AWS Security Specialty Practice Test

Answer choices

1. A. Disable server-side encryption and rely on TLS.
2. B. Rely only on the S3 default SSE-S3 configuration.
3. C. Use SSE-C and distribute the same customer-provided key to every application instance.
4. D. Use SSE-KMS with a customer managed KMS key and a least-privilege key policy.

Wrong-answer review

• A. Disable server-side encryption and rely on TLS.: Incorrect. TLS protects data in transit, not data at rest.
• B. Rely only on the S3 default SSE-S3 configuration.: Incorrect. SSE-S3 provides encryption but not the requested customer-managed KMS controls.
• C. Use SSE-C and distribute the same customer-provided key to every application instance.: Incorrect. SSE-C shifts key handling to the customer and creates unnecessary distribution and operational risk for this requirement.

Answer choices

1. A. A screenshot showing that Amazon S3 supports encryption features, plus a list of bucket names.
2. B. A vulnerability scan of the EC2 fleet performed during the same audit period.
3. C. Mapped control evidence showing current bucket encryption and access configuration, along with supported automated assessment evidence or API snapshots collected for the audit period.
4. D. A policy document stating that production buckets should be encrypted, without resource-level evidence.

Answer choices

1. A. Use CloudTrail to replay resource-creation API calls from a reference account.
2. B. Give local account administrators a checklist and let each administrator build the baseline manually.
3. C. Use an organization trail to create the security resources in each member account.
4. D. Use CloudFormation StackSets for the approved baseline and deploy stack instances to the required accounts and Regions.

Answer choices

1. A. Utilize a pre-defined AWS managed policy for developers accessing S3, simplifying access management.
2. B. Grant the development team full S3 administrator access for all buckets to expedite testing workflows.
3. C. Rotate the development team’s IAM access keys every 24 hours to limit the impact of potential compromise.
4. D. Create a custom IAM policy granting read-only access to the specific buckets and objects needed for testing.

Answer choices

1. A. Give application administrators write access to the archive so they can correct malformed records.
2. B. Reduce the retention period to the minimum possible so there is less evidence to protect.
3. C. Store the logs with the monitored workloads and depend on application backups for integrity.
4. D. Use a separate central log archive with least-privilege access, encryption, integrity protections where supported, and an approved retention policy.

Answer choices

1. A. Create a gateway VPC endpoint for Secrets Manager because gateway endpoints support every AWS service.
2. B. Create an interface VPC endpoint for Secrets Manager and restrict endpoint access with appropriate endpoint and IAM policies.
3. C. Create an internet gateway and rely only on TLS because encrypted traffic is equivalent to private connectivity.
4. D. Assign public IP addresses to the application instances and restrict outbound HTTPS to the Secrets Manager public IP ranges.

Answer choices

1. A. Immediately delete the EC2 instance and all S3 objects it accessed.
2. B. Treat every finding as an independent incident and remediate each service without correlation.
3. C. Correlate the findings and supporting telemetry to validate the security event, identify affected principals/resources, and determine the actions performed and data potentially accessed.
4. D. Suppress the GuardDuty finding because Inspector reported a different finding type.

Answer choices

1. A. Create a long-lived IAM access key in every AWS account and email the keys to the contractors.
2. B. Create a security group that lists contractor public IP addresses and treat it as identity authorization.
3. C. Use IAM Identity Center federation and assign the contractor group permission sets only to the required accounts; remove the assignments when the engagement ends.
4. D. Use an SCP to grant the contractors read-only access.

Answer choices

1. A. AWS Security Hub CSPM.
2. B. Amazon Security Lake.
3. C. AWS Config.
4. D. Amazon Detective.

Answer choices

1. A. Manually update credentials every six months and store them in an encrypted file within an S3 bucket with limited access.
2. B. Implement AWS Secrets Manager with automated rotation enabled and enforce granular IAM policies restricting access to authorized users and services.
3. C. Store credentials directly in application code, relying on network firewalls for access control and periodic manual review.
4. D. Utilize Systems Manager Parameter Store with manual rotation and broad user access for simplicity.