AWS Security Specialty Practice Test

Answer choices

1. A. Enable S3 versioning because versioning reduces the number of CloudTrail API events generated, for the described technical objective and its associated operational control requirements.
2. B. Disable CloudTrail entirely for the account, for the described technical objective and its associated operational control requirements, within the . detection (16%) context.
3. C. Review the investigation requirements and refine CloudTrail advanced event selectors to capture the required S3 data events instead of logging unnecessary object activity, within the proposed design.
4. D. Delete historical CloudTrail logs to reduce the current event-ingestion rate, for the described technical objective and its associated operational control requirements, within the proposed design.

Wrong-answer review

• A. Enable S3 versioning because versioning reduces the number of CloudTrail API events generated, for the described technical objective and its associated operational control requirements.: Incorrect. Versioning changes object history behavior; it does not suppress API event generation.
• B. Disable CloudTrail entirely for the account, for the described technical objective and its associated operational control requirements, within the . detection (16%) context.: Incorrect. Disabling CloudTrail removes critical audit visibility.
• D. Delete historical CloudTrail logs to reduce the current event-ingestion rate, for the described technical objective and its associated operational control requirements, within the proposed design.: Incorrect. Deleting old logs affects retention, not current event generation.

Answer choices

1. A. Use CloudTrail to replay resource-creation API calls from a reference account, under the organization’s defined implementation and exception-management process.
2. B. Give local account administrators a checklist and let each administrator build the baseline manually, under the stated technical, operational, and governance constraints.
3. C. Use an organization trail to create the security resources in each member account, within organization-wide risk-and-accountability boundaries.
4. D. Use CloudFormation StackSets for the approved baseline and deploy stack instances to the required accounts and Regions, for the stated implementation and support requirements.

Answer choices

1. A. Amazon Inspector and AWS Config only, for the affected environment.
2. B. Amazon Detective and S3 Lifecycle policies only, within the proposed design.
3. C. Amazon GuardDuty, Security Hub, and Macie, for evaluation.
4. D. Amazon CloudTrail and AWS Lambda only, under the documented operational and governance requirements.

Answer choices

1. A. A CloudTrail permission allowing GetObject, for the described technical objective and its associated operational control requirements, for review.
2. B. An inbound security-group rule on the S3 bucket, within the documented scope, ownership, and validation boundaries.
3. C. kms:Decrypt on the customer managed KMS key, permitted by the effective KMS key/IAM policy configuration, within organization-wide risk-and-accountability boundaries.
4. D. An explicit Allow in the EC2 instance's network ACL for the KMS key ARN, for the described technical objective and its associated operational control requirements, for this task.

Answer choices

1. A. Use the KMS key policy to authorize a key-administrator role for administrative actions and a separate application role only for the required cryptographic operations; use IAM policies or grants where appropriate, within the stated policy framework.
2. B. Give the application role kms:* so it can recover from key-policy mistakes without administrator assistance, for the described technical objective and its associated operational control requirements, as the primary proposed approach.
3. C. Give the key administrators access to decrypt all production data because they already manage the key, for the described technical objective and its associated operational control requirements, as the selected approach for the stated technical and business outcome.
4. D. Rely only on CloudTrail monitoring and grant both groups full KMS permissions, for the described technical objective and its associated operational control requirements, as the primary implementation for the described business requirement.

Answer choices

1. A. Only the final resource that the attacker modified because earlier activity is no longer relevant, under the stated technical, operational, and governance constraints.
2. B. Only the source IP address of the first unauthorized API call, within the documented operational, security, ownership, and validation requirements, as selected.
3. C. The initial access path, affected resources, actions performed, persistence mechanisms, and failed or bypassed controls, for the stated scenario.
4. D. The current account configuration without comparing it with the sequence of attacker actions, under the stated decision criteria.

Answer choices

1. A. Use route tables as the primary packet-filtering control and remove security groups, for the specified implementation requirement.
2. B. Use one security group for all tiers and rely on DNS names to provide segmentation, within organization-wide risk-and-accountability boundaries.
3. C. Use security groups for workload-level stateful filtering and network ACLs for subnet-level stateless filtering, for the required outcome.
4. D. Use network ACLs for stateful workload-level filtering and security groups for stateless subnet-level filtering, as described.

Answer choices

1. A. Give each workload account complete control of its own security logging and require quarterly manual reviews, as the selected approach for the stated technical and business outcome.
2. B. Use a single account so every team shares the same IAM policies, for the described technical objective and its associated operational control requirements, under this approach.
3. C. Use separate accounts for workload and security duties, plus centralized guardrails, organization logging, delegated security administration, and centralized findings.
4. D. Use a shared root credential across all accounts for centralized administration, for the described technical objective and its associated operational control requirements, under the documented operational and governance requirements.

Answer choices

1. A. Give application administrators write access to the archive so they can correct malformed records, for the stated security, delivery, and accountability requirements.
2. B. Reduce the retention period to the minimum possible so there is less evidence to protect, under organization-wide implementation-governance requirements.
3. C. Store the logs with the monitored workloads and depend on application backups for integrity, within the documented operational, security, ownership, and validation requirements.
4. D. Use a separate central log archive with least-privilege access, encryption, integrity protections where supported, and an approved retention policy, within the stated policy framework.

Answer choices

1. A. Create a long-lived IAM access key in every AWS account and email the keys to the contractors, for the described technical objective and its associated operational control requirements, for this task.
2. B. Create a security group that lists contractor public IP addresses and treat it as identity authorization, as the primary implementation for the described business requirement.
3. C. Use IAM Identity Center federation and assign the contractor group permission sets only to the required accounts; remove the assignments when the engagement ends, within this context.
4. D. Use an SCP to grant the contractors read-only access, for the described technical objective and its associated operational control requirements, for the stated scenario.