Management and Security Governance

Refer to the exhibit. A security engineer creates this IAM policy for a user. Which action can the user perform?

A company's security team discovers that an IAM role has been assumed from an unexpected external AWS account. Which AWS service can be used to analyze the trust policy and identify unintended access?

A company uses AWS Organizations and wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail log files from S3. Which TWO actions should the security team take? (Choose TWO.)

A developer has created an S3 bucket policy that grants public read access. The security team wants to prevent any S3 bucket from becoming public. Which AWS service can enforce this restriction across all accounts?

Which THREE are benefits of using AWS CloudTrail for security governance? (Choose three.)

A company wants to ensure that all S3 buckets in their AWS account have encryption enabled. Which AWS service can continuously evaluate compliance and automatically remediate non-compliant buckets?

A company uses AWS KMS to encrypt sensitive data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which TWO actions should be taken? (Choose TWO.)

A security engineer is designing a data encryption strategy for an S3 bucket that contains sensitive information. Which TWO of the following are valid options for enforcing encryption at rest?

Refer to the exhibit. A security engineer attaches this S3 bucket policy to an S3 bucket. What is the effect of this policy?

A company uses AWS KMS to encrypt data in S3 buckets. The security team needs to ensure that KMS keys can only be used by specific IAM roles within the same account. Which key policy should be applied?

Which TWO actions are best practices for securing an AWS account root user? (Select TWO.)

A company uses AWS Organizations with many accounts. The security team wants to ensure that no account can disable AWS CloudTrail or stop logging. Which configuration should be used?

A company uses AWS Organizations with multiple accounts. The security team wants to centrally manage IAM policies across all accounts. Which AWS feature should the team use to enforce permissions across member accounts?

A company is implementing AWS Organizations with multiple accounts. Which THREE are benefits of using service control policies (SCPs)? (Choose three.)

A company is using AWS Organizations to manage multiple accounts. The security team needs to enforce that all newly created S3 buckets across the organization have server-side encryption (SSE-S3) enabled by default. Which solution is MOST operationally efficient?

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all CloudTrail trails be encrypted with a customer-managed KMS key. Which CloudFormation template snippet correctly enforces this requirement?

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization block public access. Which policy should be attached to the root organizational unit to achieve this?

A company wants to automate the enforcement of security best practices across all AWS accounts in an organization. The solution should automatically remediate noncompliant resources. Which AWS service should be used to achieve this?

A security engineer notices that an IAM user has been inactive for 90 days. What is the best way to identify and disable such users?

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to my-bucket using server-side encryption with AWS KMS (SSE-KMS). What is the outcome?

A security engineer is designing a solution to automatically remediate non-compliant resources in an AWS account. The engineer needs to trigger an AWS Lambda function when an EC2 instance is launched without the required tags. Which AWS service should be used to detect the non-compliant resource and invoke the Lambda function?

A company uses AWS Key Management Service (KMS) to encrypt sensitive data in Amazon S3. The security team needs to ensure that the KMS key can only be used from within the company's VPC and not from the public internet. How can this be achieved?

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance in a private subnet is making outbound connections to an external IP address on port 443. The VPC has a NAT gateway in a public subnet, and the route table for the private subnet directs 0.0.0.0/0 to the NAT gateway. The security group for the instance allows all outbound traffic. Which AWS service can the engineer use to determine which IAM role or user is responsible for launching the instance?

A security engineer is designing a system to centrally manage security rules across multiple AWS accounts. The engineer wants to ensure that any resources that are non-compliant with security policies are automatically remediated. Which combination of services should the engineer use?

A security engineer needs to automatically detect and respond to unauthorized API calls in an AWS account. Which two services should be used together?

Refer to the exhibit. A security engineer applies this bucket policy to an S3 bucket. A user without HTTPS tries to download an object. What is the outcome?

An IAM policy is attached to a user. The user reports that they cannot list objects in the bucket 'example-bucket' from their home office IP address 203.0.113.50. What is the most likely cause?

A security engineer needs to ensure that an Amazon S3 bucket is not publicly accessible. Which AWS service can be used to continuously monitor and alert if the bucket becomes public?

A company wants to centrally manage and enforce security policies across all accounts in AWS Organizations. Which AWS service should be used to define and apply guardrails?

A company has a multi-account AWS environment managed with AWS Organizations. The security team wants to ensure that no EC2 instance in any account can be launched without a specific tag 'CostCenter'. The team has created a Service Control Policy (SCP) that denies the ec2:RunInstances action if the request does not include the tag 'CostCenter'. However, they find that instances are still being launched without the tag in some accounts. What is the most likely reason?

Which TWO AWS services can be used to detect and alert on unauthorized API calls in real time?

A security team needs to ensure that all API calls made in the AWS account are logged and the logs are stored in a central S3 bucket that is encrypted with a KMS key. Which combination of steps should the team take to achieve this?

A company has a multi-account AWS Organization with hundreds of accounts. The security team wants to prevent any IAM user from creating access keys in any account. What is the most scalable and secure approach?

The exhibit shows an S3 bucket policy. The security team wants to ensure that only users from account 123456789012 can access objects in the bucket. What is a potential security issue with this policy?

An S3 bucket policy is created as shown. What is the effect of this policy?

A company has a requirement to audit all API calls made to AWS services in their account. Which AWS service should be used to meet this requirement?

A global e-commerce company operates in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company uses AWS Organizations with 50 member accounts grouped by business unit. The security team recently discovered that several S3 buckets containing customer data were accidentally made public due to misconfigured bucket policies. The team wants to implement a preventive control that blocks any S3 bucket from becoming public across all accounts, while still allowing authorized cross-account access. The solution must be centrally managed and not require changes to existing IAM policies. Additionally, the team needs to be notified immediately when a public bucket is attempted. Which solution meets all requirements?

A company requires that all IAM users in the Security team must use multi-factor authentication (MFA) to access the AWS Management Console. The company has enabled MFA for all users, but the Security team administrator reports that some users can still sign in without MFA. Which action should the administrator take to enforce MFA for all sign-ins?

A company has a multi-account AWS Organization with 50 accounts. The security team uses AWS CloudTrail to log all API calls and sends the logs to a central S3 bucket in the security account. The team wants to ensure that any attempt to disable CloudTrail logging or delete the trail is detected and automatically remediated within 5 minutes. They have configured an AWS Config rule that triggers an AWS Lambda function when the CloudTrail configuration changes. However, the Lambda function is not being invoked when they test by stopping the trail. The Lambda function's IAM role has permissions to start and update CloudTrail. CloudTrail logs show that the Config rule is evaluating the resource, but the Lambda function is not triggered. What is the most likely cause?

A company's security team discovers that an EC2 instance in the production account has been compromised. The instance has an IAM role attached that allows it to read from an S3 bucket containing sensitive data. The team needs to immediately stop the data exfiltration while preserving the evidence. What should the team do first?

Which THREE measures should a security team implement to detect and respond to potential security incidents in an AWS environment? (Select THREE.)

Refer to the exhibit. A security engineer applied the bucket policy shown. What is the effect of this policy?

A security engineer needs to audit all API calls made in an AWS account for the past 90 days. Which AWS service should the engineer use?

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce that all S3 buckets across the organization have block public access enabled. Which policy should be used?

A company has a requirement that all Amazon EC2 instances must be launched with an IAM role that grants least-privilege permissions. The security team wants to prevent users from launching instances without a role, and also want to ensure that the role used is one of a set of approved roles. How can this be enforced?

A security engineer needs to grant a user read-only access to an S3 bucket. Which THREE of the following are required in the IAM policy?

A security engineer notices that an S3 bucket policy allows access to a principal from another AWS account. Which AWS feature can be used to check if this external access is intended?

A security engineer needs to ensure that all API calls in an AWS account are logged and that the logs are encrypted at rest and retained for at least 7 years. Which THREE steps should the engineer take? (Choose THREE.)

A security team is reviewing IAM roles and policies. They want to ensure that any new IAM role created in the account must include a specific managed policy (e.g., SecurityAudit). What AWS service can enforce this requirement?

A company has an S3 bucket that contains sensitive data. The bucket policy allows access only from a specific VPC endpoint. A security engineer notices that objects in the bucket are being deleted by an IAM user from outside the VPC. The engineer checks the bucket policy and confirms that the policy denies access if the request does not come from the VPC endpoint. However, the deletions continue. What is the most likely cause?

Refer to the exhibit. A company uses this CloudFormation template. What security best practice is being violated?

Which TWO AWS services can be used to enforce that specific resource types (e.g., EC2 instances) are tagged with a 'CostCenter' tag? (Choose two.)

What is the purpose of an AWS Service Control Policy (SCP) in AWS Organizations?

A company uses AWS KMS to encrypt sensitive data. The security team wants to ensure that KMS keys can only be used by specific IAM roles and that key usage is logged. Which combination of actions should the team take? (Choose the best answer.)

A company wants to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which AWS service can be used to enforce this requirement?

Match each AWS security control to its category.

A security engineer needs to ensure that all new IAM users are created with a strong password policy enforced. Which action should be taken?

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record these changes?

A company uses AWS Organizations with a management account and several member accounts. The security team wants to restrict the use of specific AWS services (e.g., EC2, Lambda) in certain accounts based on the account's environment (dev, test, prod). Which approach should be used to implement this requirement?

A company wants to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. The bucket policy in Account A allows access from Account B. What additional configuration is required?

A company has a requirement that all IAM users must use strong passwords. The security engineer needs to enforce a password policy that requires minimum 12 characters, at least one uppercase letter, and at least one number. The engineer sets the password policy in IAM. However, existing users with weak passwords are not forced to change them. What should the engineer do to enforce the policy for existing users?

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent the creation of Amazon EC2 instances with public IP addresses in all accounts. Which TWO actions should the team take to implement this control using Service Control Policies (SCPs)?

A security team wants to audit all changes to IAM policies in the AWS account. Which AWS service should be used to track these changes?

A security engineer runs the get-account-authorization-details command and sees the exhibit output. The engineer wants to ensure that the 'admin' user does not have administrative access. Which steps should be taken?

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot upload files to the S3 bucket 'example-bucket' using the AWS CLI with HTTPS. What is the most likely reason?

A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?

A security engineer discovers that an IAM user has a policy that allows them to delete any S3 bucket in the account. The engineer wants to audit all delete actions performed by this user. Which AWS service should be used?

A company is using AWS Organizations and wants to delegate the management of IAM policies to a specific member account without granting full administrative access. Which AWS feature allows the management account to delegate policy management to another account?

A company uses AWS Organizations and wants to centrally manage CloudTrail trails across all accounts. Which feature should be enabled?

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

A security engineer is designing a solution to automatically remediate noncompliant EC2 security groups. The company uses AWS Organizations with multiple accounts. The engineer wants to deploy an AWS Config rule and a custom Lambda function in a central security account to evaluate and remediate security groups across all accounts. Which combination of steps is REQUIRED to allow the Lambda function to modify security groups in member accounts? (Choose TWO.)

A company is implementing a data classification policy using AWS. The policy requires that all S3 objects containing personally identifiable information (PII) be automatically tagged and encrypted. Which THREE services should be used together to meet this requirement?

A security engineer is designing a solution to detect and alert on any S3 bucket that is publicly accessible. Which THREE services can be used together to achieve this?

A security engineer is reviewing the following IAM policy attached to a role. Which TWO actions are allowed by this policy? (Choose two.) ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": "*" } ] } ```

A company uses AWS Key Management Service (KMS) to encrypt data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which action should be taken?

A company wants to log all API calls made in their AWS account for auditing. Which AWS service should be enabled to capture these logs?

A security engineer has attached the above IAM policy to a user. The user reports that they cannot upload objects to the S3 bucket from their office, which has a public IP address of 198.51.100.50. What is the MOST likely reason for the failure?

A security team needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. The solution must be scalable and support future account additions. Which approach meets these requirements?

A company's security team is implementing a data classification policy for S3 objects using S3 Object Tags. They need to ensure that any object uploaded without the required 'classification' tag is automatically denied. Which S3 bucket policy condition should be used?

A security engineer is designing a system to detect and respond to IAM policy changes that could grant excessive permissions. The solution must alert within minutes of the change and automatically revert the change if it violates a predefined baseline. Which combination of services should the engineer use?

A startup is deploying a web application on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that all traffic to the EC2 instances is encrypted. They configure the ALB to listen on HTTPS (port 443) and forward traffic to the EC2 instances on HTTP (port 80). Additionally, they create a security group for the EC2 instances that only allows inbound traffic from the ALB's security group on port 80. However, a security audit reveals that the traffic between the ALB and EC2 instances is not encrypted. Which step should the security team take to encrypt the traffic between the ALB and EC2 instances?

A security engineer notices that an IAM role in the production account is being assumed by a user from another AWS account, which violates the principle of least privilege. The role's trust policy allows the root user of the external account. What is the MOST secure way to restrict access to only a specific user in the external account?

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to read objects from an S3 bucket only from the office IP range 192.0.2.0/24. However, the user reports that they can access objects from any IP address. What is the most likely reason?

A developer accidentally committed AWS access keys to a public GitHub repository. The security team needs to immediately revoke the compromised keys and ensure that no new keys are created for that IAM user. What is the most effective immediate action?

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that no account can disable a specific security service, such as AWS Config, across all accounts. Which approach should be used?

Refer to the exhibit. A security engineer runs the CLI command to determine if the IAM user 'testuser' created a key pair in January 2023. The output shows one event. What can be concluded from this output?

A company is implementing a data retention policy for CloudTrail logs. The logs are stored in an S3 bucket. The policy requires that logs be retained for 7 years and then automatically deleted. Which TWO actions should the security engineer take to meet this requirement?

A security engineer is reviewing the CloudTrail configuration for a trail named 'management-trail'. The engineer needs to ensure that all S3 object-level operations in the bucket 'my-bucket' are logged. What is the issue with the current configuration?

A company has a security requirement that any Amazon RDS database must be encrypted at rest. Which TWO actions should be taken to enforce this requirement?

A security engineer is designing a system to centrally manage IAM users and roles across multiple AWS accounts. The company uses AWS Organizations. Which AWS service should be used to manage permissions across accounts?

A company has a security policy that requires all IAM users to use multi-factor authentication (MFA) when accessing the AWS Management Console. The company also wants to enforce this policy using an SCP. Which TWO conditions must be met for the SCP to be effective?

A security engineer is implementing a data classification policy for an S3 bucket that contains sensitive customer data. The policy requires that all objects be encrypted at rest using AWS KMS and that any attempt to upload an unencrypted object be denied. Which THREE steps should the engineer take to enforce this policy? (Choose THREE.)

A company uses AWS Organizations with multiple accounts. The security team wants to prevent all users in the production account from disabling AWS CloudTrail or modifying its configuration. What is the MOST effective way to achieve this?

Refer to the exhibit. A CloudFormation template creates an S3 bucket. Which security control is NOT enabled by this template?

A security team needs to ensure that all IAM users in a production account use multi-factor authentication (MFA) before accessing the AWS Management Console. Which TWO steps should be taken? (Choose TWO.)

A financial services company uses AWS Organizations to manage multiple accounts. The Security team has enabled AWS CloudTrail in all accounts and logs are delivered to a central S3 bucket in the management account. The company has a requirement to detect and alert on any IAM user or role that performs a console login without multi-factor authentication (MFA) across all accounts. Currently, the team manually reviews CloudTrail logs, which is time-consuming and error-prone. They want an automated solution that uses AWS services and follows AWS best practices for security governance. The solution must be cost-effective and should not require custom code or third-party tools. What should the Security team do to meet this requirement?

A security engineer is designing a governance framework for a multi-account AWS environment. The framework must enforce the principle of least privilege for cross-account access. Which TWO strategies should be implemented?

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created accounts automatically have AWS CloudTrail enabled, with logs delivered to a centralized S3 bucket. Which solution meets these requirements with the least operational overhead?

Which TWO AWS services can be used to automatically enforce policies on resources at the time of creation? (Choose two.)

A company wants to enforce that all IAM users in its AWS account use multi-factor authentication (MFA) for console login. Which action should be taken to ensure compliance?

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to detect users without MFA and automatically send a notification?

A company wants to centrally manage backups for Amazon RDS instances across multiple AWS accounts. Which AWS service should be used to automate the creation and enforcement of backup policies?

A company is using AWS Organizations and wants to restrict the use of specific AWS services in member accounts. Which TWO approaches can be used to enforce these restrictions? (Choose TWO.)

A company has an AWS environment with multiple accounts managed under AWS Organizations. The security team wants to enforce that all newly created S3 buckets in any account have encryption enabled by default. Which approach should the security team take?

A company has a requirement to automatically rotate secrets for an RDS database every 90 days. The secrets are stored in AWS Secrets Manager. Which resource should be configured to perform the rotation?

A security engineer is configuring an S3 bucket policy to restrict access to only requests that originate from a specific VPC endpoint. Which condition key should be used?

A company wants to automatically detect and remediate S3 buckets that are publicly accessible. Which AWS service can be used to evaluate bucket policies against a defined rule and trigger an automated response?

A company wants to grant a third-party auditor read-only access to specific CloudTrail log files stored in an S3 bucket. The auditor should not be able to list or access any other objects in the bucket. What is the most secure way to achieve this?

A company has an AWS Organization with hundreds of accounts. The security team wants to enforce that no account can disable AWS CloudTrail logging. Which TWO approaches can achieve this?

An organization has a requirement to retain all AWS CloudTrail logs for at least 7 years for compliance. Currently, logs are stored in an S3 bucket with default settings. What is the MOST cost-effective way to meet the retention requirement?

A security engineer creates the IAM policy shown in the exhibit. The policy is attached to an IAM role. When a user assumes the role and attempts to upload an object to the bucket without specifying server-side encryption, what is the expected behavior?

Which TWO AWS services can be used to detect and alert on suspicious API activity in real-time? (Choose two.)

A company wants to centrally manage and enforce security policies across multiple AWS accounts using AWS Organizations. Which THREE actions should be taken? (Choose three.)

Which THREE AWS services can be used to detect and alert on suspicious API activity in an AWS account? (Choose three.)

A company uses AWS Organizations to manage 50 accounts. The security team has enabled AWS CloudTrail in the management account with an organization trail that delivers logs to a central S3 bucket. The bucket policy grants necessary permissions to CloudTrail. Recently, the security team noticed that logs from two member accounts stopped appearing in the bucket. Other accounts continue to deliver logs correctly. The CloudTrail status in the management account shows that the trail is logging and deliveries are succeeding. The security team checked the CloudTrail configuration in the affected member accounts and found that they do not have any trails configured. The IAM roles used for CloudTrail in the management account have sufficient permissions. What is the most likely cause of the missing logs?

A company has a multi-account AWS Organizations setup with hundreds of accounts. The Security team needs to enforce a policy that prohibits the creation of any S3 bucket with public read access across all accounts. They have enabled all features in Organizations and are using Service Control Policies (SCPs). The team creates an SCP with a Deny effect for s3:PutBucketAcl and s3:PutBucketPolicy when the request includes a condition that would make the bucket public. They attach the SCP to the root OU. However, a developer in a member account under the root OU is able to create a bucket with a bucket policy that grants public read access. The SCP is evaluated and shows the Deny is effective for s3:PutBucketPolicy but the bucket policy is still created. What is the MOST likely reason for this behavior?

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted with AWS KMS keys. What is the MOST effective way to enforce this requirement?

A company needs to audit all changes to IAM policies in its AWS account. Which AWS service should be used to record the change history of IAM policies?

An organization uses AWS Organizations and wants to restrict the use of specific EC2 instance types across all member accounts. Which policy type should be used to enforce this restriction?

An organization uses AWS Organizations with multiple OUs. The security team wants to ensure that any new account created in the 'Production' OU automatically gets a set of mandatory tags (CostCenter, Environment) and that these tags cannot be removed. What is the most effective approach?

A security engineer notices that CloudTrail logs are not being delivered to the S3 bucket for the past 2 hours. The output of 'get-trail-status' is shown. What is the most likely cause?

A company needs to centrally manage access to AWS resources across multiple accounts. Which AWS service should be used to define and enforce a set of common permissions for all accounts in the organization?

A company has a single AWS account with several IAM users. The security team wants to ensure that all IAM users have strong passwords and that passwords are rotated every 90 days. The team also wants to receive a notification if any user's password is older than 90 days. The team has enabled an IAM password policy that requires strong passwords and sets a maximum password age of 90 days. However, they are not receiving notifications about expired passwords. Which additional step should the security team take to receive notifications?

A company has an AWS account with a single VPC and multiple subnets. The security team wants to ensure that no network ACL (NACL) allows inbound SSH (port 22) from 0.0.0.0/0. Which AWS service can be used to detect and alert on such non-compliant NACLs?

A company uses AWS Organizations and wants to restrict the use of specific AWS services in member accounts. For example, they want to block the use of Amazon Redshift. Which policy type should be used?

A company needs to ensure that its S3 buckets are not publicly accessible. Which TWO AWS services can be used to detect and report on public S3 buckets? (Choose two.)

A company is implementing a multi-account strategy using AWS Organizations. The security team wants to enforce that all newly created member accounts automatically have an IAM role that allows read-only access to the management account. Which configuration should be used?

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no root user credentials are used for any account. Which TWO actions should be taken to enforce this?

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent any IAM user from creating access keys. Which type of policy should be used to enforce this control across all accounts?

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. What is the most efficient way to enforce this across all accounts?

A security engineer notices that an S3 bucket contains objects that are accessible to authenticated users from other AWS accounts. The bucket policy allows access to the 'aws:SourceArn' condition that references an Amazon Resource Name (ARN) from another account. What is the MOST effective way to restrict access to only users from the company's own account?

A security auditor needs to view a list of all IAM users, including their last activity timestamps, for a compliance review. Which AWS service provides this information natively?

Which THREE are best practices for managing security in a multi-account AWS environment? (Choose three.)

A company wants to centrally manage access keys for all IAM users across multiple accounts. Which AWS service should be used to rotate access keys automatically?

A security engineer notices that an IAM user has permissions to launch EC2 instances but the engineer wants to ensure that all new instances are automatically tagged with the creator's user name. What is the most efficient way to enforce this?

A company wants to implement least privilege access for a data analytics team that uses Amazon Athena to query data in S3. Which THREE steps should be taken?

Which THREE steps should a security engineer take to remediate a compromised IAM user whose access keys were exposed? (Choose three.)

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security engineer tests the configuration and finds that requests from the VPC endpoint are being denied. The bucket policy contains the following condition: "Condition": { "StringEquals": { "aws:SourceVpce": "vpce-12345678" } }. The VPC endpoint ID is correct. The engineer also confirms that the VPC endpoint policy allows the necessary S3 actions. What is the most likely reason for the denial?

Match each AWS VPC flow log type to its description.

Which TWO are valid methods to centrally manage multiple AWS accounts? (Choose two.)

A security engineer is tasked with ensuring that all S3 buckets in an AWS account have versioning enabled. The engineer needs to identify buckets that do not have versioning enabled. Which AWS service is BEST suited for this task?

Refer to the exhibit. A security engineer runs the get-trail-status command for a CloudTrail trail. The engineer notices that LatestCloudWatchLogsDeliveryTime is null. What does this indicate?

A company has a single AWS account with multiple IAM users. The security team wants to enforce that all users use MFA for API calls. An IAM policy is created that denies all actions unless MFA is present. The policy is attached to all users. However, users report that they can still make API calls without MFA. The security team reviews the policy and confirms it is correct. What is the most likely reason the policy is not being enforced?

A company uses AWS Organizations and wants to restrict the AWS Regions in which resources can be created across all member accounts. Which mechanism should be used?

A security engineer is designing a solution to protect sensitive data in S3. Which THREE mechanisms can be used to enforce encryption at rest?

A security engineer needs to ensure that all EC2 instances launched in an account have a specific tag (e.g., CostCenter) applied. If an instance is launched without the tag, it should be automatically terminated. Which solution meets these requirements with minimal effort?

A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

A company wants to implement a least-privilege security model for its AWS environment. The security team has identified that many IAM users have overly permissive policies. The team wants to use AWS IAM Access Analyzer to identify policies that grant access to external principals. However, the team is not seeing any findings. What is the most likely reason?

A security engineer is troubleshooting a situation where an IAM user is unable to assume a role in a different account. The trust policy of the role allows the user's account to assume the role, and the user has permissions to call AssumeRole. However, the user receives an 'AccessDenied' error. What is the most likely cause?

A company wants to implement a least-privilege access model for their AWS resources. Which TWO of the following are best practices for achieving this?

Which THREE AWS services can be used to centrally manage and audit permissions across multiple accounts in AWS Organizations?

A security engineer needs to centrally manage and enforce security policies across multiple AWS accounts in an organization. Which AWS service should they use?

A security engineer notices that an IAM user has been performing suspicious actions in an AWS account. The engineer needs to generate a credential report to identify the age of the user's access keys. Which AWS CLI command should the engineer run?

A company's security team wants to receive alerts when an IAM user creates a new access key. Which AWS service can be used to monitor and notify on this specific API call?

A company uses AWS Organizations with a multi-account strategy. The security team wants to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI) ID. Which approach should the team take to enforce this requirement across all accounts?

A security engineer is designing a solution to enforce that all S3 buckets in an AWS account have server-side encryption enabled. The engineer needs to automatically remediate any non-compliant buckets. Which AWS service should be used to implement this requirement?

A developer needs to grant an IAM user read-only access to an S3 bucket containing sensitive data. The bucket is encrypted with an AWS KMS customer managed key. Which set of permissions must be included in the IAM policy?

A company wants to receive real-time notifications when an IAM user in their AWS account performs a console login. Which AWS service should be used to monitor and alert on this activity?

A company wants to centrally manage and enforce encryption on all EBS volumes across multiple AWS accounts. Which AWS service can be used to define and enforce encryption policies at the organizational level?

Which TWO actions should a security engineer take to ensure that an S3 bucket is not publicly accessible? (Choose two.)

This SCP is attached to an organizational unit (OU). A developer in an account within the OU tries to launch a t2.small instance. What is the outcome?

A company wants to ensure that all Amazon S3 buckets are encrypted at rest. Which THREE services can be used together to automatically remediate unencrypted S3 buckets?

A company wants to enforce that all IAM users in an AWS account must have multi-factor authentication (MFA) enabled. Which AWS service can be used to automatically detect and remediate non-compliant users?

A security team needs to enforce that all EC2 instances launched in a specific AWS account use only approved AMIs. Which combination of services can enforce this requirement?

A company's security team needs to enforce encryption at rest for all RDS instances in the production account. They have enabled mandatory encryption using a service control policy. What else must be done to ensure existing unencrypted RDS instances are encrypted?

A security engineer is auditing IAM policies. The engineer wants to identify if any policy grants 'Effect: Allow' with 'Action: *' and 'Resource: *'. Which TWO AWS services can be used to detect such overly permissive policies?

A company wants to ensure that all IAM users in an account have multi-factor authentication (MFA) enabled. A security administrator needs to identify users who do not have MFA. Which AWS service should the administrator use?

A company's Security team is using AWS Organizations with a consolidated billing account. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. Which combination of actions should the security team take? (Choose the best answer.)

A company has an AWS account with multiple S3 buckets that contain sensitive data. The security team wants to ensure that no public access is granted to any bucket. The team has enabled AWS Config and set up a rule to detect public buckets. The rule reports that all buckets are compliant. However, during a security review, a team member finds that one bucket has a bucket policy that grants 's3:GetObject' to 'Principal': '*'. Why did the AWS Config rule not detect this?

Which THREE AWS services can be used to centrally manage security across multiple accounts? (Select THREE.)

Which TWO actions should a security engineer take to protect root user credentials? (Select TWO.)

A company wants to automatically detect and notify about any S3 buckets that have public read access. Which combination of services should be used?

An IAM policy is used to grant access to an S3 bucket. The policy condition requires that objects be retrieved using AES256 encryption. However, users can still download objects without specifying encryption. What is the MOST likely reason?

A company uses AWS Organizations with all features enabled. The security team needs to ensure that no member account can disable AWS CloudTrail logging or delete CloudTrail logs stored in S3. Which combination of preventive controls should be implemented?

Refer to the exhibit. An IAM policy attached to a user allows s3:GetObject only from a specific IP range and denies all S3 actions if not using HTTPS. What happens when the user makes a GET request from IP 10.0.0.5 using HTTP?

A company's security team needs to implement a solution to detect and alert on the creation of IAM users or roles with administrative privileges. The solution must be able to analyze historical account activity and provide real-time alerts. Which combination of AWS services should be used?

A company needs to grant an IAM user permissions to start and stop specific EC2 instances. Which IAM policy element should be used to restrict actions to specific instances?

Which TWO AWS services can be used to centrally manage and audit permissions across multiple AWS accounts? (Choose two.)

A security engineer needs to implement a solution to detect and alert on suspicious API calls in an AWS account. Which TWO AWS services should be integrated to achieve this? (Choose two.)

Which TWO actions are valid ways to enforce the principle of least privilege in an AWS environment?

A company wants to centralize the management of IAM users and groups for multiple AWS accounts. Which AWS service should be used to allow users to access multiple accounts with a single set of credentials?

Refer to the exhibit. A security engineer runs the AWS CLI command to look up CloudTrail events. What can be concluded from the output?

A company's security team is implementing a solution to automatically revoke public access to Amazon S3 buckets that become public. The solution must be serverless and use native AWS services. Which combination of services should be used?

Which TWO AWS services can be used to centrally manage and enforce security policies across multiple AWS accounts? (Select TWO.)

A security engineer needs to grant an EC2 instance access to an S3 bucket without storing long-term credentials on the instance. Which approach should the engineer use?

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that no account can disable Amazon GuardDuty. Which SCP should be applied?

A security engineer is auditing the AWS Organizations structure. The engineer notices that the 'Management' account (111111111111) has a status of 'ACTIVE' and joined method 'CREATED'. The engineer is concerned about potential security risks. Which action should the engineer take to improve security?

A security engineer needs to generate a report of all AWS Identity and Access Management (IAM) users who have not used their access keys in the last 90 days. Which AWS service can provide this information?

A company needs to audit all changes to IAM policies in their AWS account for compliance. Which AWS service should be enabled to record the API calls that modify IAM policies?

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

A security engineer needs to audit all IAM role creations across an AWS account. Which AWS service should be used to log these API calls?

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which policy should be attached to the IAM users or group to enforce this requirement?

A company uses AWS Organizations with 50 accounts. The security team wants to centrally manage IAM roles that grant cross-account access to a central security account. Which THREE steps are required to set up this cross-account access?

Which TWO AWS services can be used to enforce that Amazon S3 buckets are not publicly accessible? (Choose two.)

A company wants to run a security assessment that checks for vulnerabilities in an EC2 instance. Which AWS service should be used?

Which TWO actions are effective for detecting and responding to unauthorized access in an AWS environment? (Choose two.)