1. Your developer is using the KMS service and an assigned key in their Java program. They get the below error when running the codearn:aws:iam::113745388712:user/UserB is not authorized to perform: kms:DescribeKey Which of the following could help resolve the issue?

A) Ensure that UserB is given the right permissions in the Bucket policy
B) Ensure that UserB is given the right permissions in the IAM policy
C) Ensure that UserB is given the right IAM role to access the key
D) Ensure that UserB is given the right permissions in the Key policy



2. Your team is designing a web application. The users for this web application would need to sign in via an external ID provider such as facebook or Google. Which of the following AWS(Amazon Web Service) service would you use for authentication?

A) AWS IAM
B) AWS Config
C) AWS SAML
D) AWS Cognito



3. You are designing a connectivity solution between on-premises infrastructure and Amazon VPC. Your server's on-premises will be communicating with your VPC instances. You will be establishing IPSec tunnels over the internet. You will be using VPN gateways and terminating the IPsec tunnels on AWS-supported customer gateways. Which of the following objectives would you achieve by implementing an IPSec tunnel as outlined above? Choose 4 answers form the options below(Select 3answers)

A) Data encryption across the Internet
B) Data integrity protection across the Internet
C) End-to-end protection of data in transit
D) End-to-end Identity authentication
E) Peer identity authentication between VPN gateway and customer gateway
F) Protection of data in transit over the Internet

4. A company hosts a popular web application that connects to an Amazon RDS MySQL DB instance running in a private VPC subnet that was created with default ACL settings. The IT Security department has a suspicion that a DDos attack is coming from a suspecting IP. How can you protect the subnets from this attack?

A) Change the Outbound NACL to deny access from the suspecting IP (Incorrect)
B) Change the Inbound Security Groups to deny access from the suspecting IP
C) Change the Outbound Security Groups to deny access from the suspecting IP
D) Change the Inbound NACL to deny access from the suspecting IP



5. You have a set of Customer keys created using the AWS(Amazon Web Service) KMS service. These keys have been used for around 6 months. You are now trying to use the new KMS features for the existing set of key?s but are not able to do so. What could be the reason for this. Please select:

A) You have not explicitly given access via the key policy
B) You have not given access via the IAM roles *
C) You have not explicitly given access iia AM users
D) You have not explicitly given access via the IAM policy