- (Exam Topic 3)
A company is hosting a static website on Amazon S3 The company has configured an Amazon CloudFront distribution to serve the website contents The company has associated an AWS WAF web ACL with the CloudFront distribution. The web ACL ensures that requests originate from the United States to address
compliance restrictions.
THE company is worried that the S3 URL might still be accessible directly and that requests can bypass the CloudFront distribution
Which combination of steps should the company take to remove direct access to the S3 URL? (Select TWO. )

1. A. Select "Restrict Bucket Access" in the origin settings of the CloudFront distribution
2. B. Create an origin access identity (OAI) for the S3 origin
3. C. Update the S3 bucket policy to allow s3 GetObject with a condition that the aws Referer key matches the secret value Deny all other requests
4. D. Configure the S3 bucket poky so that only the origin access identity (OAI) has read permission for objects in the bucket
5. E. Add an origin custom header that has the name Referer to the CloudFront distribution Give the header a secret value.

Correct Answer: AD

- (Exam Topic 1)
A financial institution has the following security requirements:
Cloud-based users must be contained in a separate authentication domain.
Cloud-based users cannot access on-premises systems.
As part of standing up a cloud environment, the financial institution is creating a number of Amazon managed databases and Amazon EC2 instances. An Active Directory service exists on-premises that has all the administrator accounts, and these must be able to access the databases and instances.
How would the organization manage its resources in the MOST secure manner? (Choose two.)

1. A. Configure an AWS Managed Microsoft AD to manage the cloud resources.
2. B. Configure an additional on-premises Active Directory service to manage the cloud resources.
3. C. Establish a one-way trust relationship from the existing Active Directory to the new Active Directory service.
4. D. Establish a one-way trust relationship from the new Active Directory to the existing Active Directory service.
5. E. Establish a two-way trust between the new and existing Active Directory services.

Correct Answer: AE
Deploy a new forest/domain on AWS with one-way trust. If you are planning on leveraging credentials from an on-premises AD on AWS member servers, you must establish at least a one-way trust to the Active Directory running on AWS. In this model, the AWS domain becomes the resource domain where computer objects are located and on-premises domain becomes the account domain. Ref: https://d1.awsstatic.com/whitepapers/adds-on-aws.pdf

- (Exam Topic 2)
A company uses user data scripts that contain sensitive information to bootstrap Amazon EC2 instances. A Security Engineer discovers that this sensitive information is viewable by people who should not have access to it.
What is the MOST secure way to protect the sensitive information used to bootstrap the instances?

1. A. Store the scripts in the AMI and encrypt the sensitive data using AWS KMS Use the instance role profile to control access to the KMS keys needed to decrypt the data.
2. B. Store the sensitive data in AWS Systems Manager Parameter Store using the encrypted string parameter and assign the GetParameters permission to the EC2 instance role.
3. C. Externalize the bootstrap scripts in Amazon S3 and encrypt them using AWS KM
4. D. Remove the scripts from the instance and clear the logs after the instance is configured.
5. E. Block user access of the EC2 instance's metadata service using IAM policie
6. F. Remove all scripts and clear the logs after execution.

Correct Answer: B

- (Exam Topic 3)
In order to encrypt data in transit for a connection to an AWS RDS instance, which of the following would you implement
Please select:

1. A. Transparent data encryption
2. B. SSL from your application
3. C. Data keys from AWS KMS
4. D. Data Keys from CloudHSM

Correct Answer: B
This is mentioned in the AWS Documentation
You can use SSL from your application to encrypt a connection to a DB instance running MySQL MariaDB, Amazon Aurora, SQL Server, Oracle, or PostgreSQL.
Option A is incorrect since Transparent data encryption is used for data at rest and not in transit Options C and D are incorrect since keys can be used for encryption of data at rest
For more information on working with RDS and SSL, please refer to below URL: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html
The correct answer is: SSL from your application Submit your Feedback/Queries to our Experts

- (Exam Topic 3)
A company has resources hosted in their AWS Account. There is a requirement to monitor all API activity for all regions. The audit needs to be applied for future regions as well. Which of the following can be used to fulfil this requirement.
Please select:

1. A. Ensure Cloudtrail for each regio
2. B. Then enable for each future region.
3. C. Ensure one Cloudtrail trail is enabled for all regions.
4. D. Create a Cloudtrail for each regio
5. E. Use Cloudformation to enable the trail for all future regions.
6. F. Create a Cloudtrail for each regio
7. G. Use AWS Config to enable the trail for all future regions.

Correct Answer: B
The AWS Documentation mentions the following
You can now turn on a trail across all regions for your AWS account. CloudTrail will deliver log files from all regions to the Amazon S3 bucket and an optional CloudWatch Logs log group you specified. Additionally, when AWS launches a new region, CloudTrail will create the same trail in the new region. As a result you will receive log files containing API activity for the new region without taking any action.
Option A and C is invalid because this would be a maintenance overhead to enable cloudtrail for every region Option D is invalid because this AWS Config cannot be used to enable trails
For more information on this feature, please visit the following URL:
https://aws.ama2on.com/about-aws/whats-new/20l5/l2/turn-on-cloudtrail-across-all-reeions-and-support-for-mul The correct answer is: Ensure one Cloudtrail trail is enabled for all regions. Submit your Feedback/Queries to our Experts