AWS Certified Security – Specialty 1-10

表示モード

画像位置

文字位置

理解度の自動記録

問題幅 % 60〜100%

Q1AWS Certified Security Specialty

Q1. At an online retail company, a cloud administrator is setting up a new AWS account.
The administrator wants to protect customer data stored in Amazon S3 buckets.
In addition, they want to minimize the risk of unintended data exposure and misconfiguration of objects within the S3 buckets as much as possible.
Which solution meets these requirements with the least operational overhead?

A. Configure S3 Block Public Access for the entire AWS account.
B. Configure S3 Block Public Access for each individual object within the buckets.
C. Disable the ACLs (access control lists) configured on the objects within the buckets.
D. Use AWS PrivateLink for Amazon S3 as the access path to the buckets.

Show answer

Correct answer: A. Configure S3 Block Public Access for the entire AWS account.

Enabling S3 Block Public Access at the AWS account level is the recommended approach for protecting data with the least operational overhead.
When configured at the account level, it is automatically applied to all existing and newly created buckets and objects, collectively preventing exposure caused by misconfigured bucket policies or ACLs.
Per-object configuration (B) and disabling ACLs (C) require individual handling that is prone to omissions and actually increases operational overhead.
PrivateLink (D) is a mechanism related to the connection path and does not match the requirement of suppressing public access settings.
Being preventive and centrally manageable is the basis for the correct answer.
Blocking public access to your Amazon S3 storage (AWS official documentation)

Q2AWS Certified Security Specialty

Q2. On the internal systems team of a manufacturing company, developers invoke functions directly using AWS Lambda function URLs.
The company wants to prevent developers from creating or updating unauthenticated functions in the production account.
The company wants to enforce this control using AWS Organizations, while also needing a mechanism that requires no additional work or awareness on the developers’ part.
Which solution meets this requirement?

A. Instruct developers to enable CORS (cross-origin resource sharing) on all function URLs, in case functions might be called from another domain.
B. Use an AWS WAF delegated administrator account to detect and block unauthenticated access to production account function URLs based on the OU to which the account using the function belongs.
C. Use an SCP to allow all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions where the lambda:FunctionUrlAuthType condition key value is AWS_IAM.
D. Use an SCP to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions where the lambda:FunctionUrlAuthType condition key value is NONE.

Show answer

Correct answer: D. Use an SCP to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions where the lambda:FunctionUrlAuthType condition key value is NONE.

Lambda function URLs have two authentication types: AWS_IAM (IAM authentication) and NONE (public).
NONE makes the function accessible to anyone, which poses a serious risk in a production environment.
By explicitly denying Create/UpdateFunctionUrlConfig where FunctionUrlAuthType is NONE via an SCP (service control policy), you can prevent the creation of unauthenticated functions across the entire organization without any effort on the developers’ part.
Option C (Allow), which permits AWS_IAM, still leaves room for creation via other permissions unless a Deny is in place, so it is insufficient as a preventive guardrail.
WAF (B) and CORS (A) are not means of enforcing the authentication type itself.
Security and auth model for Lambda function URLs (AWS official documentation)

Q3AWS Certified Security Specialty

Q3. A security engineer at a startup received a notification of suspicious activity regarding a Linux-based Amazon EC2 instance that uses Amazon EBS-based storage.
Upon investigation, they found that the instance was communicating with a known malicious address.
The instance resides in a development account within a VPC in the us-east-1 region.
The VPC has an internet gateway and is configured with two subnets, us-east-1a and us-east-1b.
Each subnet is associated with a route table that uses the internet gateway as its default route, and uses the default network ACL.
The suspicious EC2 instance is running in the us-east-1b subnet.
Initial investigation revealed that the only instance running in that subnet is the suspicious instance in question.
Which response immediately mitigates the attack while also helping to investigate the root cause?

A. Log in to the suspicious instance and use the netstat command to identify established remote connections.
Create a deny rule in the instance’s security group for the identified IP addresses.
Install additional diagnostic tools onto the instance for investigation.
As the first rule during the investigation, update the outbound network ACL of the us-east-1b subnet to explicitly deny all traffic.
B. Update the outbound network ACL of the us-east-1b subnet to explicitly deny all traffic as the first rule.
Replace the existing security group with a new one that allows connections only from a diagnostic security group.
Remove the deny rule from the outbound network ACL of the us-east-1b subnet.
Launch a new EC2 instance equipped with diagnostic tools and assign the new security group to it.
Investigate the suspicious instance from that new instance.
C. Configure the Amazon EBS volume attached to the suspicious EC2 instance so that it is not deleted on instance termination.
Terminate the instance.
Launch a new EC2 instance equipped with diagnostic tools in us-east-1a.
Mount the EBS volume of the terminated instance to that new instance and investigate.
D. Create an AWS WAF web ACL that denies communication with the suspicious instance.
Associate that web ACL with the instance to mitigate the attack.
Log in to the instance, install diagnostic tools, and investigate.

Show answer

Correct answer: C. Configure the Amazon EBS volume attached to the suspicious EC2 instance so that it is not deleted on instance termination. Terminate the instance. Launch a new EC2 instance equipped with diagnostic tools in us-east-1a. Mount the EBS volume of the terminated instance to that new instance and investigate.

The fundamental principles of incident response are immediate containment, evidence preservation, and forensics in a safe environment.
Without logging in directly to the suspected compromised instance or installing additional tools, you preserve the EBS volume, then terminate the instance to immediately cut off the malicious communication.
By setting the volume to not be deleted on termination, the on-disk evidence is retained and can be analyzed by mounting it to a separate clean instance.
Options A and D, which log in and operate on the instance, risk contaminating the evidence.
WAF cannot be attached directly to EC2, so D itself is inappropriate.
B isolates via the network but keeps the instance running, making its containment weaker than C.
AWS Security Incident Response Guide (AWS official documentation)

Q4AWS Certified Security Specialty

Q4. A financial company’s VPC has no route to the internet, and the private DNS hostnames option is enabled.
An Amazon Aurora database is running within this VPC.
A security engineer wants to use AWS Secrets Manager to automatically rotate the Aurora credentials.
The engineer configured the default AWS Lambda rotation function for Secrets Manager to run in the same VPC as Aurora.
However, it turned out that the Lambda function cannot communicate with the Secrets Manager endpoint, and the password rotation does not work correctly.
What is the most secure way to give the Lambda function a means to communicate with the Secrets Manager endpoint?

A. Add a NAT gateway to the VPC to provide a route to the Secrets Manager endpoint.
B. Add a gateway-type VPC endpoint to the VPC to provide a route to the Secrets Manager endpoint.
C. Add an interface-type VPC endpoint to the VPC to provide a route to the Secrets Manager endpoint.
D. Add an internet gateway to the VPC to provide a route to the Secrets Manager endpoint.

Show answer

Correct answer: C. Add an interface-type VPC endpoint to the VPC to provide a route to the Secrets Manager endpoint.

Secrets Manager is a regional service that can be connected to privately via interface-type VPC endpoints built on AWS PrivateLink.
In a VPC with no internet route, an interface endpoint creates an ENI and a private IP within the subnet, allowing communication with Secrets Manager without going through the internet or a NAT, which makes it the most secure option.
A NAT gateway (A) and an internet gateway (D) send traffic out to the public internet, which violates the requirement.
Gateway-type endpoints (B) only support S3 and DynamoDB and cannot be used for Secrets Manager.
Using a Secrets Manager VPC endpoint (AWS official documentation)

Q5AWS Certified Security Specialty

Q5. A security engineer at a logistics company wants to forward custom application security logs generated on Amazon EC2 instances to Amazon CloudWatch.
The engineer installed the CloudWatch agent on the EC2 instance and added the target log path to the CloudWatch agent configuration file.
However, CloudWatch is not receiving the logs.
When the engineer checked, the awslogs service was running normally on the EC2 instance.
What should the engineer do next to resolve this problem?

A. Add AWS CloudTrail to the EC2 instance’s trust policy.
Change the destination of the custom logs from CloudWatch to CloudTrail.
B. Add Amazon S3 to the EC2 instance’s trust policy.
Configure the application to write custom logs to an S3 bucket and have CloudWatch ingest them.
C. Add Amazon Inspector to the EC2 instance’s trust policy.
Use Amazon Inspector instead of the CloudWatch agent to collect the custom logs.
D. Attach the AWS managed policy CloudWatchAgentServerPolicy to the EC2 instance’s role.

Show answer

Correct answer: D. Attach the AWS managed policy CloudWatchAgentServerPolicy to the EC2 instance’s role.

The CloudWatch agent requires explicit IAM permissions to create log groups and log streams and to send log events.
The most common cause of failed log delivery by the agent is insufficient IAM permissions on the EC2 instance role, and attaching CloudWatchAgentServerPolicy grants the logs:CreateLogGroup, CreateLogStream, and PutLogEvents permissions, resolving the issue.
A trust policy defines the principals that can assume a role, so options A, B, and C, which add S3, Inspector, or CloudTrail to the trust policy, have a different meaning and do not meet this requirement.
Create IAM roles and users for use with the CloudWatch agent (AWS official documentation)

Q6AWS Certified Security Specialty

Q6. A pharmaceutical company is attempting to perform forensic analysis on an Amazon EC2 instance but cannot connect to the instance using AWS Systems Manager Session Manager.
The company has already installed the AWS Systems Manager agent (SSM Agent) on the EC2 instance.
This EC2 instance is placed in a subnet within a VPC that has no internet gateway attached.
The EC2 instance has a security group associated with it, but neither inbound nor outbound rules are configured.
The subnet’s network ACL is set to allow all inbound and outbound traffic.
Which combination of actions allows forensic analysis to be performed on the EC2 instance without compromising the forensic data? (Choose three.)

A. Update the EC2 instance’s security group to add a rule that allows outbound traffic to 0.0.0.0/0 on port 443.
B. Update the EC2 instance’s security group to add a rule that allows inbound traffic on port 443 from the VPC’s CIDR range.
C. Create a new EC2 key pair and associate it with the EC2 instance.
D. Create a VPC interface endpoint for Systems Manager within the VPC where the EC2 instance is placed.
E. Associate a security group with the VPC interface endpoint that allows inbound traffic on port 443 from the VPC’s CIDR range.
F. Create a VPC interface endpoint for EC2 within the VPC where the EC2 instance is placed.

Show answer

Correct answer: A, D, E

Session Manager requires outbound HTTPS (port 443) communication from EC2 to the Systems Manager endpoints.
In a VPC with no internet route, you can connect securely without external exposure by creating an interface VPC endpoint for Systems Manager (D), allowing outbound port 443 in the EC2 security group (A), and allowing inbound port 443 from the VPC CIDR in the endpoint’s security group (E).
A key pair (C) is for SSH, so it is unnecessary and could compromise evidence due to the risk of a reboot.
An inbound rule for Session Manager itself (B) is unnecessary, and an endpoint for EC2 (F) does not apply to this connection requirement.
Creating VPC endpoints for Systems Manager (AWS official documentation)

Q7AWS Certified Security Specialty

Q7. A security team at an insurance company centrally manages an internal AWS Key Management Service (AWS KMS) customer managed key.
Only members of the security team are allowed to manage this KMS key.
Meanwhile, the application team has a software process that occasionally needs temporary access to this key.
The security team needs to provide access to the key for this software process.
Which solution meets these requirements with the least operational overhead?

A. Export the KMS key’s key material to an on-premises hardware security module (HSM) and grant the application team access to that key material.
B. Edit the key policy that allows the security team access to the KMS key, adding the application team as a principal.
Revert this change once access is no longer needed.
C. Create a key grant that allows the application team to use the KMS key, and retire the grant once access is no longer needed.
D. Generate key material on-premises to create a new KMS key.
Import the key material into AWS KMS and grant permission to use the key each time the application team needs access.

Show answer

Correct answer: C. Create a key grant that allows the application team to use the KMS key, and retire the grant once access is no longer needed.

A KMS key grant is a mechanism that can grant temporary, fine-grained usage permissions without changing the key policy itself.
Grants can programmatically and dynamically grant and revoke permissions such as Encrypt, Decrypt, and GenerateDataKey, making them ideal for short-term access requirements and minimizing operational overhead.
Editing the key policy (B) involves the effort of changing and reverting it, and carries a high risk of misconfiguration.
Exporting key material (A) is not possible in KMS, and operating with imported keys (D) is a cumbersome procedure; both are excessive responses.
Grants in AWS KMS (AWS official documentation)

Q8AWS Certified Security Specialty

Q8. An advertising agency uses AWS CloudTrail and Amazon CloudWatch to monitor resources within its AWS account.
The company’s developers have been using an IAM role in this account over the past three months.
A security engineer needs to review and narrow down the customer managed IAM policy attached to the role so that the role has only the least privilege.
Which solution meets this requirement with the least effort?

A. Run the AWS IAM Access Analyzer policy generation feature against that IAM role.
B. Run the AWS IAM Access Analyzer policy validation feature against that IAM role.
C. Search CloudWatch logs to identify the actions the role invoked, and evaluate the required permissions.
D. Use AWS Trusted Advisor to compare the policy assigned to the role against AWS best practices.

Show answer

Correct answer: A. Run the AWS IAM Access Analyzer policy generation feature against that IAM role.

The IAM Access Analyzer policy generation feature automatically generates a least-privilege policy based on actual usage history recorded in CloudTrail.
Because the role has been used for three months and sufficient CloudTrail history has accumulated, policy generation can create a policy that includes only the API actions and resources actually invoked, achieving least privilege with minimal effort.
Policy validation (B) only checks syntax and best practices and does not generate a least-privilege policy.
Manually searching logs (C) requires significant effort, and Trusted Advisor (D) is not suited for generating least-privilege policies.
IAM Access Analyzer policy generation (AWS official documentation)

Q9AWS Certified Security Specialty

Q9. An educational institution operates AWS IAM Identity Center using SAML 2.0 federation.
The institution has decided to switch the identity provider (IdP) referenced by the federation from the current IdP to a different IdP.
The directories on which both IdPs are based are both Active Directory.
Which solution meets this requirement?

A. Disable all existing users and groups in IAM Identity Center that were included in the federation with the original IdP.
B. Change the attribute mappings in the IAM Identity Center trust relationship to match the information sent by the new IdP.
C. Reconfigure all existing IAM roles in the company’s AWS account to explicitly trust the new IdP as a principal.
D. Ensure that the Network Time Protocol (NTP) clock skew between IAM Identity Center and the new IdP’s endpoints is properly configured.

Show answer

Correct answer: B. Change the attribute mappings in the IAM Identity Center trust relationship to match the information sent by the new IdP.

IAM Identity Center associates federated users with identities, groups, and permission sets through SAML assertions and attribute mappings.
When switching only the IdP without changing the underlying directory, updating the attribute mappings to match the new IdP’s assertions allows migration while maintaining the associations of existing users and groups.
Disabling existing users (A) is unnecessary and instead causes them to lose access.
Changing IAM role trust (C) is a matter of role-based access rather than IdP federation and does not apply.
Checking clock skew (D) is only for isolating connection failures and does not itself meet the requirement of switching the IdP.
Attribute mappings in IAM Identity Center (AWS official documentation)

Q10AWS Certified Security Specialty

Q10. A telecommunications provider runs an application on AWS.
The company uses a multi-environment configuration, isolating each environment in a separate AWS account.
The accounts are managed through an AWS Organizations organization, and there is one dedicated security account within the organization.
The company needs to create an inventory of all sensitive data stored in Amazon S3 buckets across each account in the organization.
The findings must be reviewable from a single location.
Which solution meets these requirements?

A. Set the security account as the delegated administrator account for Amazon Macie and AWS Security Hub.
Enable and configure Macie, and publish the sensitive data findings to Security Hub.
B. Set the security account as the delegated administrator account for AWS Security Hub.
Configure Amazon Inspector in each account to scan for sensitive data in S3 buckets.
Publish the sensitive data findings to Security Hub.
C. Configure Amazon Inspector in each account to scan for sensitive data in S3 buckets.
Enable the integration between Amazon Inspector and AWS Trusted Advisor.
Publish the sensitive data findings to Trusted Advisor.
D. Enable and configure Amazon Macie in each account to detect sensitive data.
Enable the integration between Macie and AWS Trusted Advisor.
Publish the sensitive data findings to Trusted Advisor.

Show answer

Correct answer: A. Set the security account as the delegated administrator account for Amazon Macie and AWS Security Hub. Enable and configure Macie, and publish the sensitive data findings to Security Hub.

Amazon Macie is a service specialized in the discovery, classification, and inventorying of sensitive data stored in S3.
Macie can be enabled organization-wide across AWS Organizations using the delegated administrator mechanism, and setting the security account as the delegated administrator for both Macie and Security Hub allows the findings to be aggregated in a single location.
Amazon Inspector does not perform sensitive data discovery for S3 (B and C), so it does not meet the requirement.
Trusted Advisor (C and D) is not an aggregation destination for sensitive data findings and does not match the requirement for centralized visibility.
Amazon Macie and AWS Organizations (AWS official documentation)

AWS Certified Security – Specialty 1-10

Choose confidence levels to display