Free 312-40 sample questions

Correct answer: The SIEM's data connector for AWS is configured with credentials that lack permissions to access the central S3 bucket.

The most probable cause is a permissions issue. When using a central S3 bucket for AWS Organizations' CloudTrail logs, the IAM role or user credentials used by the SIEM's data connector must have the necessary `s3:GetObject` and `s3:ListBucket` permissions on that specific bucket. Network ACLs are stateless and less likely to be the root cause for a service-level integration. CloudTrail is enabled by default for management events, so it's unlikely to be disabled. A misconfigured trail would affect log generation, not ingestion by an external system if logs are present in S3.

Correct answers: Secret Manager; Identity and Access Management (IAM)

Secret Manager is GCP's dedicated service for storing, managing, and accessing secrets. It provides versioning, automatic rotation (via Cloud Functions), and integration with other GCP services. IAM is used to define granular permissions, specifying which principals (users, service accounts) can access which secrets.

IAM provides the authorization mechanism to control access to Secret Manager. You use IAM policies to grant roles like 'Secret Manager Secret Accessor' to specific service accounts or users, enforcing the principle of least privilege. Secret Manager relies on IAM for its access control.

Correct answer: False

This statement is false. While AWS manages the physical security and availability of the KMS hardware, the customer is responsible for configuring the key policies (IAM), managing grants, enabling or disabling keys, and configuring automatic key rotation. For SSE-KMS, this is a shared responsibility. The customer defines the key and its access policies; AWS manages the underlying service that performs the encryption.

Correct answer: Deploy the Synapse workspace with a Managed Virtual Network, enable the data exfiltration protection feature, use Managed Private Endpoints for connections to other PaaS services, and create a Private Endpoint for connecting to the workspace.

This is the most comprehensive and secure solution. A Managed VNet isolates the workspace. Data exfiltration protection blocks outbound public internet traffic. Managed Private Endpoints secure connections to other Azure services. A Private Endpoint for the workspace itself ensures all client connections originate from the private network, satisfying all stated requirements.

Correct answer: Amazon Inspector

Amazon Inspector is the correct service. It is an automated vulnerability management service that continuously scans AWS workloads (EC2, ECR for containers) for software vulnerabilities and unintended network exposure. It automatically discovers running workloads, scans them, and provides a prioritized list of findings.

Correct answer: aws iam list-attached-role-policies

This is the correct command. `aws iam list-attached-role-policies --role-name ` lists the names and ARNs of the managed policies that are attached to the specified IAM role. This is a primary step in enumerating permissions during a penetration test.

Correct answer: Pilot Light: Replicate the RDS database to a read replica in the DR region and use S3 Cross-Region Replication. Keep a small EC2 instance running in the DR region to act as the core, ready to scale out.

The Pilot Light strategy provides a balance between cost and recovery time. The core infrastructure is running (the 'pilot light'), and data is actively replicated (RDS read replica, S3 CRR), which supports a low RPO. In a disaster, the infrastructure can be scaled out relatively quickly (e.g., via Auto Scaling), meeting the < 1 hour RTO without the cost of a fully scaled-out warm standby environment.

Correct answer: AWS CloudTrail Logs

AWS CloudTrail is the correct source. It provides a record of actions taken by a user, role, or an AWS service. All management API calls, including `PutBucketAcl`, are recorded in CloudTrail logs, providing the necessary audit trail for forensic investigation of permission changes.

Correct answer: Azure Policy

Azure Policy is the correct service. It allows you to create policies that enforce and control the properties of a resource. These policies can enforce rules for resource configuration, such as allowing only certain VM SKUs or requiring tags. It has built-in policy initiatives that map to compliance frameworks like NIST, making it the ideal tool for governance and compliance enforcement.

Correct answer: Place each tier in a separate private subnet. Use distinct Security Groups for each tier (e.g., Web-SG, App-SG, DB-SG). Configure rules so that Web-SG only accepts traffic from the load balancer, App-SG only from Web-SG, and DB-SG only from App-SG.

This is the ideal implementation. It uses subnetting for network segmentation and granular, stateful Security Groups to enforce the principle of least privilege. Traffic flow is strictly controlled between tiers (ELB -> Web -> App -> DB), providing strong defense-in-depth.