1. Your company has been using AWS(Amazon Web Service) for hosting EC2 Instances for their web and database applications. They want to have a compliance check to see the followingWhether any ports are left open other than admin ones like SSH and RDPWhether any ports to the database server other than ones from the web server security group are openWhich of the following can help achieve this in the easiest way possible. You don't want to carry out an extra configuration changes?

A) AWS Inspector
B) AWS Config
C) AWS GuardDuty
D) AWS Trusted Advisor



2. You are planning on using the AWS(Amazon Web Service) KMS service for managing keys for your application. For which of the following can the KMS CMK keys be used for encrypting? Choose 2 answers from the options given below(Select 2answers)

A) Password
B) RSA Keys
C) Large files
D) Image Objects



3. You have a set of application , database and web servers hosted in AWS. The web servers are placed behind an ELB. There are separate security groups for the application, database and web servers. The network security groups have been defined accordingly. There is an issue with the communication between the application and database servers. In order to troubleshoot the issue between just the application and database server, what is the ideal set of MINIMAL steps you would take .

A) Check the Inbound security rules for the database security group Check the Outbound security rules for the application security group
B) Check the Outbound security rules for the database security group Check the Inbound security rules for the application security group
C) Check the both the Inbound and Outbound security rules for the database security group Check the Inbound security rules for the application security group
D) Check the Outbound security rules for the database security group Check the both the Inbound and Outbound security rules for the application security group



4. You are building a system to distribute confidential training videos to employees. Using CloudFront, what method could be used to serve content that is stored in 53, but not publicly accessible from 53 directly? Please select:

A) Create a 53 bucket policy that lists the Cloud Front distribution ID as the Principal and the target bucket as the Amazon Resource Name (ARN).
B) Create an Origin Access Identity (OAI) for Cloud Front and grant access to the objects in your S3 bucket to that OAI.
C) Create an Identity and Access Management (IAM) User for Cloud Front and grant access to the objects in your 53 bucket to that IAM User
D) Add the Cloud Front account security group to the appropriate S3 bucket policy.



5. One of the EC2 Instances in your company has been compromised. What steps would you take to ensure that you could apply digital forensics on the Instance. Select 2 answers from the options given below(Select 2answers)

A) Remove the role applied to the Ec2 Instance
B) Ensure that the security groups only allow communication to this forensic instance
C) Terminate the instance
D) Create a separate forensic instance