Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A financial technology startup is setting up its AWS environment. An application running on Amazon ECS tasks needs to retrieve records from an Amazon DynamoDB table, while an external compliance auditor requires weekly console access to inspect security configurations without modifying any resources. Which TWO of the following identity and access management actions should the startup implement to meet these requirements securely? (Select TWO.)

  1. Create an IAM role with the necessary DynamoDB read permissions and associate it with the Amazon ECS task definition.Answer
  2. Create a dedicated IAM user for the external auditor, require Multi-Factor Authentication (MFA), and attach a policy allowing read-only access to security settings.Answer
  3. C
    Generate long-term access keys for the AWS account root user and configure them as environment variables inside the ECS tasks.
  4. D
    Create an IAM user for the auditor, generate access keys, and configure the ECS task to use the auditor's credentials to authenticate to DynamoDB.
  5. E
    Submit a request to AWS Support to review the security configuration, as policy auditing falls under the physical infrastructure layer managed by AWS.

Answer

The startup should configure an IAM role with DynamoDB read permissions for the ECS task definition and establish a dedicated IAM user with MFA and read-only permissions for the auditor.
The correct identity setup involves creating an IAM role for the ECS container tasks to assume temporary access credentials dynamically, and establishing a dedicated IAM user for the external auditor with a read-only policy and MFA enabled for safe administrative console access.

Step-by-Step Solution

1
Analyze the application's access requirements.
The ECS task running the application requires access to DynamoDB. Hardcoding or passing static credentials is a security risk, so an IAM role must be configured for the ECS task (task role) to provide temporary, automatically rotated security credentials.
This follows the principle of least privilege and eliminates long-term credentials for applications.
2
Analyze the auditor's access requirements.
The auditor requires access to the console to view security configurations. This is a human access requirement, which requires a dedicated IAM user or federated login, coupled with Multi-Factor Authentication (MFA) and a read-only policy.
This secures administrative/auditing endpoints and ensures individual accountability without granting write permissions.
3
Evaluate the distractors against AWS best practices and the Shared Responsibility Model.
Using the root account keys is highly discouraged. Reusing human IAM user credentials for application workloads is insecure. Asking AWS to manage IAM audit operations misinterprets the customer's responsibility under the Shared Responsibility Model.
This isolates human vs. machine identity and defines ownership of cloud security configurations.

Key Concept

The core of AWS identity security relies on isolating human identities (using IAM users/federation with MFA) and machine identities (using IAM roles for temporary credentials), whilst adhering to the Shared Responsibility Model where the customer owns resource access configuration.
Estimated Time:2m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic