AWS Security Clase 5

You are hosting a web site via website hosting on an S3 bucket - http://demo.s3-website-us-east-l

.amazonaws.com. You have some web pages that use Javascript that access resources in another bucket which has web site hosting also enabled. But when

users access the web pages , they are getting a blocked Javascript error. How can you rectify this?

• A. Enable CORS for the bucket

• B. Enable versioning for the bucket

• C. Enable MFA for the bucket

• D. Enable CRR for the bucket

You have a vendor that needs access to an AWS resource. You create an AWS user account. You want to restrict access to the resource using a policy for just

that user over a brief period. Which of the following would be an ideal policy to use?

• A. An AWS Managed Policy

• B. An Inline Policy

• C. A Bucket Policy

• D. A bucket ACL

A company wants to have a secure way of generating, storing and managing cryptographic exclusive access for the keys. Which of the following can be used for

this purpose?

• A. Use KMS and the normal KMS encryption keys

• B. Use KMS and use an external key material

• C. Use S3 Server Side encryption

• D. Use Cloud HSM

Your company has an EC2 Instance that is hosted in an AWS VPC. There is a requirement to ensure that logs files from the EC2 Instance are stored accordingly.

The access should also be limited for the destination of the log files. How can this be accomplished? Choose 2 answers from the options given below. Each

answer forms part of the solution

• A. Stream the log files to a separate Cloudtrail trail

• B. Stream the log files to a separate Cloudwatch Log group

• C. Create an 1AM policy that gives the desired level of access to the Cloudtrail trail

• D. Create an 1AM policy that gives the desired level of access to the Cloudwatch Log group

Your company has defined privileged users for their AWS Account. These users are administrators for key resources defined in the company. There is now a

mandate to enhance the security

authentication for these users. How can this be accomplished?

• A. Enable MFA for these user accounts

• B. Enable versioning for these user accounts

• C. Enable accidental deletion for these user accounts

• D. Disable root access for the users

You have a 2 tier application hosted in AWS. It consists of a web server and database server (SQL Server) hosted on separate EC2 Instances. You are devising

the security groups for these EC2 Instances. The Web tier needs to be accessed by users across the Internet. You have created a web security group(wg-123)

and database security group(db-345). Which combination of the following security group rules will allow the application to be secure and functional. Choose 2

answers from the options given below.

• A. wg-123 -Allow ports 80 and 443 from 0.0.0.0/0

• B. db-345 - Allow port 1433 from wg-123

• C. wg-123 - Allow port 1433 from wg-123

• D. db-345 -Allow ports 1433 from 0.0.0.0/0

Your IT Security department has mandated that all data on EBS volumes created for underlying EC2 Instances need to be encrypted. Which of the following can

help achieve this?

• A. AWS KMS API

• B. AWS Certificate Manager

• C. API Gateway with STS

• D. IAM Access Key

You have an instance setup in a test environment in AWS. You installed the required application and the promoted the server to a production environment. Your IT

Security team has advised that there maybe traffic flowing in from an unknown IP address to port 22. How can this be mitigated immediately?

• A. Shutdown the instance

• B. Remove the rule for incoming traffic on port 22 for the Security Group

• C. Change the AMI for the instance

• D. Change the Instance type for the instance