Exam Simulator: Security and Compliance

As a SysOps administrator for a startup, you have been tasked to provide the most suitable database service for the company in order to:

1. Store and retrieve any amount of data and serve any level of request traffic.
2. Scale up or scale down your tables’ throughput capacity without downtime or performance degradation.
3. Create full backups of your tables for long-term retention and archival for regulatory compliance needs.

Which of the following Amazon database service is the most suitable solution to use to achieve the above requirements?

You are developing a service marketplace platform in which people buy and sell online services. The project manager instructed you that the API calls on the AWS resources should be monitored and recorded. You used CloudTrail to help you in compliance, operational, and risk auditing of your AWS account.

The project manager asked you where does CloudTrail store all of the logs?

Which of the following AWS service is a security management service which allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organization?

A company needs to submit the security and compliance documents such as AWS ISO certifications and Payment Card Industry (PCI).

Which of the following AWS service provides on-demand downloads of AWS security and compliance documents?

In compliance with PCI DSS, an EU-based company is required to provide compliance documents, such as Payment Card Industry (PCI).

Where are these AWS compliance documents located?

Your new educational app for high-school students uses Amazon Cognito to handle user authentication and authorization. Now, you are thinking to add another method of authentication in addition to just a username and password to make the app more secure.

What solution will you implement to add the extra layer of security?

A company wants to incorporate a single sign-on feature from its corporate Active Directory. The company also wants to restrict access for each individual user to a designated user folder in an S3 bucket.

Which action should a SysOps administrator take to meet these requirements? (Select all that apply)

A company is developing an educational mobile app that uploads the user’s performance of individuals lessons to DynamoDB. Amazon Cognito is being used for authentication, authorization, and user management, and users sign-in with Facebook IDs and Google IDs. In order to securely store data in DynamoDB, the design should use temporary AWS credentials.

Which of the following feature of Amazon Cognito is used to obtain temporary credentials to access AWS services?

A company just launched a new mobile app that stores players and score information using Amazon S3 and DynamoDB. The users of the app can sign in using an external identity provider (IdP), such as Login with Amazon, Facebook, or Google. Amazon recommends that you do not embed or distribute long-term AWS credentials with apps that a user downloads to a device, even in an encrypted store.

What should a SysOps administrator use to requests temporary AWS security credentials when needed?

A company is using IAM with Amazon EC2 to control whether users can perform a task using specific Amazon EC2 API actions and whether they can use specific AWS resources. A SysOps administrator attempts to launch an instance with a role, but he gets an AccessDenied error.

Which actions should the SysOps administrator take to fix this issue?

You are using AWS Trusted Advisor as it provides you real-time guidance to help you provision your resources following AWS best practices. Which of the following categories is NOT included in the AWS Trusted Advisor’s best practice recommendations?

A Linux instance running in your VPC requires some configuration changes to be implemented locally and you need to run some commands.

Which of the following can be used to securely access the instance?

In compliance with PCI DSS, an EU-based company is required to provide compliance documents, such as Payment Card Industry (PCI). Where are these AWS compliance documents located?

A company needs to create an AWS multi-account strategy for its AWS Control Tower landing zone as a well-architected AWS environment following the best practices.

Which action should a SysOps administrator take to meet these requirements?

A company starts growing rapidly and they need to implement a solution to centrally manage billing; control access, and security; and share resources across the AWS accounts.

Which of the following AWS services will meet this requirement?

Which of the following AWS Key Management Service (AWS KMS) practice encrypts plaintext data with a data key, and then encrypts the data key under another key?

A company just installed a new WordPress website on an Amazon EC2 Linux instance. Although the website is installed on an Amazon EC2 instance, they cannot directly deploy an ACM Certificate on that instance.

Which action should the SysOps administrator take to fix this issue?

A company wants to set up an AWS Site-to-Site VPN connection with a virtual private gateway as the target gateway.

Which of the following is the FIRST step to meet the requirement?

The instances that you launch into an Amazon VPC can’t communicate with your own (remote) network. Which of the following services do you need to create and configure in order to enable access to your remote network from your VPC?

You are working for Examsdigest LLC, as a SysOps Administrator. You have been tasked to connect the on-premises infrastructure to their AWS cloud as secure as possible.

Which of the following AWS services can you use to accomplish this? (Choose all that apply)

Which of the following AWS Services enables you to replace hardcoded credentials in your code with an API to ensure that the secret can’t be compromised by someone examining your code?

A company for compliance purposes needs to assess how well its resource configurations comply with internal practices, industry guidelines, and regulations.

Which tool should a SysOps administrator use to meet these requirements?

A company is hosted the new application in an Auto Scaling group of EC2 instances. The company wants to implement an SSL solution for the app to improve its security. The certificate is obtained from a third-party issuer.

Where can you import the SSL/TLS certificate to improve the security of the application?

A company wants to implement a solution to automate security vulnerability assessments throughout the development and deployment pipelines.

Which service should a SysOps administrator enable to meet the requirement?