Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 1Question →

A multi-department enterprise wants to secure its AWS environment by implementing the principle of least privilege and reducing security risks associated with credential management. The administrator must configure access for both developers (human users) and applications running on Amazon EC2 instances (machine identities). Which two methods represent AWS security best practices for managing these identities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use AWS IAM Identity Center to federate human identities and centrally manage user access to AWS accounts.; Attach an IAM role to the Amazon EC2 instances to provide applications with temporary security credentials.

Answer

The correct practices are to use AWS IAM Identity Center for federated human access, and to attach IAM roles to Amazon EC2 instances for secure machine access using temporary credentials.
Centrally managing human user identities with AWS IAM Identity Center and using IAM roles to assign temporary credentials to EC2 instances are the industry-standard AWS best practices. They eliminate the need for permanent access keys, simplify credential rotation, and preserve detailed accountability in audit logs.

Step-by-Step Solution

1
Analyze the requirements for human identities (developers).
Identify that AWS IAM Identity Center is the modern, recommended approach to centrally manage federated human access instead of creating static IAM users.
Reduces credential management overhead and aligns with the best practice of avoiding long-term IAM user credentials.
2
Analyze the requirements for machine identities (applications running on EC2 instances).
Identify that IAM roles should be attached to EC2 instances to provide temporary, automatically rotated security credentials.
Eliminates the risk of hardcoding or storing long-term API access keys in application configuration files.
3
Evaluate the incorrect choices to ensure they violate AWS security best practices.
Confirm that using the root user, sharing IAM accounts, or storing long-term access keys on EC2 instances are insecure configurations.
These practices increase the attack surface and violate the principles of least privilege and individual accountability.

Key Concept

AWS IAM best practices for securing human and machine access using federation and temporary credentials.
Question 2Question →

A retail corporation is designing a hybrid cloud architecture and needs to secure its data at rest on AWS. The security compliance policy states that the keys used for encrypting financial transactions must be stored on dedicated, single-tenant cryptographic hardware controlled entirely by the customer. However, for standard application logs stored in Amazon S3, the company wants to use a fully managed service where AWS handles the physical hardware management, but the customer retains control over key policies and rotation.

Which two of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions.; Use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.

Answer

Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions, and use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys. AWS CloudHSM satisfies the need for dedicated, single-tenant hardware cryptographic keys controlled entirely by the customer. AWS KMS with customer managed keys satisfies the requirement for a fully managed multi-tenant key service where AWS manages the underlying HSM hardware while the customer retains control over key policies and key rotation.

Step-by-Step Solution

1
Analyze the encryption requirements for the financial transaction keys.
The requirement specifies dedicated, single-tenant cryptographic hardware controlled entirely by the customer, which points directly to AWS CloudHSM.
AWS CloudHSM is a dedicated HSM service that gives the customer exclusive administrative control.
2
Analyze the encryption requirements for the application logs stored in Amazon S3.
The requirement specifies a fully managed service where AWS manages the hardware, but the customer controls key policies and rotation. This aligns with AWS KMS customer managed keys.
AWS KMS customer managed keys are managed by the customer but run on AWS-managed multi-tenant HSM infrastructure.
3
Select the correct combination of AWS services that fulfill both conditions.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys.
This combination successfully meets both dedicated and fully-managed encryption needs.

Key Concept

Selecting appropriate AWS services (AWS KMS vs. AWS CloudHSM) based on multi-tenant versus single-tenant encryption hardware requirements under the shared responsibility model.
Question 3Question →

A government contractor is deploying an application on AWS that handles classified public safety records. Compliance regulations mandate that all data at rest must be encrypted using cryptographic keys stored inside dedicated, single-tenant hardware security modules (HSMs) that are physically and logically isolated. Which option correctly identifies the AWS service that meets this requirement and the customer's responsibility for that service under the AWS Shared Responsibility Model?

Show answer & explanation

Answer: AWS CloudHSM; the customer is responsible for managing users, keys, and cryptographic partitions on the dedicated HSM instance.

Answer

AWS CloudHSM; the customer is responsible for managing users, keys, and cryptographic partitions on the dedicated HSM instance.
AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud. It provides dedicated, single-tenant HSM instances under the customer's direct control. Under the AWS Shared Responsibility Model, AWS manages physical security, hardware provisioning, and network connectivity, while the customer maintains sole control over the cryptographic keys, partitions, and user management.

Step-by-Step Solution

1
Identify the key residency and tenancy requirement.
The requirements mandate dedicated, single-tenant hardware security modules (HSMs), which points to AWS CloudHSM instead of AWS Key Management Service (AWS KMS) which uses shared, multi-tenant HSMs.
AWS CloudHSM provides dedicated HSM instances, whereas AWS KMS is a multi-tenant service.
2
Determine the shared responsibility model boundary for the chosen service.
For AWS CloudHSM, AWS manages hardware provisioning, physical security, and high availability, while the customer manages HSM partitions, cryptographic users, and key generation.
To satisfy the compliance requirements, the customer must maintain exclusive administrative control over the keys and users on the single-tenant HSM.

Key Concept

AWS CloudHSM vs AWS KMS and the Shared Responsibility Model for dedicated cryptography.
Estimated Time:1m 0s
Question 4Question →

A retail company is migrating its customer database to Amazon RDS for PostgreSQL to reduce administrative overhead. Which two of the following tasks are the responsibility of the customer under the AWS Shared Responsibility Model?

Select all that apply

Show answer & explanation

Answer: Managing database user accounts, permissions, and access controls within the database engine; Configuring database security groups to control incoming network traffic to the RDS instance

Answer

Managing database user accounts, permissions, and access controls within the database engine, as well as configuring database security groups to control incoming network traffic to the RDS instance, are both responsibilities of the customer.
For managed services like Amazon RDS, AWS manages the host operating system, patching, and physical infrastructure. The customer remains responsible for configuration tasks within the database engine (such as user accounts, roles, and privileges) and controlling network access to the database instance using database security groups.

Step-by-Step Solution

1
Identify the type of service being deployed.
Amazon RDS is a managed database service (PaaS).
The boundary of responsibility shifts depending on whether the service is IaaS (like EC2) or PaaS (like RDS).
2
Determine the split of responsibilities for Amazon RDS.
AWS handles physical security, infrastructure, operating system maintenance, and database patching. The customer handles database configuration, database-level security groups, data encryption, and user access management.
This determines which options represent customer tasks rather than AWS tasks.
3
Evaluate the choices based on the determined responsibilities.
Managing database user accounts/permissions and configuring database security groups are customer tasks. Operating system patching, physical storage drive replacement, and retrieving raw physical facility logs are AWS tasks.
This confirms the correct options.

Key Concept

Under the AWS Shared Responsibility Model for managed database services (RDS), AWS manages the infrastructure, OS patching, and physical hardware, while the customer manages database access, application configuration, and network security groups.
Estimated Time:1m 30s
Question 5Question →

A company's backend application instances in Subnet A must query a PostgreSQL database running on an Amazon EC2 instance in Subnet B. To secure this traffic, a network administrator is configuring network access control lists (Network ACLs) for Subnet B and a security group for the database instance. Which two configuration steps are required to allow this database traffic while maintaining the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a security group rule to the database instance that allows inbound TCP traffic on port 5432 from the application instances.; Add an outbound rule to the Network ACL of Subnet B that allows TCP traffic on ephemeral ports 1024–65535 to Subnet A.

Answer

The correct configurations are to add an inbound security group rule on port 5432 from the application instances, and to add a Network ACL outbound rule on the database subnet allowing ephemeral port traffic to the application subnet.
The correct configurations are adding an inbound security group rule on the database instance for port 5432, and adding an outbound Network ACL rule on the database subnet for ephemeral ports. Security groups are stateful, meaning they track connection states and automatically allow return traffic for established inbound connections. Network ACLs are stateless, meaning every packet must be evaluated against rules. When a client initiates a connection to a database, the return traffic is sent from the database to the client's ephemeral ports (ranging from 1024 to 65535). Therefore, the stateless Network ACL must explicitly permit outbound traffic to these ephemeral ports.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups at the instance level.
Identify that allowing inbound database traffic on port 5432 automatically allows the return traffic outbound, making additional outbound rules for this traffic on the Security Group unnecessary.
Security Groups are stateful firewalls.
2
Analyze the stateless behavior of Network ACLs at the subnet level.
Determine that both inbound and outbound traffic must be explicitly allowed. For database responses, the return traffic is sent to the ephemeral ports of the application servers.
Network ACLs are stateless and require explicit rules for return traffic.
3
Evaluate the role of IAM policies vs. network security controls.
Recognize that network-level packet filtering is handled by Security Groups and Network ACLs, not by IAM roles or policies.
IAM controls API and resource authorization, not TCP/IP network packet filtering.

Key Concept

Distinguishing between the stateful behavior of Security Groups at the instance level and the stateless behavior of Network ACLs at the subnet level.
Question 6Question →

A global online learning platform hosts virtual classrooms on Amazon EC2 instances and stores course materials in Amazon S3 buckets. The security team needs to implement a solution that continuously scans their EC2 instances for software vulnerabilities and unintended network exposure. Additionally, they must identify potential security threats across their AWS accounts, such as cryptocurrency mining or brute-force attacks, using machine learning and threat intelligence. Which combination of AWS services will address these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
Amazon Inspector and Amazon GuardDuty together fulfill both security objectives. Amazon Inspector acts as a static and dynamic vulnerability scanner for EC2 instances and ECR container images to locate software flaws. Amazon GuardDuty acts as an intelligent threat detector that analyzes active telemetry logs to identify operational and account-level security threats in real time.

Step-by-Step Solution

1
Analyze the requirement for scanning EC2 instances for software vulnerabilities and network reachability issues.
Identify Amazon Inspector as the designated AWS service for automated host vulnerability assessment.
Amazon Inspector automatically discovers EC2 instances and scans them against a database of known vulnerabilities (CVEs) and evaluates network exposure configurations.
2
Analyze the requirement for detecting active threats, suspicious API calls, cryptomining, and brute-force attempts across the AWS account.
Identify Amazon GuardDuty as the primary intelligent threat detection service.
Amazon GuardDuty processes logs (such as VPC Flow Logs, CloudTrail, and DNS logs) using threat intelligence and machine learning to flag abnormal or malicious activity.

Key Concept

Vulnerability scanning of virtual servers versus intelligent, log-based cloud threat detection.
Question 7Question →

A retail company is auditing its AWS account to align with AWS Identity and Access Management (IAM) security best practices. Currently, developers use shared credentials for daily administrative tasks, and multi-factor authentication (MFA) is not enabled on the account. Which of the following actions should the company perform to secure their environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to only specific tasks that require root credentials.; Configure AWS IAM Identity Center to delegate daily administrative access to developers using temporary security credentials.

Answer

To secure the AWS environment, the company should enable multi-factor authentication (MFA) on the AWS account root user and restrict its use, and configure AWS IAM Identity Center to delegate daily administrative access using temporary credentials.
The correct actions are to enable multi-factor authentication (MFA) on the root user to secure the account, and to set up AWS IAM Identity Center to manage developer access. This ensures that developers use temporary, unique credentials for daily operations instead of sharing permanent administrative access.

Step-by-Step Solution

1
Identify root user credentials security requirements.
Determine that the root user should have MFA enabled and must not be used for daily operations.
Root user credentials have complete administrative access across the entire account and represent a high security risk if compromised.
2
Analyze credential management for daily developer operations.
Determine that developers should use temporary credentials managed via AWS IAM Identity Center rather than permanent or shared keys.
Using temporary credentials minimizes the risk of credential leakage and aligns with the principle of least privilege.

Key Concept

Implementing IAM best practices including securing the root account with MFA and utilizing temporary credentials via identity federation or IAM Identity Center.
Estimated Time:1m 0s
Question 8Question →

A logistics company containerizes its shipment tracking application and deploys it on AWS Fargate. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Configuring security group rules to control traffic to and from the container tasks

Answer

Configuring security group rules to control traffic to and from the container tasks
The configuration of security groups to control inbound and outbound traffic to the container tasks is a customer responsibility. Even though AWS Fargate abstracts the underlying host servers and operating system, the customer retains control and responsibility over network-level access control to their own workloads.

Step-by-Step Solution

1
Analyze the service type and deployment model
AWS Fargate is a serverless compute engine for containers, which falls under a managed service model where the underlying host operating system and hardware are managed by AWS.
Identifying the service category helps determine the boundary line between the customer's security 'in' the cloud and AWS's security 'of' the cloud.
2
Differentiate between customer and AWS responsibilities for this service
AWS manages physical security, host patching, and hardware. The customer manages application code, container images, IAM roles, and network security configuration (security groups) for the tasks.
This allows us to isolate which configuration task is still controlled by the customer in a serverless container environment.

Key Concept

Shared Responsibility Model for Serverless Container Services
Question 9Question →

An enterprise is establishing access policies for a newly deployed reporting service hosted on an Amazon EC2 instance and a database administrator who requires CLI access for database maintenance. Which of the following identity configurations represent AWS-recommended practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with permissions to read the database and attach it to the EC2 instance.; Create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.

Answer

Create an IAM role with permissions to read the database and attach it to the EC2 instance, and create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.
The correct configurations involve using an IAM role for the EC2 instance and a dedicated IAM user with restricted permissions for the administrator. Attaching an IAM role to the EC2 instance enables the reporting service to securely access the database using automatically rotated temporary credentials. For the database administrator, a dedicated IAM user with CLI access keys and least-privilege policies ensures accountable, secure programmatic access.

Step-by-Step Solution

1
Analyze the security requirements for the EC2-hosted application.
The application needs access to the database without exposing long-term credentials.
AWS best practices recommend using IAM roles for applications running on EC2 instances to obtain temporary credentials.
2
Analyze the access requirements for the database administrator.
The administrator needs programmatic access (CLI) to perform manual maintenance.
For human programmatic access, a dedicated IAM user with CLI access keys and least-privilege policies should be created.
3
Identify and eliminate options proposing insecure practices or boundary violations.
Using root user access keys, embedding permanent credentials, or requesting AWS to perform database maintenance are incorrect.
These violate root user best practices, credential storage standards, and the AWS Shared Responsibility Model.

Key Concept

Identity and Access Management (IAM) Best Practices
Question 10Question →

A medical device manufacturer is deploying an IoT monitoring system on AWS. The quality assurance team must retrieve official AWS compliance reports, such as ISO certificates, to complete their regulatory filing. Which AWS service provides on-demand access to these security and compliance reports?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is a self-service portal that provides customers with direct access to AWS compliance documentation. This includes Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and various ISO certifications required by regulators and auditors.

Step-by-Step Solution

1
Identify the requirement to retrieve third-party compliance reports and certifications (such as ISO certificates) for AWS infrastructure.
The requirement points to AWS compliance and governance documentation.
AWS manages the security of the cloud and provides audit reports to customers to prove compliance.
2
Determine which AWS service acts as the central portal for these compliance documents.
AWS Artifact is identified as the dedicated self-service portal for downloading these reports on demand.
Other services like Systems Manager, GuardDuty, or CloudTrail are used for resource management, threat detection, or API logging rather than document retrieval.

Key Concept

AWS Artifact provides on-demand access to AWS compliance reports and agreements.
Estimated Time:1m 0s
Question 11Question →

A fintech startup is deploying a public-facing REST API using Amazon API Gateway to expose financial transaction data. The API must be secured against unauthorized access, and all data transit must be encrypted. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

Show answer & explanation

Answer: Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers

Answer

Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers
Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers is the correct answer because managing identity and access management (IAM) permissions, authentication, and authorization policies for the application's APIs falls under the customer's responsibility for securing their data 'in' the cloud.

Step-by-Step Solution

1
Identify the AWS service type in the scenario.
Amazon API Gateway is a fully managed (Platform-as-a-Service/Serverless) AWS service.
Managed services shift infrastructure-level maintenance tasks from the customer to AWS.
2
Differentiate between security 'of' the cloud and security 'in' the cloud for a managed service.
AWS handles the physical security, underlying operating systems, and patching. The customer remains responsible for securing data, configuring resource policies, and managing user access.
This determines which task the customer must execute directly to secure their API.
3
Evaluate the choices to find the customer-managed task.
Configuring user pools or Lambda authorizers controls access to the application data, which is 'in' the cloud and thus the customer's responsibility.
API access control is managed at the application layer by the customer.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon API Gateway, AWS handles physical security, OS patching, and network infrastructure, while the customer is responsible for application-level security, including client-side encryption, access control (authentication/authorization), and resource configuration.
Question 12Question →

A research institute manages high-performance simulation applications running on a fleet of Amazon EC2 instances. The institute's security audit team requires a tool that can continuously scan the operating systems of these instances for known software vulnerabilities and analyze network paths to identify unintended exposure to the internet. Which AWS service is designed to perform these automated vulnerability assessments?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector is the correct service because it automatically evaluates Amazon EC2 instances for software vulnerabilities and unintended network path exposure.
Amazon Inspector is designed to automatically discover and scan Amazon EC2 instances, container images, and AWS Lambda functions for software vulnerabilities (like CVEs) and unintended network exposure.

Step-by-Step Solution

1
Analyze the core requirement of finding an AWS service that performs automated security assessments, scans for software vulnerabilities, and analyzes network paths on Amazon EC2 instances.
The target service must support host-level operating system scanning and network exposure analysis.
This distinguishes between services that monitor active API threats and those that audit static configuration and patching status.
2
Evaluate the capabilities of Amazon Inspector against other security services.
Amazon Inspector is the only service that performs automated vulnerability scans on host software and checks network accessibility, whereas GuardDuty is for active threat detection, CloudTrail is for auditing API events, and Shield is for DDoS protection.
Identifying the distinct functionality of each option ensures the selection of the correct service.

Key Concept

Continuous vulnerability assessment and network reachability analysis using Amazon Inspector.
Estimated Time:1m 0s
Question 13Question →

A financial services company uses Amazon S3 Glacier Flexible Retrieval to archive historical transaction records for compliance auditing. Under the AWS Shared Responsibility Model, which of the following security and operational tasks are the sole responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring Vault Lock policies to enforce compliance and prevent modification of archives; Managing Identity and Access Management (IAM) policies to regulate user access to the vault

Answer

The customer is responsible for configuring Vault Lock policies to enforce compliance and managing Identity and Access Management (IAM) policies to regulate user access to the vault.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For Amazon S3 Glacier, this includes configuring Vault Lock policies to enforce compliance and managing IAM policies to regulate user access. These are control plane configurations managed entirely by the customer.

Step-by-Step Solution

1
Identify the service type and model boundary.
Amazon S3 Glacier is a managed service where AWS handles the underlying infrastructure and virtualization.
Understanding the service type helps distinguish between infrastructure tasks managed by AWS and data/access configurations managed by the customer.
2
Evaluate each operational task against the Shared Responsibility Model.
Vault Lock policies and IAM configurations are data integrity and access control responsibilities (customer's job). Media disposal, host OS patching, and compliance portal access are infrastructure and global compliance responsibilities (AWS's job or AWS Artifact's domain).
This isolates the tasks that fall under customer configuration rather than AWS infrastructure management.

Key Concept

Shared Responsibility Model for Managed Services
Question 14Question →

A company hires a new systems administrator who needs daily access to manage Amazon EC2 instances and Amazon RDS databases. Which of the following is the AWS-recommended best practice for granting this administrator access?

Show answer & explanation

Answer: Create an individual IAM user for the administrator, attach policies granting only the necessary permissions, and require multi-factor authentication (MFA).

Answer

Create an individual IAM user for the administrator, attach policies granting only the necessary permissions, and require multi-factor authentication (MFA).
The correct approach is to create an individual IAM user with policies that grant only the required permissions for managing EC2 and RDS, and to secure the user with multi-factor authentication. This adheres to the principle of least privilege and ensures individual accountability.

Step-by-Step Solution

1
Identify the security requirements for daily administrative access to AWS resources.
Determine that the administrator needs specific access to EC2 and RDS, requiring individual credentials and multi-factor authentication.
Individual accountability and multi-factor authentication are core security practices.
2
Evaluate the options against AWS Identity and Access Management (IAM) best practices.
Determine that using individual IAM users with least privilege permissions meets these best practices, while avoiding the root user, permanent role login, or outsourcing IAM tasks to AWS.
This alignment ensures the account remains secure and follows the principle of least privilege.

Key Concept

IAM Best Practices for Daily Administration
Question 15Question →

A cloud architect is designing the network security for a SaaS application's web servers running on Amazon EC2 instances in a VPC. To establish a defense-in-depth strategy, the architect plans to use both Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the characteristics and differences between these two firewall layers? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security groups operate at the Amazon EC2 instance level, whereas Network ACLs operate at the subnet level.; Security groups are stateful, meaning return traffic is automatically allowed, whereas Network ACLs are stateless and require explicit outbound rules for return traffic.

Answer

Security groups operate at the Amazon EC2 instance level and are stateful firewalls, while Network ACLs operate at the subnet level and are stateless firewalls.
Security groups are stateful firewalls operating at the instance level (ENI), allowing return traffic automatically without needing an explicit outbound rule. Network ACLs are stateless firewalls operating at the subnet level, requiring explicit rules for both inbound and outbound traffic paths.

Step-by-Step Solution

1
Determine the operating boundary of Security Groups and Network ACLs.
Security groups are applied directly to EC2 instances (via elastic network interfaces), whereas Network ACLs are associated with entire subnets.
This establishes the scope of control for each firewall layer.
2
Analyze how connection states are processed by both firewalls.
Security groups automatically allow return traffic for established connections (stateful), while Network ACLs do not remember connection states and require matching rules in both directions (stateless).
This differentiates the traffic flow logic between the two security mechanisms.

Key Concept

Understanding the architectural differences between Security Groups and Network ACLs, specifically focusing on their evaluation level (instance vs. subnet) and state tracking behavior (stateful vs. stateless).
Estimated Time:1m 30s
Question 16Question →

A software-as-a-service (SaaS) provider is preparing for an ISO 27001 certification audit of its order management application. To satisfy the auditors, the company must verify that the underlying AWS physical infrastructure is certified and identify which specific AWS services in their deployment are covered under this compliance standard. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Access AWS Artifact to retrieve the AWS ISO 27001 compliance report.; Refer to the AWS Services in Scope by Compliance Program documentation.

Answer

The company should access AWS Artifact to retrieve the AWS ISO 27001 compliance report and refer to the AWS Services in Scope by Compliance Program documentation to confirm which services are certified.
The correct options involve retrieving compliance documents from AWS Artifact and checking service certification scope. AWS Artifact is the self-service portal for AWS compliance reports, such as ISO 27001 certificates. Since not all AWS services are in scope for every standard, verifying the service-specific compliance status via the AWS Services in Scope documentation is required to confirm that the architecture meets audit criteria.

Step-by-Step Solution

1
Obtain physical infrastructure compliance reports.
Access the AWS Artifact console and download the ISO 27001 certification report, which serves as the official compliance documentation for AWS data centers.
AWS is responsible for physical security and provides third-party audit reports to customers for compliance verification.
2
Verify service-specific compliance scope.
Check the AWS Services in Scope by Compliance Program online documentation to confirm that the specific services used in the application are certified.
Not all AWS services are immediately covered under every compliance standard, so verifying in-scope services is a necessary audit step.

Key Concept

AWS Compliance and Governance via AWS Artifact and Services in Scope documentation
Question 17Question →

A global retail company is preparing for an annual PCI-DSS audit of its payment processing workload hosted on AWS. The compliance team needs to gather official documentation proving the physical security compliance of AWS data centers and establish a workflow to continuously audit and evaluate AWS resource configurations against regulatory standards. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS PCI-DSS compliance package and related security reports from AWS Artifact.; Use AWS Config to continuously record and evaluate resource configuration changes against compliance guidelines.

Answer

Retrieve the compliance documents from AWS Artifact, and use AWS Config to record and evaluate resource configuration compliance.
The correct options are downloading compliance documents from AWS Artifact and utilizing AWS Config for resource evaluation. AWS Artifact serves as the direct portal for retrieving official AWS audit reports (such as PCI-DSS packages) to verify the security of the AWS infrastructure. AWS Config provides the mechanism to continuously monitor, record, and evaluate resource configurations to ensure they align with compliance guidelines.

Step-by-Step Solution

1
Determine the resource responsible for providing AWS's third-party compliance reports and agreements.
Identify AWS Artifact as the self-service portal to download reports like SOC and PCI-DSS compliance packages.
AWS Artifact provides on-demand access to AWS compliance documentation to satisfy external audit requirements.
2
Determine the service designed to continuously audit, record, and evaluate resource configurations against compliance rules.
Select AWS Config as the configuration management and compliance auditing tool.
AWS Config tracks configuration history and evaluates changes against predefined rules to ensure governance.

Key Concept

Compliance and Governance
Question 18Question →

A logistics company is migrating its tracking application to AWS and needs to set up a comprehensive monitoring and auditing solution. The company wants to track all administrative actions and API modifications made to their AWS resources for compliance auditing. Additionally, they need to collect system-level metrics, such as CPU utilization from their Amazon EC2 instances, and automatically send alerts if thresholds are exceeded.

Which of the following AWS services should the company configure to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail to audit and record all API calls, user activity, and resource modifications; Amazon CloudWatch to collect metrics, monitor resource performance, and trigger alarms based on thresholds

Answer

AWS CloudTrail and Amazon CloudWatch are the correct services to configure.
AWS CloudTrail tracks and logs user activity and API transactions to provide a complete history of actions for compliance. Amazon CloudWatch collects and monitors real-time performance metrics (like CPU utilization) and sends alerts when pre-defined resource thresholds are breached.

Step-by-Step Solution

1
Identify the service required to track administrative actions and API modifications for auditing.
AWS CloudTrail logs all API actions and management events.
This satisfies the requirement to maintain a record of all modifications and user actions for compliance.
2
Identify the service required to monitor performance metrics like CPU utilization and trigger alarms.
Amazon CloudWatch collects system-level metrics and manages alarms.
This satisfies the operational monitoring and alerting requirements.

Key Concept

AWS CloudTrail logs API calls and management events for compliance auditing, while Amazon CloudWatch monitors resource performance metrics and triggers operational alarms.
Question 19Question →

A financial technology company is preparing for a security audit and must establish robust auditing and monitoring controls. The company needs to maintain a complete history of all API calls made within their AWS environment for compliance verification. Additionally, the security team needs to receive immediate notifications if any unauthorized modifications are made to network security configurations, such as security group rules.

Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable AWS CloudTrail to capture and log API calls, storing them in a secure Amazon S3 bucket for compliance auditing.; Create Amazon CloudWatch metric filters and alarms to notify security administrators in real-time when specific unauthorized API patterns occur in the logs.

Answer

Enable AWS CloudTrail to capture API calls for compliance auditing, and create Amazon CloudWatch metric filters and alarms for real-time notifications.
To satisfy both requirements, the company must use AWS CloudTrail to record a complete log of all API operations (like creating or modifying resources) and deliver them to S3. They must also use Amazon CloudWatch Logs to collect the logs, create metric filters for unauthorized patterns (e.g., security group updates), and configure CloudWatch Alarms to send real-time alerts.

Step-by-Step Solution

1
Identify the service responsible for auditing API requests and user activity.
AWS CloudTrail is identified as the service that records API activity and stores the history in an Amazon S3 bucket.
CloudTrail provides operational and risk auditing, governance, and compliance of your AWS account.
2
Identify the service responsible for monitoring metrics and setting up real-time alarms.
Amazon CloudWatch is identified as the service that can monitor logs, define metric filters, and configure alarms.
CloudWatch is used for monitoring resource utilization, log files, and triggering actions or alerts based on metrics.
3
Eliminate options that misrepresent the AWS Shared Responsibility Model or confuse services.
Options recommending Amazon Inspector for log analysis or requesting AWS-managed physical logs are eliminated.
Under the Shared Responsibility Model, physical infrastructure logs are AWS's responsibility and are not shared. Vulnerability scanning is distinct from active threat monitoring and log analysis.

Key Concept

AWS CloudTrail provides API auditing and activity logging, while Amazon CloudWatch provides performance metrics, log monitoring, and real-time alarms.
Question 20Question →

A financial technology startup is setting up its AWS environment. An application running on Amazon ECS tasks needs to retrieve records from an Amazon DynamoDB table, while an external compliance auditor requires weekly console access to inspect security configurations without modifying any resources. Which TWO of the following identity and access management actions should the startup implement to meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with the necessary DynamoDB read permissions and associate it with the Amazon ECS task definition.; Create a dedicated IAM user for the external auditor, require Multi-Factor Authentication (MFA), and attach a policy allowing read-only access to security settings.

Answer

The startup should configure an IAM role with DynamoDB read permissions for the ECS task definition and establish a dedicated IAM user with MFA and read-only permissions for the auditor.
The correct identity setup involves creating an IAM role for the ECS container tasks to assume temporary access credentials dynamically, and establishing a dedicated IAM user for the external auditor with a read-only policy and MFA enabled for safe administrative console access.

Step-by-Step Solution

1
Analyze the application's access requirements.
The ECS task running the application requires access to DynamoDB. Hardcoding or passing static credentials is a security risk, so an IAM role must be configured for the ECS task (task role) to provide temporary, automatically rotated security credentials.
This follows the principle of least privilege and eliminates long-term credentials for applications.
2
Analyze the auditor's access requirements.
The auditor requires access to the console to view security configurations. This is a human access requirement, which requires a dedicated IAM user or federated login, coupled with Multi-Factor Authentication (MFA) and a read-only policy.
This secures administrative/auditing endpoints and ensures individual accountability without granting write permissions.
3
Evaluate the distractors against AWS best practices and the Shared Responsibility Model.
Using the root account keys is highly discouraged. Reusing human IAM user credentials for application workloads is insecure. Asking AWS to manage IAM audit operations misinterprets the customer's responsibility under the Shared Responsibility Model.
This isolates human vs. machine identity and defines ownership of cloud security configurations.

Key Concept

The core of AWS identity security relies on isolating human identities (using IAM users/federation with MFA) and machine identities (using IAM roles for temporary credentials), whilst adhering to the Shared Responsibility Model where the customer owns resource access configuration.
Estimated Time:2m 30s
Page 1 / 23Next