Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging 3

Question 1

A company wants to automatically remediate non-compliant AWS Config rules. Which approach should they use?

Accepted Answer

Use AWS Config remediation actions backed by AWS Systems Manager Automation documents

Answer

AWS Config supports automatic remediation by associating SSM Automation documents with rules, which execute when a resource is found NON_COMPLIANT.

Question 2

Which AWS service can analyze VPC Flow Logs, DNS logs, and CloudTrail logs to investigate the root cause and full scope of a security incident?

Accepted Answer

Amazon Detective

Answer

Amazon Detective automatically builds a graph model from your AWS logs and uses ML to help investigators quickly understand security incidents.

Question 3

An engineer wants to be notified whenever a security group is changed to allow unrestricted SSH access (port 22 from 0.0.0.0/0). Which solution achieves this?

Accepted Answer

Enable AWS Config rule 'restricted-ssh' with SNS notification on NON_COMPLIANT

Answer

The AWS Config managed rule 'restricted-ssh' evaluates security groups and triggers notifications via SNS when unrestricted SSH access is detected.

Question 4

What does enabling 'CloudTrail Insights' provide that standard CloudTrail does not?

Accepted Answer

Automatic detection of unusual API call rates or error rates that deviate from baseline

Answer

CloudTrail Insights uses ML to establish a baseline of normal API activity and alerts you when it detects unusual write management API call volumes or error rates.

Question 5

When GuardDuty is enabled in an AWS Organization, which account should be designated as the GuardDuty administrator?

Accepted Answer

A dedicated security account delegated as the GuardDuty administrator

Answer

AWS best practice is to delegate GuardDuty administration to a dedicated security account, which can view and manage findings across all member accounts.

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging 3