Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 341Question →

A game development studio is deploying dedicated multiplayer game servers on Amazon Elastic Compute Cloud (Amazon EC2). According to the AWS Shared Responsibility Model, which two operational security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Patching the guest operating system of the game server instances; Configuring the guest operating system firewalls on the EC2 instances

Answer

The customer is responsible for patching the guest operating system of the game server instances and configuring the guest operating system firewalls on the EC2 instances.
Under the AWS Shared Responsibility Model, Amazon EC2 is treated as an Infrastructure as a Service (IaaS) model. In this setup, the customer maintains control of the guest operating system, which includes the responsibility to apply OS patches and configure software firewalls within the instances. AWS handles the physical infrastructure and the virtualization layer.

Step-by-Step Solution

1
Identify the service type and model boundary in the scenario.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, meaning the customer maintains full control over the guest operating system, network configurations, and data.
Determining whether the service is IaaS, PaaS, or SaaS helps establish where the boundary between customer and AWS responsibility lies.
2
Differentiate between security 'of' the cloud and security 'in' the cloud.
AWS secures the global infrastructure, physical hardware, and virtualization layers. The customer secures their data, operating systems, and network access controls.
Categorizing tasks using this distinction helps identify which responsibilities belong to the customer.

Key Concept

Shared Responsibility Model for IaaS Services
Question 342Question →

A municipal public transit authority is migrating its ticketing database and web applications to the AWS Cloud. During an audit, the compliance officer asks who is responsible for configuring firewall rules (such as security groups) to protect the applications, and how the authority can verify AWS's physical infrastructure compliance. Which of the following statements correctly identifies the responsibility mapping and the service needed to retrieve the necessary AWS compliance reports?

Show answer & explanation

Answer: The customer is responsible for configuring security groups; AWS compliance documents are retrieved using AWS Artifact.

Answer

The customer is responsible for configuring security groups, and AWS compliance documents are retrieved using AWS Artifact.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes defining firewall rules via security groups. To download AWS's official compliance documentation (like ISO and PCI certifications), the customer must use AWS Artifact, which is the central portal for these agreements and reports.

Step-by-Step Solution

1
Identify the security group configuration responsibility within the Shared Responsibility Model.
Customers are responsible for security 'in' the cloud, which includes configuring guest operating systems, network access control lists, and security groups.
AWS manages the global infrastructure, while the customer controls their resources and access configurations.
2
Identify the AWS service dedicated to providing compliance reports and agreements.
AWS Artifact provides on-demand access to AWS security and compliance reports (such as SOC and PCI reports) and online agreements.
Other services like CloudTrail or Trusted Advisor serve different auditing or optimization functions.

Key Concept

Understanding compliance reports retrieval and the Shared Responsibility Model boundaries.
Estimated Time:1m 0s
Question 343Question →

An organization runs automated database backup scripts on its on-premises servers. These scripts need to upload backups to an Amazon S3 bucket. To comply with security best practices, the organization wants to avoid storing long-term access keys on the physical servers. Which IAM solution should the organization implement to grant these scripts secure, temporary access?

Show answer & explanation

Answer: AWS IAM Roles Anywhere

Answer

AWS IAM Roles Anywhere
AWS IAM Roles Anywhere is the correct solution because it allows workloads running outside of AWS, such as on-premises servers, to use digital certificates to authenticate and obtain temporary AWS credentials by assuming an IAM role. This eliminates the security risk of storing long-term AWS access keys on physical infrastructure.

Step-by-Step Solution

1
Identify the requirements: the workload runs on-premises, needs access to Amazon S3, and must not store long-term access keys.
Conclude that standard IAM roles cannot be directly assumed by on-premises servers without a secure mechanism to authenticate them.
On-premises servers do not have access to the AWS Instance Metadata Service, which automatically distributes credentials to AWS-native resources.
2
Evaluate AWS services designed for hybrid security integration.
Determine that AWS IAM Roles Anywhere is the designated feature that allows external workloads to exchange X.509 digital certificates for temporary AWS credentials.
This establishes trust between the on-premises environment and AWS to provision short-term security credentials dynamically without storing long-term access keys.

Key Concept

AWS IAM Roles Anywhere provides temporary security credentials for workloads outside of AWS.
Question 344Question →

A newly hired cloud administrator needs to perform daily operational tasks in the AWS Management Console, such as configuring network settings and managing Amazon S3 buckets. Which AWS security best practice should be followed to grant these permissions?

Show answer & explanation

Answer: Create an individual IAM user with the necessary permissions for the administrator's daily tasks.

Answer

Create an individual IAM user with the necessary permissions for the administrator's daily tasks.
Creating an individual IAM user for daily tasks aligns with the AWS best practice of maintaining separate identities for auditing and applying the principle of least privilege, while avoiding the use of the root user.

Step-by-Step Solution

1
Analyze the operational requirements.
A new internal administrator needs persistent access to the AWS Management Console to perform everyday administrative tasks such as configuring networks and S3.
Understanding the identity type and access frequency helps determine the correct IAM entity to use.
2
Apply AWS security best practices for identity management.
The AWS account root user should not be used for daily tasks. Instead, an individual IAM user should be created with standard administrator permissions mapped to their specific identity.
This establishes individual accountability, supports the principle of least privilege, and protects the root account.

Key Concept

AWS IAM Best Practices - Avoiding Root User and Using Individual IAM Users
Estimated Time:45s
Question 345Question →

A SaaS provider hosts its web application on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (Amazon ECR). The security team needs to implement automated tools to accomplish two tasks:
1. Continually scan the EC2 instances and container images for software vulnerabilities and unintended network exposure.
2. Monitor AWS account activity and network traffic to detect anomalous behavior, potential unauthorized access, and malicious threats.

Which two AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty should be used to scan for software vulnerabilities and detect malicious threats, respectively.
Amazon Inspector automatically and continuously scans EC2 instances and ECR container images for software vulnerabilities and unintended network exposure. Amazon GuardDuty provides continuous threat detection by monitoring AWS account activity and network traffic to identify potential malicious activity.

Step-by-Step Solution

1
Identify the service responsible for scanning EC2 instances and ECR container images for software vulnerabilities and network exposure.
Amazon Inspector performs vulnerability scanning on Amazon EC2 instances and Amazon ECR images.
This meets the first requirement of detecting software vulnerabilities and unintended network exposure.
2
Identify the service responsible for monitoring AWS account activity and network traffic to detect anomalous or malicious behavior.
Amazon GuardDuty provides continuous threat detection by analyzing events and log data.
This meets the second requirement of detecting threats, unauthorized access, and malicious activity.

Key Concept

AWS threat detection and vulnerability management services
Estimated Time:1m 30s
Question 346Question →

A media broadcasting company is preparing for an annual governance review of its cloud-based video archiving system. The governance team needs to acquire official AWS ISO 27001 certification documents and clarify how the security of AWS's physical infrastructure is validated. Which two of the following options represent correct actions or concepts that meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Retrieve the AWS ISO 27001 certification report directly from AWS Artifact.; Rely on AWS compliance reports for physical infrastructure security, as AWS is responsible for security of the cloud.

Answer

To meet the governance requirements, the company should retrieve the AWS ISO 27001 certification report directly from AWS Artifact, and rely on AWS compliance reports for physical infrastructure security, as AWS is responsible for security of the cloud.
Retrieving the AWS ISO 27001 certification report directly from AWS Artifact is correct because AWS Artifact is the self-service portal that provides on-demand access to AWS security and compliance reports. Relying on AWS compliance reports for physical infrastructure security is correct because, under the Shared Responsibility Model, AWS is responsible for security of the cloud (the physical infrastructure), and customers verify this inheritance through these reports.

Step-by-Step Solution

1
Identify where to retrieve official AWS compliance documents.
AWS Artifact is identified as the portal providing on-demand access to AWS security and compliance reports (such as SOC and ISO certifications).
This resolves the requirement of acquiring the official AWS ISO 27001 certification.
2
Determine the boundary of security responsibility for physical infrastructure under the Shared Responsibility Model.
Under the model, AWS is responsible for security 'of' the cloud, which includes the physical infrastructure of data centers.
This clarifies how physical security is validated without needing custom audits.

Key Concept

AWS compliance reports retrieval via AWS Artifact and boundaries of physical security under the Shared Responsibility Model.
Question 347Question →

A logistics company is building a package tracking system on AWS. The company's security policy requires that all package destination logs must be encrypted at rest. Which of the following are customer responsibilities for protecting this data? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enabling encryption on the AWS storage services where the logs are stored; Managing access permissions for the keys used to encrypt the logs

Answer

Under the AWS Shared Responsibility Model, the customer is responsible for enabling encryption on the storage services where their logs reside, and managing the access permissions for the keys used to encrypt those logs.
Under the AWS Shared Responsibility Model, customers are responsible for data protection settings within the services they use ('security in the cloud'). This includes configuring encryption at rest for storage resources (such as Amazon S3 buckets or Amazon EBS volumes) and managing access permissions for the cryptographic keys used to encrypt that data. AWS, on the other hand, is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud ('security of the cloud').

Step-by-Step Solution

1
Identify the boundary between customer responsibility and AWS responsibility regarding data protection.
Recognize that 'security in the cloud' (such as configuring encryption on storage services and managing key access) is the customer's responsibility, while 'security of the cloud' (physical security and hardware maintenance) is AWS's responsibility.
This helps eliminate options that involve physical data center security or hardware replacements.
2
Evaluate the remaining options to identify correct key management and encryption practices.
Confirm that configuring encryption on storage services and managing key permissions are correct customer duties, whereas AWS CloudHSM is a dedicated service requiring manual key administration rather than automatic global service integration.
This isolates the two correct actions.

Key Concept

AWS Shared Responsibility Model for Data Encryption
Estimated Time:45s
Question 348Question →

An online education platform is deploying a new serverless application using AWS Lambda functions. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Configuring the Identity and Access Management (IAM) execution role and access policies for the Lambda function.

Answer

Configuring the Identity and Access Management (IAM) execution role and access policies for the Lambda function.
Configuring the IAM execution role and access policies is a customer responsibility under security 'in' the cloud. The customer must define permissions to ensure the function only accesses the resources it requires (least privilege rule).

Step-by-Step Solution

1
Analyze the service classification specified in the scenario.
The application runs on AWS Lambda, which is classified as a serverless/managed service.
Different service categories (IaaS vs. PaaS/Serverless) shift the boundaries of the Shared Responsibility Model, with AWS taking on more administrative responsibilities for managed services.
2
Determine the boundary between AWS and customer responsibilities for managed serverless resources.
AWS manages physical security, virtualization, container OS, and execution runtimes. The customer manages application code, data classification, and Identity and Access Management (IAM) permissions.
This division isolates infrastructure maintenance from application-level configurations and security settings.
3
Evaluate the choices to locate the one that describes a customer configuration task.
Configuring IAM execution roles is an access management task performed by the customer inside the console or API.
IAM settings are always managed by the customer to maintain control over authorization and resource access.

Key Concept

Shared Responsibility Model for Serverless Services
Estimated Time:1m 30s
Question 349Question →

A company is setting up a new AWS account and needs to organize access permissions for several system administrators and developers. According to AWS Identity and Access Management (IAM) best practices, which TWO statements correctly describe the characteristics and usage of IAM groups? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: They allow administrators to assign permissions to multiple IAM users simultaneously by attaching a policy to the group.; They are collections of IAM users and do not possess their own login credentials or access keys.

Answer

The correct statements are that IAM groups allow administrators to assign permissions to multiple users at once by attaching a policy, and that they are collections of users without their own security credentials.
IAM groups are designed to simplify permission management by allowing administrators to apply policies to multiple users at once. Because they are administrative collections rather than entities that take action, they do not have login credentials or access keys of their own.

Step-by-Step Solution

1
Analyze the role and capabilities of IAM groups in AWS.
Identify that IAM groups are collections of IAM users used to simplify permission management. Policies attached to a group are inherited by all member users.
This helps determine which options correctly state how groups function.
2
Examine the credentials and structure of IAM groups.
Confirm that IAM groups do not have their own password or access keys, and cannot be nested or assumed by AWS services.
This allows us to identify the second correct statement and rule out the incorrect statements.

Key Concept

IAM groups simplify access management by applying policies to multiple users at once, and they do not have credentials or support nesting.
Question 350Question →

A digital publishing company requires a solution to track changes made to its AWS infrastructure resources, specifically recording who made a configuration change and when. At the same time, the company needs to monitor application log files for specific error patterns and trigger automated alerts. Which AWS services are designed to address these requirements?

Show answer & explanation

Answer: AWS CloudTrail for tracking user and API activity, and Amazon CloudWatch for monitoring log files and sending alerts.

Answer

AWS CloudTrail for tracking user and API activity, and Amazon CloudWatch for monitoring log files and sending alerts.
AWS CloudTrail records user activity and API calls, allowing the company to track changes and audit who performed specific actions. Amazon CloudWatch is used to collect logs, monitor application performance, and configure alarms when specific log patterns or thresholds are met.

Step-by-Step Solution

1
Identify the service responsible for auditing API actions and user modifications to resources.
AWS CloudTrail records AWS Management Console actions and API calls.
CloudTrail provides operational and risk auditing of AWS account activity.
2
Identify the service responsible for collecting application logs, monitoring metrics, and triggering alerts.
Amazon CloudWatch monitors resource performance and collects logs to trigger alarms.
CloudWatch provides real-time monitoring and alerting for application metrics and log patterns.

Key Concept

AWS CloudTrail provides compliance auditing of API calls, while Amazon CloudWatch provides performance monitoring and log alerting.
Estimated Time:1m 5s
Question 351Question →

A multi-department enterprise is setting up its AWS environment. The security team must define access controls for two distinct groups: a finance audit team that requires read-only access to AWS billing information, and an operations team that needs to start, stop, and reboot Amazon EC2 instances. Which TWO of the following configurations represent AWS-recommended IAM best practices to implement this access? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM user group for the audit team, attach the AWS-managed Billing policy to it, and assign individual audit users to this group.; Create an IAM user group for the operations team, attach a customer-managed policy that permits the necessary EC2 actions to it, and assign individual operations users to this group.

Answer

Create an IAM user group for the audit team, attach the AWS-managed Billing policy to it, and assign individual audit users to this group; and create an IAM user group for the operations team, attach a customer-managed policy that permits the necessary EC2 actions to it, and assign individual operations users to this group.
The correct configurations involve creating separate IAM user groups for the audit and operations teams, attaching targeted permission policies, and placing individual users into those groups. This aligns with AWS security best practices by avoiding direct policy assignment to users and applying the principle of least privilege.

Step-by-Step Solution

1
Analyze the access requirements for the audit and operations teams.
The audit team needs read-only billing access. The operations team needs partial EC2 access (start, stop, reboot).
This establishes the minimum permissions needed for each team to apply the principle of least privilege.
2
Identify the AWS identity best practices for organizing access.
Instead of assigning policies to individual users or sharing credentials, users should be placed in IAM user groups with specific permission policies attached.
Grouping users simplifies permission management and ensures consistency across roles.
3
Evaluate the option configurations against security standards.
Creating separate groups for audit and operations with specific policies is correct. Using root accounts, sharing users, or requesting AWS to manage OS access are incorrect configurations.
This rules out distractors based on security anti-patterns and the Shared Responsibility Model.

Key Concept

Principle of least privilege and IAM user groups management
Estimated Time:1m 30s
Question 352Question →

An organization is deploying a web application on Amazon EC2 instances. The security team must ensure that inbound HTTP traffic to port 80 is permitted, and that the corresponding outbound response traffic is automatically allowed back to the client without needing a corresponding outbound rule. Which AWS security feature should be configured to meet this requirement?

Show answer & explanation

Answer: Security Groups

Answer

Security Groups are stateful firewalls that operate at the instance level. When you allow inbound traffic on port 80, the return traffic is automatically allowed regardless of outbound rules. Network Access Control Lists (NACLs) are stateless and would require an explicit outbound rule. Amazon Inspector is a vulnerability scanner, and AWS Shield is for DDoS protection.
Security Groups are stateful firewalls operating at the instance level. Any permitted inbound traffic automatically allows the outbound response traffic to flow back, bypassing outbound rules. This aligns perfectly with the requirement to allow inbound HTTP traffic on port 80 and have the response traffic automatically permitted.

Step-by-Step Solution

1
Analyze the requirement for automatic return traffic.
The requirement specifies that outbound response traffic must be automatically permitted without an explicit outbound rule, indicating a stateful firewall behavior.
Identifying the stateful nature narrows the choices down to Security Groups, since they are stateful at the EC2 instance level.
2
Compare Security Groups and Network ACLs.
Security Groups are stateful (allowing return traffic automatically), while Network ACLs are stateless (requiring explicit rules in both directions).
This confirms that Security Groups are the correct configuration option to meet the organization's requirements.

Key Concept

Stateful vs. stateless network security controls in AWS VPC (Security Groups vs. Network ACLs)
Estimated Time:1m 0s
Question 353Question →

A retail company wants to store its weekly sales reports in Amazon Simple Storage Service (Amazon S3). To protect this data, they want to enable encryption at rest using cryptographic keys that are fully managed by AWS. Which AWS service is designed to easily create and manage these encryption keys?

Show answer & explanation

Answer: AWS Key Management Service (AWS KMS)

Answer

AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) is a fully managed service that integrates with many AWS services (such as Amazon S3) to easily create, manage, and rotate cryptographic keys used to secure data at rest.

Step-by-Step Solution

1
Identify the core requirement from the scenario.
The requirement is to encrypt data at rest in Amazon S3 using a fully managed key management service.
This narrows down the choice to services that deal with encryption and key management.
2
Evaluate the managed services offered by AWS for cryptographic key management.
AWS Key Management Service (AWS KMS) is the standard multi-tenant managed service for creating and managing keys. AWS CloudHSM offers dedicated hardware security modules but requires manual management by the customer.
Since the scenario specifies a fully managed service that easily creates and manages keys, AWS KMS is the correct fit.

Key Concept

AWS Key Management Service (AWS KMS) provides a fully managed, secure solution for creating and controlling cryptographic keys to encrypt data at rest across AWS services.
Estimated Time:45s
Question 354Question →

A logistics company is using Amazon Simple Queue Service (SQS) to decouple its order processing systems. Under the AWS Shared Responsibility Model, which TWO of the following tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring IAM policies to authorize specific applications and microservices to send and receive messages from the queues; Configuring server-side encryption (SSE) for the queues and managing the access permissions of the associated KMS keys

Answer

Configuring IAM policies to authorize specific applications and microservices, and configuring server-side encryption (SSE) for the queues.
Under the AWS Shared Responsibility Model, customers are responsible for securing their data and access to resources (security 'in' the cloud). For a managed service like Amazon SQS, this includes defining IAM policies to regulate queue access and configuring server-side encryption (SSE) along with permissions for AWS KMS keys. AWS maintains the security 'of' the cloud, managing SQS server OS patches, infrastructure scaling, and message replication.

Step-by-Step Solution

1
Differentiate between customer-managed tasks and AWS-managed tasks for fully managed services under the Shared Responsibility Model.
Identify that AWS manages host OS patching and queue replication across Availability Zones.
This rules out tasks related to physical infrastructure and service maintenance.
2
Determine tasks that fall under customer-controlled data protection and access management configurations.
Identify that configuring IAM policies and enabling KMS encryption keys are customer responsibilities.
This establishes the correct actions for securing queue access and data.
3
Analyze how AWS compliance reports are retrieved and audited.
Determine that reports are obtained via AWS Artifact rather than querying CloudWatch Logs.
This eliminates the incorrect auditing method option.

Key Concept

Shared Responsibility Model for Managed Services
Question 355Question →

A travel booking startup wants to establish a logging and monitoring workflow on AWS. The security team needs to audit and track all API calls and user changes made within the AWS account for compliance. The operations team needs to monitor the CPU usage of their Amazon EC2 instances and receive alerts if utilization goes above a threshold. Which AWS services should the startup implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail to capture and audit API activity across the AWS infrastructure; Amazon CloudWatch to collect resource metrics and trigger alerts when performance thresholds are exceeded

Answer

AWS CloudTrail and Amazon CloudWatch should be implemented.
AWS CloudTrail is correct because it provides continuous tracking of user actions and API calls across AWS services, serving the compliance and auditing needs. Amazon CloudWatch is correct because it monitors performance metrics like CPU usage and supports automated alarms when specified thresholds are exceeded.

Step-by-Step Solution

1
Identify the requirement to audit and track API calls and user changes for compliance.
AWS CloudTrail is selected as the primary service for recording API activity and user actions.
CloudTrail provides operational and risk auditing, governance, and compliance logs.
2
Identify the requirement to monitor EC2 CPU usage and receive threshold alerts.
Amazon CloudWatch is selected to monitor performance metrics and configure alarms.
CloudWatch collects monitoring data and enables real-time alarms on performance metrics like CPU utilization.

Key Concept

AWS logging, monitoring, and auditing services
Question 356Question →

A company wants to share a dataset stored in an Amazon S3 bucket with a partner organization's AWS account. The company wants to grant this access by attaching a policy directly to the S3 bucket itself, specifying who can access it. Which type of policy should the company use to meet these requirements?

Show answer & explanation

Answer: Resource-based policy

Answer

Resource-based policy
A resource-based policy, such as an Amazon S3 bucket policy, is attached directly to the resource itself. It allows the owner of the resource to specify which principals (including users, roles, or other AWS accounts) have permission to access that specific resource.

Step-by-Step Solution

1
Identify where the permissions policy needs to be attached according to the scenario.
The scenario requires the policy to be attached directly to the S3 bucket (which is a resource) rather than an IAM user or role.
This establishes that the solution requires a resource-level control mechanism.
2
Determine which AWS policy type is designed to be attached directly to resources and support cross-account principals.
Resource-based policies (such as S3 bucket policies) meet this requirement by directly identifying external AWS account IDs in the 'Principal' element.
This confirms that a resource-based policy is the correct mechanism for this resource-sharing scenario.

Key Concept

Resource-based policies are attached directly to AWS resources (like S3 buckets or KMS keys) and define which principals (including external AWS accounts) can access that resource.
Question 357Question →

A company is configuring a multi-tier web application within an Amazon VPC and needs to implement granular network security controls. The network architect plans to use a combination of Security Groups and Network Access Control Lists (Network ACLs) to secure the application instances and subnets. Which of the following statements correctly describe how Security Groups and Network ACLs handle inbound and outbound traffic? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security Groups are stateful, meaning allowed inbound traffic is automatically permitted to flow outbound as return traffic.; Network ACLs are stateless, meaning return traffic for allowed inbound requests must be explicitly permitted by an outbound rule.

Answer

Security Groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit rules for return traffic).
Security Groups are stateful firewalls that operate at the instance level (network interface level). Any allowed inbound traffic automatically permits the corresponding outbound return traffic. In contrast, Network ACLs are stateless firewalls that operate at the subnet level. They do not remember connection states, so outbound return traffic must be explicitly allowed by an outbound rule.

Step-by-Step Solution

1
Analyze how Security Groups process traffic state.
Security Groups are stateful; once inbound traffic is allowed, the outbound return traffic is automatically allowed.
This is a fundamental design feature of Security Groups to simplify instance-level firewall management.
2
Analyze how Network ACLs process traffic state.
Network ACLs are stateless; they do not track connection state, meaning separate rules are required for inbound and outbound traffic.
This allows subnet-level filtering to have separate controls for ingress and egress traffic.
3
Identify the correct statements and eliminate incorrect options.
The statements defining Security Groups as stateful and Network ACLs as stateless are correct. The statements suggesting the opposite, reversing their operational levels (subnet vs. instance), or misdefining Amazon Inspector are incorrect.
This aligns with the AWS Shared Responsibility Model and core networking concepts in VPC.

Key Concept

Stateful Security Groups vs. Stateless Network ACLs
Question 358Question →

A software development firm is deploying its microservices-based application using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Configuring security groups to control network traffic allowed to reach the containers

Answer

Configuring security groups to control network traffic allowed to reach the containers
Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud.' When using AWS Fargate, AWS handles the host operating system, hypervisor, and physical security. The customer maintains control over, and responsibility for, configuring the security groups to manage inbound and outbound network traffic to their container tasks.

Step-by-Step Solution

1
Identify the service deployment model used in the scenario.
The application runs on Amazon ECS using the AWS Fargate launch type, which is a serverless/managed container environment.
Determining the service type helps define the boundary lines of the Shared Responsibility Model, separating customer tasks from AWS infrastructure tasks.
2
Evaluate the operational tasks against customer and AWS boundaries.
Configuring security groups to filter container traffic is a customer task, while host patching, physical security, and direct host compliance access are managed by AWS.
Under the Shared Responsibility Model, customers are responsible for managing access configurations (security in the cloud) such as security groups for container tasks.

Key Concept

Shared Responsibility Model
Question 359Question →

A logistics company suspects that credentials for one of its administrative accounts have been compromised, leading to unauthorized resource creation in multiple AWS Regions. The security team wants to implement a service that continuously monitors their AWS accounts for malicious activity and anomalies, such as unauthorized API calls or unusual network traffic, without needing to write custom detection rules. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty is the correct AWS service to continuously monitor accounts for malicious activity and anomalies, such as unauthorized API calls, using intelligent threat detection.
Amazon GuardDuty is correct because it is a managed threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity, utilizing machine learning and anomaly detection to identify compromised credentials, unauthorized access, and malicious API patterns.

Step-by-Step Solution

1
Analyze the requirement for continuous, automated threat detection and account-level monitoring for compromised credentials and malicious activity.
Identify that the solution must analyze sources like CloudTrail events, VPC Flow Logs, and DNS logs to discover anomalies automatically.
This establishes the scope of security monitoring and logging needed for the scenario.
2
Evaluate the AWS security services to find the one that performs intelligent threat detection without requiring manual detection rule creation.
Select Amazon GuardDuty, as it uses machine learning and anomaly detection to identify threats like credential compromise across AWS accounts.
This distinguishes Amazon GuardDuty from performance monitoring tools, vulnerability scanners, or infrastructure DDoS protection.

Key Concept

AWS Security Logging, Monitoring, and Auditing using Amazon GuardDuty for threat detection.
Question 360Question →

A startup is setting up an application on AWS and must encrypt its customer data at rest. According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility regarding data protection?

Show answer & explanation

Answer: Enabling and configuring encryption for the application's storage volumes

Answer

Enabling and configuring encryption for the application's storage volumes
The correct answer is correct because configuring and enabling encryption for customer-controlled assets (such as storage volumes and database instances) is a customer responsibility ('Security in the Cloud') under the AWS Shared Responsibility Model.

Step-by-Step Solution

1
Identify the boundary between customer and AWS responsibilities under the Shared Responsibility Model.
AWS is responsible for 'Security of the Cloud' (physical infrastructure, hardware, virtualization layer), while the customer is responsible for 'Security in the Cloud' (customer data, platform, applications, identity and access management).
This establishes which operations fall under AWS control versus customer control.
2
Evaluate the choices to determine which action is performed by the customer.
Enabling and configuring encryption on storage volumes is a configuration task performed by the customer on their own resources ('Security in the Cloud'). Tasks like physical security of hardware and drive decommissioning are 'Security of the Cloud' managed by AWS.
This identifies the correct customer responsibility.

Key Concept

Under the AWS Shared Responsibility Model, customers are responsible for data protection configuration (Security in the Cloud), such as enabling encryption on storage volumes, while AWS manages the physical security and infrastructure (Security of the Cloud).
PreviousPage 18 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 18 | Examkin