Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 361Question →

A retail company hosts its core inventory management system on a fleet of Amazon EC2 instances. The company's security policy requires automated, continuous assessments of these instances to identify software package vulnerabilities and unintended network paths that could lead to exposure. Which AWS service should the company use to automate these security assessments?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
Amazon Inspector is the correct service because it provides automated, continuous vulnerability management. It scans Amazon EC2 instances, Amazon Elastic Container Registry (ECR) container images, and AWS Lambda functions for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Identify the security requirement.
The company needs to continuously scan EC2 instances for software vulnerabilities and network path exposure.
This establishes the target service capability needed (host and vulnerability assessment).
2
Match the requirement with the correct AWS service capability.
Amazon Inspector is designed specifically for automated and continuous vulnerability scanning of EC2 instances, container images, and Lambda functions.
This distinguishes it from log-monitoring, API-logging, or shared infrastructure services.

Key Concept

Automated host and container vulnerability scanning using Amazon Inspector
Estimated Time:1m 30s
Question 362Question →

A medical device manufacturer is deploying an application on AWS that handles sensitive patient health data. The company's compliance framework requires that all data at rest be encrypted using keys stored on dedicated, single-tenant hardware security modules that the customer directly manages. Additionally, the company must maintain responsibility for configuring access to these keys.

Which of the following actions are responsibilities of the customer to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provisioning dedicated hardware security modules using AWS CloudHSM; Configuring key policies and user permissions to control access to the cryptographic keys

Answer

Provisioning dedicated hardware security modules using AWS CloudHSM and configuring key policies and user permissions to control access to the cryptographic keys
The correct actions are provisioning dedicated hardware security modules using AWS CloudHSM and configuring key policies and user permissions. AWS CloudHSM satisfies the compliance requirement for dedicated, single-tenant hardware. Managing permissions and policies to secure access to these keys is a customer responsibility under the AWS Shared Responsibility Model.

Step-by-Step Solution

1
Identify the cryptographic hardware requirement (dedicated, single-tenant hardware security modules directly managed by the customer).
Determine that this maps to AWS CloudHSM rather than AWS Key Management Service (KMS).
AWS CloudHSM is the only AWS service offering dedicated, single-tenant HSMs under direct customer control.
2
Evaluate the customer's administrative boundaries for cryptographic keys under the Shared Responsibility Model.
Identify that configuring access policies and permissions is the customer's duty.
The customer is responsible for security 'in' the cloud, which includes configuring key policies and permissions.
3
Differentiate between customer responsibilities and AWS physical infrastructure duties.
Eliminate options involving physical security and hardware replacement.
AWS is responsible for security 'of' the cloud, meaning physical maintenance and facility security are handled exclusively by AWS.

Key Concept

Distinction between AWS KMS and AWS CloudHSM, and the mapping of data protection responsibilities under the AWS Shared Responsibility Model.
Question 363Question →

A cloud architect needs to implement a network security control that operates at the subnet level to block traffic from a list of known malicious IP addresses before it reaches any EC2 instances. The control must evaluate traffic as it enters and leaves the subnet boundary, and any returned response traffic must be explicitly permitted by a rule because the control does not automatically remember connection states. Which AWS resource should the architect configure?

Show answer & explanation

Answer: Network Access Control Lists (Network ACLs)

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) are stateless firewalls that operate at the subnet level. They require rules to be configured for both inbound and outbound traffic because they do not track connection states.

Step-by-Step Solution

1
Identify the boundary level at which the firewall control must operate.
The requirement specifies the control must operate at the subnet level.
This helps narrow down the choices between instance-level controls and subnet-level controls.
2
Analyze the stateful or stateless behavior required for the firewall rules.
The control must evaluate traffic in both directions and does not automatically track connection states, requiring explicit return rules (stateless behavior).
This confirms that Network ACLs must be used, as they are stateless and operate at the subnet boundary, whereas Security Groups are stateful and operate at the instance level.

Key Concept

Understanding the differences in scope and state management between Security Groups and Network ACLs.
Estimated Time:1m 0s
Question 364Question →

A company is deploying an application on Amazon EC2 instances that requires read and write access to an Amazon DynamoDB table. At the same time, the company needs to grant temporary access to external developers from a partner organization to collaborate on the project.

Which of the following actions align with AWS Identity and Access Management (IAM) best practices to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign an IAM role to the Amazon EC2 instances that grants the necessary permissions to access the Amazon DynamoDB table.; Configure a cross-account IAM role that the partner organization's developers can assume to access the required resources.

Answer

Assign an IAM role to the Amazon EC2 instances to grant permissions to the DynamoDB table, and configure a cross-account IAM role for the partner developers to assume.
The correct options represent AWS best practices for identity management. Assigning an IAM role to the EC2 instances allows secure application-to-service communication via temporary credentials. Configuring a cross-account IAM role for the external developers provides secure, temporary access to the partner organization without requiring new user creation or credential sharing.

Step-by-Step Solution

1
Analyze the access requirement for the application running on Amazon EC2 instances to access Amazon DynamoDB.
Determine that applications on EC2 should use temporary credentials provided by an IAM role associated with an EC2 instance profile, rather than storing long-term credentials like access keys on the instance.
This minimizes security risks by avoiding hardcoded or stored long-term access keys.
2
Analyze the access requirement for third-party developers from a partner organization.
Determine that cross-account access should be managed using IAM roles that external users can assume temporarily, rather than creating permanent IAM users or sharing root credentials.
This follows the security principle of granting temporary access and maintaining central control without sharing sensitive credentials.

Key Concept

AWS identity management best practices prioritize the use of temporary credentials via IAM roles for applications and third-party cross-account access, while strictly avoiding the use of long-term credentials or root accounts for operational tasks.
Question 365Question →

A systems administrator is configuring basic security boundaries for a new VPC deployment. To protect the environment, the administrator must understand the functional differences between Security Groups and Network Access Control Lists (Network ACLs). Which TWO statements accurately describe the characteristics of these two resources? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security Groups operate at the instance level and automatically allow return traffic for approved inbound requests due to their stateful nature.; Network ACLs operate at the subnet boundary and require explicit outbound rules to permit return traffic because they are stateless.

Answer

The correct answers are the statements that Security Groups operate at the instance level and are stateful, and Network ACLs operate at the subnet boundary and are stateless.
Security Groups are stateful firewalls that operate at the instance level (specifically the Elastic Network Interface), meaning outbound return traffic is automatically permitted for established inbound connections. In contrast, Network ACLs are stateless firewalls that operate at the subnet boundary, meaning they evaluate inbound and outbound traffic independently, requiring explicit rules in both directions.

Step-by-Step Solution

1
Identify the level at which Security Groups and Network ACLs operate.
Security Groups apply at the instance (network interface) level, while Network ACLs apply at the subnet boundary.
This distinguishes the scope of each firewall type.
2
Determine the stateful or stateless behavior of each control.
Security Groups are stateful (allowing return traffic automatically), whereas Network ACLs are stateless (requiring separate inbound and outbound rules).
This dictates how traffic return paths must be configured.
3
Evaluate the shared responsibility boundary for security group configurations.
Customers are responsible for configuring their own firewall rules (Security Groups and Network ACLs).
AWS does not manage customer-specific access control policies.

Key Concept

Comparison of Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level)
Question 366Question →

A telemedicine platform hosts its patient portal application on Amazon EC2 instances. The platform's security team needs to implement a solution that continuously monitors the AWS account for malicious activity and unauthorized access, while also automatically scanning the EC2 instances for known software vulnerabilities and unintended network exposure. Which two AWS services should the security team use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides continuous threat detection across the AWS environment, while Amazon Inspector scans the EC2 instances for software vulnerabilities and network exposure.
Amazon GuardDuty continuously monitors AWS accounts and workloads for malicious activity such as credential compromise or malware, while Amazon Inspector automatically scans EC2 instances for software vulnerabilities and unintended network exposure. Together, they satisfy the requirement for both threat detection and vulnerability scanning.

Step-by-Step Solution

1
Analyze the requirement for host-level software vulnerability and network exposure scanning on Amazon EC2 instances.
Amazon Inspector is identified as the service designed for automated vulnerability assessment of EC2 instances.
Inspector performs software package vulnerability checks and assesses network reachability of hosts.
2
Analyze the requirement for continuous account-level monitoring for malicious activity and unauthorized behavior.
Amazon GuardDuty is identified as the designated intelligent threat detection service.
GuardDuty monitors logs (such as CloudTrail, VPC Flow Logs, and DNS logs) to detect activities like cryptomining, credential exfiltration, or unauthorized access.

Key Concept

AWS threat detection and vulnerability management services
Question 367Question →

A healthcare technology company is hosting its web application on Amazon EC2. The company's compliance team requires a continuous audit trail of all API operations and configuration changes made to AWS resources by users and services. Simultaneously, the operations team needs to monitor the CPU utilization of the EC2 instances and receive automated notifications if utilization exceeds 80%. Which of the following AWS services should the company implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon CloudWatch

Answer

AWS CloudTrail and Amazon CloudWatch should be used to record API activity and monitor performance metrics, respectively.
AWS CloudTrail meets the first requirement by tracking and recording user API history and configuration changes for auditing and compliance. Amazon CloudWatch meets the second requirement by gathering performance metrics such as EC2 CPU utilization and generating alarms when thresholds are crossed.

Step-by-Step Solution

1
Identify the service required for compliance auditing and tracking user API activities.
AWS CloudTrail is selected because it records a history of API calls, user logins, and configuration changes within the AWS account.
The compliance team needs a continuous audit trail of all API operations and resource changes.
2
Identify the service required to track performance metrics (CPU utilization) and send alerts.
Amazon CloudWatch is selected because it monitors metrics and allows users to set up alarms and notifications when threshold limits are exceeded.
The operations team needs to monitor CPU utilization on EC2 instances and receive alerts if it exceeds 80%.

Key Concept

Understanding the distinct roles of AWS logging and monitoring services, specifically distinguishing between API auditing (CloudTrail) and operational metric monitoring (CloudWatch).
Estimated Time:1m 0s
Question 368Question →

A startup is hosting a payment processing application on EC2 instances. To secure the environment, they must satisfy two conditions: block traffic from specific external IP addresses at the subnet boundary, and allow HTTPS traffic to the instances such that return traffic is allowed automatically without explicit outbound rules. Which combination of actions should the startup perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a deny rule to the subnet's Network Access Control List (NACL) for the specific IP addresses.; Add an inbound allow rule for port 443 to the Security Group associated with the instances.

Answer

Add a deny rule to the subnet's Network Access Control List (NACL) for the specific IP addresses, and add an inbound allow rule for port 443 to the Security Group associated with the instances.
The correct actions are to configure a deny rule on the subnet's Network Access Control List (NACL) and an inbound allow rule on the EC2 instances' Security Group. NACLs operate at the subnet boundary and allow explicit deny rules, which meets the requirement of blocking specific malicious IP addresses before they reach the hosts. Security Groups operate at the instance level and are stateful, meaning any permitted inbound connection on port 443 automatically permits the corresponding outbound response traffic without requiring a separate outbound rule.

Step-by-Step Solution

1
Analyze the requirement to block traffic from specific external IP addresses at the subnet boundary.
Identify that Network Access Control Lists (NACLs) operate at the subnet level and support explicit deny rules, making them suitable for this requirement.
Security Groups do not support explicit deny rules and operate at the instance level, not the subnet level.
2
Analyze the requirement to allow HTTPS traffic to the instances such that return traffic is allowed automatically.
Identify that Security Groups are stateful and operate at the instance level. An inbound rule allowing port 443 automatically permits the return outbound traffic.
NACLs are stateless and require explicit outbound rules to permit return traffic, which violates the requirement for automatic return traffic.

Key Concept

Understanding the difference between stateful Security Groups (instance-level) and stateless Network ACLs (subnet-level).
Estimated Time:1m 30s
Question 369Question →

A startup's systems administrator needs to perform a set of tasks: launching a new Amazon EC2 instance, configuring an IAM group for developers, modifying the contact information of the AWS account, and closing an unused AWS account. According to AWS security principles, which of these tasks must be performed by logging in as the AWS account root user?

Show answer & explanation

Answer: Modifying the primary account contact information and closing the unused AWS account

Answer

Modifying the primary account contact information and closing the unused AWS account
The correct option correctly identifies that modifying primary account contact information and closing an AWS account are among the few restricted tasks that require logging in as the AWS account root user. AWS recommends protecting the root user credentials and using them only for these specific actions.

Step-by-Step Solution

1
Analyze the administrative tasks to determine if they are daily operations or critical account lifecycle actions.
Launching EC2 instances and configuring IAM groups are identified as standard daily administrative tasks, while closing the account and changing primary contact information are account-level operations.
This separation helps identify where the principle of least privilege and root user protection rules apply.
2
Evaluate the permissions and capabilities of IAM identities (users, groups, and roles) versus the root user.
Daily administrative tasks can be fully managed using IAM policies attached to IAM users or groups. Account closure and primary credential/contact modifications are restricted exclusively to the root user.
AWS security best practices dictate that the root user should not be used for daily tasks, but is required for specific, high-risk account management tasks.
3
Verify if the task can be delegated to AWS Support under the Shared Responsibility Model.
AWS is responsible for security of the cloud, while the customer is responsible for security in the cloud, which includes account configurations and management. Thus, AWS Support cannot perform these tasks.
This confirms that the customer must perform these actions themselves using the appropriate account credentials.

Key Concept

AWS Root User vs IAM administrative users and roles
Estimated Time:1m 0s
Question 370Question →

A developer is deploying a backend database within an Amazon VPC and needs to restrict access so that only the application tier can communicate with it. The developer wants a security control that operates at the instance level and automatically allows return traffic for any established inbound connection. Which AWS security feature should the developer implement?

Show answer & explanation

Answer: Security groups

Answer

Security groups
The correct answer is security groups. Security groups act as a virtual firewall for your EC2 instances to control incoming and outgoing traffic. They are stateful, which means that if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Similarly, if inbound traffic is allowed, return outbound traffic is automatically allowed.

Step-by-Step Solution

1
Identify the level of security control required by the scenario.
The scenario requires an instance-level firewall rather than a subnet-level control.
This narrows the choice down to security groups, as network ACLs operate at the subnet level.
2
Determine the statefulness behavior of the required control.
The firewall must automatically allow outbound return traffic for any established inbound connection, which is the definition of stateful behavior.
Security groups are stateful and automatically permit return traffic, satisfying both the instance-level and stateful requirements.

Key Concept

Security groups are stateful, instance-level firewalls in Amazon VPC, whereas Network ACLs are stateless, subnet-level firewalls.
Question 371Question →

A digital marketing firm is hosting a data analytics application on AWS and has chosen to deploy its relational database using Amazon Relational Database Service (Amazon RDS). According to the AWS Shared Responsibility Model, which operational security task is the sole responsibility of the customer?

Show answer & explanation

Answer: Configuring network access rules using security groups and managing database user permissions.

Answer

Configuring network access rules using security groups and managing database user permissions.
The option concerning security groups and user permissions is correct. Under the AWS Shared Responsibility Model, Amazon RDS is a managed service. While AWS is responsible for security 'of' the cloud (including database patching, physical infrastructure, and host OS maintenance), the customer remains responsible for security 'in' the cloud, which includes configuring database network access using security groups and managing database-level user accounts and authorization.

Step-by-Step Solution

1
Identify the AWS service type being used in the scenario.
Amazon RDS is an AWS managed database service (Platform-as-a-Service/PaaS).
The level of customer responsibility under the Shared Responsibility Model varies depending on whether the service is Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), or Software-as-a-Service (SaaS).
2
Determine the boundary of responsibility for Amazon RDS.
AWS manages the operating system, database patching, backups, physical infrastructure, and hardware. The customer manages database access control, network access configurations (security groups), and data encryption.
Since RDS is a managed service, AWS abstracts the underlying OS and hardware, shifting those security responsibilities from the customer to AWS.
3
Evaluate the choices against the customer's responsibilities for Amazon RDS.
Configuring security groups and user access is a customer responsibility. Operating system patching, physical hardware maintenance, and data center security logs are AWS responsibilities.
This isolates the correct task that falls on the customer under security 'in' the cloud.

Key Concept

Shared Responsibility Model for Managed Services (PaaS)
Question 372Question →

A cloud practitioner is planning the network security layout for an Amazon VPC. Which two of the following statements correctly describe the characteristics of security groups and Network Access Control Lists (NACLs)?

Select all that apply

Show answer & explanation

Answer: Security groups are stateful, meaning return traffic is automatically allowed regardless of outbound rules.; Network ACLs operate at the subnet level and act as a firewall for controlling traffic entering and leaving one or more subnets.

Answer

Security groups are stateful (inbound allowed traffic automatically allows return traffic) and Network ACLs operate at the subnet level as a firewall.
The correct options are that security groups are stateful (allowing return traffic automatically) and Network ACLs operate at the subnet boundary as firewalls. These represent the standard configuration and operational boundaries for VPC network security.

Step-by-Step Solution

1
Analyze the characteristics of security groups.
Identify that security groups operate at the instance level and are stateful, which means they automatically allow return traffic.
This helps evaluate the options regarding security group scope and statefulness.
2
Analyze the characteristics of Network Access Control Lists (NACLs).
Identify that Network ACLs operate at the subnet level and are stateless, requiring explicit rules for both inbound and outbound traffic.
This helps evaluate the options regarding Network ACL scope and statefulness.
3
Evaluate the option related to the Shared Responsibility Model.
Recognize that network configuration, including security groups and NACL rules, is a customer responsibility.
This eliminates the distractor proposing that AWS manages these custom rules.

Key Concept

Understanding the difference between stateful security groups (instance-level) and stateless Network ACLs (subnet-level), and the customer responsibility for network security configuration.
Question 373Question →

An automotive telemetry platform processes data from millions of connected vehicles and stores it in AWS. The security operations team needs to continuously monitor the AWS accounts and containerized workloads for threats such as cryptocurrency mining, credential exfiltration, and communication with malicious IP addresses. Which AWS service should the platform team use to perform this intelligent threat detection?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty is the correct AWS service to perform continuous, intelligent threat detection by monitoring activities such as potential cryptocurrency mining, compromised credentials, and unauthorized communications.
Amazon GuardDuty is a continuous security monitoring service that analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS query logs. It uses threat intelligence feeds and machine learning to identify anomalous and malicious activities within the AWS environment, such as communication with command-and-control servers or cryptocurrency mining.

Step-by-Step Solution

1
Analyze the operational requirements of the security team.
The platform requires intelligent, continuous threat detection targeting behaviors like cryptocurrency mining, credential exfiltration, and malicious IP communications.
Distinguishing between vulnerability scanning (proactive software analysis) and active threat detection (reactive/behavioral log analysis) is critical to selecting the correct AWS service.
2
Map the requirements to the correct AWS security service.
Amazon GuardDuty continuously analyzes data sources including CloudTrail events, VPC Flow Logs, and DNS logs to identify malicious activities and anomalies. The other services listed perform vulnerability assessment (Amazon Inspector), auditing (AWS CloudTrail), or DDoS mitigation (AWS Shield).
Aligning AWS service capabilities with the scenario's functional demands identifies the correct solution.

Key Concept

Continuous Threat Detection and Anomaly Monitoring
Question 374Question →

A retail company's security team wants to monitor log files generated by an application running on Amazon EC2 instances. They need to aggregate these logs in a central location, monitor them for specific patterns (such as failed authentication attempts), and send real-time alerts to the team when a threshold is exceeded. Which AWS service should the company use to meet these requirements?

Show answer & explanation

Answer: Amazon CloudWatch

Answer

Amazon CloudWatch is the service that should be used because it collects and aggregates application logs, monitors them for patterns, and triggers alarms.
Amazon CloudWatch is designed to collect logs, metrics, and events from AWS resources and applications. By installing the CloudWatch agent on Amazon EC2 instances, the security team can push custom application logs to CloudWatch Logs, use metric filters to look for specific patterns like failed login attempts, and set up CloudWatch Alarms to send real-time notifications.

Step-by-Step Solution

1
Analyze the request requirements: the company needs to aggregate log files generated inside an Amazon EC2 instance (guest OS/application level) and set up metric filters/alarms based on pattern matching (like failed logins).
Identified log aggregation and custom pattern alerting as the primary requirements.
This establishes the scope of the required service capabilities.
2
Evaluate the capabilities of Amazon CloudWatch Logs for EC2 instances.
Amazon CloudWatch Logs can collect custom application and system logs using the CloudWatch agent installed on the instance.
This confirms CloudWatch can fulfill the aggregation requirement.
3
Determine how to monitor for specific patterns and send real-time alerts.
CloudWatch Logs allows the creation of metric filters (to count specific terms or patterns) and CloudWatch Alarms (to send alerts, such as via Amazon SNS, when thresholds are exceeded).
This confirms CloudWatch fulfills the real-time alerting requirement.

Key Concept

Amazon CloudWatch logs performance metrics, application logs, and resource metrics, allowing users to configure alarms for real-time monitoring and alerting.
Estimated Time:1m 30s
Question 375Question →

A logistics company is setting up its virtual private cloud (VPC) on AWS. The network administrator needs to ensure that return traffic for allowed inbound requests to EC2 instances is permitted automatically without needing explicit outbound rules. However, they also need a secondary layer at the subnet boundary that can explicitly block all traffic from a known list of scanner IP addresses. Which network security configurations should be used to accomplish this?

Show answer & explanation

Answer: Configure a stateful Security Group at the instance level to allow return traffic automatically, and a stateless Network ACL at the subnet level to block the scanner IPs.

Answer

Configure a stateful Security Group at the instance level to allow return traffic automatically, and a stateless Network ACL at the subnet level to block the scanner IPs.
The correct option correctly identifies the roles and behaviors of Security Groups and Network ACLs. Security Groups are stateful firewalls that run at the instance level, meaning that return traffic is automatically allowed regardless of outbound rules. Network ACLs operate at the subnet level and are stateless, meaning they evaluate traffic in both directions separately and support explicit deny rules to block specific IP addresses.

Step-by-Step Solution

1
Analyze the requirement for automatic return traffic without outbound rules.
Identify that a stateful firewall is required at the instance level, which is the definition of an AWS Security Group.
Security Groups are stateful, meaning any inbound traffic allowed is automatically permitted to flow outbound.
2
Analyze the requirement to block specific IP addresses at the subnet boundary.
Identify that a subnet-level firewall supporting deny rules is required, which points to a Network Access Control List (NACL).
Network ACLs operate at the subnet level, are stateless, and allow both explicit allow and deny rules.

Key Concept

The difference between stateful Security Groups (operating at the instance level) and stateless Network ACLs (operating at the subnet level).
Question 376Question →

A company's security team is restricting access for a group of data analysts who currently hold full administrative permissions. The team wants to ensure the analysts can only read data from specific Amazon S3 buckets and run queries in Amazon Athena, following the principle of least privilege. Which of the following actions should the security team perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM group for the analysts and attach an IAM policy that grants read-only access to S3 and query permissions for Athena.; Place the individual IAM users of the analysts into the new IAM group and remove any directly attached AdministratorAccess policies.

Answer

Creating a dedicated IAM group with a policy that allows only S3 and Athena access, and moving the analysts' individual IAM users into that group while removing their administrator policies.
The correct actions involve applying the principle of least privilege. By creating an IAM group with a policy restricted to the required Amazon S3 and Amazon Athena permissions, and placing individual IAM users into this group while stripping their admin rights, the company ensures that analysts have only the access necessary for their job functions. Managing access at the group level simplifies administration and aligns with AWS security best practices.

Step-by-Step Solution

1
Define the required permissions using an IAM policy that allows read-only access to Amazon S3 and query execution in Amazon Athena, and attach it to a newly created IAM group.
Access is grouped under a single administrative boundary corresponding to the analysts' job role.
Grouping permissions makes management easier and adheres to the principle of least privilege.
2
Assign the analysts' individual IAM users to the IAM group and detach any previously assigned direct policies, such as administrative access.
Analysts lose broad access and are restricted only to the permissions granted by the group policy.
This implements the transition to least privilege access controls safely.

Key Concept

Implementing the principle of least privilege using IAM users, groups, and policies under the AWS Shared Responsibility Model.
Question 377Question →

A telecommunications company is migrating its customer billing system to AWS. The security policy mandates that all database backups stored in Amazon S3 must be encrypted at rest using encryption keys managed within dedicated, single-tenant hardware security modules (HSMs) to comply with local regulations. Additionally, the company wants to ensure this encryption strategy complies with the AWS Shared Responsibility Model.

Which of the following options correctly identify a service or responsibility required for this architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudHSM to manage the encryption keys on dedicated, single-tenant hardware security modules.; The customer's responsibility to configure the server-side encryption settings on the Amazon S3 buckets.

Answer

AWS CloudHSM to manage the encryption keys on dedicated, single-tenant hardware security modules, and the customer's responsibility to configure the server-side encryption settings on the Amazon S3 buckets.
AWS CloudHSM provides dedicated, single-tenant hardware security modules (HSMs) directly under the customer's control, which satisfies the compliance requirement. Additionally, under the Shared Responsibility Model, configuring data protection settings like server-side encryption on Amazon S3 buckets falls under the customer's responsibility (security in the cloud).

Step-by-Step Solution

1
Identify the key management service required for dedicated, single-tenant cryptographic hardware.
AWS CloudHSM is selected because it provides dedicated, single-tenant HSM instances, unlike AWS KMS which is a multi-tenant service.
The scenario requires single-tenant cryptographic hardware to comply with local regulations.
2
Determine the party responsible for configuring encryption on Amazon S3 buckets under the AWS Shared Responsibility Model.
Configuring S3 encryption is classified as a customer responsibility (security in the cloud).
Under the Shared Responsibility Model, AWS secures the infrastructure, but the customer is responsible for configuring data protection controls such as bucket policies and encryption settings.

Key Concept

AWS CloudHSM vs AWS KMS single-tenant requirements and the customer's role in data encryption under the AWS Shared Responsibility Model
Estimated Time:1m 30s
Question 378Question →

A company needs to grant an external auditing firm temporary, read-only access to the AWS CloudTrail logs stored in their AWS account. The access must expire automatically after a set period. Which configuration should the company use to grant this access according to AWS security best practices?

Show answer & explanation

Answer: Create an IAM role with a read-only policy that the auditing firm can assume.

Answer

Create an IAM role with a read-only policy that the auditing firm can assume.
Creating an IAM role with a read-only policy is the correct approach. IAM roles do not have permanent credentials; instead, they provide temporary security credentials that expire automatically, which satisfies the requirement for temporary, time-limited access without the risk of long-term credentials.

Step-by-Step Solution

1
Analyze the requirements for external access.
The external auditing firm requires read-only access to AWS CloudTrail logs, and the access must be temporary and automatically expire.
This establishes the constraints of the required solution: read-only permissions and temporary credentials.
2
Evaluate the AWS Identity and Access Management (IAM) entities.
IAM roles provide temporary security credentials that rotate automatically and expire, which matches the need for temporary access. IAM users, by contrast, rely on long-term credentials like passwords or access keys, which are not suitable for temporary third-party access.
This identifies the correct mechanism to fulfill the temporary access requirement while adhering to security best practices.
3
Verify compliance with the Shared Responsibility Model and root user best practices.
Sharing root user credentials is a major security violation, and asking AWS Support to manage access permissions violates the customer's responsibility for security 'in' the cloud. Configuring an IAM role is the customer's responsibility and aligns with best practices.
This confirms that alternative options violate fundamental AWS security and responsibility principles.

Key Concept

AWS IAM Roles for Temporary Access
Question 379Question →

A company is hosting a web application on Amazon EC2 instances within a public VPC subnet. The system administrator wants to protect the web tier by implementing two security controls: block all traffic from a known malicious range of IP addresses, and restrict access to the web instances to only HTTP and HTTPS traffic. Which two of the following configurations should the administrator implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a Network Access Control List (NACL) associated with the subnet and add an inbound deny rule for the malicious IP address range.; Create a Security Group associated with the EC2 instances and add inbound allow rules for HTTP and HTTPS traffic.

Answer

Creating a Network Access Control List (NACL) with an inbound deny rule for the malicious IP range, and creating a Security Group with inbound allow rules for HTTP and HTTPS traffic.
The correct configuration uses a Network Access Control List (NACL) to deny traffic from the malicious IP range because NACLs operate at the subnet level and support explicit deny rules. It also uses a Security Group to allow only HTTP and HTTPS traffic because Security Groups act at the instance level as stateful firewalls controlling inbound allowed ports.

Step-by-Step Solution

1
Analyze the requirement to block a specific IP address range.
Identify that Network Access Control Lists (NACLs) operate at the subnet level and support explicit deny rules, which can prevent malicious traffic from entering the subnet.
Security Groups do not support deny rules, so NACLs must be used for explicit blocking.
2
Analyze the requirement to restrict instance-level access to HTTP/HTTPS traffic.
Identify that Security Groups operate at the instance level and can be configured with allow rules for specific protocols (HTTP and HTTPS).
This implements least-privilege access at the virtual firewall level for the EC2 instances.

Key Concept

Understanding the difference between stateful Security Groups (operating at the instance level with allow rules only) and stateless Network ACLs (operating at the subnet level with allow/deny rules).
Estimated Time:1m 30s
Question 380Question →

A municipal library is hosting its public book catalog on an Amazon EC2 instance. The library's IT administrator is configuring a security group to secure this instance. Which two statements describe the behavior or characteristics of AWS security groups?

Select all that apply

Show answer & explanation

Answer: They are stateful, meaning that return traffic for allowed inbound requests is automatically permitted.; They deny all inbound traffic by default when a new security group is created, requiring explicit allow rules.

Answer

The correct statements are that security groups are stateful, automatically allowing return traffic for allowed inbound requests, and that newly created security groups deny all inbound traffic by default.
Security groups are stateful firewalls that automatically allow outbound response traffic for any permitted inbound connection. When created, they deny all incoming connections by default until custom rules are added to allow traffic.

Step-by-Step Solution

1
Identify the target resource context.
The scenario requires securing an Amazon EC2 instance using a security group.
This defines the resource scope for application of the firewall rules.
2
Determine the state behavior of security groups.
Security groups track connections and are stateful, meaning allowed traffic automatically allows its corresponding return traffic.
This establishes stateful traffic rules.
3
Evaluate the default configuration.
New security groups default to blocking all inbound traffic while allowing all outbound traffic.
This defines standard baseline security posture.

Key Concept

AWS security groups act as virtual firewalls at the instance level, operating statefully with default settings that deny all inbound traffic.
PreviousPage 19 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 19 | Examkin