Exam AWS Certified Security - Specialty topic 1 question 489 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 489
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A company has an application on Amazon EC2 instances that store confidential customer data. The company must restrict access to customer data. A security engineer requires secure access to the instances that host the application. According to company policy, users must not open any inbound ports, maintain bastion hosts, or manage SSH keys for the EC2 instances.

The security engineer wants to monitor, store, and access all session activity logs. The logs must be encrypted.

Which solution will meet these requirements?

A. Use AWS Control Tower to connect to the EC2 instances. Configure Amazon CloudWatch logging for the sessions. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.
B. Use AWS Security Hub to connect to the EC2 instances. Configure Amazon CloudWatch logging for the sessions. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.
C. Use AWS Systems Manager Session Manager to connect to the EC2 instances. Configure Amazon CloudWatch monitoring to record the sessions. Select the store session logs option for the desired CloudWatch Logs log groups.
D. Use AWS Systems Manager Session Manager to connect to the EC2 instances. Configure Amazon CloudWatch logging. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.

Show Suggested Answer

Suggested Answer: D 🗳️

by cloudenthusiast at June 2, 2023, 7:58 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

6_8ftwin

Highly Voted 2 years ago

Selected Answer: D

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-logging.html#session-manager-logging-cloudwatch-logs C would not be encrypted.

upvoted 5 times

...

cloudenthusiast

Highly Voted 2 years, 1 month ago

Selected Answer: D

AWS Systems Manager Session Manager: It allows secure and controlled access to EC2 instances without the need for opening inbound ports or managing SSH keys. The security engineer can establish a secure session with the EC2 instances using the Session Manager without exposing them to the public internet. Amazon CloudWatch logging: By configuring CloudWatch logging, the security engineer can monitor and capture session activity logs. This includes commands executed, input/output streams, and metadata associated with the session. Upload session logs option: Selecting the "upload session logs" option ensures that the session activity logs are captured and stored in CloudWatch Logs. Encrypted CloudWatch Logs log groups: By allowing only encrypted CloudWatch Logs log groups, the security engineer ensures that the session activity logs are encrypted at rest, providing an additional layer of security for the stored logs.

upvoted 5 times

...

Raphaello

Most Recent 1 year, 4 months ago

Selected Answer: D

D is the correct answer.

upvoted 1 times

...

yorkicurke

1 year, 6 months ago

Selected Answer: D

Big thanks to @6_8ftwin To log session data using Amazon CloudWatch Logs (console) Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/ In the navigation pane, choose Session Manager. Choose the Preferences tab, and then choose Edit. Select the check box next to Enable under CloudWatch logging. Choose the """Upload session logs""" option. (Recommended) Select the check box next to """Allow only encrypted CloudWatch log groups""". With this option turned on, log data is encrypted using the server-side encryption key specified for the log group.

upvoted 1 times

...

Noexperience

1 year, 10 months ago

Selected Answer: C

C. Use AWS Systems Manager Session Manager to connect to the EC2 instances. Configure Amazon CloudWatch monitoring to record the sessions. Select the store session logs option for the desired CloudWatch Logs log groups.

upvoted 1 times

...