Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 201Question →

A software development firm manages a multi-account AWS environment. A developer in the development account needs temporary administrative access to perform emergency troubleshooting on resources in the production account. Which of the following options represents the most secure, AWS-recommended method to achieve this?

Show answer & explanation

Answer: Create an IAM role in the production account with a trust policy that allows the development account to assume it, and grant the developer permission to assume this role.

Answer

Create an IAM role in the production account with a trust policy that allows the development account to assume it, and grant the developer permission to assume this role.
The correct method is to create an IAM role in the production account that trusts the development account, and then allow the developer to assume this role. This approach follows the security best practice of using temporary credentials (via AWS STS) for cross-account delegation, eliminating the need to create static credentials or duplicate users across multiple accounts.

Step-by-Step Solution

1
Evaluate the need for cross-account access and identify the appropriate IAM entity.
Determine that IAM roles are designed to delegate access to resources across different AWS accounts using temporary credentials.
IAM roles allow users in one account to assume permissions in another account securely without creating duplicate IAM users or sharing static keys.
2
Configure the trust policy of the target IAM role in the production account.
Define a trust policy that specifies the development account ID as a trusted principal.
This establishes a cryptographic trust relationship, allowing users in the trusted development account to assume the role.
3
Grant the developer permission to assume the cross-account role.
Attach an IAM policy to the developer's IAM user or group in the development account that allows the sts:AssumeRole action on the production role's ARN.
The developer must have explicit permission to request the temporary credentials from AWS STS.

Key Concept

Cross-account access delegation using IAM roles and temporary security credentials.
Estimated Time:1m 30s
Question 202Question →

A logistics company is preparing for an external audit to verify that its cloud infrastructure meets international compliance standards. The company needs to retrieve AWS security reports and determine which security tasks are managed directly by AWS. Which two of the following actions should the company take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Download AWS compliance documents, such as SOC and PCI reports, using AWS Artifact; Identify that physical security and infrastructure virtualization controls are managed by AWS

Answer

Downloading AWS compliance documents from AWS Artifact and identifying that physical security and infrastructure virtualization controls are managed by AWS.
AWS Artifact provides on-demand access to AWS security and compliance reports (such as SOC and PCI reports). Additionally, under the Shared Responsibility Model, AWS is responsible for 'security of the cloud,' which includes physical security of the data centers and the virtualization layer.

Step-by-Step Solution

1
Locate the tool to retrieve AWS compliance reports.
Identify AWS Artifact as the on-demand service for downloading SOC, PCI, and ISO compliance documents.
The company needs to obtain official AWS compliance documents for its auditors.
2
Determine the physical and infrastructure security boundaries.
Identify that AWS manages physical security of the data centers and the virtualization layer under the Shared Responsibility Model.
The company needs to establish which security controls are handled directly by AWS.

Key Concept

Retrieving AWS compliance reports and mapping shared responsibility boundaries.
Question 203Question →

A systems administrator is troubleshooting a connectivity issue for a web application deployed on Amazon EC2 instances within a custom VPC subnet. The instances are associated with a stateful Security Group that allows inbound HTTP (port 80) traffic from any source, and allows all outbound traffic. At the subnet level, the custom Network Access Control List (Network ACL) is configured with an inbound rule allowing HTTP (port 80) traffic from any source, but its outbound rule set only contains the default deny rule. Users report that they receive connection timeouts when trying to access the web application. Which of the following explains why the connection attempts are timing out?

Show answer & explanation

Answer: The Network ACL is stateless, which means it does not automatically allow return traffic; an outbound rule must be added to allow traffic to the clients' ephemeral ports.

Answer

The Network ACL is stateless, which means it does not automatically allow return traffic; an outbound rule must be added to allow traffic to the clients' ephemeral ports.
The correct answer is correct because Network Access Control Lists (Network ACLs) are stateless. Even though the inbound HTTP traffic is allowed and the instance's Security Group is stateful (allowing return traffic automatically at the instance level), the stateless Network ACL blocks the return traffic because it does not track connection states. Therefore, an outbound rule must be explicitly added to the Network ACL to allow the web server's responses to reach the clients' ephemeral ports (typically 1024-65535).

Step-by-Step Solution

1
Analyze the stateful nature of the Security Group associated with the EC2 instances.
The Security Group is stateful, so inbound HTTP traffic on port 80 is allowed, and its response traffic is automatically allowed outbound at the instance level.
To determine if the traffic is blocked at the instance boundary.
2
Analyze the stateless nature of the Network ACL associated with the subnet.
The Network ACL is stateless, which means outbound return traffic is not tracked or automatically allowed, even if the corresponding inbound traffic was permitted.
To check if the subnet boundary is blocking the return traffic.
3
Identify the missing configuration in the Network ACL outbound rules.
The outbound rule set only contains the default deny rule, blocking response packets sent to client ephemeral ports (typically 1024-65535). An explicit outbound rule is required.
To resolve the connection timeout by allowing the server to respond to the client.

Key Concept

Stateful vs. Stateless network security controls in AWS VPC
Estimated Time:2m 0s
Question 204Question →

A regional energy utility company is hosting its customer portal on AWS. In preparation for an upcoming regulatory audit, the company's compliance officer needs to retrieve the AWS Service Organization Control (SOC) reports to verify the security controls of the AWS physical infrastructure. Which AWS resource provides on-demand access to these compliance documents?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the primary, self-service portal for downloading AWS compliance documents, such as SOC and PCI reports, which are required for demonstrating compliance.

Step-by-Step Solution

1
Identify the requirement to retrieve third-party audit reports (such as SOC reports) for AWS infrastructure.
Recognized that the auditor needs AWS-owned compliance documentation rather than customer-generated logs.
This establishes the scope of the search to AWS infrastructure compliance.
2
Evaluate AWS services that provide self-service access to security and compliance reports.
Identified AWS Artifact as the dedicated portal for compliance documentation.
This matches the requirements of obtaining audit-ready reports on-demand.

Key Concept

AWS Artifact is the central resource for downloading AWS security and compliance reports.
Estimated Time:1m 0s
Question 205Question →

A media streaming company wants to improve its security posture on AWS. The company needs to implement continuous monitoring of its AWS accounts for malicious activity or unauthorized behavior. Additionally, it needs to automatically scan its Amazon EC2 instances for software vulnerabilities.

Which of the following AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides continuous threat detection across AWS accounts, while Amazon Inspector automatically scans EC2 instances for software vulnerabilities.
Amazon GuardDuty is correct because it provides continuous, intelligent threat detection by monitoring network logs and account activity. Amazon Inspector is correct because it is the dedicated tool for scanning EC2 instances and container images for software vulnerabilities and network exposure.

Step-by-Step Solution

1
Identify the service needed for continuous monitoring of AWS accounts for malicious or unauthorized activity.
Amazon GuardDuty is designed for intelligent threat detection and continuous monitoring of AWS workloads and accounts.
GuardDuty uses machine learning and threat intelligence to detect anomalies and unauthorized activities.
2
Identify the service needed to scan Amazon EC2 instances for software vulnerabilities.
Amazon Inspector is the service that automatically scans EC2 instances, containers, and serverless functions for known vulnerabilities.
Inspector compares system configurations and software packages against databases of known security vulnerabilities.

Key Concept

Identifying the distinct roles of AWS threat detection and vulnerability management services.
Question 206Question →

A smart-agriculture IoT company runs containerized data processing applications on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (Amazon ECR). The security team wants to implement continuous, automated scans to identify software vulnerabilities in both the EC2 operating system packages and the ECR container images. According to the AWS Shared Responsibility Model, which AWS service performs these scans, and who is responsible for configuring the tool and remediating the findings?

Show answer & explanation

Answer: Amazon Inspector is used to perform the vulnerability scans, and the customer is responsible for configuring the scans and patching the identified vulnerabilities.

Answer

Amazon Inspector is used to perform the vulnerability scans, and the customer is responsible for configuring the scans and patching the identified vulnerabilities.
Amazon Inspector is a vulnerability management service that continuously scans AWS workloads, including Amazon EC2 instances and Amazon ECR container images, for software vulnerabilities and unintended network exposure. Under the AWS Shared Responsibility Model, the customer is responsible for configuring the service, analyzing the findings, and performing remediation (such as patching operating systems and updating container images), while AWS is responsible for the security OF the cloud (the underlying infrastructure).

Step-by-Step Solution

1
Identify the security requirement from the scenario.
The platform needs continuous, automated scanning of Amazon EC2 operating system packages and Amazon ECR container images for known software vulnerabilities.
This establishes that the necessary capability is host and package vulnerability scanning rather than network threat detection or API activity logging.
2
Select the correct AWS service that corresponds to vulnerability scanning.
Amazon Inspector is identified as the AWS service that provides automated vulnerability management for EC2 and ECR.
This eliminates services like Amazon GuardDuty (used for threat detection) and AWS CloudTrail (used for API logging).
3
Apply the AWS Shared Responsibility Model to the scenario's operations.
Determine that while AWS provides the Amazon Inspector service, the customer is responsible for enabling it, configuring the scan scopes, analyzing the reports, and executing remediation actions such as patching the EC2 guest OS and updating container files.
This rules out the misconception that AWS automatically remediates or patches customer-managed software resources.

Key Concept

Vulnerability management and the division of security duties under the AWS Shared Responsibility Model
Estimated Time:2m 0s
Question 207Question →

A startup is establishing its cloud presence and needs to set up administrative access for its system administrator. The administrator will be responsible for creating resources, managing network settings, and monitoring logs on a daily basis. What is the AWS-recommended best practice to configure this administrative access?

Show answer & explanation

Answer: Create an individual IAM user for the administrator, grant the necessary administrative permissions, and enforce multi-factor authentication (MFA)

Answer

Create an individual IAM user for the administrator, grant the necessary administrative permissions, and enforce multi-factor authentication (MFA)
Creating an individual IAM user for the administrator, granting the necessary permissions, and enabling MFA aligns with AWS security best practices. This ensures accountability, limits the exposure of the root account, and adds an extra layer of security via MFA.

Step-by-Step Solution

1
Identify the security requirements for daily administrative access, recognizing that the root user should not be used.
Discard the option suggesting the use of the AWS account root user.
AWS security best practices dictate that the root user credentials should be locked away and used only for a few specific tasks.
2
Evaluate the customer's versus AWS's responsibilities in managing access credentials under the AWS Shared Responsibility Model.
Discard the option proposing that AWS support manages user daily permissions.
Identity and Access Management (IAM) configurations are strictly the responsibility of the customer.
3
Determine the correct IAM entity and authentication setup for a human user requiring administrative access.
Identify that an individual IAM user with MFA is the recommended secure configuration, whereas roles are for temporary access and are not shared with static credentials.
An individual IAM user ensures accountability, enables MFA for security, and avoids sharing credentials or using temporary role configurations incorrectly.

Key Concept

AWS IAM Best Practices and Root User Security
Estimated Time:1m 30s
Question 208Question →

A startup wants to establish operational visibility and security auditing. They need to log all API calls made by users and services across their AWS account, and they also need to collect and monitor performance metrics, such as CPU utilization, from their Amazon EC2 instances.

Which of the following AWS services should the startup use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon CloudWatch

Answer

AWS CloudTrail and Amazon CloudWatch are the correct services. AWS CloudTrail is used to audit user activity and API calls, while Amazon CloudWatch monitors resource metrics and performance.
AWS CloudTrail is designed to capture and log API calls and user activity, satisfying the audit requirement. Amazon CloudWatch collects and monitors operational performance metrics such as CPU utilization, satisfying the resource monitoring requirement.

Step-by-Step Solution

1
Identify the service that records API activity and user actions for auditing.
AWS CloudTrail records API calls made within the AWS account, which satisfies the auditing requirement.
CloudTrail is the primary service dedicated to governance, compliance, and auditing of actions in an AWS account.
2
Identify the service that collects and monitors resource metrics like CPU utilization.
Amazon CloudWatch tracks and monitors performance metrics and logs from AWS resources.
CloudWatch is the core monitoring and observability service designed to track resource health and application performance.

Key Concept

AWS CloudTrail provides API auditing and user activity tracking, whereas Amazon CloudWatch provides resource performance monitoring and metrics collection.
Question 209Question →

A digital real estate platform runs its database and web servers on Amazon Elastic Compute Cloud (Amazon EC2) instances. The platform's security team needs to implement a solution that automatically scans these EC2 instances for software vulnerabilities, package issues, and unintended network path exposures. Which AWS service should the real estate platform use to meet these requirements?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
Amazon Inspector is the correct service because it is specifically designed to perform automated vulnerability scans on Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions, detecting known software vulnerabilities and unintended network paths.

Step-by-Step Solution

1
Identify the primary requirement in the scenario, which is scanning Amazon EC2 instances for software vulnerabilities, package issues, and unintended network path exposures.
The target task is vulnerability management and host-level security assessment.
This narrows down the potential AWS services to those focused on scanning workloads for known CVEs and exposure.
2
Evaluate the available AWS security services against this requirement and select the one designed specifically for automated vulnerability scanning.
Amazon Inspector is the designated service for automated vulnerability management on EC2 and container images.
It matches the scanning requirement, whereas other security services focus on threat detection, logging, or operational management.

Key Concept

Amazon Inspector is an automated vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure.
Question 210Question →

A startup is setting up its initial AWS environment and wants to secure the account. Which of the following are AWS Identity and Access Management (IAM) best practices that the startup should implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) for the AWS account root user.; Create individual IAM users for each team member who requires access.

Answer

The correct practices are to enable multi-factor authentication (MFA) for the AWS account root user and to create individual IAM users for each team member who requires access.
Securing the root user with multi-factor authentication (MFA) protects the root account from credential theft. Creating individual IAM users ensures distinct identities, which supports traceability and facilitates implementing specific permissions for each team member.

Step-by-Step Solution

1
Review account-level security best practices.
Identify that securing the root account with multi-factor authentication (MFA) is the highest priority first step.
The root user has complete administrative control over the entire AWS account, so securing it prevents full-scale compromises.
2
Evaluate user-level credential provisioning policies.
Determine that individual team members must be assigned their own distinct IAM users rather than sharing root or general user credentials.
This establishes accountability and enables administrators to grant permissions using the principle of least privilege.

Key Concept

Applying core IAM best practices to protect account resources by isolating root privileges and utilizing individual user identities.
Question 211Question →

A non-profit organization stores its public files in Amazon S3 and runs a web application on Amazon EC2 instances. Which two of the following tasks are the responsibility of AWS under the AWS Shared Responsibility Model?

Select all that apply

Show answer & explanation

Answer: Maintaining physical security of the data centers hosting the infrastructure; Disposing of decommissioned physical storage devices

Answer

AWS is responsible for maintaining the physical security of the data centers and securely disposing of decommissioned physical storage devices.
Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud. This includes physical data center security and hardware lifecycle tasks, such as destroying decommissioned physical storage drives.

Step-by-Step Solution

1
Identify the service models described in the scenario.
Amazon S3 (a managed object storage service) and Amazon EC2 (an Infrastructure as a Service, or IaaS, compute service) are used.
This establishes where the boundary of responsibility is drawn for each service.
2
Distinguish between responsibilities for security 'of' the cloud and security 'in' the cloud.
AWS handles the security 'of' the cloud (physical infrastructure, hardware, and the virtualization layer). The customer handles the security 'in' the cloud (guest operating systems, application configurations, firewall rules, and data access policies).
This division is the foundational logic of the AWS Shared Responsibility Model.
3
Evaluate the choices to see which are managed by AWS.
Physical data center security and physical storage device disposal belong to AWS. Configuring S3 bucket permissions, patching the EC2 guest operating system, and managing security groups are operational tasks managed by the customer.
This identifies the two correct responsibilities assigned to AWS.

Key Concept

AWS Shared Responsibility Model
Estimated Time:1m 0s
Question 212Question →

A company wants to automate vulnerability assessments for its Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Which AWS service should the company use?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads (such as Amazon EC2 instances, AWS Lambda functions, and container images) for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Identify the goal
The company wants to automatically scan Amazon EC2 instances to check for software vulnerabilities and unintended network exposure.
This establishes the requirements of vulnerability scanning at the host/software level.
2
Select the appropriate AWS service
Amazon Inspector is selected as the correct service.
Amazon Inspector is specifically designed to automate security assessments and vulnerability scanning on EC2 instances and container images.

Key Concept

Vulnerability management on AWS hosts and packages
Estimated Time:45s
Question 213Question →

A health-tech company hosts its patient management portal on Amazon EC2 instances. The security team needs a service that can continuously monitor the AWS environment for potential security threats, such as command-and-control (C2) activity, unauthorized API calls, and brute-force attacks on the instances. Which AWS service is designed to perform this type of intelligent threat detection?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides intelligent threat detection by continuously monitoring logs (such as VPC Flow Logs, AWS CloudTrail management events, and DNS logs) using machine learning and threat intelligence to identify suspicious activities like brute-force attacks and command-and-control communication.

Step-by-Step Solution

1
Analyze the business and security requirements in the scenario.
The company needs continuous, intelligent threat detection to identify malicious activities like command-and-control activity, brute-force attacks, and unauthorized API calls within their AWS environment.
Identifying the target behavior (active threat detection) helps narrow down the appropriate AWS security service category.
2
Evaluate the capabilities of the proposed AWS security services.
Amazon GuardDuty uses threat intelligence feeds and machine learning to detect anomalies and unauthorized activities across AWS accounts and workloads, matching all specified requirements.
This step distinguishes active log-based threat detection (GuardDuty) from package vulnerability scanning (Inspector) or API logging (CloudTrail).

Key Concept

Active threat detection and monitoring on AWS
Estimated Time:1m 0s
Question 214Question →

A media streaming company is preparing to share its compliance posture with new business partners. The company needs to retrieve official AWS security compliance documents, such as Service Organization Control (SOC) reports, to demonstrate the security of the AWS infrastructure. Which AWS service or portal provides on-demand access to these reports?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact provides on-demand access to AWS security and compliance reports, such as Service Organization Control (SOC) and Payment Card Industry (PCI) reports.

Step-by-Step Solution

1
Identify the core business requirement.
The requirement is to retrieve official AWS security compliance documents (such as SOC reports) to share with partners.
This establishes the scope of the search to AWS compliance and governance tools.
2
Determine the AWS service designed for compliance reports.
AWS Artifact is the dedicated, self-service portal for on-demand access to AWS security and compliance reports and agreements.
This matches the requirement for downloading SOC reports directly.

Key Concept

AWS Compliance and Governance
Question 215Question →

A retail company deploys its online storefront using AWS Elastic Beanstalk. Under the AWS Shared Responsibility Model, which two of the following security-related tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Securing the application code and data uploaded to the environment; Configuring Identity and Access Management (IAM) user permissions for accessing the environment

Answer

Securing the application code and data uploaded to the environment, and configuring Identity and Access Management (IAM) user permissions for accessing the environment.
In the Platform as a Service (PaaS) model represented by AWS Elastic Beanstalk, the customer is responsible for configuring access policies (IAM) and securing the application code and data they upload. AWS manages and maintains the infrastructure, virtualization layer, guest operating system, and the application runtime platform.

Step-by-Step Solution

1
Identify the service model of the AWS service described.
AWS Elastic Beanstalk is identified as a Platform as a Service (PaaS) model.
The shared responsibility boundary shifts depending on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS).
2
Differentiate between the customer's responsibility and AWS's responsibility for a PaaS service.
AWS manages the guest operating system, platform patching (such as Java or Node.js runtimes), virtualization layer, and physical infrastructure. The customer remains responsible for application code, configuration settings, data security, and identity/access control.
This step determines which tasks fall under customer ownership ('security in the cloud') versus AWS ownership ('security of the cloud') for managed services.
3
Select the two customer responsibilities from the options provided.
The tasks of securing the application code and data, as well as configuring IAM permissions, are selected.
These match the customer's operational responsibilities in a Platform as a Service (PaaS) deployment.

Key Concept

Under the AWS Shared Responsibility Model, the division of labor depends on the type of service. For Platform as a Service (PaaS) offerings like AWS Elastic Beanstalk, AWS takes on more responsibility by managing the guest OS, runtime software, and physical security. The customer remains responsible for securing their code, protecting their data, and controlling user access via IAM.
Question 216Question →

A healthcare provider must ensure that all administrative actions performed in their AWS Cloud environment are recorded for regulatory compliance. They need to track when a user logs in, which resources were modified, and the source IP address of the request. Which AWS service is designed to record and log these API transactions?

Show answer & explanation

Answer: AWS CloudTrail

Answer

AWS CloudTrail
AWS CloudTrail is designed specifically to track, log, and audit user activity and API calls across the AWS infrastructure. It provides detailed records of who made the request, when, and from what IP address, which meets compliance requirements.

Step-by-Step Solution

1
Identify the key requirement in the scenario.
The healthcare provider needs to record all administrative actions, track user logins, resource modifications, and log the source IP addresses of the requests for regulatory compliance.
This establishes the core need for API logging and activity auditing.
2
Evaluate the capabilities of the AWS services listed in the options.
AWS CloudTrail records and logs AWS API transactions and user actions. Amazon CloudWatch focuses on operational metrics and system logs. Amazon GuardDuty focuses on threat detection. AWS Trusted Advisor provides optimization recommendations.
Matching the requirements to the correct service's primary function ensures the correct selection.
3
Verify which service provides the necessary activity history.
AWS CloudTrail is the specific service designed to log API transactions and user activity for auditing and compliance.
This confirms the correct option based on AWS services documentation.

Key Concept

AWS CloudTrail is the primary service used to log, monitor, and retain account activity related to actions across your AWS infrastructure, enabling operational auditing and compliance verification.
Question 217Question →

A software-as-a-service (SaaS) company providing human resources platform services is undergoing an external SOC 2 Type II audit. The audit team requires documentation verifying the security and compliance of the AWS physical infrastructure, and confirmation of how the SaaS company manages encryption keys for its application data. Which of the following actions should the company take to meet these audit requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS SOC 2 report directly from AWS Artifact to provide to the auditors; Manage customer-managed encryption keys for application data using AWS Key Management Service (AWS KMS)

Answer

To meet these requirements, the company should download the AWS SOC 2 report directly from AWS Artifact to verify AWS infrastructure compliance, and manage application data encryption keys using AWS Key Management Service (AWS KMS) to fulfill their responsibility under the Shared Responsibility Model.
The correct options are downloading the AWS SOC 2 report from AWS Artifact and managing encryption keys using AWS Key Management Service (AWS KMS). AWS Artifact provides on-demand access to security and compliance reports (such as SOC and PCI reports) which verify the compliance of AWS physical infrastructure. Additionally, under the Shared Responsibility Model, the customer is responsible for data protection, which includes configuring encryption and managing keys using AWS KMS.

Step-by-Step Solution

1
Identify the service for retrieving AWS compliance reports
Determine that AWS Artifact is the self-service portal to download reports like SOC 2 to prove AWS physical infrastructure compliance.
Auditors require third-party verification of the infrastructure managed by AWS.
2
Determine the tool and responsibility for data encryption key management
Identify that managing keys for data encryption is a customer responsibility under the Shared Responsibility Model, which is implemented using AWS Key Management Service (AWS KMS).
The customer is responsible for data protection and encryption in the cloud.

Key Concept

AWS Compliance and Governance and the Shared Responsibility Model
Estimated Time:1m 30s
Question 218Question →

A financial services firm wants to audit user activity in its AWS account to ensure compliance. They need to keep a complete record of all API transactions, and they also want to receive real-time notifications if anyone attempts to modify security group rules. Which combination of AWS services should the company implement to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail to log and track API calls across the account.; Amazon CloudWatch Alarms to monitor log events and send alerts for security group changes.

Answer

To audit all API transactions and receive real-time notifications for security group changes, the company should configure AWS CloudTrail to log API activity and use Amazon CloudWatch Alarms to monitor the logs and trigger alerts.
Deploying AWS CloudTrail allows the company to log, continuously monitor, and retain account activity related to actions across their AWS infrastructure. To receive real-time notifications for modifications to security group rules, the company can deliver CloudTrail logs to Amazon CloudWatch Logs and configure Amazon CloudWatch Alarms to trigger alerts based on specific log patterns.

Step-by-Step Solution

1
Identify the service responsible for auditing and logging AWS API actions.
AWS CloudTrail is identified as the service that records API calls, user activity, and resource changes across the AWS infrastructure.
Tracking user activity and API transaction history is a core capability of AWS CloudTrail.
2
Determine how to monitor logs and trigger notifications for specific events like security group modifications.
Amazon CloudWatch Logs can receive CloudTrail logs, and CloudWatch Alarms can trigger alerts (such as via Amazon SNS) based on metric filters for security group modification events.
Amazon CloudWatch is designed for real-time monitoring and alerting based on log patterns and resource metrics.

Key Concept

AWS CloudTrail is used for auditing and tracking API activity, while Amazon CloudWatch is used for monitoring resource performance, logs, and setting up alarms.
Question 219Question →

An online travel agency wants to improve its security posture on AWS. The company needs to implement a solution that continuously monitors its AWS accounts for malicious activity or unauthorized access, and it also needs to automate security assessments of its Amazon EC2 instances to identify software vulnerabilities. Which two AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services because Amazon GuardDuty provides intelligent threat detection through continuous log analysis, while Amazon Inspector automates vulnerability scanning for host systems and software dependencies.
Amazon GuardDuty and Amazon Inspector are correct. Amazon GuardDuty continuously monitors AWS accounts and workloads for threats and malicious activity using machine learning. Amazon Inspector automatically assesses Amazon EC2 instances for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Identify the requirement for continuous threat detection and unauthorized behavior monitoring.
Amazon GuardDuty is selected as it uses machine learning and threat intelligence to analyze logs and detect malicious activity.
GuardDuty is the primary AWS service for active threat detection across accounts.
2
Identify the requirement for automated security assessments and software vulnerability scanning of Amazon EC2 instances.
Amazon Inspector is selected as it scans workloads (such as EC2 instances) for software packages vulnerabilities and network reachability issues.
Inspector is the primary AWS service for host-level vulnerability scanning.

Key Concept

AWS Threat Detection and Vulnerability Management Services
Question 220Question →

A genomic research institute stores patient DNA sequencing data in Amazon S3 and runs analysis workloads on Amazon EC2. The institute's compliance guidelines state that:
1. The cryptographic keys used for encrypting the data at rest must be managed on dedicated, single-tenant hardware security modules (HSMs) where the customer has sole control over cryptographic web users and key policies.
2. All data in transit between the EC2 instances and the S3 buckets must be encrypted using Transport Layer Security (TLS).

Which of the following implementation details are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The customer must deploy AWS CloudHSM to manage encryption keys to satisfy the dedicated, single-tenant hardware module requirement.; The customer is responsible for configuring bucket policies that enforce HTTPS (TLS) connections to secure data in transit to Amazon S3.

Answer

The customer must deploy AWS CloudHSM to manage encryption keys to satisfy the dedicated, single-tenant hardware module requirement, and the customer is responsible for configuring S3 bucket policies that enforce HTTPS (TLS) connections to secure data in transit.
The correct implementation requires AWS CloudHSM because it is a dedicated, single-tenant HSM service that gives the customer exclusive cryptographic control over keys and users. Additionally, under the Shared Responsibility Model, configuring bucket policies to enforce TLS for data in transit is a customer-side responsibility.

Step-by-Step Solution

1
Analyze the at-rest encryption requirements for single-tenant, dedicated HSM hardware.
Determine that AWS Key Management Service (AWS KMS) is a shared, multi-tenant service and does not meet this requirement, whereas AWS CloudHSM provides dedicated single-tenant HSM instances.
This isolates the correct key management service required for compliance.
2
Analyze the in-transit encryption requirement under the Shared Responsibility Model.
Recognize that while AWS provides the network infrastructure and endpoints, the customer must configure their applications and S3 bucket policies to require HTTPS/TLS.
This establishes correct ownership of configurations for data in transit.

Key Concept

Understanding the difference between multi-tenant AWS KMS and single-tenant AWS CloudHSM, and mapping the customer's responsibility for configuring encryption in transit under the AWS Shared Responsibility Model.
PreviousPage 11 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 11 | Examkin