AWS Interactive Knowledge Tool
Get ready for AWS Certified Security – Specialty
You’re on a journey toward AWS Certification. Validating your experience with an industry-recognized credential is a great way to gain new skills, solidify knowledge, highlight your value, and accelerate your career trajectory. These Interactive sample questions will help you prepare for the structure and topics covered on the official AWS Security - Specialty exam.
In addition to the questions, you’ll see answers, explanations, and other resources designed to enhance your understanding of the principles needed to pass the exam. After you’re comfortable with these principles and sample questions, you’ll be ready to evaluate your knowledge with the official practice exam.
Ready to go beyond cloud skilled?
Let's get started.
AWS Certified Security – Specialty
Your knowledge in review
You'll find a summary of your learning experience below. Take a deeper look at all the questions, review your answers, and find links to learning resources specific to that topic. Or, if you’re ready, sign up to take the official practice exam.
-
1
-
2
-
3
-
4
-
5
-
6
-
7
-
8
-
9
-
10
A corporate cloud security policy states that communication between the company's VPC and KMS must travel entirely within the AWS network and not use public service endpoints.
Which combination of the following actions MOST satisfies this requirement? (Select TWO.)
Details
An IAM policy can deny access to AWS KMS except through your VPC endpoint with the following condition statement:
"Condition": {
"StringNotEquals": {
"aws:sourceVpce": "vpce-0295a3caf8414c94a"
}
}
If you select the Enable Private DNS Name option, the standard AWS KMS DNS hostname (https://kms.
An application team is designing a solution with two applications. The security team wants the applications' logs to be captured in two different places, because one of the applications produces logs with sensitive data.
Which solution meets the requirement with the LEAST risk and effort?
Details
Each application's log can be configured to send the log to a specific Amazon CloudWatch Logs log group.
A security engineer must set up security group rules for a three-tier application:
Presentation tier – Accessed by users over the web, protected by the security group presentation-sg
Logic tier – RESTful API accessed from the presentation tier through HTTPS, protected by the security group logic-sg
Data tier – SQL Server database accessed over port 1433 from the logic tier, protected by the security group data-sg
Which combination of the following security group rules will allow the application to be secure and functional? (Select THREE.)
Details
In an n-tier architecture, each tier’s security group allows traffic from the security group sending it traffic only. The presentation tier opens traffic for HTTP and HTTPS from the internet. Since security groups are stateful, only inbound rules are required.
A security engineer is working with a product team building a web application on AWS. The application uses Amazon S3 to host the static content, Amazon API Gateway to provide RESTful services, and Amazon DynamoDB as the backend data store. The users already exist in a directory that is exposed through a SAML identity provider.
Which combination of the following actions should the engineer take to enable users to be authenticated into the web application and call APIs? (Select THREE).
Details
When Amazon Cognito receives a SAML assertion, it needs to be able to map SAML attributes to user pool attributes. When configuring Amazon Cognito to receive SAML assertions from an identity provider, you need ensure that the identity provider is configured to have Amazon Cognito as a relying party. Amazon API Gateway will need to be able to understand the authorization being passed from Amazon Cognito, which is a configuration step.
A company is hosting a web application on AWS and is using an Amazon S3 bucket to store images. Users should have the ability to read objects in the bucket. A security engineer has written the following bucket policy to grant public read access:
{
"ID":"Policy1502987489630",
"Version":"2012-10-17",
"Statement":[
{
"Sid":"Stmt1502987487640",
"Action":[
"s3:GetObject",
"s3:GetObjectVersion"
],
"Effect":"Allow",
"Resource":"arn:aws:s3:::appbucket",
"Principal":"*"
}
]
}
Attempts to read an object, however, receive the error: "Action does not apply to any resource(s) in statement.”
What should the engineer do to fix the error?
Details
The resource section should match with the type of operation. Change the ARN to include /* at the end, as it is an object operation. https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/.
A company decides to place database hosts in its own VPC, and to set up VPC peering to different VPCs containing the application and web tiers. The application servers are unable to connect to the database.
Which network troubleshooting steps should be taken to resolve the issue? (Select TWO.)
Details
You must configure the route tables in each VPC to route to each other through the peering connection. You also must add rules to the security group for the databases to accept requests from the application server security group in the other VPC.
When testing a new AWS Lambda function that retrieves items from an Amazon DynamoDB table, the security engineer notices that the function was not logging any data to Amazon CloudWatch Logs.
The following policy was assigned to the role assumed by the Lambda function:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Dynamo-1234567",
"Action": [
"dynamodb:GetItem"
],
"Effect": "Allow",
"Resource": "*"
}
}
Which least-privilege policy addition would allow this function to log properly?
Details
Basic Lambda permissions required to log to Amazon CloudWatch Logs include CreateLogGroup, CreateLogStream, and PutLogEvents.
A company is building a data lake on Amazon S3. The data consists of millions of small files containing sensitive information. The security team has the following requirements for the architecture:
Data must be encrypted in transit.
Data must be encrypted at rest.
The bucket must be private, but if the bucket is accidentally made public, the data must remain confidential.
Which combination of steps would meet the requirements? (Select TWO.)
Details
Bucket encryption using KMS will protect both in case disks are stolen as well as if the bucket is public. This is because the AWS KMS key would need to have privileges granted to it for users outside of AWS. HTTPS will protect data in transit.
A security engineer must ensure that all API calls are collected across all company accounts, and that they are preserved online and are instantly available for analysis for 90 days. For compliance reasons, this data must be restorable for 7 years.
Which steps must be taken to meet the retention needs in a scalable, cost-effective way?
Details
Meets all requirements and is cost effective by using lifecycle policies to transition to Amazon Glacier.
A security engineer has been informed that a user’s access key has been found on GitHub. The engineer must ensure that this access key cannot continue to be used, and must assess whether the access key was used to perform any unauthorized activities.
Which steps must be taken to perform these tasks?
Details
Removes keys and audits the environment for malicious activities.
Question 1
A company is migrating a legacy web application from a single server to multiple Amazon EC2 instances behind an Application Load Balancer (ALB). After the migration, users report that they are frequently losing their sessions and are being prompted to log in again.
Which action should be taken to resolve the issue reported by users?
Answer
A) Add the aws:sourceVpce condition to the AWS KMS key policy referencing the company's VPC endpoint ID.
C) Create a VPC endpoint for AWS KMS with private DNS enabled.
An IAM policy can deny access to AWS KMS except through your VPC endpoint with the following condition statement:
"Condition": {
"StringNotEquals": {
"aws:sourceVpce": "vpce-0295a3caf8414c94a"
}
}
If you select the Enable Private DNS Name option, the standard AWS KMS DNS hostname (https://kms.
Helpful Links
Question 2
An application team is designing a solution with two applications. The security team wants the applications' logs to be captured in two different places, because one of the applications produces logs with sensitive data.
Which solution meets the requirement with the LEAST risk and effort?
Answer
B) Use Amazon CloudWatch Logs with two log groups, with one for each application, and use an AWS IAM policy to control access to the log groups, as required.
Each application's log can be configured to send the log to a specific Amazon CloudWatch Logs log group.
Helpful Links
Question 3
A security engineer must set up security group rules for a three-tier application:
Presentation tier – Accessed by users over the web, protected by the security group presentation-sg
Logic tier – RESTful API accessed from the presentation tier through HTTPS, protected by the security group logic-sg
Data tier – SQL Server database accessed over port 1433 from the logic tier, protected by the security group data-sg
Which combination of the following security group rules will allow the application to be secure and functional? (Select THREE.)
Answer
A) presentation-sg: Allow ports 80 and 443 from 0.0.0.0/0
C) data-sg: Allow port 1433 from logic-sg
E) logic-sg: Allow port 443 from presentation-sg
In an n-tier architecture, each tier’s security group allows traffic from the security group sending it traffic only. The presentation tier opens traffic for HTTP and HTTPS from the internet. Since security groups are stateful, only inbound rules are required.
Helpful Links
Question 4
A security engineer is working with a product team building a web application on AWS. The application uses Amazon S3 to host the static content, Amazon API Gateway to provide RESTful services, and Amazon DynamoDB as the backend data store. The users already exist in a directory that is exposed through a SAML identity provider.
Which combination of the following actions should the engineer take to enable users to be authenticated into the web application and call APIs? (Select THREE).
Answer
B) Configure a SAML identity provider in Amazon Cognito to map attributes to the Amazon Cognito user pool attributes.
C) Configure the SAML identity provider to add the Amazon Cognito user pool as a relying party.
F) Update API Gateway to use an Amazon Cognito user pool authorizer.
When Amazon Cognito receives a SAML assertion, it needs to be able to map SAML attributes to user pool attributes. When configuring Amazon Cognito to receive SAML assertions from an identity provider, you need ensure that the identity provider is configured to have Amazon Cognito as a relying party. Amazon API Gateway will need to be able to understand the authorization being passed from Amazon Cognito, which is a configuration step.
Question 5
A company is hosting a web application on AWS and is using an Amazon S3 bucket to store images. Users should have the ability to read objects in the bucket. A security engineer has written the following bucket policy to grant public read access:
{
"ID":"Policy1502987489630",
"Version":"2012-10-17",
"Statement":[
{
"Sid":"Stmt1502987487640",
"Action":[
"s3:GetObject",
"s3:GetObjectVersion"
],
"Effect":"Allow",
"Resource":"arn:aws:s3:::appbucket",
"Principal":"*"
}
]
}
Attempts to read an object, however, receive the error: "Action does not apply to any resource(s) in statement.”
What should the engineer do to fix the error?
Answer
C) Change the resource section to "arn:aws:s3:::appbucket/*".
The resource section should match with the type of operation. Change the ARN to include /* at the end, as it is an object operation. https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/.
Question 6
A company decides to place database hosts in its own VPC, and to set up VPC peering to different VPCs containing the application and web tiers. The application servers are unable to connect to the database.
Which network troubleshooting steps should be taken to resolve the issue? (Select TWO.)
Answer
B) Check the route tables for the application server subnets for routes to the VPC peering connection
D) Check the database security groups for rules that allow traffic from the application servers.
You must configure the route tables in each VPC to route to each other through the peering connection. You also must add rules to the security group for the databases to accept requests from the application server security group in the other VPC.
Question 7
When testing a new AWS Lambda function that retrieves items from an Amazon DynamoDB table, the security engineer notices that the function was not logging any data to Amazon CloudWatch Logs.
The following policy was assigned to the role assumed by the Lambda function:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Dynamo-1234567",
"Action": [
"dynamodb:GetItem"
],
"Effect": "Allow",
"Resource": "*"
}
}
Which least-privilege policy addition would allow this function to log properly?
Answer
C) {
"Sid": "Logging-12345",
"Resource": "*",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow"
}
Basic Lambda permissions required to log to Amazon CloudWatch Logs include CreateLogGroup, CreateLogStream, and PutLogEvents.
Helpful Links
Question 8
A company is building a data lake on Amazon S3. The data consists of millions of small files containing sensitive information. The security team has the following requirements for the architecture:
Data must be encrypted in transit.
Data must be encrypted at rest.
The bucket must be private, but if the bucket is accidentally made public, the data must remain confidential.
Which combination of steps would meet the requirements? (Select TWO.)
Answer
B) Enable default encryption with server-side encryption with AWS KMS-managed keys (SSE-KMS) on the S3 bucket.
C) Add a bucket policy that includes a deny if a PutObject request does not include aws:SecureTransport
Bucket encryption using KMS will protect both in case disks are stolen as well as if the bucket is public. This is because the AWS KMS key would need to have privileges granted to it for users outside of AWS. HTTPS will protect data in transit.
Question 9
A security engineer must ensure that all API calls are collected across all company accounts, and that they are preserved online and are instantly available for analysis for 90 days. For compliance reasons, this data must be restorable for 7 years.
Which steps must be taken to meet the retention needs in a scalable, cost-effective way?
Answer
D) Enable AWS CloudTrail logging across all accounts to a centralized Amazon S3 bucket. Set a lifecycle policy to move the data to Amazon Glacier after 90 days, and expire the data after 7 years.
Meets all requirements and is cost effective by using lifecycle policies to transition to Amazon Glacier.
Helpful Links
Question 10
A security engineer has been informed that a user’s access key has been found on GitHub. The engineer must ensure that this access key cannot continue to be used, and must assess whether the access key was used to perform any unauthorized activities.
Which steps must be taken to perform these tasks?
Answer
C) Delete or rotate the user’s key, review the AWS CloudTrail logs in all regions, and delete any unrecognized or unauthorized resources.
Removes keys and audits the environment for malicious activities.