Exam AWS Certified Security - Specialty topic 1 question 325 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 325
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A company is running third-party WAF software on AWS. The company's security team discovers that the third-party WAF software has vulnerabilities that can lead to server-side request forgery (SSRF) attacks. Because of this discovery, the security team mandates that the entire AWS infrastructure must use version 2 of the instance metadata service (IMDSv2).
At the planned completion of the implementation of IMDSv2, the security team uses the Amazon CloudWatch metric Amazon EC2:MetadataNoToken and determines that hundreds of old IMDSv1 requests still are occurring each day. The security team is willing to risk the availability of the company's application to finish this implementation.
Which combination of steps should the security team take to complete the migration to IMDSv2 in the AWS environment? (Choose two.)

A. Write and enforce an IAM policy that denies the ec2:runinstances action when the ec2:MetadataHttpTokens condition key is not set to required.
B. Use the ec2 modify-instance-metadata-options command from the AWS CLI with the http-put-response-hop-limit 0 option.
C. Use the ec2 modify-instance-metadata-options command from the AWS CLI with the --http-tokens required option.
D. Modify instance security groups to deny all outbound HTTP traffic to 169.254.169.254.
E. From each of the AWS account EC2 instances run the following command:

Show Suggested Answer

Suggested Answer: AC 🗳️

by mh777 at Sept. 1, 2022, 7:28 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Toptip

1 year, 11 months ago

Selected Answer: AC

A + C best combination

upvoted 1 times

...

HieuTT

2 years, 6 months ago

325 is the end question ??? While Database have 334 questions

upvoted 4 times

...

sapien45

2 years, 8 months ago

Selected Answer: AC

The two answers are part of the same solution https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html aws ec2 run-instances --image-id ami-0abcdef1234567890 --instance-type t3.large ... --metadata-options "HttpEndpoint=enabled,HttpProtocolIpv6=enabled" https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata { "Version": "2012-10-17", "Statement": [ { "Sid": "RequireImdsV2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" } } } ] }

upvoted 4 times

...

mh777

2 years, 8 months ago

Selected Answer: AC

A: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata C: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/configuring-instance-metadata-options.html

upvoted 2 times

...

Exam AWS Certified Security - Specialty All Questions

View all questions & answers for the AWS Certified Security - Specialty exam

Exam AWS Certified Security - Specialty topic 1 question 325 discussion

Comments

Toptip

HieuTT

sapien45

mh777

SY0-701