Free AWS-CERTIFIED-SYSOPS-ADMINISTRATOR-ASSOCIATE Amazon AWS-CERTIFIED-SYSOPS-ADMINISTRATOR-ASSOCIATE Practice Test Question - Page 3

Question 7 (Topic 1)

A SysOps administrator must manage the security of an AWS account. Recently, an IAM user's access key was mistakenly uploaded to a public code repository. The SysOps administrator must identify anything that was changed by using this access key. How should the SysOps administrator meet these requirements?

Select an option, then click Submit answer.

○ Create an Amazon EventBridge (Amazon CloudWatch Events) rule to send all IAM events to an AWS Lambda function for analysis.
○ Query Amazon EC2 logs by using Amazon CloudWatch Logs Insights for all events initiated with the compromised access key within the suspected timeframe.
○ Search AWS CloudTrail event history for all events initiated with the compromised access key within the suspected timeframe.
○ Search VPC Flow Logs for all events initiated with the compromised access key within the suspected timeframe.

Reference / correct answer:

Search AWS CloudTrail event history for all events initiated with the compromised access key within the suspected timeframe.

Most accepted answer: C. Search AWS CloudTrail event history for all events initiated with the compromised access key within the suspected timeframe.

Community votes: C=4

Selected Answer: C C "You can troubleshoot operational and security incidents over the past 90 days in the CloudTrail console by viewing Event history." https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html upvoted 10 times

AWS CloudTrail records all API activity in an AWS account, including actions taken by IAM users and their access keys. By using CloudTrail, the SysOps administrator can track exactly what actions were performed with the compromised access key, including changes to resources or account configurations, and view a detailed log of events within the specified timeframe. Other Options: Option A: Creating an EventBridge (formerly CloudWatch Events) rule for IAM events would not provide historical data about the actions already taken with the compromised key. This setup would only capture future IAM events. Option B: CloudWatch Logs Insights does not provide logs of all actions taken by IAM users and access keys across services. It is mainly used for querying logs stored in CloudWatch, such as application logs. Option D: VPC Flow Logs track network traffic but do not log specific API actions, making them unsuitable for identifying API events or actions taken with an IAM access key. Correct Answer: C upvoted 3 times

Selected Answer: C "all event" is key word for answer. upvoted 1 times jipark 2 years, 11 months ago sorry for mistype - for all event of CloudTrail (not EC2 log) upvoted 1 times ...

sorry for mistype - for all event of CloudTrail (not EC2 log) upvoted 1 times

Selected Answer: C answer is C. upvoted 1 times

Question 8 (Topic 1)

A company runs an application that hosts critical data for several clients. The company uses AWS CloudTrail to track user activities on various AWS resources. To meet new security requirements, the company needs to protect the CloudTrail log files from being modified, deleted, or forged. Which solution will meet these requirement?

Select an option, then click Submit answer.

○ Enable CloudTrail log file integrity validation.
○ Use Amazon S3 MFA Delete on the S3 bucket where the CloudTrail log files are stored.
○ Use Amazon S3 Versioning to keep all versions of the CloudTrail log files.
○ Use AWS Key Management Service (AWS KMS) security keys to secure the CloudTrail log files.

Reference / correct answer:

Use Amazon S3 MFA Delete on the S3 bucket where the CloudTrail log files are stored.

Most accepted answer: B. Use Amazon S3 MFA Delete on the S3 bucket where the CloudTrail log files are stored.

Community votes: A=5, B=6, C=1

Selected Answer: A If you have answered anything but A, remember that CloudTrail log file integrity validation is EXACTLY made for this purpose and nothing else. upvoted 1 times

Selected Answer: A **A. Enable CloudTrail log file integrity validation**. Enabling CloudTrail log file integrity validation ensures that the log files are protected using industry-standard algorithms (SHA-256 for hashing and SHA-256 with RSA for digital signing). This makes it computationally infeasible to modify, delete, or forge the log files without detection[1](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html)[2](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html). upvoted 3 times

Selected Answer: A To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation. This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection. You can use the AWS CLI to validate the files in the location where CloudTrail delivered them. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html#cloudtrail-log-file-validation-intro-use-cases upvoted 1 times

Answer is A and ChatGPT agrees: A. Enable CloudTrail log file integrity validation (Correct) CloudTrail log file integrity validation uses SHA-256 hashing and digital signatures to ensure that log files have not been tampered with or altered.This provides cryptographic proof of the integrity of the log files.It directly addresses the requirement to ensure that logs are not forged or modified.This is the most relevant feature provided by AWS CloudTrail for log protection. B. Use Amazon S3 MFA Delete on the S3 bucket where the CloudTrail log files are stored (Partially Correct)MFA Delete prevents accidental or unauthorized deletions of S3 objects, but it does not protect against forgery or tampering of log contents.While useful, this alone does not meet the full requirement of securing logs against modification or forgery. upvoted 1 times

Selected Answer: B I think it's B. upvoted 1 times

Question 9 (Topic 1)

A company wants to prohibit its developers from using a particular family of Amazon EC2 instances. The company uses AWS Organizations and wants to apply the restriction across multiple accounts. What is the MOST operationally efficient way for the company to apply service control policies (SCPs) to meet these requirements?

Select an option, then click Submit answer.

○ Add the accounts to an organizational unit (OU). Apply the SCPs to the OU.
○ Add the accounts to resource groups in AWS Resource Groups. Apply the SCPs to the resource groups.
○ Apply the SCPs to each developer account
○ Enroll the accounts with AWS Control Tower. Apply the SCPs to the AWS Control Tower management account.

Free AWS-CERTIFIED-SYSOPS-ADMINISTRATOR-ASSOCIATE – Amazon AWS-CERTIFIED-SYSOPS-ADMINISTRATOR-ASSOCIATE Practice Test Question