Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 301Question →

A startup is preparing for a security audit and needs to generate a report showing who made specific API requests to modify their Amazon EC2 instances over the last thirty days. Which AWS service should the startup use to retrieve this API transaction history?

Show answer & explanation

Answer: AWS CloudTrail

Answer

AWS CloudTrail is the service designed to track and log user activity and API calls across AWS infrastructure for auditing and compliance.
AWS CloudTrail is specifically built to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. This service provides a complete history of API calls, including the identity of the API caller, the time of the call, the source IP address, and the request parameters, making it the correct choice for generating an audit report.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to retrieve a history of API requests showing who modified Amazon EC2 resources.
This establishes that the solution must focus on administrative tracking, logging, and auditing of API activity.
2
Evaluate the capabilities of the available AWS monitoring and security services.
AWS CloudTrail records user actions and API calls, whereas Amazon CloudWatch monitors performance metrics, Amazon GuardDuty detects security threats, and AWS Trusted Advisor checks configuration best practices.
Choosing the service that specifically records API transaction histories ensures compliance auditing needs are met.

Key Concept

AWS CloudTrail is used to audit user activity and API calls, while Amazon CloudWatch is used for performance monitoring and operational metrics.
Estimated Time:45s
Question 302Question →

An online retail company is expanding its operations to new regions and must verify that the underlying AWS infrastructure meets both PCI DSS and ISO 27001 standards. Which of the following actions should the company take to verify AWS compliance and clarify security boundaries? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS ISO 27001 certification and PCI DSS compliance packages from AWS Artifact.; Review the AWS Shared Responsibility Model to identify which security controls are managed by AWS and which are the customer's responsibility.

Answer

To verify compliance and understand security boundaries, the company should download the AWS compliance packages from AWS Artifact and review the AWS Shared Responsibility Model.
Verifying AWS compliance is done by retrieving official audit reports and certifications from AWS Artifact. Understanding security boundaries requires reviewing the AWS Shared Responsibility Model, which defines the security obligations of both AWS and the customer.

Step-by-Step Solution

1
Identify the AWS tool used to download official compliance reports and certifications.
AWS Artifact provides on-demand access to compliance reports (like PCI DSS and ISO certifications).
The company needs official documentation of AWS's infrastructure compliance for their expansion.
2
Determine how to clarify the division of security obligations between AWS and the company.
The AWS Shared Responsibility Model outlines which controls are the responsibility of AWS (security of the cloud) and which are the customer's responsibility (security in the cloud).
Understanding security boundaries prevents configuration gaps and misalignments during audits.

Key Concept

AWS Artifact provides compliance reports, while the Shared Responsibility Model defines security boundaries.
Question 303Question →

A business analyst is configuring an Amazon Simple Storage Service (Amazon S3) bucket to store financial reports. The company requires that all objects in the bucket be encrypted at rest. Under the AWS shared responsibility model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Enabling default encryption on the Amazon S3 bucket

Answer

Enabling default encryption on the Amazon S3 bucket
Enabling default encryption on the Amazon S3 bucket is correct because the customer is responsible for security 'in' the cloud, which includes configuring data protection features such as encryption settings on S3 buckets. AWS provides the tools, but the customer must enable and configure them.

Step-by-Step Solution

1
Analyze the requirement under the AWS Shared Responsibility Model for data protection.
Identify that data protection 'in the cloud' (such as configuring encryption settings for S3 buckets) is the customer's responsibility.
AWS protects the infrastructure that runs all of the services offered in the AWS Cloud, while customers are responsible for securing their data within those services.
2
Evaluate the choices to find which action represents a customer configuration task.
The action of enabling default encryption on the S3 bucket is a customer-managed configuration. Other actions like physical security, infrastructure patching, and dedicated hardware maintenance are handled by AWS.
This confirms the correct choice matches customer-side configurations for data protection.

Key Concept

Under the AWS shared responsibility model, AWS is responsible for security 'of' the cloud (infrastructure, physical security, patching virtualization software), whereas the customer is responsible for security 'in' the cloud (data encryption settings, access controls, configuring resources).
Estimated Time:45s
Question 304Question →

A financial technology firm wants to enhance its operational visibility and security auditing on AWS. The operations team needs to collect and search log files generated by their application running on Amazon EC2 instances, and trigger automated alerts when system errors are detected. Simultaneously, the security team needs to audit all administrative API requests made to AWS resources to identify which user made specific configuration changes. Which AWS services should the firm implement to fulfill these two requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon CloudWatch

Answer

AWS CloudTrail and Amazon CloudWatch
The firm should implement AWS CloudTrail and Amazon CloudWatch. AWS CloudTrail is designed to record API calls and user activity across the AWS infrastructure, providing a complete audit trail of who made changes to resources. Amazon CloudWatch, combined with the CloudWatch agent on EC2 instances, is used to collect, monitor, and search application log files, as well as set up metrics and alarms to notify the operations team of system errors in real time.

Step-by-Step Solution

1
Analyze the security auditing requirement to track who made specific configuration changes.
Identify that AWS CloudTrail records API calls, user actions, and resource changes.
This satisfies the requirement to audit administrative actions and trace user activity.
2
Analyze the operational logging requirement to collect application logs from EC2 and trigger alerts on errors.
Identify that Amazon CloudWatch (and CloudWatch Logs) can collect application logs via an agent and create metric filters for alarms.
This fulfills the need for real-time application log monitoring and automated alerting.
3
Evaluate the incorrect options against the requirements.
Rule out Amazon GuardDuty, Amazon Inspector, and AWS Shield as they focus on threat detection, vulnerability scanning, and DDoS protection respectively, rather than general logging and API auditing.
Eliminating distractors ensures a precise and correct selection of the two monitoring services.

Key Concept

AWS CloudTrail is used for auditing AWS API calls and user activity (governance and compliance), while Amazon CloudWatch is used for performance monitoring, application log collection, and metric-based alerting.
Estimated Time:1m 30s
Question 305Question →

A financial services company needs to investigate an incident where a critical Amazon RDS database instance was unexpectedly deleted. The security team must identify the specific IAM user who initiated the deletion, the exact time of the API call, and the source IP address of the request. Which AWS service should the security team use to retrieve this historical record of API activity?

Show answer & explanation

Answer: AWS CloudTrail

Answer

AWS CloudTrail
AWS CloudTrail is designed to record API calls and user interactions across AWS infrastructure. It provides detailed records of who made a request, from where, and at what time, which is essential for security auditing and forensic analysis.

Step-by-Step Solution

1
Identify the goal of the security team, which is to audit API activity to determine who deleted an Amazon RDS database instance, when the action occurred, and from what source IP.
The team needs a service that logs and indexes administrative activity and management console operations.
This is an auditing and compliance task focused on tracking user actions and API usage.
2
Compare the capabilities of available AWS logging and monitoring services to find the one that tracks API calls.
AWS CloudTrail records management events, showing user identities, API calls, timestamps, and source IP addresses.
Selecting the service specifically designed for tracking account-wide API operations ensures the team can retrieve the required history.

Key Concept

AWS CloudTrail is the primary service for auditing and recording AWS API activity, tracking user actions, console logins, and service operations.
Estimated Time:1m 0s
Question 306Question →

A logistics company is migrating its application to Amazon EC2 instances. The security team needs to implement a logging and monitoring strategy that addresses two requirements: First, they must monitor application-specific log files generated on the EC2 instances for pattern matches and automatically notify administrators if error rates spike. Second, they must continuously analyze AWS API calls and network activity to detect potential security threats, such as compromised credentials or communication with known malicious IP addresses. Which TWO AWS services should the company implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon CloudWatch to monitor application log files for error patterns and trigger notifications using alarms; Amazon GuardDuty to continuously analyze API events and network logs to identify threat patterns and compromised credentials

Answer

The logistics company should implement Amazon CloudWatch and Amazon GuardDuty.
The correct services are Amazon CloudWatch and Amazon GuardDuty. Amazon CloudWatch collects and monitors log files from resources like EC2 instances using metric filters, allowing administrators to configure alarms and notifications. Amazon GuardDuty uses intelligent threat detection to analyze data sources like CloudTrail logs and VPC Flow Logs to detect malicious activity and compromised credentials.

Step-by-Step Solution

1
Identify the service required to monitor application log files and alert on error thresholds.
Amazon CloudWatch is selected because it collects log files, allows pattern matching via metric filters, and triggers notifications through CloudWatch Alarms.
This satisfies the requirement to monitor EC2 application log files for error rate spikes and notify administrators.
2
Identify the service required to continuously analyze AWS API calls and network activity for active security threats.
Amazon GuardDuty is selected because it is an intelligent threat detection service that analyzes logs (such as CloudTrail and VPC Flow Logs) to identify anomalies and compromised credentials.
This satisfies the requirement to detect security threats like compromised credentials and communication with malicious IPs.

Key Concept

AWS security logging, monitoring, and threat detection services
Question 307Question →

A company wants to integrate a third-party security auditing application that runs on an external, non-AWS platform. The application requires read-only access to the company's AWS resource configurations. Which of the following is the AWS-recommended best practice to grant this access securely?

Show answer & explanation

Answer: Create an IAM role with a trust policy that allows the third-party account to assume it, and attach a read-only policy to the role.

Answer

Create an IAM role with a trust policy that allows the third-party account to assume it, and attach a read-only policy to the role.
Creating an IAM role with a trust policy is the secure and recommended way to grant access to third-party accounts or external applications. It allows the external service to temporarily assume the role and access the necessary resources, ensuring that no long-term credentials (like passwords or access keys) are shared or stored externally.

Step-by-Step Solution

1
Analyze the access requirement
The external third-party application requires read-only access to AWS resource configurations without introducing permanent credential risks.
Security best practices dictate minimizing permanent credential exposure and using temporary access methods.
2
Evaluate role-based access vs user-based access
IAM roles provide temporary credentials using security token services, whereas IAM users use long-term credentials.
An IAM role is designed for cross-account or external service access delegation without exposing long-term keys.
3
Select the correct AWS recommendation
Create an IAM role with a trust relationship defining who can assume the role, and apply a permission policy containing read-only access.
This implements the principle of least privilege and avoids sharing permanent credentials.

Key Concept

Delegating AWS resource access to third-party applications using temporary credentials via IAM roles.
Question 308Question →

A logistics company is migrating its supply chain database to AWS. The compliance team needs to verify how regulatory compliance is managed under the AWS Shared Responsibility Model. Which of the following compliance-related activities is the sole responsibility of AWS?

Show answer & explanation

Answer: Maintaining the physical security and environmental controls of the data centers hosting the database.

Answer

Maintaining the physical security and environmental controls of the data centers hosting the database.
AWS is responsible for security 'of' the cloud, which includes protecting the physical infrastructure (hardware, software, networking, and facilities) that runs all of the services offered in the AWS Cloud.

Step-by-Step Solution

1
Analyze the requirements under the AWS Shared Responsibility Model.
Identify that AWS is responsible for security 'of' the cloud, while the customer is responsible for security 'in' the cloud.
This establishes the framework to classify which compliance task belongs to which party.
2
Evaluate the options to identify which task belongs to AWS's infrastructure management.
Determine that physical security and environmental controls of data centers are managed solely by AWS, whereas operating systems, report downloads, and logging configurations are managed by the customer.
This isolates the correct option showing the AWS-managed compliance control.

Key Concept

Shared Responsibility Model for Compliance
Question 309Question →

A healthcare analytics company is migrating its data warehousing workloads to Amazon Redshift to perform complex queries on patient data. According to the AWS Shared Responsibility Model, which two of the following security and operational tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Managing database user accounts, cluster-level security groups, and database-level permissions; Enabling encryption at rest for the data warehouse using customer-managed keys in AWS Key Management Service (AWS KMS)

Answer

Managing database user accounts, cluster-level security groups, and database-level permissions; Enabling encryption at rest for the data warehouse using customer-managed keys in AWS Key Management Service (AWS KMS)
Under the AWS Shared Responsibility Model for managed services like Amazon Redshift, the customer is responsible for security 'in' the cloud, which includes managing database user access, permissions, cluster security groups, and data protection settings such as enabling encryption at rest using AWS Key Management Service (AWS KMS) keys.

Step-by-Step Solution

1
Identify the AWS service type and deployment model.
Amazon Redshift is a fully managed data warehouse service (PaaS/managed database), which automatically abstracts the physical hosting and operating system layers from the customer.
Understanding the service type determines where the boundary lies between customer and AWS responsibilities under the Shared Responsibility Model.
2
Evaluate the customer-side responsibilities (security 'in' the cloud) for managed database services.
The customer controls identity and access management (creating database users, granting permissions) and configurations like cluster-level security groups and database encryption using customer-managed keys.
Even in managed services, data security, authorization, and firewall rules at the service level remain customer duties.
3
Evaluate the AWS-side responsibilities (security 'of' the cloud) and filter out incorrect options.
AWS handles OS patching, hardware replacement, and physical security. Thus, managing physical data centers, patching cluster node operating systems, and configuring internal cluster networking are AWS responsibilities.
AWS manages the infrastructure layer for all cloud deployments, particularly for managed and containerized services.

Key Concept

Shared Responsibility Model for Managed Services
Question 310Question →

A company is configuring a Virtual Private Cloud (VPC) to host a new application. The security administrator wants to implement a defense-in-depth strategy by combining instance-level firewall protection with subnet-level firewall protection. Which of the following statements correctly describe the characteristics of Security Groups and Network Access Control Lists (Network ACLs)? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security Groups are stateful firewalls that control traffic at the instance level.; Network ACLs are stateless firewalls that control traffic at the subnet level.

Answer

The correct answers are the statements that state Security Groups are stateful firewalls operating at the instance level, and Network ACLs are stateless firewalls operating at the subnet level.
Security Groups act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level. They are stateful, meaning any allowed inbound traffic is automatically allowed to exit. Network ACLs act as a firewall for associated subnets, controlling traffic entering and leaving the subnet. They are stateless, meaning return traffic must be explicitly allowed by a corresponding rule.

Step-by-Step Solution

1
Analyze the configuration and characteristics of Security Groups.
Identify that Security Groups are applied at the instance level (e.g., to elastic network interfaces) and are stateful.
This helps verify the correct statements regarding Security Groups.
2
Analyze the configuration and characteristics of Network ACLs.
Identify that Network ACLs are applied at the subnet boundary and are stateless.
This helps verify the correct statements regarding Network ACLs.
3
Review the Shared Responsibility Model regarding firewall rule configuration.
Confirm that configuring security rules is a customer responsibility, ruling out options that shift this responsibility to AWS.
This eliminates incorrect distractors regarding operational responsibilities.

Key Concept

Stateful Security Groups vs. Stateless Network ACLs
Estimated Time:1m 0s
Question 311Question →

A company's security team needs to define a custom set of permissions for their database administrators. The policy must be reusable across multiple IAM groups, support version history, and allow for easy rollbacks if a change causes issues. Which type of IAM policy should the security team implement to meet these requirements?

Show answer & explanation

Answer: Customer managed policy

Answer

Customer managed policy
Customer managed policies are standalone policies created and managed by the customer. They can be attached to multiple IAM groups, support up to five versions for rollback capability, and allow full customization of permissions.

Step-by-Step Solution

1
Analyze the requirements for the custom policy: it must be reusable across multiple groups, support version control, and allow rollbacks.
Identified that the policy must be a standalone resource managed by the customer, rather than an inline policy or a policy controlled by AWS.
Standalone policies permit reuse, and customer-created policies allow custom configurations and versions.
2
Evaluate policy options against these requirements: customer managed policies offer version history and multi-entity attachment.
Confirmed that customer managed policies fit all requirements perfectly, whereas inline policies lack reuse and AWS managed policies lack customization/version control.
To choose the correct best practice for managing customized permission sets at scale.

Key Concept

AWS IAM Policy Types
Estimated Time:1m 0s
Question 312Question →

A digital marketing agency needs to implement security measures for its AWS infrastructure. The agency wants to continuously monitor its AWS accounts for unauthorized behavior and malicious activity. Additionally, they need to scan their Amazon Elastic Container Registry (Amazon ECR) container images for software vulnerabilities. Which two AWS services should the agency use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides continuous threat detection by analyzing logs for malicious behavior, while Amazon Inspector scans container images in Amazon ECR for software vulnerabilities.
Amazon GuardDuty and Amazon Inspector are the appropriate AWS services for threat detection and vulnerability management. Amazon GuardDuty monitors the AWS environment for threats, whereas Amazon Inspector evaluates container images for known software vulnerabilities.

Step-by-Step Solution

1
Identify the service needed for continuous monitoring of AWS accounts for unauthorized behavior and malicious activity.
Amazon GuardDuty uses machine learning, anomaly detection, and integrated threat intelligence to detect malicious activity across accounts.
This matches the threat detection requirement of the agency.
2
Identify the service needed to scan Amazon ECR container images for software vulnerabilities.
Amazon Inspector automatically scans container images stored in Amazon ECR for known vulnerabilities.
This matches the vulnerability management requirement of the agency.

Key Concept

AWS threat detection and vulnerability management services
Question 313Question →

An organization is setting up access controls for a new application developer who needs to manage Amazon S3 buckets and Amazon EC2 instances. Which of the following is the AWS-recommended method to configure this access?

Show answer & explanation

Answer: Create an individual IAM user for the developer and attach policy permissions that grant only the required access.

Answer

Create an individual IAM user for the developer and attach policy permissions that grant only the required access.
Creating a dedicated IAM user and applying the principle of least privilege ensures that the developer has a unique identity and only the permissions required to do their job, which aligns with AWS security best practices.

Step-by-Step Solution

1
Determine the entity type needed for a human operator who requires long-term credentials to access the AWS Management Console.
An IAM user is the correct choice because IAM users represent individuals who require permanent credentials.
This establishes accountability and follows the design pattern for human operators.
2
Determine the appropriate permissions configuration based on AWS security standards.
Apply the principle of least privilege by attaching a policy that only grants access to S3 and EC2.
This minimizes security risks by preventing the developer from accessing unrelated services or sensitive actions.

Key Concept

Best practices for AWS Identity and Access Management (IAM), including using IAM users for human operators, practicing least privilege, and avoiding root user usage.
Estimated Time:45s
Question 314Question →

A company is implementing a data protection policy for its applications running on AWS. The security team needs to understand the division of responsibility for data protection under the AWS Shared Responsibility Model.

Which of the following are responsibilities of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Encrypting customer data at rest within AWS storage services; Configuring SSL/TLS for encrypting data in transit

Answer

Under the AWS Shared Responsibility Model, the customer is responsible for encrypting customer data at rest within AWS storage services and configuring SSL/TLS for encrypting data in transit.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. This includes protecting their own data, which requires them to configure encryption at rest within AWS storage services and establish SSL/TLS encryption for data in transit.

Step-by-Step Solution

1
Differentiate between security 'of' the cloud and security 'in' the cloud.
AWS manages security of the cloud (infrastructure, hardware, physical security). The customer manages security in the cloud (data, configurations, access control).
This division defines the boundary of responsibilities under the AWS Shared Responsibility Model.
2
Classify the given options into customer or AWS responsibilities.
Encrypting data at rest and configuring SSL/TLS for data in transit are security configurations within the customer's guest environment. Physical security and hardware disposal are infrastructure tasks managed by AWS.
Identifying who controls the configuration helps correctly attribute the responsibility.

Key Concept

Under the AWS Shared Responsibility Model, AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. The customer is responsible for managing their data (including encryption options), classified as security 'in' the cloud.
Question 315Question →

An online education platform needs to implement a security and monitoring strategy for its AWS environment. The security team must meet two primary requirements: first, they must keep a complete history of all API calls made within their AWS account for auditing purposes; second, they need to continuously monitor their AWS accounts and workloads for malicious activity and unauthorized behavior, such as potential cryptocurrency mining. Which AWS services should the company implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon GuardDuty

Answer

The company should use AWS CloudTrail to record the history of API calls, and Amazon GuardDuty to monitor the account and workloads for malicious behavior like cryptocurrency mining.
AWS CloudTrail is designed to record API calls and user activity for security auditing. Amazon GuardDuty is a threat detection service that continuously monitors accounts and workloads for malicious activity, such as unauthorized access or cryptocurrency mining.

Step-by-Step Solution

1
Identify the service that records AWS API calls and user activity.
AWS CloudTrail is identified as the audit log provider.
The requirement is to keep a history of all API calls for auditing purposes.
2
Identify the service that performs intelligent threat detection and workload monitoring.
Amazon GuardDuty is identified as the threat detection service.
The requirement is to monitor for malicious activities and unauthorized behaviors like cryptocurrency mining.
3
Verify that the incorrect services are ruled out based on their use cases.
Amazon CloudWatch and Amazon Inspector are ruled out.
CloudWatch is for performance monitoring and Inspector is for vulnerability scanning.

Key Concept

Distinguishing between audit trails, active threat detection, and operational monitoring in AWS.
Question 316Question →

Which of the following AWS Identity and Access Management (IAM) components is specifically designed to provide temporary security credentials for AWS services or federated users?

Show answer & explanation

Answer: IAM role

Answer

IAM role
The correct answer is the option specifying an IAM role. An IAM role is an identity that you can create in your account that has specific permissions. It is not associated with a specific user or group, and when assumed, AWS Security Token Service (STS) dynamically generates temporary security credentials that expire after a set duration.

Step-by-Step Solution

1
Identify the primary requirement in the question stem, which is the need for temporary security credentials for AWS services or federated users.
Temporary security credentials are required.
This narrows down the potential IAM entities to those that do not use permanent or long-term keys.
2
Evaluate the credentials associated with each IAM entity: IAM users, groups, roles, and the root user.
IAM users, groups, and root users use or manage long-term credentials, whereas IAM roles use security tokens for temporary access.
To choose the correct identity type, we must distinguish between permanent and temporary credential mechanisms in AWS.
3
Select the entity that can be assumed to obtain temporary credentials.
IAM role is selected as the correct answer.
An IAM role provides temporary security credentials when assumed by a service or external identity.

Key Concept

Temporary security credentials via IAM Roles
Estimated Time:45s
Question 317Question →

A financial institution is deploying a payment gateway on AWS. The institution's compliance policy dictates that all customer transactions must be encrypted at rest using single-tenant cryptographic hardware under the institution's exclusive control. Additionally, all transactional data must be encrypted in transit across all application tiers.

Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Generating and managing the cryptographic keys and user accounts within an AWS CloudHSM instance; Configuring SSL/TLS parameters to secure data in transit between application layers

Answer

Generating and managing the cryptographic keys and user accounts within an AWS CloudHSM instance, and configuring SSL/TLS parameters to secure data in transit between application layers.
Generating and managing keys inside AWS CloudHSM is a customer responsibility because CloudHSM provides dedicated cryptographic hardware where the customer has sole control over keys and users. Configuring SSL/TLS parameters for data in transit is also a customer responsibility because it is configured at the application and operating system level, which falls under customer control in the AWS Shared Responsibility Model.

Step-by-Step Solution

1
Identify key management requirements.
The scenario requires dedicated, single-tenant cryptographic hardware under exclusive control. This points to AWS CloudHSM.
AWS CloudHSM provides dedicated, single-tenant hardware security modules where the customer manages the keys and users, unlike AWS KMS which is multi-tenant by default.
2
Identify data in transit requirements.
Securing data in transit requires SSL/TLS configuration between application layers.
Encrypting data in transit is handled by configuring secure communication protocols (like SSL/TLS) at the operating system or application tier, which are managed by the customer.
3
Differentiate customer responsibilities from AWS responsibilities.
AWS handles physical security, hardware lifecycle, and hypervisor security, while the customer handles data configuration, encryption settings, and key management inside their instances.
Under the Shared Responsibility Model, AWS is responsible for security 'of' the cloud (physical data centers, hardware infrastructure), and the customer is responsible for security 'in' the cloud (data encryption, network traffic protection).

Key Concept

Under the AWS Shared Responsibility Model, the customer is responsible for configuring encryption in transit (SSL/TLS) and managing their cryptographic keys and user accounts within single-tenant hardware like AWS CloudHSM, while AWS handles physical infrastructure and hardware maintenance.
Estimated Time:2m 0s
Question 318Question →

A startup is configuring access permissions for a newly deployed multi-tier application. An Amazon EC2 instance needs to retrieve configuration files from an Amazon S3 bucket, while an external systems administrator requires temporary access to troubleshoot EC2 configurations. Which two of the following options represent AWS-recommended practices for securing these access requirements?

Select all that apply

Show answer & explanation

Answer: Attach an IAM role with S3 read-only permissions to the EC2 instance to grant the application temporary access credentials.; Configure an IAM role with EC2 administrative permissions for the external administrator to assume for a limited duration.

Answer

The correct practices are to attach an IAM role with S3 read-only permissions to the EC2 instance and to configure an IAM role with EC2 administrative permissions for the external administrator to assume for a limited duration.
Attaching an IAM role with S3 permissions to the EC2 instance ensures the application dynamically acquires temporary credentials, avoiding hardcoded secrets. Additionally, setting up an IAM role with EC2 administrative permissions that the external administrator can assume ensures they only have administrative access for a limited, controlled duration.

Step-by-Step Solution

1
Analyze the access requirement for the EC2 instance.
The application running on the instance requires access to S3. AWS recommends using IAM roles to delegate temporary credentials to applications instead of using long-term access keys.
This secures EC2-to-S3 access without exposing long-term secrets.
2
Analyze the access requirement for the external systems administrator.
The administrator only needs access temporarily. AWS recommends using assume-role configurations to grant temporary credentials for third parties or administrative tasks.
This ensures the administrative permissions expire after a set time, reducing the attack surface.
3
Evaluate the distractors against AWS best practices and the Shared Responsibility Model.
Using the root account, using hardcoded IAM user access keys, and expecting AWS to manage OS-level settings all violate AWS practices.
This confirms the two chosen answers are the only correct and secure solutions.

Key Concept

Securing applications and users using IAM roles to provide temporary credentials and adhering to the Shared Responsibility Model.
Estimated Time:1m 30s
Question 319Question →

An education technology company is preparing for an independent audit to verify its compliance with international security standards. The compliance team needs to obtain official documentation regarding the security of the AWS physical infrastructure and understand which compliance tasks remain the responsibility of the company. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS ISO 27001 certification directly from AWS Artifact; Configure and document the security settings of guest operating systems running on Amazon EC2 instances

Answer

The company should download the AWS ISO 27001 certification directly from AWS Artifact and configure and document the security settings of guest operating systems running on Amazon EC2 instances.
The correct answers identify downloading the compliance documents from AWS Artifact and managing guest operating system security as customer responsibilities. Under the Shared Responsibility Model, AWS maintains compliance and security audits of the physical infrastructure and virtualization layer, which customers can verify by downloading reports from AWS Artifact. Meanwhile, customers are fully responsible for the compliance, security configurations, and updates of the operating systems they run on their EC2 instances.

Step-by-Step Solution

1
Identify where to retrieve AWS's third-party compliance reports.
AWS Artifact is recognized as the correct portal for downloading compliance reports like ISO certifications and SOC reports.
AWS provides on-demand access to its compliance documentation to help customers verify AWS infrastructure security.
2
Determine the customer's responsibilities for compliance under the Shared Responsibility Model.
The customer is responsible for the configuration, maintenance, and security of guest operating systems running on EC2.
AWS manages security of the cloud (infrastructure, physical hosts), whereas customers manage security in the cloud (guest OS, applications, data).

Key Concept

AWS Compliance and the Shared Responsibility Model
Question 320Question →

A company wants to grant a team of new developers access to manage AWS resources. All developers in the team require the same permissions. Which of the following actions align with AWS Identity and Access Management (IAM) security best practices to accomplish this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM group with the required permissions attached, and add individual developer user accounts to this group.; Enable multi-factor authentication (MFA) on each individual developer's IAM user account.

Answer

Creating an IAM group with the required permissions attached, adding developer user accounts to this group, and enabling multi-factor authentication (MFA) on each developer's IAM user account.
Configuring permissions using IAM groups ensures administrative efficiency and uniform policy application. Securing individual accounts with multi-factor authentication (MFA) adds essential protection to human access identities.

Step-by-Step Solution

1
Determine the best practice for applying identical permissions to multiple users.
Utilize an IAM group to consolidate and manage permissions for the entire team in one place.
This prevents configuration drift and simplifies permission management.
2
Determine the best practice for protecting individual credentials.
Apply Multi-Factor Authentication (MFA) to all individual accounts.
MFA provides additional protection if a user's password is stolen or guessed.

Key Concept

Foundational IAM Best Practices (Groups and MFA)
PreviousPage 16 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 16 | Examkin