A security team manages a company??s AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security team can administer the KMS keys. The company's application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team's software process with access to the keys.
Which solution will meet these requirements with the LEAST operational overhead?

1. A. Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.
2. B. Edit the key policy that grants the security team access to the KMS keys by adding the application team as principal
3. C. Revert this change when the application team no longer needs access.
4. D. Create a key grant to allow the application team to use the KMS key
5. E. Revoke the grant when the application team no longer needs access.
6. F. Create a new KMS key by generating key material on premise
7. G. Import the key material to AWS KMS whenever the application team needs acces
8. H. Grant the application team permissions to use the key.

Correct Answer: C

A security engineer needs to implement a solution to identify any sensitive data that is stored in an Amazon S3 bucket. The solution must report on sensitive data in the S3 bucket by using an existing Amazon Simple Notification Service (Amazon SNS) topic.
Which solution will meet these requirements with the LEAST implementation effort?

1. A. Enable AWS Confi
2. B. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.
3. C. Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a patter
4. D. Program the Lambda function to send notifications to the SNS topic.
5. E. Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive dat
6. F. Create an Amazon EventBridge rule to send notifications to the SNS topic.
7. G. Enable Amazon GuardDut
8. H. Configure AWS CloudTrail S3 data event
9. I. Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic.

Correct Answer: C

A company is operating an open-source software platform that is internet facing. The legacy software platform no longer receives security updates. The software platform operates using Amazon Route 53 weighted load balancing to send traffic to two Amazon EC2 instances that connect to an Amazon RDS cluster. A recent report suggests this software platform is vulnerable to SQL injection attacks, with samples of attacks provided. The company's security engineer must secure this system against SQL injection attacks within 24 hours. The solution must involve the least amount of effort and maintain normal operations during implementation.
What should the security engineer do to meet these requirements?

1. A. Create an Application Load Balancer with the existing EC2 instances as a target grou
2. B. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the AL
3. C. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to the AL
4. D. Update security groups on the EC2 instances to prevent direct access from the internet.
5. E. Create an Amazon CloudFront distribution specifying one EC2 instance as an origi
6. F. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the distributio
7. G. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to CloudFront.
8. H. Obtain the latest source code for the platform and make the necessary update
9. I. Test the updated code to ensure that the vulnerability has been mitigated, then deploy the patched version of the platform to the EC2 instances.
10. J. Update the security group that is attached to the EC2 instances, removing access from the internet to the TCP port used by the SQL databas
11. K. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the EC2 instances.

Correct Answer: A

A company has AWS accounts in an organization in AWS Organizations. An Amazon S3 bucket in one account is publicly accessible. A security engineer must remove public access and ensure the bucket cannot be made public again.
Which solution will meet these requirements?

1. A. Enforce KMS encryption and deny s3:GetObject by SCP.
2. B. Enable PublicAccessBlock and deny s3:GetObject by SCP.
3. C. Enable PublicAccessBlock and deny s3:PutPublicAccessBlock by SCP.
4. D. Enable Object Lock governance and deny s3:PutPublicAccessBlock by SCP.

Correct Answer: C

A company has a web application that reads from and writes to an Amazon S3 bucket. The company needs to authenticate all S3 API calls with AWS credentials.
Which solution will provide the application with AWS credentials?

1. A. Use Amazon Cognito identity pools and the GetId API.
2. B. Use Amazon Cognito identity pools and AssumeRoleWithWebIdentity.
3. C. Use Amazon Cognito user pools with ID tokens.
4. D. Use Amazon Cognito user pools with access tokens.

Correct Answer: B