Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 221Question →

A security analyst needs to determine which IAM user made a specific API call to delete an Amazon S3 bucket last week. Which AWS service should the analyst use to retrieve this API history?

Show answer & explanation

Answer: AWS CloudTrail

Answer

AWS CloudTrail
AWS CloudTrail is the AWS service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It records API calls and user actions, allowing security teams to pinpoint who made a call, when it occurred, and from which IP address.

Step-by-Step Solution

1
Identify the core requirement of the scenario.
The requirement is to trace user identity and API actions (specifically the deletion of an S3 bucket).
This is an auditing and compliance task that requires access to API transaction logs.
2
Evaluate the capabilities of the primary logging and monitoring services in AWS.
AWS CloudTrail is the dedicated service that records API activity, whereas Amazon CloudWatch monitors metrics/operational logs, Amazon GuardDuty performs threat analysis, and OS-level logging is a customer responsibility.
Matching the requirement with the correct service leads to AWS CloudTrail as the correct tool.

Key Concept

API Auditing and User Activity Tracking
Estimated Time:45s
Question 222Question →

A financial technology company must comply with a strict regulatory standard requiring that cryptographic keys used to encrypt transactional data at rest be stored in dedicated, single-tenant hardware security modules (HSMs) where the customer retains exclusive administrative control over the HSM partitions. Which of the following options represents the correct service selection and distribution of responsibility under the AWS Shared Responsibility Model?

Show answer & explanation

Answer: AWS CloudHSM; the customer is responsible for managing the HSM users, keys, and cryptographic partitions, while AWS manages the physical hardware maintenance and network availability of the HSM appliance.

Answer

AWS CloudHSM is the correct service selection because it provides dedicated, single-tenant HSMs with customer administrative control over the partition. Under this model, the customer is responsible for managing HSM users, keys, and cryptographic configurations, while AWS handles the physical hardware maintenance, network provisioning, and appliance availability.
The correct option correctly identifies AWS CloudHSM as the service that provides dedicated, single-tenant HSM appliances under the customer's exclusive control. It also correctly defines the shared responsibility boundaries where the customer manages the logical aspects (HSM users, keys, partitions) and AWS manages the physical and infrastructure aspects (hardware maintenance and network availability of the appliance).

Step-by-Step Solution

1
Analyze the compliance requirement for encryption key storage
The requirement specifies dedicated, single-tenant hardware security modules (HSMs) with exclusive customer control over the cryptographic partitions.
To choose between AWS Key Management Service (KMS) and AWS CloudHSM.
2
Evaluate AWS KMS against the requirement
AWS KMS is a managed, multi-tenant service. Even with customer managed keys, the underlying HSMs are shared across multiple tenants. Thus, KMS does not meet the dedicated, single-tenant requirement.
To eliminate KMS-based options.
3
Evaluate AWS CloudHSM against the requirement
AWS CloudHSM provides dedicated, single-tenant HSM instances within the customer's VPC, meeting the compliance requirement.
To confirm AWS CloudHSM as the correct service selection.
4
Determine the distribution of responsibility for AWS CloudHSM
AWS manages physical security, hardware maintenance, network connectivity, and the appliance OS/firmware. The customer manages HSM users, key generation, and partition administration.
To select the correct option that accurately represents the Shared Responsibility Model for AWS CloudHSM.

Key Concept

AWS CloudHSM vs AWS KMS and the Shared Responsibility Model for cryptographic key storage
Question 223Question →

A renewable energy company operates a fleet of Amazon EC2 instances to monitor wind turbine telemetry and stores its deployment packages in Amazon Elastic Container Registry (Amazon ECR). The company needs to implement a solution that continuously scans its container images and virtual machines for software vulnerabilities, while also monitoring its AWS accounts for potential unauthorized behavior and DNS data exfiltration attempts.

Which of the following AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
The correct services are Amazon Inspector and Amazon GuardDuty. Amazon Inspector is designed for vulnerability management, scanning EC2 instances and container images for software vulnerabilities. Amazon GuardDuty is an intelligent threat detection service that monitors logs to identify malicious activity such as DNS data exfiltration.

Step-by-Step Solution

1
Analyze the requirement for scanning EC2 virtual machines and ECR container images for software vulnerabilities.
Identify Amazon Inspector as the service that automates software vulnerability management for these resources.
Amazon Inspector specifically performs package and software vulnerability scanning on host instances and registry containers.
2
Analyze the requirement for continuous threat detection and monitoring for unauthorized behavior and DNS exfiltration.
Identify Amazon GuardDuty as the service providing intelligent threat detection.
Amazon GuardDuty analyzes VPC Flow Logs, DNS logs, and other sources to detect malicious operations and exfiltration attempts.
3
Evaluate the remaining options to ensure they do not meet the primary goals.
Eliminate Amazon Macie, AWS CloudTrail, and Amazon CloudWatch as they do not scan hosts for software vulnerabilities or perform active threat detection.
These services focus on sensitive data discovery in S3, API call logging, and performance monitoring respectively.

Key Concept

Differentiating vulnerability management (Amazon Inspector) from threat detection (Amazon GuardDuty) and other AWS security and logging services.
Question 224Question →

An organization needs to grant a new database administrator the necessary permissions to manage Amazon RDS resources on a daily basis. Which of the following actions aligns with the AWS-recommended best practice for securing this access?

Show answer & explanation

Answer: Create an individual IAM user with the minimum required permissions to manage Amazon RDS resources.

Answer

Create an individual IAM user with the minimum required permissions to manage Amazon RDS resources.
The correct action is to create an individual IAM user with the minimum required permissions. This aligns with the principle of least privilege by ensuring the database administrator only has access to Amazon RDS, and ensures accountability by using a unique identity rather than sharing credentials.

Step-by-Step Solution

1
Identify the entity requiring access.
A human database administrator requires daily access to the AWS Management Console.
Understanding the type of identity helps determine the appropriate access mechanism.
2
Apply the principle of least privilege and root account safety best practices.
Create an individual IAM user and assign only the permissions needed to manage RDS, while avoiding the use or sharing of the root account.
Ensures administrative accountability and limits access to only the necessary services.

Key Concept

AWS IAM Best Practices for User Access Control
Estimated Time:45s
Question 225Question →

A financial services company uses Amazon Simple Storage Service (Amazon S3) to store sensitive customer transaction records. Under the AWS Shared Responsibility Model, which of the following tasks is the customer responsible for performing?

Show answer & explanation

Answer: Configuring access controls, such as bucket policies and Identity and Access Management (IAM) policies, to restrict access to the stored transaction records

Answer

Configuring access controls, such as bucket policies and Identity and Access Management (IAM) policies, to restrict access to the stored transaction records
The task of configuring access controls, such as bucket policies and Identity and Access Management (IAM) policies, represents security 'in' the cloud. Because the customer owns the data stored in the S3 bucket, they are solely responsible for determining who can access that data and configuring the permissions accordingly.

Step-by-Step Solution

1
Identify the AWS service type and its place in the Shared Responsibility Model.
Amazon S3 is a managed service (PaaS/storage service) where AWS manages the underlying infrastructure, operating systems, and physical security.
Understanding the service type determines where the boundary between customer and AWS responsibility lies.
2
Distinguish between security 'of' the cloud and security 'in' the cloud.
Security 'of' the cloud includes hardware, virtualization, and physical facilities, which AWS manages. Security 'in' the cloud includes customer data, access management, and resource configuration, which the customer manages.
This distinction allows mapping of operational tasks to the correct owner.
3
Evaluate the choices based on the determined boundaries.
Upgrading host OS, physical security, and obtaining infrastructure compliance certifications belong to AWS. Configuring bucket policies and IAM permissions is a customer configuration task to protect their own data.
Applying the model boundaries helps isolate the correct customer responsibility.

Key Concept

AWS Shared Responsibility Model for Managed Services (Amazon S3)
Question 226Question →

An AWS cloud practitioner is configuring network security within a Virtual Private Cloud (VPC). To ensure proper network isolation, they need to identify the operational differences between Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the behavior of these security controls? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security groups are stateful, meaning that return traffic is automatically allowed regardless of outbound rules.; Network Access Control Lists (Network ACLs) are stateless, meaning that return traffic must be explicitly allowed by rules in both directions.

Answer

Security groups are stateful, meaning return traffic is automatically allowed; and Network Access Control Lists (Network ACLs) are stateless, meaning return traffic must be explicitly allowed in both directions.
The correct options are the statements indicating that Security Groups are stateful and Network Access Control Lists (Network ACLs) are stateless. In AWS, Security Groups automatically allow return traffic for any established connection, while Network ACLs require explicit inbound and outbound rules to permit traffic in both directions.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups.
Confirm that Security Groups automatically track connection state and allow return traffic without needing explicit outbound rules.
This is a fundamental concept of Security Groups operating as an instance-level firewall.
2
Analyze the stateless behavior of Network ACLs.
Confirm that Network ACLs do not track connection state, meaning inbound and outbound rules must be configured separately to allow round-trip communication.
This is a fundamental concept of Network ACLs operating as a subnet-level firewall.
3
Evaluate the remaining options for layer of operation and responsibility mappings.
Identify that Security Groups operate at the instance level (not subnet level), Network ACLs operate at the subnet level (not instance level), and physical security is the responsibility of AWS (not the customer).
This helps rule out incorrect options based on common AWS CCP security misconceptions.

Key Concept

The operational differences between stateful Security Groups at the instance level and stateless Network ACLs at the subnet level.
Estimated Time:45s
Question 227Question →

A developer deploys a web application on an Amazon EC2 instance and updates its security group to permit inbound traffic on port 80. Although no outbound rules are modified, the instance can successfully return response traffic to the clients. Which characteristic of security groups explains why this outbound traffic is allowed?

Show answer & explanation

Answer: Security groups are stateful, meaning allowed inbound traffic is automatically permitted to flow outbound.

Answer

Security groups are stateful, meaning allowed inbound traffic is automatically permitted to flow outbound.
Security groups are stateful, which means that any rule permitting inbound traffic automatically permits the corresponding outbound response traffic, regardless of the outbound rules configured.

Step-by-Step Solution

1
Analyze the resource and rules configuration.
The application runs on an Amazon EC2 instance with an inbound security group rule allowing port 80 traffic.
This establishes that inbound traffic is authorized.
2
Determine the stateful nature of the security firewall.
Since security groups operate at the instance level and are stateful, allowing inbound traffic automatically permits the corresponding outbound response traffic.
Stateful firewalls track the connection state and allow return traffic without requiring matching outbound rules.

Key Concept

Security groups are stateful firewalls that control inbound and outbound traffic at the Amazon EC2 instance level, automatically allowing return traffic.
Question 228Question →

A media company is looking for a way to continuously monitor its AWS accounts and workloads for malicious activities, such as cryptocurrency mining, unauthorized data access, or compromised credentials. The solution must automatically analyze data from AWS CloudTrail logs, VPC Flow Logs, and DNS query logs to identify threats. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it continuously monitors AWS accounts and workloads for malicious activity by analyzing data from sources like AWS CloudTrail, VPC Flow Logs, and DNS logs.

Step-by-Step Solution

1
Identify the primary goal of the scenario: continuously monitoring AWS workloads for malicious activities, unauthorized access, and compromised credentials.
Threat detection requirement.
Enables selection of security services rather than operational or compliance services.
2
Analyze the data sources specified: AWS CloudTrail logs, VPC Flow Logs, and DNS query logs.
Identify the service that natively ingests and analyzes these three specific log sources.
Differentiates from vulnerability scanners that inspect instances directly.
3
Select the service that performs intelligent threat detection using machine learning and anomaly detection.
Amazon GuardDuty is selected as the correct answer.
It is the only service designed to actively process these logs to find threats.

Key Concept

Intelligent threat detection and security monitoring using Amazon GuardDuty
Question 229Question →

A retail company is migrating its inventory management system to AWS. The system runs on Amazon EC2 instances and requires permission to write to an Amazon DynamoDB table. Additionally, a team of developers requires access to perform administrative tasks. Which of the following actions represent AWS-recommended security practices for managing access in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an IAM role with permissions to access DynamoDB and associate it with the EC2 instances.; Organize the developers into an IAM user group and attach policies directly to the group rather than to individual users.

Answer

The correct practices are configuring an IAM role for the EC2 instances to access the database, and organizing developers into an IAM user group with attached policies.
The correct practices are configuring an IAM role with the appropriate permissions and associating it with the EC2 instances, which allows the application to securely access DynamoDB using temporary credentials. Additionally, organizing developers into an IAM user group and attaching policies directly to the group ensures consistency and simplifies administration, aligning with IAM best practices.

Step-by-Step Solution

1
Analyze the requirement for the application on EC2 to access DynamoDB.
Determine that assigning an IAM role to the EC2 instances is the AWS-recommended method, avoiding hardcoded credentials.
This uses temporary security credentials, aligning with the principle of least privilege and credential rotation.
2
Analyze the requirement for developers to perform administrative tasks.
Determine that placing developers into an IAM user group and attaching policies to the group is the recommended practice.
This simplifies permission management and prevents configuration drift among individual user accounts.
3
Evaluate and eliminate incorrect practices.
Reject options recommending root user sharing, long-term embedded credentials, or delegating credential configuration to AWS Support.
These violate root user safety, credential management best practices, and the Shared Responsibility Model boundaries respectively.

Key Concept

AWS IAM best practices including IAM roles for EC2, IAM groups for user management, and the Shared Responsibility Model.
Question 230Question →

A gaming studio is deploying a multiplayer matchmaking backend on AWS using Amazon DynamoDB to store player session states. Under the AWS Shared Responsibility Model, which two security-related tasks are the sole responsibility of the gaming studio?

Select all that apply

Show answer & explanation

Answer: Implementing client-side encryption for sensitive player data before sending it to the database; Configuring Identity and Access Management (IAM) policies to restrict access to the database tables

Answer

Implementing client-side encryption for sensitive player data before sending it to the database and configuring Identity and Access Management (IAM) policies to restrict access to the database tables are customer responsibilities.
In the Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed service like Amazon DynamoDB, this includes managing user access via Identity and Access Management (IAM) policies and encrypting sensitive player data on the client side before writing it to the database. AWS maintains the security 'of' the cloud, which includes the physical hardware, operating systems, and database engine software.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon DynamoDB is identified as a fully managed database service (NoSQL).
Managed services shift operational tasks (like patching and physical security) to AWS, meaning the customer is responsible primarily for data configuration and access control.
2
Evaluate the customer's responsibilities for a managed database service.
The customer controls identity and access management (IAM) and how they secure the data itself (client-side encryption).
In the Shared Responsibility Model, data security 'in the cloud' (including encryption and access control) remains the customer's responsibility, regardless of the service type.
3
Identify AWS's responsibilities for DynamoDB.
AWS is responsible for managing the physical data centers, host operating systems, and the DynamoDB database engine software.
AWS manages the infrastructure layer, hardware, and system software for managed services, making guest OS patching, database software updates, and physical audits part of the AWS responsibility ('of the cloud').

Key Concept

Shared Responsibility Model for Managed Services
Question 231Question →

An enterprise wants to simplify permission management for its finance department. Currently, the IT team manually attaches permissions to each new financial analyst's AWS account, which has led to inconsistent access rights and administrative overhead. Which of the following is the AWS-recommended method to resolve this issue?

Show answer & explanation

Answer: Create an IAM group for the finance department, attach the necessary permissions policy to the group, and add the financial analysts to this group.

Answer

Create an IAM group for the finance department, attach the necessary permissions policy to the group, and add the financial analysts to this group.
Creating an IAM group and attaching the required policy to it allows the administrator to manage permissions for all group members at once. New users automatically inherit the group's permissions when added, eliminating administrative overhead and ensuring consistency.

Step-by-Step Solution

1
Analyze the administrative challenge of managing permissions individually for multiple users with identical job functions.
Identify that individual assignment is prone to errors, leads to inconsistent access rights, and increases administrative overhead.
Permissions should be managed centrally and consistently for users sharing the same functional role.
2
Evaluate the AWS IAM constructs that allow collective permission management.
Determine that IAM groups are designed to associate policies with collections of users, while IAM roles are for temporary access and the root user must not be shared.
Using the appropriate IAM construct ensures secure, scalable, and compliant access control.

Key Concept

Managing user permissions collectively using IAM Groups
Question 232Question →

A company is setting up a new application on AWS and wants to establish baseline security logging and operational monitoring. They need to track user activity and API calls for auditing purposes, as well as collect and track performance metrics for their Amazon EC2 instances. Which of the following AWS services should the company use to meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon CloudWatch

Answer

AWS CloudTrail and Amazon CloudWatch are the services needed to track API activity and monitor EC2 performance metrics respectively.
AWS CloudTrail and Amazon CloudWatch are the appropriate services because CloudTrail records and audits all AWS API calls and user interactions, while CloudWatch tracks operational metrics such as CPU utilization and network traffic for resources like EC2 instances.

Step-by-Step Solution

1
Identify the service needed for tracking user activity and API operations.
AWS CloudTrail logs API calls, providing details on who made a call, when, and from what IP address.
This satisfies the requirement for security auditing and tracking user actions.
2
Identify the service needed for collecting and tracking performance metrics.
Amazon CloudWatch collects metric data such as CPU utilization, disk read/writes, and network traffic.
This satisfies the requirement for operational monitoring of Amazon EC2 instances.

Key Concept

Identifying the distinct use cases of AWS auditing and monitoring tools, specifically AWS CloudTrail for API logging and Amazon CloudWatch for resource metrics.
Question 233Question →

An organization is securing a proprietary database tier hosted on Amazon EC2 instances within a private subnet of a Virtual Private Cloud (VPC). The database must receive SQL traffic on TCP port 33063306 from the application servers located in a public subnet, while ensuring strict network isolation at both the subnet and instance levels. Which two configuration steps are required to establish this network security architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the database security group with an inbound rule allowing TCP port 33063306 from the application security group, and rely on its stateful nature to automatically permit outbound response traffic.; Configure the private subnet Network ACL with an inbound rule allowing TCP port 33063306 from the public subnet CIDR, and an outbound rule allowing TCP ports 10241024-6553565535 to the public subnet CIDR.

Answer

Configuring the database security group with an inbound rule allowing TCP port 33063306 from the application security group (leveraging its stateful tracking), and configuring the private subnet Network ACL with an inbound rule allowing TCP port 33063306 and an outbound rule allowing TCP ephemeral ports 10241024-6553565535.
Security groups operate at the instance level and are stateful. When you add an inbound rule allowing TCP port 33063306 from the application security group, the return traffic is automatically permitted outbound, regardless of outbound rules. Network ACLs operate at the subnet level and are stateless. This means that both inbound traffic (port 33063306) and outbound response traffic (ephemeral ports 10241024-6553565535) must be explicitly allowed.

Step-by-Step Solution

1
Determine instance-level security requirements using Security Groups.
A Security Group rule must allow inbound database traffic on port 33063306 from the source application tier. Because Security Groups are stateful, no outbound rule is needed for return traffic.
Security Groups provide stateful firewall protection at the resource/instance level.
2
Determine subnet-level security requirements using Network ACLs.
The Network ACL must allow inbound TCP traffic on port 33063306 from the public subnet. Additionally, an outbound rule must allow TCP traffic to ephemeral ports 10241024-6553565535 back to the public subnet.
Network ACLs are stateless firewalls at the subnet boundary, meaning outbound return path rules are required.

Key Concept

The key concept is the distinction between stateful Security Groups (operating at the instance level) and stateless Network Access Control Lists (operating at the subnet level) in AWS VPC security.
Question 234Question →

A security team needs to monitor an AWS environment for active threats and unauthorized behavior. They require a solution that automatically analyzes AWS CloudTrail events, VPC Flow Logs, and DNS logs to identify activities like an Amazon EC2 instance communicating with a known malicious command-and-control server. The solution must be agentless and operate at the account level. Which AWS service should the security team use to meet these requirements?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides intelligent threat detection. It analyzes data from AWS CloudTrail, VPC Flow Logs, and DNS logs without requiring agents, allowing it to identify suspicious activities like communication with known malicious command-and-control servers.

Step-by-Step Solution

1
Analyze the requirements of the scenario.
The scenario requires identifying active threats (like command-and-control traffic), analyzing logs (VPC Flow Logs, CloudTrail, DNS logs), and operating agentlessly at the AWS account level.
Understanding these parameters helps narrow down the correct security service that operates without host-based agents.
2
Differentiate between the candidate services.
Amazon GuardDuty is a threat detection service that matches the log analysis and agentless requirements. Amazon Inspector scans for vulnerabilities rather than active threats. Amazon CloudWatch collects logs and metrics but lacks built-in threat intelligence.
Distinguishing services based on their primary functions (vulnerability scanning vs. threat detection vs. log collection) points to the correct solution.
3
Select the correct service.
Amazon GuardDuty is selected as the correct answer.
It fulfills all criteria, including log source analysis and agentless detection.

Key Concept

AWS Threat Detection and Logging
Question 235Question →

A company wants to set up access for a new employee who needs to manage Amazon EC2 instances on a daily basis. The manager wants to follow AWS security best practices. Which of the following actions should the administrator take to grant the employee this access?

Show answer & explanation

Answer: Create an IAM user for the employee and attach an IAM policy with EC2 management permissions.

Answer

Create an IAM user for the employee and attach an IAM policy with EC2 management permissions.
Creating a dedicated IAM user for the employee and attaching an IAM policy with the necessary EC2 management permissions is the standard AWS best practice. This ensures accountability, follows the principle of least privilege, and aligns with secure identity management recommendations.

Step-by-Step Solution

1
Identify the type of identity required for a new employee's daily operations.
An IAM user is appropriate for an individual human needing long-term credentials for AWS console or CLI access.
AWS best practices dictate that individuals should have unique IAM users rather than sharing root credentials or using temporary roles as permanent logins.
2
Determine how to grant the minimum required permissions to the IAM user.
Attach an IAM policy specifying permissions to manage EC2 instances.
Following the principle of least privilege ensures the employee only has access to the resources required for their job role.

Key Concept

Identity and Access Management (IAM) Identity Types and Best Practices
Estimated Time:45s
Question 236Question →

A company is hosting a secure web application on Amazon EC2 instances within a VPC. The security team wants to allow incoming traffic on port 443443 (HTTPS) while blocking a specific range of known malicious IP addresses at the boundary before the traffic reaches any EC2 instance. They also need to ensure that the EC2 instances can send outbound response traffic back to clients. Which of the following network security configurations meets these requirements?

Show answer & explanation

Answer: Apply a stateful Security Group to the EC2 instances to allow inbound HTTPS traffic, and configure a stateless Network ACL at the subnet level with a rule that denies the malicious IP range and a rule that allows inbound HTTPS traffic along with outbound ephemeral port traffic.

Answer

Apply a stateful Security Group to the EC2 instances to allow inbound HTTPS traffic, and configure a stateless Network ACL at the subnet level with a rule that denies the malicious IP range and a rule that allows inbound HTTPS traffic along with outbound ephemeral port traffic.
The correct configuration combines stateful Security Groups at the instance level with stateless Network ACLs at the subnet level. Because Security Groups are stateful, allowing inbound HTTPS traffic on port 443443 automatically permits the return outbound traffic. Because Network ACLs are stateless, they require both inbound and outbound rules to allow the connection to succeed, which includes allowing outbound ephemeral port traffic (1024−655351024-65535). Additionally, Network ACLs support explicit deny rules, which makes them the correct choice for blocking a specific malicious IP range at the subnet boundary.

Step-by-Step Solution

1
Analyze the requirement to block a specific malicious IP range at the subnet boundary.
Network Access Control Lists (NACLs) operate at the subnet boundary and support explicit deny rules, whereas Security Groups operate at the instance level and only support allow rules.
This establishes that the IP block must be implemented at the Network ACL level.
2
Evaluate the stateful behavior of Security Groups.
Security Groups are stateful. Allowing inbound traffic on port 443443 automatically allows the outbound response traffic.
This simplifies instance-level configurations since return traffic does not require an explicit outbound rule.
3
Evaluate the stateless behavior of Network ACLs.
Network ACLs are stateless. Inbound traffic allowed on port 443443 requires a corresponding outbound rule to allow ephemeral port traffic (1024−655351024-65535) back to the client.
Stateless firewalls do not track connection states, so both ingress and egress paths must be explicitly configured.
4
Verify shared responsibility boundaries.
Configuring firewalls (Security Groups and Network ACLs) in a customer's VPC is the customer's responsibility under the Shared Responsibility Model.
AWS manages physical and infrastructure security, while the customer secures their resources in the cloud.

Key Concept

Stateful Security Groups vs Stateless Network ACLs
Question 237Question →

An enterprise is deploying an application on Amazon EC2 instances that needs to retrieve files from an Amazon S3 bucket. Which of the following configurations represent AWS Identity and Access Management (IAM) best practices for this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM role with the necessary S3 access permissions directly to the Amazon EC2 instances.; Configure a least-privilege IAM policy and attach it to the IAM role.

Answer

Attach an IAM role with the necessary S3 access permissions directly to the Amazon EC2 instances, and configure a least-privilege IAM policy and attach it to the IAM role.
The correct configuration is to associate an IAM role with the Amazon EC2 instance and attach a least-privilege policy to that role. This follows AWS best practices by granting only the necessary permissions and using temporary credentials for programmatic access.

Step-by-Step Solution

1
Determine the authentication mechanism for applications running on AWS compute resources.
Identified that IAM roles should be used to assign permissions to AWS resources like EC2 instances.
This eliminates the need to manage and secure long-term credentials in code.
2
Define the specific resource access requirements.
The application only needs to read files from a specific Amazon S3 bucket.
Enables the design of a highly restrictive permission policy.
3
Apply the IAM policy to the role using the principle of least privilege.
Created a customer-managed policy with read-only access to the S3 bucket and attached it to the EC2 role.
Ensures that the application has only the access necessary to perform its job.

Key Concept

AWS Identity and Access Management (IAM) roles and policy configurations for applications on Amazon EC2 instances
Estimated Time:1m 0s
Question 238Question →

A logistics company coordinates delivery routes using an application hosted on Amazon EC2 instances. The security team needs to implement a solution that continuously monitors the environment for active threats, such as instances communicating with known malicious command-and-control servers or performing unauthorized API actions. This monitoring must be performed without installing software agents or affecting application performance. Which AWS service should be used to meet these requirements?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is correct because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It analyzes foundation data sources such as VPC Flow Logs, DNS logs, and AWS CloudTrail management events without requiring agent installation, ensuring zero impact on application performance.

Step-by-Step Solution

1
Identify the primary requirement: continuous monitoring for active threats (such as communication with command-and-control servers) without installing agents.
Determine that the required capability is intelligent threat detection rather than host vulnerability scanning.
Vulnerability scanning (like Amazon Inspector) checks for security weaknesses, while threat detection identifies active malicious activity.
2
Analyze the constraint: no software agents must be installed and there must be no performance impact on workloads.
Identify AWS services that analyze logs at the account and network infrastructure level rather than running on the OS.
Amazon GuardDuty operates completely out-of-band by analyzing logs like VPC Flow Logs and DNS logs directly from the AWS infrastructure.
3
Evaluate the choices to find the service that matches intelligent, agentless threat detection.
Select Amazon GuardDuty as the correct service.
Amazon GuardDuty uses threat intelligence and machine learning to detect anomalies and malicious behavior without agents.

Key Concept

Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior in your AWS accounts and workloads by analyzing data sources like CloudTrail, VPC Flow Logs, and DNS logs.
Estimated Time:1m 30s
Question 239Question →

A media streaming company uses Amazon CloudFront to distribute video content to users worldwide. Under the AWS Shared Responsibility Model, which two of the following security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring Geo Restriction to prevent access from specific geographic locations; Restricting access to content using signed URLs or signed cookies

Answer

Configuring Geo Restriction to prevent access from specific geographic locations, and restricting access to content using signed URLs or signed cookies are the responsibilities of the customer.
Configuring Geo Restriction and restricting access using signed URLs or signed cookies are both customer tasks. Under the Shared Responsibility Model, the customer is responsible for configuring access controls and protecting their data/content (Security in the Cloud).

Step-by-Step Solution

1
Analyze the service model type for Amazon CloudFront.
Amazon CloudFront is a managed global content delivery network (CDN) service.
Managed services shift physical and server-level infrastructure management to AWS, while the customer retains control over configuration, data access, and content protection.
2
Distinguish between customer responsibilities (security 'in' the cloud) and AWS responsibilities (security 'of' the cloud) for CloudFront.
AWS manages physical security of edge locations, hardware maintenance, and edge server patching. The customer manages content access settings (Geo Restriction, signed URLs/cookies) and viewer encryption certificates.
This allows identifying the tasks that the customer must perform to secure their content delivery.

Key Concept

AWS Shared Responsibility Model for managed services, specifically distinguishing customer-side configuration responsibilities from AWS-side infrastructure management.
Question 240Question →

A startup is deploying a microservices application using AWS Lambda to process user registration data. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of AWS?

Show answer & explanation

Answer: Patching the underlying operating system and runtime environment of the Lambda function

Answer

Patching the underlying operating system and runtime environment of the Lambda function is the responsibility of AWS.
Under the AWS Shared Responsibility Model, for serverless and managed services like AWS Lambda, AWS manages the guest operating system, runtime environment, physical infrastructure, and virtualization layer. Therefore, patching the underlying OS and runtime environment is a responsibility of AWS.

Step-by-Step Solution

1
Analyze the service type mentioned in the scenario.
AWS Lambda is a serverless, fully managed compute service.
Different AWS services (IaaS vs. PaaS/Serverless) have different boundaries of responsibility under the Shared Responsibility Model.
2
Determine the division of responsibilities for serverless compute.
AWS manages the physical infrastructure, virtualization layer, operating system, and execution runtime. The customer is responsible for configuring access policies, writing secure application code, and protecting their data.
Since the customer does not have access to or control over the underlying OS or runtime in Lambda, AWS must maintain and patch them.

Key Concept

Shared Responsibility Model for Serverless Compute (AWS Lambda)
Estimated Time:45s
PreviousPage 12 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 12 | Examkin