrail wrote it. Which approach satisfies this requirement?

Accepted Answer

Enable CloudTrail log file integrity validation and use the digest files with the AWS CLI validate-logs command to verify the hashes.

Answer

Enable S3 server-side encryption with SSE-KMS on the log bucket so tampering is prevented by encryption.

Answer

Turn on S3 Versioning and MFA Delete on the log bucket to detect and block modifications.

Answer

Configure AWS Config to record configuration changes to the S3 bucket and alert on any object-level modifications.

Question 19

A company has 40 accounts in AWS Organizations. The security team wants to guarantee that management events from every existing and future member account are captured in a single, tamper-evident location, without requiring administrators in each account to create or maintain their own trails. Which approach BEST meets these requirements with the least ongoing operational overhead?

Accepted Answer

Create an organization trail from the management account that delivers logs to a centralized S3 bucket, and enable log file validation.

Answer

Provide a CloudFormation StackSet that deploys an individual account-level trail in each member account, delivering to a local S3 bucket.

Answer

Enable CloudTrail Insights in each member account and forward findings to a central Security Hub aggregator.

Answer

Configure AWS Config in all accounts and use an aggregator to record management API activity in the management account.

Question 20

A security engineer configures a new CloudTrail trail to deliver logs to a centralized S3 bucket in a dedicated logging account. The trail is created successfully in the source account, but no log files ever appear in the destination bucket. CloudTrail shows no delivery errors in the console for the first few hours. The bucket has default SSE-S3 encryption enabled and a bucket policy that was recently modified to add a condition requiring the aws:SecureTransport key. What is the MOST likely cause of the missing log files?

Accepted Answer

The S3 bucket policy does not grant the CloudTrail service principal (cloudtrail.amazonaws.com) the s3:PutObject and s3:GetBucketAcl permissions required to write log files.

Answer

CloudTrail cannot deliver logs to an S3 bucket that uses SSE-S3 encryption; the bucket must use SSE-KMS with a key policy granting CloudTrail access.

Answer

Cross-account log delivery from a source account to a logging account is not supported by CloudTrail and requires an organization trail instead.

Answer

The aws:SecureTransport condition blocks CloudTrail because the service delivers logs over unencrypted HTTP connections.

Question 21

A security engineer needs to prove which IAM principals read individual objects from a highly sensitive S3 bucket named 'legal-contracts'. After enabling a multi-region CloudTrail trail, the engineer notices that GetObject and PutObject API calls for the bucket do not appear in the CloudTrail logs, although CreateBucket and PutBucketPolicy calls are present. What is the correct action to capture the required object-level activity?

Accepted Answer

Configure S3 data events in the CloudTrail trail, scoped to the 'legal-contracts' bucket, and specify read and write event types.

Answer

Enable S3 server access logging on the 'legal-contracts' bucket and deliver logs to CloudTrail.

Answer

Enable CloudTrail Insights events on the trail to automatically detect object-level anomalies.

Answer

Turn on VPC Flow Logs for the subnet where the S3 gateway endpoint resides to record object access.

Question 22

A security engineer configured a multi-Region CloudTrail trail to deliver logs to an S3 bucket and created an Athena table pointing to the bucket prefix. After several days, queries against the Athena table return zero rows even though the S3 bucket contains many CloudTrail log object files under the correct prefix. The engineer confirms the trail is active and logs are being written. What is the MOST likely cause of the empty query results?

Accepted Answer

The Athena table's LOCATION or partition definitions do not match the actual S3 key path (account ID, Region, and date structure) where CloudTrail writes the objects.

Answer

CloudTrail log file integrity validation is enabled, which prevents Athena from reading the compressed log objects.

Answer

The trail is not configured to log management events, so the delivered objects contain no queryable records.

Answer

S3 server-side encryption with SSE-S3 blocks Athena from decrypting the CloudTrail objects at query time.

Question 23

A security engineer must centralize application logs from a fleet of Amazon Linux 2 EC2 instances into CloudWatch Logs so that a metric filter can trigger alarms on repeated authentication failures. After installing and starting the unified CloudWatch agent on the instances, the engineer confirms the agent process is running, but no log groups or log events appear in CloudWatch Logs. The agent configuration file correctly references the application log file path. What is the MOST likely cause of the missing logs?

Accepted Answer

The EC2 instance profile (IAM role attached to the instances) lacks the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents permissions.

Answer

CloudWatch Logs does not support ingestion from EC2 instances unless a VPC interface endpoint is created for the CloudTrail service.

Answer

The metric filter must be created before the agent starts, otherwise CloudWatch discards incoming log events.

Answer

Log data must first be delivered to an S3 bucket, and CloudWatch Logs subscriptions pull the events from S3 automatically.

Question 24

A security operations team receives dozens of CloudWatch alarm notifications each night for a fleet of EC2 instances. Individual metric alarms fire for high CPU, high memory, and low disk space, but the team only wants to be paged when an instance shows signs of genuine distress — specifically when CPU is high AND disk space is low at the same time. They want to reduce noise without deleting the existing metric alarms, which feed other dashboards. What is the MOST appropriate approach?

Accepted Answer

Create a CloudWatch composite alarm that references the existing CPU and disk-space metric alarms with an ALARM(cpu) AND ALARM(disk) rule, and send notifications only from the composite alarm.

Answer

Delete the individual metric alarms and create a single metric math alarm that adds CPU and disk metrics together, alarming when the sum crosses a threshold.

Answer

Configure an SNS filter policy on the existing alarm topic so subscribers only receive messages when two alarms publish within the same minute.

Answer

Increase the evaluation period and datapoints-to-alarm on each individual metric alarm so they fire less frequently overnight.

Question 25

A security team operates a centralized logging account. They need application VPC Flow Logs and CloudWatch Logs from 40 member accounts to be continuously streamed in near real time to a central Amazon OpenSearch Service domain in the logging account for correlation and dashboards. The solution must scale to high log volume, require minimal per-account maintenance, and avoid custom polling code. Which approach best meets these requirements?

Accepted Answer

In each member account, create a CloudWatch Logs subscription filter that sends log events to a cross-account Amazon Kinesis Data Firehose delivery stream (via a destination in the logging account) configured to deliver to the central OpenSearch domain.

Answer

Schedule a Lambda function in each member account to call GetLogEvents every minute and PutRecord the results into an S3 bucket in the logging account, then load them into OpenSearch nightly.

Answer

Enable CloudWatch Logs export tasks in every member account to export log groups to the central S3 bucket on a recurring basis, then index the objects with an OpenSearch ingestion pipeline.

Answer

Configure AWS Config aggregators in the logging account to collect the log data from all member accounts and forward it to OpenSearch through EventBridge.

Question 26

A security analyst uses CloudWatch Logs Insights to investigate a suspected credential-stuffing attack against an application. The application writes JSON-formatted logs to a log group that contains 90 days of data across dozens of streams. The analyst runs a query filtering for failed authentication events over the last 24 hours, but the queries consistently time out or return very slowly, and the team is concerned about the cost of repeatedly scanning the full dataset. Which change will MOST effectively reduce query latency and cost while preserving the ability to investigate this incident?

Accepted Answer

Narrow the query's absolute time range to the 24-hour incident window so Logs Insights only scans log events within that period.

Answer

Increase the log group retention period so that older data is compressed and indexed automatically.

Answer

Export the entire log group to Amazon S3 and re-run the same query directly against the raw objects using Logs Insights.

Answer

Create a metric filter on the log group and query the resulting CloudWatch metric with Logs Insights syntax.

Question 27

A security team monitors an application that writes structured JSON logs to a CloudWatch Logs group. Application error volume fluctuates significantly by time of day and day of week, so a static threshold alarm on the error count either fires constantly during peak hours or misses spikes during off-peak hours. The team wants an alerting approach that automatically adapts to the normal daily and weekly patterns of the error metric and only alarms on statistically unusual deviations, with minimal ongoing tuning. Which approach best meets this requirement?

Accepted Answer

Create a metric filter to extract the error count into a custom metric, then create a CloudWatch alarm that uses anomaly detection on that metric and alarms when values fall outside the anomaly detection band.

Answer

Create a metric filter to extract the error count, then create a static-threshold alarm and manually adjust the threshold each week based on observed peaks.

Answer

Stream the log group to Amazon S3 via Kinesis Data Firehose and run scheduled Athena queries that compare current error counts to a fixed limit.

Answer

Create a composite alarm that combines multiple static-threshold alarms so that different thresholds apply based on the time of day.

Question 28

A security team must be alerted within minutes whenever the AWS account root user signs in to the Management Console. CloudTrail is already delivering management events to a CloudWatch Logs log group in the same account. The team wants a solution that uses only native AWS logging and monitoring services, with no custom code to maintain. Which approach meets these requirements?

Accepted Answer

Create a CloudWatch Logs metric filter on the log group that matches events where userIdentity.type is Root and eventName is ConsoleLogin, then create a CloudWatch alarm on that metric that publishes to an SNS topic.

Answer

Enable Amazon Athena on the CloudTrail S3 bucket and schedule a query every five minutes to detect root console logins, sending results to SNS.

Answer

Configure AWS Config with a custom rule that evaluates CloudTrail events and triggers an SNS notification when the root user logs in.

Answer

Create a VPC Flow Logs subscription filter that forwards root login records to a Lambda function which invokes SNS.

Question 29

A company centralizes application logs in a CloudWatch Logs log group configured with a 30-day retention period. A new compliance requirement mandates that these logs be retained for 7 years for potential audit, but they will rarely be queried after 90 days. The security team wants to meet the retention requirement while minimizing storage cost. Which approach best satisfies these requirements?

Accepted Answer

Create a subscription filter that streams the log group to Amazon Kinesis Data Firehose, delivering logs to an S3 bucket with lifecycle policies transitioning to Glacier, while keeping the 30-day CloudWatch retention.

Answer

Change the log group retention setting to 7 years so CloudWatch Logs stores all data for the full period.

Answer

Enable CloudWatch Logs export to S3 manually once and rely on the export for all future logs.

Answer

Increase the retention to 90 days and enable CloudWatch Logs Insights to archive queries automatically after that period.

Question 30

A security team wants application logs from a CloudWatch Logs log group delivered continuously to an S3 bucket in near real time so that a downstream SIEM can pull and parse them within seconds of generation. They also want the ability to transform each record (adding a source field) before it lands in S3, without managing servers. Which approach meets these requirements?

Accepted Answer

Create a CloudWatch Logs subscription filter that streams the log group to an Amazon Data Firehose delivery stream, with a Lambda transform function, delivering to the S3 bucket.

Answer

Configure a CloudWatch Logs export task scheduled every 5 minutes to export the log group data to the S3 bucket.

Answer

Enable a CloudWatch Logs metric filter on the log group and configure the metric alarm action to publish the log data to the S3 bucket.

Answer

Create an EventBridge rule matching the log group events and target the S3 bucket directly to store each log event.

Question 31

A security governance team manages an AWS Organization with 150 accounts. External auditors need read-only access to view the aggregated compliance status of all AWS Config rules across every account and Region, from a single location, for a quarterly audit. The team wants to minimize ongoing operational effort and avoid granting auditors access to each individual member account. Which approach best meets these requirements?

Accepted Answer

Set up an AWS Config aggregator in a delegated administrator account that collects data from the entire organization, then grant auditors read-only IAM access to the aggregator's compliance dashboard in that account.

Answer

Enable AWS Config in each account, export the configuration snapshots to a central S3 bucket, and have auditors query the raw JSON files using Athena.

Answer

Create a cross-account IAM role in every member account and provide the auditors with instructions to assume each role and review Config compliance individually.

Answer

Use AWS Security Hub in each account and email the auditors weekly CSV exports of the findings summaries.

Question 32

A security engineer at a company with 40 AWS accounts under AWS Organizations needs a single, read-only dashboard that shows the compliance status of all AWS Config rules across every account and every Region. The solution must automatically include new accounts as they join the organization and must not require the engineer to log in to each account individually. What is the most operationally efficient way to achieve this?

Accepted Answer

Create an organization aggregator in AWS Config from the delegated administrator account, configured to aggregate data from all accounts in the organization and all Regions.

Answer

Enable AWS Config in each account and configure a CloudWatch cross-account dashboard that pulls the ConfigRuleComplianceStatus metric from every account.

Answer

Create an individual account aggregator in the management account and manually add each of the 40 account IDs as authorized source accounts.

Answer

Export AWS Config compliance snapshots from every account to a central S3 bucket and query the combined results with Amazon Athena.

Question 33

A security governance team manages 60 accounts through AWS Organizations with Control Tower. They must produce a single dashboard that scores each account against the CIS AWS Foundations Benchmark, automatically re-scores when new accounts are enrolled, and enables cross-account remediation of common misconfigurations without deploying and maintaining rule definitions in every account individually. Which approach best meets these requirements with the least ongoing operational overhead?

Accepted Answer

Enable AWS Security Hub with central configuration from the delegated administrator account, apply the CIS AWS Foundations Benchmark standard organization-wide, and configure automated response and remediation via EventBridge rules.

Answer

Deploy identical AWS Config rules manually in every member account and build a custom Lambda function that aggregates compliance data into a shared S3 bucket for reporting.

Answer

Create an AWS Config aggregator in the audit account and rely on it to automatically enforce the CIS benchmark and remediate findings across all member accounts.

Answer

Use Service Control Policies to block all API calls that would create non-compliant resources, eliminating the need for benchmark scoring.

Question 34

A security engineer needs to demonstrate to auditors exactly when an RDS instance transitioned from an encrypted (compliant) state to an unencrypted (non-compliant) state, and identify what configuration change triggered the transition. AWS Config is enabled in the account with the relevant managed rule active. Which approach provides the required historical evidence with the least custom development?

Accepted Answer

Use the AWS Config configuration timeline and compliance timeline for the RDS resource to review the sequence of configuration items and compliance status changes over time.

Answer

Enable VPC Flow Logs on the RDS subnet and query them in Athena to correlate traffic changes with the compliance transition.

Answer

Create a CloudWatch Logs metric filter on the RDS engine logs to detect encryption state changes and set an alarm.

Answer

Rely on GuardDuty RDS Protection findings to identify when the encryption setting was altered.

Question 35

A security team at a large enterprise manages 120 AWS accounts under AWS Organizations. They need to deploy a standardized set of AWS Config rules across all existing and future member accounts to enforce a PCI DSS baseline. The team wants to manage these rules centrally from a dedicated security tooling account (not the management account) and ensure that member account administrators cannot delete or modify the deployed rules. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Register the security tooling account as a delegated administrator for AWS Config, then deploy an organization conformance pack from that account targeting the entire organization.

Answer

Create a CloudFormation StackSet from the management account that provisions individual AWS Config rules in each member account, and re-run the StackSet manually whenever a new account is added.

Answer

Deploy a conformance pack independently in each member account using a script that assumes a cross-account role, scheduling the script to run daily to catch new accounts.

Answer

Enable AWS Config in the management account only and rely on an SCP that denies config:DeleteConfigRule to protect the rules across the organization.

Question 36

A financial services company runs 220 AWS accounts under AWS Organizations. The security governance team wants a single, repeatable way to continuously evaluate accounts against the PCI DSS requirement set, generate compliance reports for auditors, and automatically remediate a specific violation (public S3 buckets) across all accounts. They want to minimize per-account manual setup and centralize the evaluation logic. Which approach best meets these requirements?

Accepted Answer

Deploy a Config conformance pack (using a PCI-aligned sample template with an embedded SSM Automation remediation for S3 public access) from the Config delegated administrator account across the organization.

Answer

Enable the Security Hub PCI DSS standard in every account individually and rely on its findings to trigger manual remediation by each account owner.

Answer

Create individual AWS Config rules in each account with separate remediation actions, and manually copy the rule definitions to new accounts as they are onboarded.

Answer

Author a single SCP in AWS Organizations that denies creation of public S3 buckets and produces a compliance report through Organizations.

Question 37

A financial services company runs 40 AWS accounts under AWS Organizations. The security governance team must continuously evaluate resource configurations against a custom internal baseline of 25 rules (some with auto-remediation) across all accounts, and they want a single pass/fail compliance score per account that can be centrally deployed and updated without touching each account individually. They already use Security Hub for aggregating GuardDuty and Inspector findings but do not want to pay for additional Security Hub security-standard control checks. Which approach BEST meets the configuration-baseline requirement while minimizing added Security Hub costs?

Accepted Answer

Deploy an AWS Config conformance pack containing the 25 custom rules and remediation actions from the delegated administrator account to the entire organization.

Answer

Enable the AWS Foundational Security Best Practices standard in Security Hub across the organization and rely on its controls for the internal baseline.

Answer

Create the 25 rules as individual AWS Config managed and custom rules manually in each of the 40 accounts and track compliance with a spreadsheet.

Answer

Author the baseline as a set of preventive SCPs at the organization root so that noncompliant configurations can never be created.

Question 38

A security governance team must ensure that every EBS volume across 40 member accounts in an AWS Organization is encrypted, and they want a compliance evaluation to run whenever a volume's configuration changes. They already deploy standard checks through an organization conformance pack. A junior engineer proposes writing a custom AWS Config rule backed by a Lambda function to perform this specific check. Which approach best meets the requirement while minimizing operational overhead and cost?

Accepted Answer

Use the AWS Config managed rule 'encrypted-volumes' deployed via the existing organization conformance pack, triggered on configuration changes.

Answer

Write a custom AWS Config rule backed by a Lambda function in each account and invoke it on a periodic 24-hour schedule.

Answer

Create an EventBridge rule in every account that triggers a Lambda function to scan all EBS volumes hourly and write results to a DynamoDB table.

Answer

Enable Amazon Inspector across all accounts to continuously assess EBS volume encryption status.

Question 39

A security engineer must ensure that any S3 bucket created in the company's production account is automatically flagged as noncompliant if default encryption is not enabled, and then automatically remediated to enable SSE-S3 encryption without manual intervention. Configuration drift must be continuously evaluated as changes occur. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable AWS Config with the managed rule s3-bucket-server-side-encryption-enabled and attach an SSM Automation remediation action that enables default encryption on noncompliant buckets.

Answer

Create a CloudWatch Logs metric filter on CloudTrail PutBucketEncryption events and trigger a Lambda function to encrypt buckets when the filter matches.

Answer

Schedule an AWS Lambda function every hour to list all buckets, check each bucket's encryption configuration, and enable SSE-S3 where missing.

Answer

Enable Amazon Macie to scan all buckets and use its findings to trigger an EventBridge rule that enables default encryption on unencrypted buckets.

Question 40

A security engineer enables AWS Config in all 15 of an organization's Regions to record configuration changes. After a week, the engineer notices that IAM user, role, and policy configuration items are being recorded and stored identically in every Region, dramatically increasing Config storage costs and duplicating compliance evaluations for the same global resources. The engineer needs to keep full visibility into IAM changes while eliminating the redundant recording. What should the engineer do?

Accepted Answer

In the Config recorder settings, disable the recording of global resource types (includeGlobalResourceTypes) in all Regions except one designated home Region.

Answer

Disable AWS Config entirely in 14 Regions and rely on a single Region to record all resource types including global resources.

Answer

Create a Config aggregator in one Region so that global resources are only counted once across the organization.

Answer

Add a Config rule that suppresses duplicate configuration items for IAM resources across Regions.

Question 41

A financial services company uses AWS Control Tower to govern a multi-account environment with over 80 accounts across several OUs. The security team requires that every newly provisioned account automatically receives a standardized set of baseline resources: a hardened VPC configuration, a specific IAM role for the SOC team, and an SNS topic subscription for security notifications. These resources are not covered by Control Tower guardrails or SCPs. The team wants this to happen automatically whenever Account Factory creates a new account, with minimal manual intervention. Which approach BEST meets these requirements?

Accepted Answer

Deploy Account Factory for Terraform (AFT) with account customization pipelines that apply the baseline resources automatically after each account is provisioned.

Answer

Add the baseline VPC, IAM role, and SNS subscription as detective Config rules in a conformance pack deployed via the delegated administrator account.

Answer

Create additional Control Tower guardrails that enforce the presence of the VPC, IAM role, and SNS subscription in every account.

Answer

Manually run a CloudFormation stack in each new account after it appears in the organization, using StackSets triggered by an operator.

Question 42

A security team manages a multi-account environment through AWS Control Tower. The compliance department requires that every newly provisioned member account automatically block the disabling of AWS Config, enforce a standardized network baseline, and prevent the deletion of the CloudTrail log archive. The team wants these controls applied consistently at account creation without manual per-account setup, and wants strong (preventive) enforcement where possible. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Use Account Factory to provision accounts and enable Control Tower's mandatory and strongly recommended guardrails, applying preventive guardrails (SCP-based) for actions like disabling Config and deleting the log archive, and detective guardrails where preventive options are unavailable.

Answer

Provision accounts with Account Factory and rely solely on detective guardrails, remediating any drift manually through the Control Tower dashboard after each account is created.

Answer

Disable Control Tower guardrails and instead attach custom IAM permission boundaries to every role in each new account to prevent Config and CloudTrail changes.

Answer

Create the accounts manually in AWS Organizations, then run a Systems Manager automation document on a schedule to detect and re-enable Config and CloudTrail if they are turned off.

Question 43

A financial services company uses AWS Control Tower to govern 60 member accounts across several OUs. A platform engineer, using local credentials in a workload account, manually modified an AWS Config recorder and detached a CloudTrail trail that Control Tower had configured during account enrollment. The security team wants Control Tower to detect this deviation and restore the mandatory baseline resources to their governed state without re-provisioning the account. Which action accomplishes this with the least operational effort?

Accepted Answer

Run the 'Re-register OU' / repair action in Control Tower, which re-applies the landing zone baseline and remediates drift on the affected account's guardrail resources.

Answer

Delete and close the affected account, then use Account Factory to provision a brand-new account with the correct baseline.

Answer

Attach an SCP that denies config:StopConfigurationRecorder and cloudtrail:DeleteTrail so the drift is automatically reverted.

Answer

Manually recreate the Config recorder and CloudTrail trail in the workload account to match other accounts' settings.

Question 44

A company has been growing organically and now runs 40 AWS accounts that were each created independently using the AWS Organizations 'create account' and 'invite existing account' features. There is no consistent baseline: some accounts lack CloudTrail, encryption defaults vary, and there is no standardized logging or audit account. Leadership wants a governed, repeatable way to provision NEW accounts going forward with a mandatory baseline (centralized logging, guardrails, standardized VPC) and a dashboard showing drift across all accounts, while minimizing custom-built automation. Which approach best meets these requirements?

Accepted Answer

Deploy AWS Control Tower to establish a landing zone with a management, log archive, and audit account, then use Account Factory to provision new accounts with mandatory guardrails and baselines, and enroll existing accounts where feasible.

Answer

Continue using AWS Organizations, attach SCPs to the root, and write a custom Lambda-based provisioning pipeline triggered by CreateAccount events to apply baselines to each new account.

Answer

Enable AWS Config in every account manually and build a conformance pack that recreates all guardrails, using CloudFormation StackSets to push baseline resources to new accounts.

Answer

Migrate all workloads into a single account with multiple VPCs to eliminate cross-account inconsistency, and apply IAM permission boundaries per team.

Question 45

A security governance team manages 120 accounts under AWS Control Tower. Leadership requires a monthly compliance report showing which accounts have deviated from the mandatory guardrails baseline (such as disallowed public S3 access and CloudTrail configuration changes). The team wants a single dashboard that continuously evaluates resource configurations across all accounts and highlights non-compliant resources over time, without writing custom aggregation code. Which approach best meets this requirement at scale?

Accepted Answer

Enable detective (strongly recommended) guardrails in Control Tower, which use AWS Config rules across the landing zone, and review the aggregated compliance status in the Control Tower dashboard and the Config aggregator.

Answer

Attach preventive SCPs to the organization root that deny the non-compliant actions, then rely on CloudTrail logs to produce the monthly deviation report.

Answer

Deploy a custom Lambda function in each account that scans resources on a schedule and writes findings to a central S3 bucket for reporting.

Answer

Enable GuardDuty across all accounts and use the findings dashboard to identify configuration deviations from the guardrail baseline.

Question 46

A financial services company manages 120 accounts using AWS Control Tower. The security governance team wants to be automatically notified whenever a landing zone control drifts from its expected state — for example, when an SCP guardrail is manually removed from an OU or a required baseline resource is deleted in an enrolled account. They want a low-maintenance, event-driven approach that integrates with their existing incident-response tooling. What should they implement?

Accepted Answer

Create an Amazon EventBridge rule in the management account that matches Control Tower lifecycle events (such as drift detection) from the aws.controltower source and routes them to an SNS topic or their incident-response system.

Answer

Enable AWS Config in every enrolled account and write a custom Config rule that periodically evaluates each account's SCP attachment and baseline resources, reporting noncompliance to a central aggregator.

Answer

Schedule a Lambda function to call the Control Tower GetLandingZoneStatus API every hour and compare the returned configuration against a stored baseline document in S3.

Answer

Turn on AWS Security Hub in all accounts and rely on the AWS Foundational Security Best Practices standard to detect and alert on landing zone control drift.

Question 47

A company has been running AWS for three years with 40 accounts created manually and joined into an existing AWS Organizations structure. Leadership now wants centralized governance with automated account provisioning, mandatory logging, and a global standard that blocks any operation outside two approved AWS Regions. The security team wants to minimize custom development and use managed, opinionated guardrails wherever possible. Which approach best meets these requirements?

Accepted Answer

Deploy AWS Control Tower on the existing organization, enroll (adopt) the existing accounts into registered OUs, use Account Factory for future accounts, and apply the Region-deny mandatory guardrail.

Answer

Author a custom SCP that denies all actions when aws:RequestedRegion is not in the approved list, attach it manually to each of the 40 accounts, and build a Lambda-based account vending pipeline for new accounts.

Answer

Migrate all 40 accounts to a brand-new organization managed by Control Tower, since Control Tower cannot be layered onto an organization that already contains member accounts.

Answer

Enable AWS Config conformance packs with a Region-restriction rule and remediation actions across all accounts, relying on detective controls to revert any resources created outside the approved Regions.

Question 48

A security governance team manages 60 accounts under AWS Control Tower. Leadership requires that no account be able to create publicly accessible RDS instances, and that any existing RDS instance that becomes publicly accessible be automatically detected and reported to a central compliance dashboard. The team wants to minimize ongoing operational overhead while enforcing this at scale. Which combination of controls best satisfies both the preventive and detective requirements?

Accepted Answer

Apply an SCP to the organizational root that denies the RDS API actions when the request sets PubliclyAccessible to true, and deploy a Config conformance pack with the rds-instance-public-access-check rule aggregated into the audit account.

Answer

Deploy a Config rule with an automatic remediation action in each account and rely on Control Tower drift detection to prevent public RDS instances from being created.

Answer

Enable a Security Hub foundational security best practices control in every account and configure GuardDuty to block RDS creation calls that set PubliclyAccessible to true.

Answer

Create an IAM permissions boundary in each account that denies RDS creation with public access, and use CloudTrail Insights to detect any instances that become publicly accessible.

Question 49

A financial services company runs 120 accounts under AWS Control Tower. The security team must audit whether every account continuously enforces a set of ~40 detective controls (Config rules) mapped to their internal compliance framework. Finance has flagged that AWS Config recording costs have grown rapidly because every account records ALL resource types, including many that are irrelevant to the compliance framework. The team wants to reduce Config cost while still meeting the audit requirement and managing controls centrally across the organization. Which approach best balances centralized governance, audit coverage, and cost?

Accepted Answer

Deploy the 40 Config rules as a conformance pack via Control Tower/Config across the organization, and adjust the Config recorder in each account to record only the specific resource types evaluated by those rules.

Answer

Turn off AWS Config in accounts that show high cost and rely on a monthly manual review using AWS Config snapshots exported to S3 for the audit evidence.

Answer

Replace AWS Config entirely with a set of scheduled Lambda functions in each account that describe resources and write compliance results to a central DynamoDB table.

Answer

Enable Security Hub CIS and PCI standards in all accounts instead of Config rules, since Security Hub does not incur Config recording charges.

Question 50

A company is designing multi-account governance for AWS. The CISO wants a standardized landing zone with pre-configured guardrails, a dedicated log archive account, and an automated account provisioning process. The finance team is concerned about the operational overhead and wants to minimize the effort of maintaining the baseline as new accounts join. The company has no existing multi-account structure. Which approach best meets these requirements with the least ongoing management effort?

Accepted Answer

Deploy AWS Control Tower to establish a landing zone with a management account, log archive and audit accounts, mandatory and strongly recommended guardrails, and Account Factory for provisioning.

Answer

Create an AWS Organization manually, author custom SCPs for each OU, and build a CloudFormation StackSet pipeline to deploy logging and baseline resources to each new account.

Answer

Use AWS Organizations with a single OU, enable all-features mode, and rely on Security Hub central configuration to enforce guardrails across accounts.

Answer

Provision each account individually and apply IAM permission boundaries in every account to enforce a consistent security baseline.

Question 51

A financial services company must implement a data classification strategy for a data lake in Amazon S3 containing millions of objects. Objects classified as 'Restricted' (containing PII) must be encrypted with a dedicated customer managed KMS key and retained for 7 years, while 'Internal' objects can use SSE-S3 and transition to cheaper storage after 90 days. The security team wants classification to drive these downstream controls automatically as new objects arrive, with minimal ongoing manual effort. Which approach best meets these requirements?

Accepted Answer

Use Amazon Macie to discover and classify sensitive data, apply object tags based on findings, and use S3 Lifecycle rules and separate buckets with tag-based bucket policies to enforce KMS encryption and tiering per classification.

Answer

Enable S3 default encryption with a single customer managed KMS key on the bucket and configure one Lifecycle rule to transition all objects to S3 Glacier Deep Archive after 90 days.

Answer

Manually review a sample of objects each quarter, tag them by hand, and rely on IAM policies to control which analysts can access Restricted data.

Answer

Turn on S3 Storage Lens with advanced metrics to identify PII and automatically re-encrypt matching objects with the dedicated KMS key.

Question 52

A security analyst receives a GuardDuty finding indicating that an IAM user's credentials may have been used from an anomalous location (UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS). The analyst needs to quickly determine the full scope of activity associated with that IAM user over the past several weeks, including which API calls were made, from which IP addresses, and whether related resources were also accessed — all without manually querying and correlating large volumes of CloudTrail, VPC Flow Logs, and GuardDuty data. Which AWS service is purpose-built to accelerate this investigation?

Accepted Answer

Use Amazon Detective to pivot from the GuardDuty finding into behavior graphs that correlate CloudTrail, VPC Flow Logs, and GuardDuty findings over time.

Answer

Enable Amazon Macie to classify sensitive data accessed by the IAM user and visualize the access patterns.

Answer

Configure AWS Config rules to record the IAM user's configuration history and generate a compliance timeline of the activity.

Answer

Run Amazon Athena queries directly against raw CloudTrail S3 logs and build a custom QuickSight dashboard for correlation.

Question 53

A security analyst receives a GuardDuty finding indicating unusual API activity from an IAM role in a production account. Before deciding on containment, the analyst needs to understand whether this role's behavior deviates from its historical baseline over the past 45 days and which resources it has interacted with. The company already has GuardDuty, Security Hub, and Amazon Detective enabled across the organization. Which approach lets the analyst most efficiently establish this behavioral context?

Accepted Answer

Open the finding's linked Amazon Detective entity profile to view the role's activity timeline, baseline of typical API calls, and related resource interactions

Answer

Query CloudTrail Lake with a custom SQL statement to reconstruct 45 days of API calls and manually chart the frequency for the role

Answer

Enable GuardDuty Malware Protection and re-scan the account to generate a behavioral baseline for the IAM role

Answer

Use Security Hub insights to group findings by resource and infer the role's normal behavior from aggregated severity scores

Question 54

A financial services company stores sensitive customer transaction records in an Amazon DynamoDB table. A compliance requirement mandates that the encryption key used for data at rest must be under the company's direct control, allowing them to define key policies, audit key usage in CloudTrail, and disable the key immediately if a breach is suspected. The security team wants to minimize operational overhead while still meeting these controls. Which DynamoDB encryption-at-rest configuration should they choose?

Accepted Answer

Use a customer managed key (CMK) in AWS KMS configured for the DynamoDB table.

Answer

Use the default AWS owned key for DynamoDB encryption, which requires no configuration.

Answer

Use an AWS managed key (aws/dynamodb) so AWS handles rotation and policy management automatically.

Answer

Disable DynamoDB server-side encryption and encrypt items client-side with a locally stored key.

Question 55

A security engineer discovers that several EC2 instances in a production account were launched with unencrypted EBS root and data volumes before an encryption policy was enforced. The engineer has already enabled EBS encryption by default at the account and Region level to protect future volumes. What is the correct approach to bring the EXISTING unencrypted volumes into compliance with the encryption-at-rest requirement while minimizing data loss?

Accepted Answer

Create a snapshot of each unencrypted volume, copy the snapshot with encryption enabled using a KMS key, create new encrypted volumes from the encrypted snapshots, and attach them to the instances.

Answer

Enabling EBS encryption by default automatically encrypts all existing unencrypted volumes during the next instance stop/start cycle, so no further action is needed.

Answer

Use the ModifyVolume API to set the Encrypted attribute to true on each existing volume in place, which encrypts the data without detaching the volume.

Answer

Apply an S3 bucket policy that enforces SSE-KMS to the volumes, since EBS volumes are stored as objects in an underlying S3 bucket.

Question 56

A security engineer is reviewing a fleet of EC2 instances that run a web application behind an Application Load Balancer. A recent penetration test found that the application is vulnerable to server-side request forgery (SSRF), and the tester was able to retrieve temporary IAM role credentials from the instance metadata service. The engineer must harden the instances to prevent this specific class of credential theft without redeploying the application. Which action most directly mitigates the risk?

Accepted Answer

Enforce Instance Metadata Service Version 2 (IMDSv2) with a session token requirement and set the metadata hop limit to 1 on the instances.

Answer

Attach a more restrictive IAM policy to the instance role so that the exposed credentials have no usable permissions.

Answer

Add a security group rule that blocks outbound traffic to 169.254.169.254 from the instances.

Answer

Enable termination protection and rotate the instance profile credentials every hour with a scheduled Lambda function.

Question 57

A security team wants to fully automate the initial containment of any EC2 instance that GuardDuty flags with a high-severity finding. When a finding arrives, the workflow must: apply a quarantine security group, capture the instance's running memory and process list for later analysis, and record the actions in an audit trail — all without an analyst logging into the instance interactively. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching GuardDuty high-severity findings that triggers a Lambda function; the function replaces the instance's security groups with an isolation group and invokes an AWS Systems Manager Run Command document that collects memory and process data via the SSM Agent, logging output to S3 and CloudWatch.

Answer

Enable GuardDuty Malware Protection so it automatically isolates the instance and streams a memory image to an S3 bucket, then review the scan results in the GuardDuty console.

Answer

Configure an EventBridge rule that opens an SSH session through EC2 Instance Connect and runs a shell script to gather forensic data, then manually change the security group afterward.

Answer

Use AWS Config remediation actions tied to a GuardDuty-based Config rule to attach an isolation security group, and rely on VPC Flow Logs to reconstruct the process activity.

Question 58

A security engineer must perform forensic analysis on a compromised EC2 instance after a GuardDuty finding. The incident-response plan requires that all evidence be preserved in a legally defensible manner and that analysis occur without altering the original volumes. The compromised instance runs in a production account. Which approach best preserves forensic integrity while enabling investigation?

Accepted Answer

Create EBS snapshots of the instance's volumes, copy the snapshots into a dedicated isolated forensics account, create volumes from the copies, and attach them to a hardened analysis instance for examination.

Answer

Stop the compromised instance, detach its volumes, and reattach them directly to a forensics instance running in the same production account.

Answer

Enable termination protection on the instance and run analysis tools directly on the live compromised instance to capture volatile data before shutting it down.

Answer

Terminate the compromised instance immediately and rely on the most recent AWS Backup recovery point to reconstruct the volumes for later analysis.

Question 59

A security engineer receives a GuardDuty finding of type Stealth:IAMUser/CloudTrailLoggingDisabled indicating an attacker used compromised credentials to stop logging on the organization's primary CloudTrail trail. The engineer must restore audit visibility as quickly as possible and ensure logging cannot be trivially disabled again by the same technique. Which combination of actions BEST addresses both the immediate recovery and future prevention?

Accepted Answer

Re-enable the CloudTrail trail (StartLogging), then apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to all principals except a break-glass role, and enable an organization trail so member accounts cannot disable it locally.

Answer

Delete the affected trail and create a new one in a different Region, relying on GuardDuty to continue monitoring without CloudTrail.

Answer

Enable CloudTrail log file integrity validation and rotate the compromised access keys, which will automatically restart logging on the stopped trail.

Answer

Turn on VPC Flow Logs and Amazon S3 server access logging as replacement data sources, since these cover the same events that CloudTrail records.

Question 60

A security engineer receives a GuardDuty finding of type UnauthorizedAccess:EC2/MaliciousIPCaller.Custom for a production EC2 instance. The organization requires that suspected compromised instances be automatically isolated for forensic investigation while preserving all volatile and non-volatile data, and while allowing forensic tooling in a separate account to access the evidence. Which automated response best meets these requirements?

Accepted Answer

Trigger an EventBridge rule on the GuardDuty finding that invokes a Lambda function to attach a forensic isolation security group with no rules to the instance, create snapshots of all EBS volumes and share them with the forensics account, and capture a memory dump via an SSM Run Command before any termination.

Answer

Configure EventBridge to invoke a Lambda function that immediately terminates the instance and deletes its EBS volumes, then emails the security team so they can rebuild from the latest AMI.

Answer

Enable Security Hub auto-remediation to stop the instance, detach its network interface, and move the finding to archived status so the on-call team can review it during business hours.

Answer

Create an EventBridge rule that triggers an SSM Automation runbook to reboot the instance, rotate its IAM role credentials, and apply the latest OS patches to remove the malware.

Question 61

A security engineer receives a GuardDuty finding of type UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS. The finding indicates that credentials from an EC2 instance's IAM role were used from an IP address outside AWS. The instance itself is still running normally and serving production traffic, and the team cannot immediately terminate or isolate it without causing an outage. What is the MOST effective immediate containment action to stop the attacker from continuing to use the stolen credentials?

Accepted Answer

Attach an IAM policy to the instance role that denies all actions when the request does not originate from the instance's VPC using the aws:SourceVpc or aws:VpcSourceIp condition keys, effectively revoking the exfiltrated session's access

Answer

Rotate the EC2 instance's SSH key pair and reboot the instance to force new temporary credentials to be issued by the metadata service

Answer

Enable IMDSv2 in required mode on the running instance so the exfiltrated credentials are immediately invalidated

Answer

Create a GuardDuty suppression rule for the finding so the SOC can continue monitoring the instance without alert noise while planning a maintenance window

Question 62

A security engineer at a fintech company runs several Amazon EKS clusters that host containerized payment workloads. Leadership wants Amazon GuardDuty to detect threats such as suspicious API calls to the Kubernetes control plane (e.g., anonymous access to sensitive resources) AND malicious process activity occurring inside running containers (e.g., a reverse shell spawned in a pod). The engineer has already enabled GuardDuty in the account. What must the engineer configure to satisfy BOTH detection requirements?

Accepted Answer

Enable EKS Protection (Kubernetes audit log monitoring) and EKS Runtime Monitoring with the automated GuardDuty security agent for the clusters

Answer

Enable only EKS Protection, which analyzes Kubernetes audit logs and VPC Flow Logs to cover both control-plane and in-container threats

Answer

Enable GuardDuty Malware Protection for EBS and forward container stdout to CloudWatch Logs for GuardDuty to parse

Answer

Deploy the CloudWatch agent to each pod and create Security Hub custom insights that correlate EKS audit events with runtime metrics

Question 63

A security team manages a multi-account AWS Organization with workloads deployed across four Regions. They have enabled Amazon GuardDuty in all accounts and Regions via the organization delegated administrator. The compliance team now requires that all GuardDuty findings be automatically collected into a single account and Region for centralized correlation, long-term retention in S3, and cross-referencing during investigations, without writing custom polling code. Which approach best meets these requirements?

Accepted Answer

Configure GuardDuty finding export to a centralized S3 bucket, and in each Region create an EventBridge rule that forwards GuardDuty findings to a custom event bus in the central account and Region.

Answer

Enable a single GuardDuty detector only in the central Region and rely on VPC peering to route findings from other Regions into it.

Answer

Use AWS Config aggregators to pull GuardDuty findings from all accounts and Regions into the central account for retention in S3.

Answer

Write a Lambda function in each Region that periodically calls the GuardDuty ListFindings API and copies results to the central S3 bucket every five minutes.

Question 64

A security team enables GuardDuty Lambda Protection across their organization. GuardDuty raises a finding indicating one of the company's Lambda functions is generating network traffic to a known cryptomining domain. The function is triggered by an SQS queue that processes customer uploads. The team must contain the threat quickly while preserving the ability to investigate how the function was compromised. Which action best achieves immediate containment with minimal disruption to unrelated workloads?

Accepted Answer

Set the function's reserved concurrency to zero and remove its execution role permissions, leaving the code and configuration intact for analysis.

Answer

Delete the Lambda function immediately and redeploy a clean version from the last known-good CI/CD artifact.

Answer

Add a deny-all NACL to the VPC subnet the account uses so the function can no longer reach the internet.

Answer

Disable the SQS queue trigger by deleting the source queue so the function stops receiving events.

Exam domain	Exam weight	Practice
Threat Detection and Incident Response	14%	Practice this topic
Security Logging and Monitoring	18%	Practice this topic
Infrastructure Security	20%	Practice this topic
Identity and Access Management	16%	Practice this topic
Data Protection	18%	Practice this topic
Management and Security Governance	14%	Practice this topic

AWS Certified Security - Specialty (SCS-C02) practice exam & study guide

Start studying SCS-C02

All SCS-C02 study resources

SCS-C02 exam domains

Sample SCS-C02 questions

Key SCS-C02 terms

SCS-C02 frequently asked questions

Threat Detection and Incident Response (14%)

Security Logging and Monitoring (18%)

Infrastructure Security (20%)

Identity and Access Management (16%)

Data Protection (18%)

Management and Security Governance (14%)