Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging 2

Question 1

A security engineer needs to ensure CloudTrail logs stored in S3 cannot be deleted by anyone, including administrators, for 7 years. Which feature should they enable?

Accepted Answer

S3 Object Lock in Compliance mode

Answer

S3 Object Lock in Compliance mode prevents any user, including root, from deleting or overwriting objects during the retention period.

Question 2

Which AWS Config rule can automatically detect whether S3 buckets have public read access enabled?

Accepted Answer

s3-bucket-public-read-prohibited

Answer

The 's3-bucket-public-read-prohibited' managed rule flags any S3 bucket that allows public read access as NON_COMPLIANT.

Question 3

VPC Flow Logs can be published to which destinations? (Choose the most complete answer)

Accepted Answer

Amazon S3, CloudWatch Logs, or Amazon Kinesis Data Firehose

Answer

VPC Flow Logs support delivery to S3 for long-term storage, CloudWatch Logs for real-time analysis, and Kinesis Data Firehose for streaming pipelines.

Question 4

An engineer notices GuardDuty finding type 'UnauthorizedAccess:IAMUser/TorIPCaller'. What does this indicate?

Accepted Answer

An IAM user's credentials were used from a Tor network exit node

Answer

This finding means AWS API calls were made using IAM user credentials from an IP address associated with a Tor exit node, suggesting potential credential compromise.

Question 5

Which service provides a centralized view of security alerts and compliance status by aggregating findings from GuardDuty, Inspector, Macie, and other AWS security services?

Accepted Answer

AWS Security Hub

Answer

AWS Security Hub aggregates, organizes, and prioritizes security findings from multiple AWS services and third-party products into a unified dashboard.

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging 2