Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 261Question →

A company is migrating its database to Amazon RDS. Under the AWS Shared Responsibility Model, which task is the responsibility of the customer?

Show answer & explanation

Answer: Managing database user accounts and access permissions

Answer

Managing database user accounts and access permissions
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed database service like Amazon RDS, this includes managing database user accounts, credentials, permissions, and network access rules (security groups).

Step-by-Step Solution

1
Identify the service type and model boundaries.
Amazon RDS is a managed database service (PaaS), where AWS manages the underlying infrastructure, operating system, and hardware.
This determines which layers are managed by AWS versus the customer.
2
Evaluate the customer's operational responsibility for data and access.
The customer retains ownership of their data and must configure who has access to the database itself.
Security 'in' the cloud includes managing access credentials and user privileges.

Key Concept

Shared Responsibility Model for managed services
Question 262Question →

A company wants to secure its Virtual Private Cloud (VPC) by controlling traffic entering and leaving its subnets. The security team needs a solution that evaluates traffic using stateless rules at the subnet boundary. Which AWS resource or feature should the company configure to achieve this?

Show answer & explanation

Answer: Network Access Control Lists (Network ACLs)

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) act as a firewall for controlling traffic in and out of one or more subnets. They are stateless, meaning that inbound and outbound rules must be defined separately to allow traffic in both directions.

Step-by-Step Solution

1
Determine the required evaluation level for the network traffic.
The scenario requires traffic evaluation at the subnet boundary level.
This rules out instance-level security controls.
2
Identify the required rule evaluation type (stateful vs. stateless).
The scenario explicitly requests stateless rules.
Stateless rules require separate configuration for inbound and outbound traffic.
3
Select the AWS VPC feature matching both subnet-level and stateless requirements.
Network Access Control Lists (Network ACLs) operate at the subnet level and are stateless.
This matches all criteria described in the scenario.

Key Concept

Understanding the difference between stateful Security Groups at the instance level and stateless Network ACLs at the subnet level.
Estimated Time:45s
Question 263Question →

A healthcare technology company runs its patient portal on a fleet of Amazon EC2 instances. The security compliance officer needs to ensure that the operating systems of these instances are regularly checked for software vulnerabilities and unintended network exposure. According to the AWS Shared Responsibility Model, which customer-managed action should the company take to meet this requirement?

Show answer & explanation

Answer: Configure Amazon Inspector to automatically scan the EC2 instances.

Answer

Configure Amazon Inspector to automatically scan the EC2 instances.
Configuring Amazon Inspector is the correct action because it is AWS's automated vulnerability management service. It continuously scans EC2 instances and ECR container images for software vulnerabilities and unintended network reachability.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to regularly check the EC2 instance operating systems for software vulnerabilities and network exposure.
Understanding whether the task involves active threat detection (log analysis) or software vulnerability/configuration scanning determines the correct AWS security tool.
2
Determine the boundary of responsibility under the Shared Responsibility Model.
The guest operating system and applications running on Amazon EC2 instances fall under the customer's responsibility (Security 'in' the Cloud).
AWS does not manage or scan guest operating systems automatically; the customer must select and configure a service like Amazon Inspector to perform these tasks.
3
Select the appropriate AWS service for vulnerability scanning.
Amazon Inspector is chosen because it specifically scans EC2 instances and ECR images for software vulnerabilities and unintended exposure.
Other services like Amazon GuardDuty (threat detection) and AWS CloudTrail (API logging) do not scan for OS-level software vulnerabilities.

Key Concept

Amazon Inspector is the native AWS service for automated vulnerability management, scanning EC2 instances and container images for software vulnerabilities and network path exposure. Under the Shared Responsibility Model, securing the guest operating system is the customer's responsibility.
Estimated Time:1m 0s
Question 264Question →

A pharmaceutical research firm must encrypt clinical trial data stored in Amazon S3. The firm's compliance policy mandates that encryption keys must be generated and stored on dedicated, single-tenant hardware security modules (HSMs) directly controlled by the firm's security team. However, the firm still wants to leverage the automated, seamless server-side encryption features of Amazon S3 without custom application-side coding. Which of the following approaches meets these requirements?

Show answer & explanation

Answer: Configure AWS Key Management Service (KMS) with a custom key store backed by an AWS CloudHSM cluster, and use those keys for S3 server-side encryption (SSE-KMS).

Answer

Configure AWS Key Management Service (KMS) with a custom key store backed by an AWS CloudHSM cluster, and use those keys for S3 server-side encryption (SSE-KMS).
The correct approach is to configure AWS Key Management Service (KMS) with a custom key store backed by an AWS CloudHSM cluster, and use those keys for S3 server-side encryption (SSE-KMS). This allows the customer to maintain sole ownership and control of the keys in a dedicated, single-tenant HSM cluster (AWS CloudHSM) while still allowing Amazon S3 to perform transparent server-side encryption via KMS integrations.

Step-by-Step Solution

1
Identify the primary compliance requirement for key control.
Encryption keys must be generated and stored on dedicated, single-tenant hardware security modules (HSMs) directly controlled by the firm.
This requirement identifies AWS CloudHSM as the necessary hardware boundary, rather than standard AWS KMS multi-tenant key storage.
2
Identify the operational integration requirement.
The firm wants to use S3's automated server-side encryption without custom application-side coding.
This rules out client-side encryption and requires a solution that integrates natively with S3 server-side encryption (SSE).
3
Determine the integration path between AWS CloudHSM and Amazon S3.
S3 cannot directly interact with AWS CloudHSM. AWS KMS must act as the intermediary using a Custom Key Store backed by the AWS CloudHSM cluster.
Using a KMS Custom Key Store allows S3 to request encryption via SSE-KMS, while KMS offloads the cryptographic operations and key storage to the user-controlled CloudHSM cluster.

Key Concept

AWS KMS Custom Key Stores
Question 265Question →

An online retail company is designing a security and operational monitoring strategy. The company needs to audit administrative API activities (such as who created a resource or modified access policies) and track EC2 instance CPU utilization to trigger alerts if performance degrades. Which AWS services should the company use to meet these two requirements?

Show answer & explanation

Answer: AWS CloudTrail to audit administrative API activities, and Amazon CloudWatch to monitor resource performance metrics

Answer

AWS CloudTrail to audit administrative API activities, and Amazon CloudWatch to monitor resource performance metrics
AWS CloudTrail is designed to record API calls and user activity across your AWS infrastructure, enabling auditing and governance. Amazon CloudWatch is designed to collect performance metrics, monitor resources, and trigger alarms based on thresholds like CPU utilization.

Step-by-Step Solution

1
Analyze the requirement for auditing administrative API activities.
Identify that AWS CloudTrail records AWS API calls, user actions, and change history for auditing purposes.
CloudTrail is the designated service for governance, compliance, operational auditing, and risk auditing of your AWS account.
2
Analyze the requirement for tracking EC2 instance CPU utilization and triggering alerts.
Identify that Amazon CloudWatch monitors operational metrics, collects log files, and sets alarms on performance thresholds.
CloudWatch is the primary monitoring service for AWS cloud resources and applications, providing real-time data and automated actions.
3
Combine the two services to form the complete solution.
The correct combination is AWS CloudTrail for API logging and Amazon CloudWatch for resource metric monitoring.
This combination satisfies both the auditing and operational alerting requirements without introducing unrelated services.

Key Concept

Distinguishing the distinct purposes of AWS CloudTrail and Amazon CloudWatch for security and operational monitoring.
Estimated Time:1m 0s
Question 266Question →

An enterprise is migrating its legacy web application to AWS and decides to run it inside Docker containers using AWS Fargate. Under the AWS Shared Responsibility Model, which two of the following operational tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Configuring the task security groups to control inbound and outbound network traffic to the container.; Managing and applying security updates to the application code and libraries within the container image.

Answer

Configuring the task security groups to control inbound and outbound network traffic, and managing and applying security updates to the application code and libraries within the container image.
Under the AWS Shared Responsibility Model for AWS Fargate, the customer is responsible for security 'in' the cloud. This includes configuring task security groups to govern network access to the containerized application and managing the application code, dependencies, and libraries within the Docker image itself.

Step-by-Step Solution

1
Analyze the service model used in the scenario.
AWS Fargate is a serverless container execution engine where AWS manages the underlying hosts, operating systems, and container runtimes, while the customer retains control over the containers and network configuration.
Identifying the service type helps determine where the boundary of responsibility lies between AWS and the customer.
2
Evaluate the customer's responsibilities for container-based workloads.
The customer is responsible for everything they package inside the container (application code, dependencies, libraries) and how the container interacts with the network (security groups).
This isolates the correct options containing customer responsibilities.
3
Evaluate the AWS responsibilities for serverless container workloads.
AWS is responsible for physical security, host OS patching, and virtualization infrastructure.
This allows for the elimination of options representing AWS-managed responsibilities.

Key Concept

Under the AWS Shared Responsibility Model for container services like AWS Fargate, the customer is responsible for the configuration of security groups and the security of their containerized application code and libraries, while AWS handles physical security, host OS patching, and runtime environment updates.
Question 267Question →

A company needs to grant an external auditor temporary access to view the configuration of their AWS resources. The auditor does not have an AWS account but has a corporate identity provider (IdP). Which of the following is the most secure AWS-recommended method to grant this access?

Show answer & explanation

Answer: Configure identity federation to allow the auditor to assume an IAM role with read-only permissions using their corporate credentials.

Answer

Configure identity federation to allow the auditor to assume an IAM role with read-only permissions using their corporate credentials.
The correct option is to configure identity federation to allow the auditor to assume an IAM role. This mechanism enables secure single sign-on (SSO) using the auditor's existing corporate credentials and assigns temporary permissions via an IAM role. This removes the security risks associated with managing and storing permanent IAM credentials for external users.

Step-by-Step Solution

1
Identify the access requirement and the external user's identity source.
An external auditor needs temporary read-only access and has a corporate identity provider (IdP).
This establishes that the user is external and possesses an existing credential repository that can be integrated.
2
Apply the principle of least privilege and secure credential management.
Avoid creating static, long-term AWS credentials or sharing root access.
Creating permanent IAM users for temporary external audits or sharing root access violates fundamental AWS security principles.
3
Select the mechanism that maps the external identity provider to temporary AWS permissions.
Implement identity federation to assume an IAM role with read-only access.
Federation delegates authentication to the external IdP and provides temporary security credentials through an IAM role.

Key Concept

Identity Federation and IAM Roles for External Access
Estimated Time:1m 0s
Question 268Question →

A retail company wants to track and record all API activity and user actions across its AWS account for compliance auditing. The company needs to know which user initiated an action, the time of the event, and the IP address from which the request was made. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: AWS CloudTrail

Answer

AWS CloudTrail
AWS CloudTrail is the AWS service that enables auditing, security monitoring, and operational troubleshooting by recording API actions and console operations. It captures details such as the identity of the caller, the request time, and the source IP address.

Step-by-Step Solution

1
Identify the primary requirement of the scenario.
The requirement is to log and audit user actions and API calls (who did what, when, and from where) across the entire AWS account.
This establishes the need for an auditing service rather than performance monitoring or vulnerability assessment.
2
Evaluate the capabilities of the available AWS security services.
AWS CloudTrail records API history and user activity, which directly matches the auditing and compliance need. Amazon CloudWatch is for metrics/logs, Amazon GuardDuty is for threat detection, and Amazon Inspector is for vulnerability scanning.
Choosing the service that specifically handles user event and API auditing ensures the correct alignment of AWS services.

Key Concept

AWS CloudTrail provides governance, compliance, operational auditing, and risk auditing of your AWS account by logging actions taken by a user, role, or an AWS service.
Question 269Question →

A company is hosting a secure web application on Amazon EC2 instances located in a public subnet. To implement a defense-in-depth strategy, the network team uses both Security Groups and Network Access Control Lists (Network ACLs). External clients must be allowed to access the application over HTTPS (port 443), while all other inbound traffic must be blocked. Which two configurations are required to allow this traffic to flow successfully to and from the instances?

Select all that apply

Show answer & explanation

Answer: Add an inbound rule to the instance's Security Group that allows TCP traffic on port 443 from 0.0.0.0/0.; Add an outbound rule to the subnet's Network ACL that allows TCP traffic on ephemeral ports (1024–65535) to 0.0.0.0/0.

Answer

Add an inbound rule to the instance's Security Group that allows TCP traffic on port 443 from 0.0.0.0/0, and add an outbound rule to the subnet's Network ACL that allows TCP traffic on ephemeral ports (1024–65535) to 0.0.0.0/0.
To allow external HTTPS traffic to reach the EC2 instances and return successfully, two levels of evaluation must be satisfied. First, at the instance level, the stateful Security Group must permit inbound traffic on TCP port 443. Because it is stateful, the return traffic is automatically allowed. Second, at the subnet level, the stateless Network ACL must permit both the inbound request on TCP port 443 and the outbound response. Since the client establishes the connection, the response traffic travels back to the client's ephemeral port range (typically 1024–65535), which must be explicitly permitted by an outbound rule in the Network ACL.

Step-by-Step Solution

1
Identify the security components and their levels of operation.
Security Groups operate at the instance/network interface level, while Network ACLs operate at the subnet level.
Understanding the boundaries is necessary to apply the rules to the correct resource type.
2
Analyze the statefulness of the Security Group for the inbound request.
Since Security Groups are stateful, adding an inbound rule for TCP port 443 from any source (0.0.0.0/0) is sufficient to allow both the request and the automated response traffic.
Stateful firewalls track connections and automatically allow return traffic.
3
Analyze the statelessness of the Network ACL for the response traffic.
Since Network ACLs are stateless, they evaluate inbound and outbound traffic independently. In addition to allowing inbound TCP 443, an outbound rule must be configured to allow traffic returning to the client's ephemeral ports (1024–65535).
Stateless firewalls do not track connection states, so return traffic must be explicitly allowed.

Key Concept

The difference between stateful Security Groups (operating at the instance level) and stateless Network ACLs (operating at the subnet level).
Estimated Time:2m 0s
Question 270Question →

A cloud administrator wants to configure network security for a new application deployment in a Virtual Private Cloud (VPC). Which TWO of the following statements correctly describe the behavior and boundaries of Security Groups and Network Access Control Lists (Network ACLs)? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security Groups are stateful (automatically allowing return traffic), whereas Network ACLs are stateless (requiring explicit inbound and outbound rules).; Security Groups operate at the instance level, whereas Network ACLs operate at the subnet level.

Answer

Security Groups are stateful, whereas Network ACLs are stateless; and Security Groups operate at the instance level, whereas Network ACLs operate at the subnet level.
Security Groups operate at the instance level (specifically elastic network interfaces) and are stateful, automatically allowing return traffic. Network ACLs operate at the subnet level and are stateless, requiring separate inbound and outbound rules to permit return traffic.

Step-by-Step Solution

1
Analyze the stateful vs. stateless nature of the two security services.
Security Groups are stateful, meaning they track connections and automatically allow returning traffic. Network ACLs are stateless, meaning they process inbound and outbound traffic independently.
This helps identify which rules need to be configured for traffic flow.
2
Determine where Security Groups and Network ACLs are applied in the network hierarchy.
Security Groups are applied to elastic network interfaces (instance level), while Network ACLs are associated with subnets (subnet level).
This defines the boundary of control for each security layer.

Key Concept

The operational level and connection tracking state of Security Groups and Network ACLs.
Question 271Question →

A business analyst needs temporary access to run a weekly report on billing data in the AWS Management Console. To follow the principle of least privilege and avoid managing long-term credentials, which approach should the administrator use?

Show answer & explanation

Answer: Configure an IAM role with the necessary billing permissions for the analyst to assume temporarily.

Answer

Configure an IAM role with the necessary billing permissions for the analyst to assume temporarily.
Configuring an IAM role is the correct approach because roles provide temporary security credentials and do not require sharing or managing long-term access keys.

Step-by-Step Solution

1
Identify the access requirement, which is temporary and should not rely on long-term credentials.
This eliminates options that require creating permanent IAM user credentials or sharing root account credentials.
Minimizing long-term credentials reduces the risk of credential exposure.
2
Select the AWS IAM entity designed to grant temporary permissions.
An IAM role is chosen as it provides temporary credentials that expire automatically.
IAM roles allow users or services to assume specific permissions for a limited duration without needing long-term access keys.

Key Concept

AWS IAM Roles and Temporary Credentials
Estimated Time:45s
Question 272Question →

A media streaming company wants to implement network-level monitoring and real-time security alerts for its virtual private cloud (VPC) environment. The company has two requirements:

1. Capture detailed information about the IP traffic going to and from network interfaces in the VPC to audit security group rule effectiveness.
2. Create automated alarms that notify the security operations team if there is a sudden spike in unauthorized connection attempts (such as HTTP 403 errors or failed SSH attempts).

Which combination of AWS features or services should the company configure to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: VPC Flow Logs; Amazon CloudWatch

Answer

VPC Flow Logs and Amazon CloudWatch
VPC Flow Logs is designed to capture IP traffic information going to and from network interfaces in a VPC, which allows the company to audit security group rules. Amazon CloudWatch is used to collect metrics, monitor logs, and trigger automated alarms when specific thresholds (such as unauthorized connection spikes) are exceeded.

Step-by-Step Solution

1
Analyze the first requirement: capturing IP traffic going to and from network interfaces in the VPC.
VPC Flow Logs is identified as the feature that captures detailed IP traffic details for network interfaces.
This is a native VPC feature specifically designed for network flow logging.
2
Analyze the second requirement: creating automated alarms based on metric thresholds and log events.
Amazon CloudWatch is identified as the service for collecting metrics, monitoring logs, and configuring alarms.
CloudWatch provides log monitoring (CloudWatch Logs) and automated alerting (CloudWatch Alarms) for custom operational thresholds.

Key Concept

Differentiating between network traffic logging (VPC Flow Logs) and resource monitoring/alerting (Amazon CloudWatch) versus API auditing (AWS CloudTrail) and vulnerability scanning (Amazon Inspector).
Question 273Question →

A gaming studio needs to implement a security logging and monitoring strategy for its multiplayer game backend. The studio has two primary requirements: first, it must track and audit all administrative API operations and configuration changes across its AWS account for compliance purposes; second, it must monitor compute instance performance metrics (such as CPU usage) and trigger real-time alerts when threshold limits are exceeded. Which of the following AWS services should the gaming studio use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail to record and audit API activity and resource configuration modifications; Amazon CloudWatch to monitor resource performance metrics and configure alarm notifications

Answer

AWS CloudTrail to audit API activity and Amazon CloudWatch to monitor resource performance metrics and alarms.
AWS CloudTrail records administrative API actions and modifications, which satisfies the audit requirement. Amazon CloudWatch collects and tracks resource metrics like CPU utilization and can trigger alarm alerts when custom thresholds are crossed, satisfying the monitoring requirement.

Step-by-Step Solution

1
Identify the AWS service responsible for capturing and recording administrative API operations.
AWS CloudTrail is identified as the service that logs AWS API calls and resource modifications for auditing.
Auditing API calls and configuration changes is a native capability of AWS CloudTrail.
2
Identify the AWS service responsible for gathering resource metrics and triggering notifications based on thresholds.
Amazon CloudWatch is identified as the service that monitors performance metrics and manages alarms.
CloudWatch is the standard service for collecting compute metrics and sending real-time alerts.

Key Concept

AWS CloudTrail is utilized for auditing user actions and administrative API calls, while Amazon CloudWatch is used to monitor performance metrics and configure real-time alerts.
Question 274Question →

A financial services company is deploying a database workload using Amazon Relational Database Service (Amazon RDS). Under the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Show answer & explanation

Answer: Configuring database-level user accounts and security group rules to restrict network access to the database instance

Answer

Configuring database-level user accounts and security group rules to restrict network access to the database instance
The correct answer is configuring database-level user accounts and security group rules. Under the AWS Shared Responsibility Model for managed services like Amazon RDS, AWS manages the operating system, database engine patching, and the physical infrastructure. The customer remains responsible for securing data access, configuring database-level permissions, and setting up network access control via security groups.

Step-by-Step Solution

1
Analyze the deployment model of the service mentioned in the scenario.
Amazon RDS is a managed database service (Platform as a Service / PaaS model).
Under the Shared Responsibility Model, AWS manages more of the operational stack for managed services compared to Infrastructure as a Service (IaaS) like Amazon EC2.
2
Determine the boundary of responsibility for Amazon RDS.
AWS is responsible for patching the guest operating system, database engine patching, and managing physical hardware. The customer is responsible for data encryption, database access permissions, and network access configuration (security groups).
AWS manages the platform, but the customer retains ownership and control of their data, access settings, and network rules.
3
Evaluate the given options against this boundary.
Configuring database-level user accounts and security group rules is a customer task, while OS patching, hardware replacement, and data center security are AWS tasks.
This identifies the correct task that falls on the customer's side of the boundary.

Key Concept

AWS Shared Responsibility Model for Managed Services
Question 275Question →

A smart agriculture startup is deploying IoT soil sensors that upload environmental telemetry data to AWS. The startup's compliance team requires a detailed ledger of who accessed or modified the AWS resources hosting this telemetry, while their operations team needs real-time alerts if telemetry ingestion metrics drop below a certain threshold. Which AWS services should the startup implement to meet both the auditing and operational alerting requirements?

Show answer & explanation

Answer: AWS CloudTrail to audit the resource access history, and Amazon CloudWatch to monitor metrics and trigger alerts when ingestion drops.

Answer

AWS CloudTrail to audit the resource access history, and Amazon CloudWatch to monitor metrics and trigger alerts when ingestion drops.
The correct answer properly pairs AWS CloudTrail (the primary audit logging service for recording user access and API activity) with Amazon CloudWatch (the monitoring service used to collect metrics and configure real-time alarms).

Step-by-Step Solution

1
Identify the AWS service required for compliance auditing and tracking user and API activities.
AWS CloudTrail is chosen because it logs, continuously monitors, and retains account activity related to actions across your AWS infrastructure.
Compliance teams require a chronological audit ledger of API activity and resource access.
2
Identify the AWS service required for monitoring performance telemetry and triggering alarms based on metric thresholds.
Amazon CloudWatch is chosen because it monitors operational metrics, displays dashboards, and configures alarms.
Operations teams need real-time alerts when metric values drop below defined ingestion thresholds.

Key Concept

Distinguishing between AWS CloudTrail for user activity auditing and Amazon CloudWatch for resource metric monitoring and alerting.
Question 276Question →

A healthcare startup is preparing for an external audit to verify compliance with HIPAA and SOC standards for its platform hosted on AWS. Which of the following actions should the startup take to meet these compliance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download official AWS compliance documents, such as SOC reports, using AWS Artifact.; Accept the Business Associate Addendum (BAA) with AWS using AWS Artifact.

Answer

Downloading official AWS compliance documents (such as SOC reports) using AWS Artifact, and accepting the Business Associate Addendum (BAA) with AWS using AWS Artifact.
The correct options are downloading AWS compliance documents like SOC reports through AWS Artifact, and accepting the Business Associate Addendum (BAA) using AWS Artifact. AWS Artifact serves as the direct portal for accessing compliance documentation and formalizing agreements required for regulatory frameworks like HIPAA.

Step-by-Step Solution

1
Identify the service used to retrieve compliance reports and accept regulatory agreements.
AWS Artifact is the central portal for downloading SOC reports and accepting the Business Associate Addendum (BAA).
This directly addresses both the SOC audit readiness and the HIPAA agreement requirement.
2
Differentiate customer security tasks from AWS infrastructure security tasks.
Physical host patching and security logs are managed by AWS and documented in Artifact reports, whereas customer-side auditing is logged by CloudTrail but not blocked by it.
This rules out tasks related to physical infrastructure patching and incorrect auditing service capabilities.

Key Concept

Using AWS Artifact for compliance report retrieval and agreement management under the Shared Responsibility Model.
Question 277Question →

An organization wants to configure secure access to its AWS resources. They need to grant an application running on an Amazon EC2 instance access to an Amazon S3 bucket, and they need to configure access for a new team of system administrators. Which of the following AWS Identity and Access Management (IAM) practices should the organization implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate an IAM role with the Amazon EC2 instance to grant the application temporary access to the S3 bucket; Create individual IAM users for each system administrator and assign them to an IAM group with administrative policies attached

Answer

Associate an IAM role with the Amazon EC2 instance to grant the application temporary access to the S3 bucket, and create individual IAM users for each system administrator and assign them to an IAM group with administrative policies attached.
The correct practices are to associate an IAM role with the EC2 instance, allowing the application to securely obtain temporary credentials to access the S3 bucket, and to create individual IAM users inside an IAM group for the system administrators to manage their administrative access centrally and securely.

Step-by-Step Solution

1
Analyze the access requirement for the application on the EC2 instance.
The application needs access to an S3 bucket. The secure way to provide access to AWS services from an EC2 instance is by using IAM roles, which provide temporary security credentials.
This avoids hardcoding or storing long-term credentials like access keys on the instance.
2
Analyze the access requirement for the new team of system administrators.
Administrators require credentials to perform daily management tasks. Best practices dictate creating individual IAM users for accountability and placing them in an IAM group with the required administrative policies.
This facilitates easier permission management and ensures individual actions can be audited.
3
Evaluate the distractors based on security and shared responsibility principles.
Using the root account, sharing user credentials, and expecting AWS to manage customer permissions are violations of security best practices and the Shared Responsibility Model.
The root user must not be used for daily tasks, credential sharing ruins auditability, and access management is a customer responsibility.

Key Concept

AWS IAM Best Practices and Access Control
Question 278Question →

A gaming startup is launching a new multiplayer game on AWS. To ensure security compliance and operational stability, the startup needs to accomplish two tasks: first, they must log and audit all administrative API operations and user activity within their AWS account; second, they must monitor system performance metrics (such as CPU utilization of their virtual servers) and receive alerts if performance drops. Which TWO AWS services should the startup implement to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail to log and track API activities and user actions across the AWS account.; Amazon CloudWatch to collect performance metrics, monitor logs, and trigger automated alerts.

Answer

The startup should use AWS CloudTrail to log and track API activities, and Amazon CloudWatch to collect performance metrics and trigger alerts.
AWS CloudTrail records and tracks user actions and API calls made within the AWS account, which is crucial for compliance and security auditing. Amazon CloudWatch collects and tracks metrics, monitors log files, and sets alarms, which is essential for performance monitoring and operational alerts.

Step-by-Step Solution

1
Identify the service needed to log and audit administrative API operations and user activity.
AWS CloudTrail is selected because it acts as a flight recorder for AWS accounts, capturing all API activity and changes.
This directly fulfills the first requirement of auditing account activity.
2
Identify the service needed to monitor system performance metrics and trigger alerts.
Amazon CloudWatch is selected because it gathers operational data, logs, and metrics (like CPU usage) and can trigger alarms.
This directly fulfills the second requirement of performance monitoring and alerting.

Key Concept

Monitoring, logging, and auditing are split between auditing user activity (AWS CloudTrail) and monitoring system/resource performance (Amazon CloudWatch).
Question 279Question →

Under the AWS shared responsibility model, a company wants to ensure that its data is encrypted at rest. Which two tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring server-side encryption on Amazon S3 buckets; Managing access policies for AWS Key Management Service (AWS KMS) keys

Answer

Configuring server-side encryption on Amazon S3 buckets and managing access policies for AWS Key Management Service (AWS KMS) keys.
The tasks of configuring server-side encryption on Amazon S3 buckets and managing access policies for AWS KMS keys are correct because they represent configuration and access control decisions within the customer's AWS account. Under the AWS Shared Responsibility Model, the customer is responsible for configuring security options 'in' the cloud.

Step-by-Step Solution

1
Determine which aspects of data protection are physical or infrastructure-related.
Physical security, disk replacement, and HSM firmware updates are managed by AWS.
AWS is responsible for security 'of' the cloud, which includes physical data centers, host operating systems, virtualization layers, and physical hardware.
2
Determine which aspects of data protection are configuration or access-related.
Enabling encryption on data storage resources and defining key access permissions are customer responsibilities.
Under the shared responsibility model, the customer is responsible for security 'in' the cloud, which includes data classification, resource configuration, and identity and access management.

Key Concept

Shared Responsibility Model for Data Protection
Question 280Question →

An administrator needs to assign similar security permissions to ten new developers in an organization. Which of the following are AWS-recommended practices for managing these permissions? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create individual IAM users for each developer to ensure activity can be audited.; Place the individual IAM users into an IAM group and attach the required permission policies to the group.

Answer

To follow AWS best practices, individual IAM users should be created for each developer, and these users should be placed in an IAM group with the necessary permission policies attached to the group.
Creating individual IAM users ensures that each developer has unique credentials, making it possible to audit actions and trace them to a specific person. Placing these users in an IAM group and attaching policies to that group is the AWS-recommended best practice to manage permissions efficiently and consistently.

Step-by-Step Solution

1
Analyze credential accountability requirements
Determine that sharing a single account (like the root user or a shared user) is insecure, meaning individual IAM users must be created for auditing purposes.
Individual IAM users ensure that all actions can be traced to a specific person.
2
Determine the most efficient method for managing group permissions
Determine that placing these individual IAM users in an IAM group and attaching policies to the group simplifies administrative overhead.
Instead of attaching policies to ten separate users, attaching them to a single group ensures consistent permissions and easy updates.

Key Concept

IAM Identity Management Best Practices (Users and Groups)
PreviousPage 14 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 14 | Examkin