- (Exam Topic 1)
A company is outsourcing its operational support 1o an external company. The company’s security officer must implement an access solution fen delegating operational support that minimizes overhead.
Which approach should the security officer take to meet these requirements?

1. A. implement Amazon Cognito identity pools with a role that uses a policy that denies the actions related to Amazon Cognito API management Allow the external company to federate through its identity provider
2. B. Federate AWS identity and Access Management (IAM) with the external company's identity provider Create an IAM role and attach a policy with the necessary permissions
3. C. Create an IAM group for me external company Add a policy to the group that denies IAM modifications Securely provide the credentials to the eternal company.
4. D. Use AWS SSO with the external company's identity provide
5. E. Create an IAM group to map to the identity provider user group, and attach a policy with the necessary permissions.

Correct Answer: B

- (Exam Topic 3)
A Network Load Balancer (NLB) target instance is not entering the InService state. A security engineer determines that health checks are failing.
Which factors could cause the health check failures? (Select THREE.)

1. A. The target instance's security group does not allow traffic from the NLB.
2. B. The target instance's security group is not attached to the NLB.
3. C. The NLB's security group is not attached to the target instance.
4. D. The target instance's subnet network ACL does not allow traffic from the NLB.
5. E. The target instance's security group is not using IP addresses to allow traffic from the NLB.
6. F. The target network ACL is not attached to the NLB.

Correct Answer: ACD

- (Exam Topic 3)
A new application will be deployed on EC2 instances in private subnets. The application will transfer sensitive data to and from an S3 bucket. Compliance requirements state that the data must not traverse the public internet. Which solution meets the compliance requirement?
Please select:

1. A. Access the S3 bucket through a proxy server
2. B. Access the S3 bucket through a NAT gateway.
3. C. Access the S3 bucket through a VPC endpoint for S3
4. D. Access the S3 bucket through the SSL protected S3 endpoint

Correct Answer: C
The AWS Documentation mentions the following
A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection, or
AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network.
Option A is invalid because using a proxy server is not sufficient enough
Option B and D are invalid because you need secure communication which should not traverse the internet For more information on VPC endpoints please see the below link https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.htmll
The correct answer is: Access the S3 bucket through a VPC endpoint for S3 Submit your Feedback/Queries to our Experts

- (Exam Topic 3)
A company has a set of EC2 Instances hosted in AWS. The EC2 Instances have EBS volumes which is used to store critical information. There is a business continuity requirement to ensure high availability for the EBS volumes. How can you achieve this?

1. A. Use lifecycle policies for the EBS volumes
2. B. Use EBS Snapshots
3. C. Use EBS volume replication
4. D. Use EBS volume encryption

Correct Answer: B
Data stored in Amazon EBS volumes is redundantly stored in multiple physical locations as part of normal operation of those services and at no additional charge. However, Amazon EBS replication is stored within the same availability zone, not across multiple zones; therefore, it is highly recommended that you conduct regular snapshots to Amazon S3 for long-term data durability Option A is invalid because there is no lifecycle policy for EBS volumes Option C is invalid because there is no EBS volume replication Option D is invalid because EBS volume encryption will not ensure business continuity For information on security for Compute Resources, please visit the below URL: https://d1.awsstatic.com/whitepapers/Security/Security_Compute_Services_Whitepaper.pdf

- (Exam Topic 2)
Which of the following minimizes the potential attack surface for applications?

1. A. Use security groups to provide stateful firewalls for Amazon EC2 instances at the hypervisor level.
2. B. Use network ACLs to provide stateful firewalls at the VPC level to prevent access to any specific AWS resource.
3. C. Use AWS Direct Connect for secure trusted connections between EC2 instances within private subnets.
4. D. Design network security in a single layer within the perimeter network (also known as DMZ, demilitarized zone, and screened subnet) to facilitate quicker responses to threats.

Correct Answer: A
https://aws.amazon.com/answers/networking/vpc-security-capabilities/ Security Group is stateful and hypervisor level.