Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 241Question →

An automotive manufacturer is auditing its connected-vehicle telemetry platform hosted on AWS to verify compliance with ISO/IEC 27001 standards. Under the AWS Shared Responsibility Model, which compliance-related activity is the sole responsibility of the customer?

Show answer & explanation

Answer: Managing access permissions and user roles within the AWS Identity and Access Management (IAM) service

Answer

Managing access permissions and user roles within the AWS Identity and Access Management (IAM) service
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. This includes configuring identity and access management (IAM) to control access to AWS resources. Managing access permissions and user roles is a customer task, while AWS is responsible for physical security of data centers, hypervisor patching, and hardware disposal.

Step-by-Step Solution

1
Analyze the compliance requirements and identify the operational boundaries defined by the AWS Shared Responsibility Model.
Establish that security 'of' the cloud (infrastructure, hardware, virtualization) belongs to AWS, while security 'in' the cloud (customer data, operating systems, access management) belongs to the customer.
This sets the foundation for distinguishing between AWS and customer responsibilities under compliance frameworks.
2
Evaluate each option against the responsibility boundaries.
Determine that physical security, hypervisor patching, and hardware disposal are security 'of' the cloud (AWS responsibilities). Managing access permissions and user roles via IAM is security 'in' the cloud (customer responsibility).
This allows the selection of the correct option that is the customer's sole responsibility.

Key Concept

AWS Shared Responsibility Model for Compliance
Question 242Question →

A food delivery startup wants to continuously monitor its AWS accounts and workloads for malicious activity and unauthorized behavior, such as potential data exfiltration or unusual API calls. Which AWS service should the startup use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it is an intelligent, managed threat detection service that continuously monitors AWS accounts, workloads, and S3 data for malicious activities, unauthorized access, and anomalous behavior.

Step-by-Step Solution

1
Identify the primary requirement in the scenario, which is the need for continuous threat detection and monitoring of AWS accounts for malicious activity.
The solution must actively monitor and analyze account-level behavior for indicators of compromise or security anomalies.
This establishes that the correct service must have active threat detection capabilities rather than static vulnerability scanning or passive logging.
2
Compare the capabilities of the options to find the service that matches this threat monitoring requirement.
Amazon GuardDuty is identified as the service built to ingest data sources like CloudTrail events and VPC flow logs to identify suspicious activity.
Amazon GuardDuty uses machine learning and threat intelligence feeds to discover activities such as credential exfiltration and unauthorized API calls, which directly satisfies the startup's requirements.

Key Concept

Continuous threat detection with Amazon GuardDuty
Estimated Time:45s
Question 243Question →

A logistics provider wants to identify potential security threats and malicious activity across their AWS accounts by analyzing VPC Flow Logs, DNS logs, and CloudTrail events. Which AWS service should they use for this continuous threat monitoring?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts, workloads, and data. It uses machine learning and threat intelligence to analyze data sources such as AWS CloudTrail event logs, VPC Flow Logs, and DNS logs.

Step-by-Step Solution

1
Identify the primary requirement in the scenario, which is continuous monitoring of AWS accounts for security threats and malicious activity by analyzing VPC Flow Logs, DNS logs, and CloudTrail events.
The requirement points to an intelligent threat detection service.
Understanding the core need helps narrow down the choices to security services designed for continuous log analysis and threat monitoring.
2
Evaluate the choices based on their core functionality.
AWS CloudTrail logs API activity; Amazon CloudWatch monitors system performance and application logs; Amazon Inspector scans for host vulnerabilities; Amazon GuardDuty performs intelligent threat detection using log analysis.
Differentiating these logging, monitoring, and security scanning services ensures the correct tool is selected for threat monitoring.

Key Concept

Continuous threat monitoring and intelligent log analysis on AWS
Estimated Time:45s
Question 244Question →

A utility company is deploying an IoT smart-grid application on AWS. The application ingests telemetry data from millions of smart meters over the public internet and stores the processed records in an Amazon S3 bucket. The company's compliance policy requires all data to be encrypted both in transit and at rest.

According to the AWS Shared Responsibility Model, which of the following actions are the responsibility of the customer to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring SSL/TLS for data ingestion to protect telemetry data in transit.; Enabling Amazon S3 server-side encryption using customer-managed keys in AWS KMS.

Answer

Configuring SSL/TLS for data ingestion to protect telemetry data in transit, and enabling Amazon S3 server-side encryption using customer-managed keys in AWS KMS.
The customer is responsible for configuring encryption of data in transit (such as enforcing SSL/TLS protocols for data ingestion) and implementing encryption at rest for stored data (such as enabling Amazon S3 server-side encryption using KMS keys). Under the Shared Responsibility Model, AWS manages the security 'of' the cloud, including physical security of data centers, host infrastructure, and underlying managed encryption hardware, while the customer manages security 'in' the cloud, including data configuration and access policies.

Step-by-Step Solution

1
Analyze the Shared Responsibility Model for encryption in transit.
Identify that configuring secure ingestion protocols (like SSL/TLS) over the public internet to AWS endpoints is the customer's responsibility to protect data in transit.
AWS secures the ingestion endpoints, but configuring the client devices and setting up SSL/TLS connections to those endpoints is managed by the customer.
2
Analyze the Shared Responsibility Model for encryption at rest.
Identify that enabling encryption on storage services like Amazon S3 and configuring the KMS keys used for that encryption is the customer's responsibility.
AWS provides the encryption features and tools, but the customer must choose to enable them and define the key policies.
3
Evaluate the infrastructure-related options to eliminate AWS-managed tasks.
Exclude physical HSM upkeep, dedicated HSM deployment for KMS, and intra-AZ network infrastructure management, as these are managed by AWS.
AWS is responsible for the physical security, hardware maintenance, and global networking infrastructure.

Key Concept

Under the AWS Shared Responsibility Model, the customer is responsible for data security configurations, which include configuring SSL/TLS protocols for data in transit and enabling server-side encryption at rest (such as in Amazon S3) using KMS keys. AWS is responsible for the security of the underlying infrastructure, including physical networking, hosting hosts, and the physical HSMs utilized by managed services.
Question 245Question →

A logistics and package delivery company runs its route optimization software on a fleet of Amazon EC2 instances. The cybersecurity team wants to implement a security solution to achieve two goals: automatically scan the EC2 instances for known software vulnerabilities, and continuously monitor the AWS account for threat patterns such as credential theft or anomalous API activity. Which AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
Amazon Inspector is the dedicated service for scanning EC2 instances for software vulnerabilities and network reachability issues. Amazon GuardDuty is the correct service for active threat detection, leveraging machine learning and threat intelligence to identify anomalous account behavior, credential compromises, and malicious activity.

Step-by-Step Solution

1
Identify the requirement for software vulnerability scanning on the virtual hosts.
Amazon Inspector is identified as the AWS service designed for automated package and software vulnerability assessment of Amazon EC2 instances.
Inspector runs automated assessments to find vulnerabilities and unintended network exposure on virtual machine instances.
2
Identify the requirement for continuous account-level threat detection.
Amazon GuardDuty is identified as the intelligent threat detection service that monitors logs (like CloudTrail and VPC Flow Logs) to identify malicious actions, compromised credentials, or anomalous behavior.
GuardDuty uses machine learning and threat intelligence to analyze account activity and identify threats in real time.

Key Concept

Vulnerability scanning versus threat detection in AWS security services
Estimated Time:1m 30s
Question 246Question →

An e-commerce startup is designing a secure network environment within a Virtual Private Cloud (VPC). To protect their resources, they plan to use both Security Groups and Network Access Control Lists (Network ACLs). Which two of the following statements correctly describe the characteristics or behavior of these network security features?

Select all that apply

Show answer & explanation

Answer: Security Groups are stateful, meaning allowed inbound traffic automatically permits return outbound traffic.; Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed by rules.

Answer

Security Groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit rules in both directions).
Security Groups are stateful firewalls that automatically allow return traffic for established connections. Conversely, Network ACLs are stateless firewalls operating at the subnet boundary, requiring explicit configuration for both inbound and outbound traffic paths.

Step-by-Step Solution

1
Analyze the state characteristics of both network security layers.
Identify that Security Groups automatically track connection state (stateful), while Network ACLs inspect every packet individually and do not track state (stateless).
This establishes the correct behavior of return traffic rules for both tools.
2
Evaluate the operational scope and management boundaries of the remaining choices.
Confirm that Security Groups apply to instances (not subnets), rules must be set by the customer (not AWS), and scanning is done by Amazon Inspector (not Network ACLs).
This eliminates incorrect answers by mapping them to known errors in boundaries, scope, and service functionality.

Key Concept

The primary distinction between Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level) within an AWS VPC.
Question 247Question →

A government contractor is building a secure document storage platform on AWS for a federal agency. To satisfy the agency's security requirements, the contractor must verify that the underlying AWS infrastructure complies with the Federal Risk and Authorization Management Program (FedRAMP) standards. Which action should the contractor take to obtain the official AWS FedRAMP authorization documents?

Show answer & explanation

Answer: Download the FedRAMP authorization letters and reports directly from AWS Artifact.

Answer

Download the FedRAMP authorization letters and reports directly from AWS Artifact.
The correct action is to download the FedRAMP authorization letters and reports directly from AWS Artifact. AWS Artifact is the dedicated, self-service portal in the AWS Management Console that provides customers with free, on-demand access to AWS security and compliance reports, such as Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from various global accreditation bodies including FedRAMP.

Step-by-Step Solution

1
Identify the compliance requirement, which is to obtain official third-party compliance reports and authorizations (FedRAMP) for the AWS infrastructure.
Recognized that these documents are standard AWS compliance artifacts.
Before using any service, the customer must locate where AWS shares its official compliance documentation.
2
Select the specific AWS service designed to deliver self-service compliance reports and agreements to customers.
Identified AWS Artifact as the primary portal for retrieving these compliance reports.
AWS Artifact provides on-demand, free access to security and compliance reports from AWS third-party auditors.

Key Concept

AWS Artifact is the primary portal for retrieving AWS security and compliance reports.
Estimated Time:1m 0s
Question 248Question →

A startup is deploying a new serverless application using AWS Lambda to process user uploads. In accordance with the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the startup?

Show answer & explanation

Answer: Defining the IAM execution roles and resource-based policies that control access to the Lambda functions.

Answer

Defining the IAM execution roles and resource-based policies that control access to the Lambda functions.
Defining IAM execution roles and resource-based policies is a customer responsibility. Under the Shared Responsibility Model, even for fully managed and serverless services like AWS Lambda, the customer retains control over identity and access management (IAM). This ensures that only authorized entities can invoke the functions and that the functions themselves have the minimum necessary privileges to access other AWS services.

Step-by-Step Solution

1
Analyze the service model type for the resource mentioned in the scenario.
AWS Lambda is a serverless (Function-as-a-Service / PaaS) offering where the underlying physical servers, virtualization hypervisors, operating systems, and runtimes are fully managed by AWS.
Determining the service type helps establish the boundary of responsibility between AWS and the customer.
2
Evaluate the customer's security responsibilities for serverless services.
The customer remains responsible for application code, data, and access management (IAM configuration, function execution roles, and resource policies).
This identifies the specific tasks the startup must perform to secure the application.
3
Select the option that represents a customer responsibility under IAM and access control.
Defining the IAM execution roles and resource-based policies falls directly under customer security configuration.
It aligns with the identity and access management requirements of the Shared Responsibility Model.

Key Concept

Under the AWS Shared Responsibility Model, serverless services like AWS Lambda shift infrastructure management responsibilities (like operating system patching and runtime maintenance) to AWS. The customer remains responsible for application code, data classification, and access management (Identity and Access Management, policies, and roles).
Question 249Question →

A mobile gaming studio hosts its backend matchmaking services on a fleet of Amazon EC2 instances. Before releasing a major update, the development team wants to scan these virtual servers for known software vulnerabilities, unintended network accessibility, and packages that do not comply with security best practices. Which AWS service is designed to automatically perform these vulnerability assessments?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
The correct answer is Amazon Inspector. Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It automatically scans Amazon EC2 instances, container images, and AWS Lambda functions for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The studio needs to scan Amazon EC2 instances for software vulnerabilities, unintended network exposure, and security best practice deviations.
This establishes the scope of the tool needed (vulnerability management at the host/software level).
2
Evaluate the AWS security services that match the requirement.
Amazon Inspector is designed specifically for automated vulnerability management and scanning of EC2 instances and container images.
Amazon Inspector analyzes the software package vulnerabilities and network reachability of EC2 instances, making it the correct choice.

Key Concept

Vulnerability management and host-level security assessments in AWS.
Estimated Time:1m 0s
Question 250Question →

A global financial technology (FinTech) company is preparing to launch a payment processing application on AWS. To meet regulatory compliance, the company needs to verify the physical security standards of the AWS data centers and retrieve the latest AWS System and Organization Controls (SOC) 1 report. Which of the following actions should the company take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Retrieve the AWS SOC 1 report directly from the AWS Artifact console.; Rely on AWS to manage the physical security of the data centers under the Shared Responsibility Model.

Answer

Retrieve the AWS SOC 1 report directly from the AWS Artifact console, and rely on AWS to manage the physical security of the data centers under the Shared Responsibility Model.
AWS compliance reports, including SOC reports, are retrieved on-demand from the AWS Artifact portal. Additionally, the Shared Responsibility Model outlines that AWS is solely responsible for physical security of its data centers, so the customer relies on AWS's compliance posture for physical infrastructure.

Step-by-Step Solution

1
Determine the resource to retrieve compliance documentation.
AWS Artifact is the central agreement and compliance portal that allows customers to download SOC reports.
This meets the requirement of obtaining the SOC 1 report.
2
Determine who controls the physical security of the AWS cloud infrastructure.
Under the Shared Responsibility Model, AWS is responsible for 'Security of the Cloud,' which covers physical security.
This clarifies the customer's role regarding data center physical controls.

Key Concept

AWS Artifact is the primary portal for retrieving AWS compliance reports, and physical infrastructure security is managed by AWS under the Shared Responsibility Model.
Question 251Question →

A company is setting up AWS access for a team of developers who need to manage cloud resources through the AWS Management Console and execute command-line scripts locally. The company wants to integrate access with their existing corporate identity provider and ensure that developers do not store long-term credentials on their local workstations. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate access from the existing corporate identity provider.; Configure developers to use short-lived temporary credentials for local command-line access.

Answer

Configure AWS IAM Identity Center to federate access from the corporate identity provider and configure developers to use short-lived temporary credentials for local command-line access.
Configuring identity federation via AWS IAM Identity Center integrates access with the corporate identity provider. Enforcing short-lived temporary credentials for local CLI access prevents the risk of storing long-term credentials on developer workstations.

Step-by-Step Solution

1
Address console access integration by implementing identity federation.
AWS IAM Identity Center is configured to allow developers to log in to the console using their corporate identity provider credentials.
This satisfies the requirement to integrate access with the existing corporate identity provider without creating duplicate IAM users.
2
Address programmatic workstation security by enforcing short-lived temporary credentials.
Developers use short-lived credentials (such as those generated via AWS STS or IAM Identity Center CLI integration) on their local machines.
This satisfies the requirement to avoid storing long-term credentials like permanent IAM access keys on local workstations.

Key Concept

Identity federation and short-lived credentials management in AWS IAM.
Question 252Question →

A startup is deploying a web application on Amazon EC2 instances. The security team needs to continuously scan these EC2 instances for software vulnerabilities and unintended network exposure. Additionally, they need to monitor their AWS accounts for malicious activity and unauthorized behavior.

Which of the following AWS services should the startup use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
Amazon Inspector is correct because it automates vulnerability management by scanning EC2 instances for software vulnerabilities and network exposure. Amazon GuardDuty is correct because it provides intelligent threat detection by continuously monitoring AWS accounts and workloads for malicious activity.

Step-by-Step Solution

1
Identify the requirement for scanning hosts (Amazon EC2 instances) for software vulnerabilities and network exposure.
Amazon Inspector is identified as the service designed to automate host-level vulnerability assessments and network reachability scans.
This matches the AWS service definition for host and container vulnerability scanning.
2
Identify the requirement for continuously monitoring the AWS account for malicious activity and unauthorized access.
Amazon GuardDuty is identified as the service that analyzes logs (such as CloudTrail and VPC Flow Logs) to detect active threats and anomalies.
This matches the AWS service definition for intelligent threat detection.

Key Concept

Identifying the distinct purposes of Amazon Inspector for vulnerability scanning and Amazon GuardDuty for threat detection.
Question 253Question →

A company wants to establish baseline visibility for its new AWS account. The company has two requirements: first, it must record a history of all API calls and user activity for security compliance auditing; second, it must track infrastructure performance metrics (such as CPU utilization) and send alerts when resource limits are exceeded. Which of the following AWS services should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon CloudWatch

Answer

The company should use AWS CloudTrail and Amazon CloudWatch.
AWS CloudTrail tracks and logs all API calls and user changes in the AWS account, which satisfies auditing needs. Amazon CloudWatch gathers performance data and can trigger notifications when metrics go past set thresholds, satisfying the performance monitoring needs.

Step-by-Step Solution

1
Determine which service records and logs AWS API events and user actions.
AWS CloudTrail is identified as the service that logs all account management actions.
This meets the compliance requirement of recording all user API activity.
2
Determine which service collects operational metrics and sends alerts on threshold violations.
Amazon CloudWatch is identified as the monitoring and alerting service.
This satisfies the requirement to track CPU utilization and set up alerts.

Key Concept

Distinguishing between CloudTrail (API history and auditing) and CloudWatch (metrics, performance monitoring, and alerting).
Question 254Question →

A financial services firm runs compliance monitoring agents on Amazon EC2 instances within a dedicated subnet. These agents must establish outbound connections to an external regulatory API on port 443443 to upload audit logs. The security team implements a strict Network Access Control List (Network ACL) for the subnet, adding an outbound rule that permits traffic to the API's IP range on TCP port 443443. No inbound rules are added to the Network ACL. The associated Security Groups are left at their default settings (allowing all outbound traffic and no inbound traffic). During testing, the agents fail to establish a connection with the API.

Which modification is required to allow this communication while maintaining the principle of least privilege?

Show answer & explanation

Answer: Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP ports 10241024-6553565535.

Answer

Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP ports 10241024-6553565535.
Since Network ACLs are stateless, they require explicit rules for both outbound request traffic and inbound response traffic. When the EC2 instances initiate connections to the external API on port 443443, the return traffic is sent to ephemeral ports (10241024-6553565535) on the EC2 instances. Therefore, an inbound Network ACL rule must be added to allow traffic from the API's IP address range on ports 10241024-6553565535. Default Security Groups are stateful, meaning they track connection state and automatically allow the return traffic at the instance level without requiring any inbound Security Group rule changes.

Step-by-Step Solution

1
Analyze the stateful behavior of the Security Group.
The default Security Group settings allow all outbound traffic. Because Security Groups are stateful, any outbound request's return traffic is automatically allowed back in. No Security Group modifications are needed.
To determine if the blockage is occurring at the instance firewall level.
2
Analyze the stateless behavior of the Network ACL.
The Network ACL is stateless, meaning outbound and inbound traffic must be explicitly permitted by separate rules. The current setup only allows outbound traffic on port 443443.
To locate the point of failure in the network path.
3
Identify the destination port of the returning traffic.
When an EC2 instance initiates a connection to port 443443 of the external API, it sends requests from a random ephemeral port (TCP range 10241024-6553565535). The API's response is sent back to this ephemeral port on the EC2 instance.
To determine the correct port range for the inbound Network ACL rule.
4
Formulate the required Network ACL rule modification.
Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP ports 10241024-6553565535.
To allow the stateless firewall to permit the returning response traffic back to the subnet.

Key Concept

Stateful vs. Stateless Firewalls (Security Groups vs. Network ACLs) and Ephemeral Ports
Estimated Time:2m 0s
Question 255Question →

A company is setting up its security guidelines for access management in AWS. The IT manager wants to enforce Multi-Factor Authentication (MFA) to protect the account's resources. According to AWS security best practices, which of the following identities should have MFA enabled? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The AWS account root user; Individual IAM users who perform administrative tasks

Answer

The AWS account root user and individual IAM users who perform administrative tasks should have Multi-Factor Authentication (MFA) enabled.
The correct options are the AWS account root user and individual IAM users who perform administrative tasks. According to AWS security best practices, multi-factor authentication (MFA) should be enabled on the root account to prevent unauthorized access to the most privileged user in the account. Similarly, IAM users, particularly those with administrative privileges, should have MFA enabled to protect daily operational access.

Step-by-Step Solution

1
Identify the entities within the AWS environment that represent human users or credentials requiring protection via Multi-Factor Authentication (MFA).
MFA is applicable to user accounts that log in via the console or CLI, such as the root user and IAM users.
MFA adds an extra layer of security on top of user passwords to verify human identity.
2
Evaluate the non-human or machine-based entities and identify why they do not use MFA.
IAM roles use temporary security credentials and are assumed programmatically, while Security Groups are network firewalls, and physical security is managed by AWS.
These entities do not involve human interactive logins and thus do not support or require MFA configuration by the customer.

Key Concept

Multi-Factor Authentication (MFA) best practices for securing human identities in IAM.
Question 256Question →

A security team needs to monitor and audit IP traffic routing through network interfaces in a Virtual Private Cloud (VPC) to investigate network connectivity issues. Which AWS feature should the team enable to collect this network traffic information?

Show answer & explanation

Answer: VPC Flow Logs

Answer

VPC Flow Logs
VPC Flow Logs is the feature that allows you to capture and log IP traffic details for network interfaces in a VPC. It is widely used to troubleshoot connection issues and audit traffic rules.

Step-by-Step Solution

1
Determine the security requirement, which is to capture and audit IP traffic going to and from network interfaces in a VPC.
The target resource must be a network monitoring or auditing feature.
This helps rule out services focused on API auditing or threat detection.
2
Evaluate the features of VPC Flow Logs against the other options.
VPC Flow Logs is specifically designed to log IP traffic at the network interface level, satisfying the requirements.
VPC Flow Logs provides the exact raw network traffic information needed for troubleshooting connectivity issues.

Key Concept

VPC Flow Logs enables you to capture information about the IP traffic going to and from network interfaces in your VPC.
Estimated Time:40s
Question 257Question →

A retail company is migrating its customer database and product catalogs to Amazon S3. The company's security policy requires that all data stored in the cloud must be encrypted at rest. Under the AWS Shared Responsibility Model, which of the following is a customer responsibility regarding this encryption requirement?

Show answer & explanation

Answer: Configuring server-side encryption on the Amazon S3 buckets using AWS Key Management Service (AWS KMS)

Answer

Configuring server-side encryption on the Amazon S3 buckets using AWS Key Management Service (AWS KMS)
The correct answer is configuring server-side encryption on the Amazon S3 buckets using AWS Key Management Service (AWS KMS). Under the AWS Shared Responsibility Model, the customer is responsible for configuring encryption of data at rest (security 'in' the cloud). This includes selecting and enabling the appropriate encryption settings on their S3 buckets.

Step-by-Step Solution

1
Determine which security controls are managed by the customer under the Shared Responsibility Model.
The customer is responsible for configuring security options 'in' the cloud, such as enabling server-side encryption on their Amazon S3 buckets.
AWS is responsible for security 'of' the cloud, which includes the physical security of data centers and the underlying infrastructure.
2
Differentiate between customer responsibilities and AWS operational tasks for managed security services.
Tasks like maintaining the physical security of hardware security modules (HSMs) and patching host operating systems of storage servers are handled entirely by AWS.
Managed services like Amazon S3 and AWS KMS offload infrastructure and physical maintenance to AWS.

Key Concept

Under the AWS Shared Responsibility Model, customers are responsible for data protection and encryption configuration (security 'in' the cloud), while AWS is responsible for physical and infrastructure security (security 'of' the cloud).
Question 258Question →

An automotive telemetry platform processes vehicle sensor data using a fleet of Amazon EC2 instances. The security team needs to implement a solution to scan these EC2 instances for known software vulnerabilities and continuously monitor the AWS accounts for malicious activity or unauthorized behavior. Which two AWS services should the platform use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
The correct services are Amazon Inspector and Amazon GuardDuty. Amazon Inspector performs vulnerability management by scanning EC2 instances for software vulnerabilities and unintended network exposure. Amazon GuardDuty provides intelligent threat detection by continuously monitoring AWS accounts and workloads for malicious activity.

Step-by-Step Solution

1
Identify the requirement for software vulnerability scanning on Amazon EC2 instances.
Amazon Inspector is selected as it is specifically designed to scan EC2 instances and container images for software vulnerabilities and network exposure.
Vulnerability scanning is a core function of Amazon Inspector.
2
Identify the requirement for continuous threat detection and monitoring of malicious activity across the AWS account.
Amazon GuardDuty is selected as it uses machine learning and threat intelligence to detect unauthorized behavior and malicious activity.
Intelligent threat detection across AWS accounts and workloads is the primary use case for Amazon GuardDuty.

Key Concept

Identifying AWS services for threat detection and vulnerability management
Question 259Question →

A logistics company uses Amazon Simple Queue Service (SQS) to decouple its order processing systems. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Configuring IAM policies to restrict access to the queue; Enabling server-side encryption (SSE) on the queue using encryption keys

Answer

Configuring IAM policies to restrict access to the queue, and enabling server-side encryption (SSE) on the queue using encryption keys.
For fully managed services like Amazon SQS, the customer is responsible for security 'in' the cloud, which includes configuring IAM policies to restrict queue access and enabling server-side encryption to protect data. AWS is responsible for security 'of' the cloud, including the underlying infrastructure, operating systems, and physical security.

Step-by-Step Solution

1
Identify the AWS service model type for Amazon SQS.
Amazon SQS is a fully managed service, meaning AWS handles all underlying infrastructure, servers, physical hardware, and operating systems.
Understanding the service type helps determine where the boundary of responsibility lies.
2
Determine customer responsibilities (security 'in' the cloud) for SQS.
The customer is responsible for data classification, encryption settings, and configuring identity and access management (IAM) policies to secure access to the queue.
Customer responsibilities for managed services focus on data protection and access configuration.
3
Identify AWS responsibilities (security 'of' the cloud) for SQS and eliminate matching options.
AWS handles OS patching, physical storage decommissioning, and infrastructure replication. Options describing these tasks are eliminated.
Infrastructure, physical security, and foundational service operations belong to AWS.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like SQS, AWS manages the infrastructure layer (such as operating system updates, hardware maintenance, and physical security), while the customer remains responsible for data configuration, encryption settings, and access control policies.
Question 260Question →

An enterprise client is designing a security monitoring architecture for their AWS environment. The client must satisfy two requirements:
1. Detect and alert in real-time when administrative actions, such as the deletion of an Amazon S3 bucket, are initiated by any user or role.
2. Continuously monitor the network activity of Amazon EC2 instances to identify active threat behaviors, such as outbound port scanning or communication with known malicious command-and-control servers.

Which combination of AWS services should the client implement to meet these requirements?

Show answer & explanation

Answer: AWS CloudTrail to capture the administrative API activity for S3 bucket deletions, and Amazon GuardDuty to analyze network logs and detect threat behaviors from EC2 instances.

Answer

The configuration using AWS CloudTrail to log S3 bucket deletions and Amazon GuardDuty to analyze network logs for EC2 threat behaviors is the correct choice.
The correct solution uses AWS CloudTrail to record administrative API calls, such as deleting S3 buckets, and Amazon GuardDuty to analyze network logs for malicious EC2 behavior. GuardDuty uses threat intelligence to detect active threats like port scanning or command-and-control communication, which satisfies the network monitoring requirement.

Step-by-Step Solution

1
Determine which service is required for logging administrative API activity.
AWS CloudTrail is selected because it is designed to audit and record API calls made across AWS resources, including S3 bucket deletion.
This isolates the administrative auditing requirement from application performance monitoring.
2
Determine which service detects active network-level threat behaviors like port scanning.
Amazon GuardDuty is selected because it continuously monitors logs (such as VPC Flow Logs) using threat intelligence to detect malicious activity.
This distinguishes active threat detection from static vulnerability assessments.
3
Apply the AWS Shared Responsibility Model to identify customer operational duties.
The customer is responsible for configuring GuardDuty to protect their EC2 instances and OS-level traffic.
This confirms that managing threats within EC2 instances falls on the customer rather than AWS teams.

Key Concept

Auditing API calls with AWS CloudTrail, executing threat detection with Amazon GuardDuty, and understanding customer responsibilities under the Shared Responsibility Model.
PreviousPage 13 / 23Next