Security and Compliance

441 questions

All types441 Multiple choice225 Multiple select216

A healthcare provider plans to store patient medical records in Amazon Simple Storage Service (Amazon S3) and must encrypt the data at rest to comply with regulatory standards. The provider wants to control their own encryption keys but wishes to avoid the operational overhead of provisioning, configuring, and maintaining dedicated, single-tenant hardware. Which solution and division of responsibility meets these requirements?

Using AWS Key Management Service (KMS) with customer managed keys, where the customer manages the key policies and rotation configuration, while AWS manages the physical security, maintenance, and availability of the underlying multi-tenant HSMs.

Using AWS CloudHSM, where AWS manages the cryptographic user accounts and key generation, while the customer is responsible for patching and maintaining the physical HSM appliances.

Using AWS Key Management Service (KMS), where the customer is responsible for upgrading the firmware and maintaining physical security of the multi-tenant HSMs, while AWS manages the key policies.

Using AWS CloudHSM, where AWS manages the encryption policies and key replication, while the customer maintains the physical power supply and rack mounting of the HSM hardware.

Show answer & explanation

Answer: Using AWS Key Management Service (KMS) with customer managed keys, where the customer manages the key policies and rotation configuration, while AWS manages the physical security, maintenance, and availability of the underlying multi-tenant HSMs.

Answer

The correct option correctly identifies that using AWS Key Management Service (KMS) with customer managed keys satisfies the requirements. AWS KMS is a multi-tenant service where AWS manages the hardware, provisioning, patching, and physical security, minimizing customer operational overhead. At the same time, the customer retains control over key policies, access permissions, and key rotation. This satisfies both the need for key control and low overhead.

Step-by-Step Solution

Analyze the business requirements to determine key management needs.

The scenario requires data encryption at rest under customer control, but explicitly specifies avoiding the operational overhead of dedicated single-tenant hardware.

This rules out AWS CloudHSM, which provides dedicated single-tenant HSM appliances that require significant customer administrative effort, and points to AWS Key Management Service (KMS) as the appropriate service.

Apply the AWS shared responsibility model to key management in AWS KMS.

For AWS KMS customer managed keys, the customer is responsible for logical controls such as defining key policies, key usage permissions, and scheduling rotation. AWS is responsible for the physical security, patching, scaling, and availability of the underlying multi-tenant HSM infrastructure.

This establishes the correct boundary of responsibility, identifying that physical maintenance of HSMs is always managed by AWS.

Key Concept

Shared responsibility model for data encryption at rest using AWS Key Management Service (KMS) versus AWS CloudHSM.

Question 22Question →

A startup is reviewing its AWS security configuration. Currently, all developers share a single IAM user with administrator privileges to manage resources, and an application running on Amazon EC2 instances uses hardcoded access keys to write data to an Amazon S3 bucket. Which of the following actions should the security team take to align with AWS security best practices? (Select TWO).

Select all that apply

Create individual IAM users for each developer and place them in an IAM group with the necessary administrative policies attached.

Attach an IAM role to the EC2 instances to grant the application temporary access to the S3 bucket instead of using hardcoded credentials.

Configure the developers to use the AWS account root user for daily administrative tasks to avoid permission conflicts.

Create a single shared IAM role for all developers to log in to the AWS Management Console directly.

Submit a request to AWS Support to monitor and automatically rotate the hardcoded access keys within the application code.

Show answer & explanation

Answer: Create individual IAM users for each developer and place them in an IAM group with the necessary administrative policies attached.; Attach an IAM role to the EC2 instances to grant the application temporary access to the S3 bucket instead of using hardcoded credentials.

Answer

Create individual IAM users for each developer and place them in an IAM group with the necessary administrative policies attached, and attach an IAM role to the EC2 instances to grant the application temporary access to the S3 bucket instead of using hardcoded credentials.

Creating individual IAM users and placing them in groups ensures that each developer has unique credentials and accountability for their actions. Attaching an IAM role to the EC2 instances allows the application to assume temporary credentials, which eliminates the security risk of storing long-term access keys inside the application code.

Step-by-Step Solution

Analyze the developer access setup and identify security risks.

The current setup uses a shared IAM user, which prevents individual accountability and violates identity management best practices.

Establishing individual IAM users grouped by job function is the recommended method to manage user identities and track actions.

Analyze the application access setup and identify security risks.

The application uses hardcoded access keys, which can be compromised if code is exposed.

AWS recommends using IAM roles to assign temporary credentials to applications running on AWS compute services like EC2.

Key Concept

AWS IAM Best Practices including individual users, groups, and temporary credentials via IAM roles.

Question 23Question →

An organization is deploying a new containerized application on Amazon EC2 instances that must periodically write application state data to an Amazon DynamoDB table. Additionally, an external compliance auditor requires temporary read-only access to the DynamoDB table to verify data integrity. Which two configurations represent the most secure AWS-recommended practices for managing these access requirements? (Select two.)

Select all that apply

Attach an IAM role with DynamoDB write permissions to the EC2 instance profile.

Create an IAM role with a trust policy that allows the external auditor to assume it for read-only access.

Generate long-term IAM access keys for a dedicated IAM user and embed them in the application configuration on the EC2 instances.

Share the AWS account root user credentials with the auditor while ensuring multi-factor authentication (MFA) is active on the account.

Submit an AWS support ticket requesting a service-level exception to disable IAM authorization for the EC2 instance's public IP address.

Show answer & explanation

Answer: Attach an IAM role with DynamoDB write permissions to the EC2 instance profile.; Create an IAM role with a trust policy that allows the external auditor to assume it for read-only access.

Answer

The correct configurations are attaching an IAM role with DynamoDB write permissions to the EC2 instance profile, and creating an IAM role with a trust policy that allows the external auditor to assume it for read-only access.

Attaching an IAM role to the EC2 instance profile ensures the application automatically receives temporary security credentials to write to DynamoDB without hardcoding keys. Creating an IAM role with a trust policy allows the external auditor to assume the role and obtain temporary, read-only permissions without requiring permanent credentials.

Step-by-Step Solution

Determine the secure method for applications running on EC2 instances to access other AWS services.

Identify that IAM roles attached to an instance profile allow services to retrieve temporary credentials, which is more secure than hardcoding credentials.

This avoids exposing permanent access keys in the code or server configurations.

Determine the secure method for external third parties to access the AWS environment temporarily.

Identify that creating a role with a trust policy allows federated or cross-account users to assume that role and receive temporary, read-only access.

This prevents creating permanent IAM users or sharing sensitive administrative credentials.

Verify if either of the correct options corresponds to AWS management or root user tasks.

Confirm that using the root user or asking AWS to disable IAM authorization violate basic security guidelines.

AWS credentials must follow the principle of least privilege, and access control is a customer responsibility under the Shared Responsibility Model.

Key Concept

Applying the principle of least privilege and using temporary security credentials via IAM roles instead of long-term access keys or sharing root account credentials.

Question 24Question →

A software-as-a-service (SaaS) provider needs to periodically analyze resource configurations stored in an Amazon S3 bucket within a customer's AWS account. The customer wants to grant this access to the provider's AWS account securely without creating or exchanging permanent IAM credentials. Which of the following is the AWS-recommended best practice to achieve this?

Create a dedicated IAM user with programmatic access, attach an S3 read-only policy, and share the access key ID and secret access key with the provider.

Establish an AWS Direct Connect connection between the provider and customer networks to automatically authorize data access based on physical port security.

Create an IAM role with a trust policy that allows the provider's AWS account to assume it, and attach a permissions policy that grants read-only access to the S3 bucket.

Generate temporary security credentials using the customer account's root user and configure the provider's applications to use these root credentials.

Show answer & explanation

Answer: Create an IAM role with a trust policy that allows the provider's AWS account to assume it, and attach a permissions policy that grants read-only access to the S3 bucket.

Answer

Create an IAM role with a trust policy that allows the provider's AWS account to assume it, and attach a permissions policy that grants read-only access to the S3 bucket.

The most secure method is to create an IAM role in the customer's account that trusts the provider's AWS account. This role has a trust policy allowing the provider to assume it and a permissions policy that grants read-only S3 access. This setup uses short-lived, temporary security credentials and avoids the exchange of long-term credentials.

Step-by-Step Solution

Identify the security requirement for cross-account resource access without long-term credentials.

Determine that temporary credentials and delegation of access to an external AWS account are required.

AWS recommends delegating access using temporary security credentials (IAM roles) rather than sharing permanent access keys or root credentials.

Create an IAM role in the trusting account (the customer's account).

An IAM role is defined with a trust policy specifying the trusted entity (the SaaS provider's AWS account ID) and a permissions policy allowing read-only access to the S3 bucket.

The trust policy enables the external account to assume the role, while the permissions policy enforces the principle of least privilege.

Allow the external provider to assume the role.

The SaaS provider assumes the role using AWS Security Token Service (STS) to obtain short-lived credentials for S3 access.

This eliminates the need to manage, rotate, or risk leaking long-term credentials.

Key Concept

IAM Roles for cross-account access provide a secure way to grant third-party entities access to AWS resources using temporary security credentials instead of sharing long-term IAM user credentials or root account details.

Question 25Question →

A media streaming company is preparing for an audit and needs to verify that the underlying AWS infrastructure complies with payment card industry and international security standards. Which AWS service provides the company with on-demand access to AWS security and compliance reports?

AWS Artifact

AWS Security Hub

Amazon Inspector

AWS Systems Manager

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact provides on-demand access to AWS security and compliance reports.

AWS Artifact is a self-service portal that provides customers with free, on-demand access to AWS's security and compliance reports (such as SOC and PCI reports) and select online agreements.

Step-by-Step Solution

Identify the requirement of accessing third-party compliance reports (such as PCI or ISO) for AWS infrastructure.

The company needs a portal where AWS publishes its own compliance documentation.

AWS is responsible for the security of the cloud, and customers need official audit reports to verify this compliance.

Select the correct AWS service that acts as a self-service portal for compliance documentation.

AWS Artifact is identified as the service designed specifically for retrieving these documents.

AWS Artifact allows customers to download SOC, PCI, and ISO compliance reports directly from the AWS Management Console.

Key Concept

AWS Artifact is the primary portal for retrieving AWS compliance reports and agreements.

Question 26Question →

A municipality is deploying a smart parking system that collects sensor data using Amazon EC2 instances located in a private subnet. The network engineering team must design a security controls strategy to govern inbound and outbound traffic at both the subnet boundary and the instance level. Which two of the following statements correctly describe the behavior of the security components needed for this architecture?

Select all that apply

Security groups operate at the instance level and are stateful, meaning that return traffic is automatically allowed regardless of outbound rules.

Network Access Control Lists (Network ACLs) operate at the subnet level and are stateless, meaning that outbound rules must explicitly allow return traffic for allowed inbound requests.

Security groups operate at the subnet level and are stateless, requiring explicit outbound rules to permit return traffic for any incoming connection.

Network Access Control Lists (Network ACLs) operate at the instance level and are stateful, meaning they automatically permit return traffic without evaluating outbound rules.

Amazon GuardDuty can be deployed directly inside the private subnet to act as a stateless firewall, blocking malicious IP addresses at the instance network interface.

Show answer & explanation

Answer: Security groups operate at the instance level and are stateful, meaning that return traffic is automatically allowed regardless of outbound rules.; Network Access Control Lists (Network ACLs) operate at the subnet level and are stateless, meaning that outbound rules must explicitly allow return traffic for allowed inbound requests.

Answer

Security groups operate at the instance level and are stateful, meaning that return traffic is automatically allowed regardless of outbound rules; and Network Access Control Lists (Network ACLs) operate at the subnet level and are stateless, meaning that outbound rules must explicitly allow return traffic for allowed inbound requests.

The correct answers identify that Security Groups operate at the instance level and are stateful, and Network ACLs operate at the subnet level and are stateless. In a stateful security group, return traffic is automatically allowed. In a stateless Network ACL, outbound rules must be explicitly configured to allow the return traffic.

Step-by-Step Solution

Evaluate the traffic management requirements at the instance level.

Determine that security groups are evaluated at the instance level and are stateful, meaning that return traffic is automatically permitted.

Security groups act as a firewall at the network interface level for EC2 instances, and their stateful nature ensures established connections do not need symmetric rules.

Evaluate the traffic management requirements at the subnet boundary level.

Determine that Network ACLs are evaluated at the subnet level and are stateless, meaning that inbound and outbound rules are processed independently.

Network ACLs act as a boundary firewall for the entire subnet, and because they are stateless, return traffic must be explicitly allowed by a corresponding outbound rule.

Key Concept

The stateful behavior of Security Groups at the instance level versus the stateless behavior of Network ACLs at the subnet level.

Question 27Question →

A company is configuring network security for an Amazon EC2 instance. The administrator wants to apply stateful firewall rules directly to the instance. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility to configure to meet this requirement?

Security groups

Network Access Control Lists (NACLs)

Physical firewalls at the data center boundary

AWS Artifact compliance documents

Show answer & explanation

Answer: Security groups

Answer

Security groups

The correct option is 'Security groups' because security groups are stateful firewalls that control inbound and outbound traffic at the instance level. Under the AWS Shared Responsibility Model, configuring security groups is the responsibility of the customer.

Step-by-Step Solution

Identify the resource and security requirement in the scenario.

The resource is an Amazon EC2 instance, which is an Infrastructure as a Service (IaaS) resource, and the requirement is to apply stateful firewall rules directly to it.

This establishes the boundary of the Shared Responsibility Model (customer responsibility for guest OS and instance-level firewalls) and the specific technical constraints (stateful, instance-level).

Evaluate the options against the Shared Responsibility Model and technical requirements.

Security groups are stateful, operate at the instance level, and are configured by the customer. Network Access Control Lists (NACLs) operate at the subnet level and are stateless. Physical firewalls are managed entirely by AWS. AWS Artifact is a compliance reporting portal, not a firewall service.

This eliminates the incorrect options based on their operational level (instance vs. subnet vs. physical infrastructure) and statefulness.

Key Concept

Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes configuring instance-level, stateful firewalls (security groups) for Amazon EC2 instances.

Question 28Question →

A retail enterprise connects its on-premises data center to an AWS Virtual Private Cloud (VPC) using an AWS Site-to-Site VPN. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Configuring and maintaining the physical customer gateway device at the on-premises data center

Patching the underlying host operating system of the virtual private gateway endpoints within the AWS infrastructure

Associating stateful security groups directly to the Virtual Private Gateway to control incoming traffic from the VPN

Requesting AWS to perform a physical security audit of the data centers housing the VPN hardware

Show answer & explanation

Answer: Configuring and maintaining the physical customer gateway device at the on-premises data center

Answer

Configuring and maintaining the physical customer gateway device at the on-premises data center

The customer gateway is a physical device or software application on the customer's side of the connection (on-premises). Under the Shared Responsibility Model, the customer maintains full ownership and operational responsibility for their physical assets, configuration, and security outside of the AWS global infrastructure.

Step-by-Step Solution

Analyze the components of the AWS Site-to-Site VPN connection.

The connection consists of a customer-side component (customer gateway) and an AWS-side component (virtual private gateway).

Identifying the boundary between on-premises infrastructure and AWS resources is key to determining responsibility.

Apply the Shared Responsibility Model guidelines to the components.

The customer is responsible for the security and configuration of resources they own and control (on-premises gateway), while AWS is responsible for the security 'of' the cloud (virtual private gateway hosting, physical security of AWS data centers).

This determines that the physical customer gateway management is the customer's task.

Key Concept

Shared Responsibility Model boundary for hybrid networking components

Question 29Question →

A software development team is building a serverless, event-driven web application. The architecture utilizes AWS Lambda to run the backend application code and Amazon DynamoDB as the database layer. According to the AWS Shared Responsibility Model, which of the following operational tasks are the sole responsibility of the customer? (Select TWO.)

Select all that apply

Configuring IAM roles to establish fine-grained permissions for the Lambda function to interact with the DynamoDB table

Writing secure application logic and managing the software dependencies of the package uploaded to AWS Lambda

Applying operating system patches and runtime updates to the underlying virtualization layer hosting the Lambda function

Defining stateless Network Access Control Lists (NACLs) at the subnet level to isolate individual Lambda execution environments

Retrieving physical security logs of AWS data centers to manually upload them to AWS Artifact for compliance verification

Show answer & explanation

Answer: Configuring IAM roles to establish fine-grained permissions for the Lambda function to interact with the DynamoDB table; Writing secure application logic and managing the software dependencies of the package uploaded to AWS Lambda

Answer

Configuring IAM roles to establish fine-grained permissions and securing custom application code along with its dependencies.

Under the AWS Shared Responsibility Model for serverless services like AWS Lambda, AWS manages the underlying physical infrastructure, virtualization layer, and operating system. The customer is responsible for securing their own application code, including dependencies, and configuring identity and access management (IAM) permissions to control access between resources (such as Lambda and DynamoDB).

Step-by-Step Solution

Analyze the service types used in the scenario.

AWS Lambda and Amazon DynamoDB are classified as managed/serverless (abstracted) services.

The division of responsibility shifts more operational tasks to AWS when using serverless services compared to Infrastructure as a Service (IaaS) like Amazon EC2.

Differentiate between customer and AWS responsibilities for serverless compute and database layers.

AWS handles physical security, infrastructure, operating systems, virtualization, and runtime environment updates. The customer handles data classification, IAM permissions, configuration settings, and application code/dependencies.

This establishes the logical boundary of the Shared Responsibility Model for serverless architectures.

Evaluate the choices against common misconceptions regarding VPC networks and compliance tooling.

Exclude operating system patching (AWS responsibility), subnet NACL isolation for Lambda containers (managed by AWS), and uploading logs to AWS Artifact (misunderstanding of AWS Artifact's pull-only nature). Identify code security and IAM configuration as customer responsibilities.

This isolates the correct options and maps the incorrect distractors to specific cloud security misconceptions.

Key Concept

Shared Responsibility Model for Serverless Services

Question 30Question →

A company is deploying a fleet of Amazon Elastic Compute Cloud (Amazon EC2) instances to host a new customer portal. According to the AWS Shared Responsibility Model, which of the following operational tasks is the sole responsibility of the customer?

Configuring and maintaining physical network hardware inside the AWS data center

Managing the virtualization hypervisor layer running on the physical host servers

Patching and updating the guest operating system running on the EC2 instances

Disposing of decommissioned storage media at the end of its lifecycle

Show answer & explanation

Answer: Patching and updating the guest operating system running on the EC2 instances

Answer

Patching and updating the guest operating system running on the EC2 instances

Patching and updating the guest operating system is a customer responsibility under the AWS Shared Responsibility Model for EC2 instances. Because EC2 is an Infrastructure as a Service (IaaS) offering, AWS manages the physical host and hypervisor, but the customer retains full control and responsibility over the operating system, applications, and data configured on the instance.

Step-by-Step Solution

Identify the service type in the scenario.

Amazon EC2 is an Infrastructure as a Service (IaaS) resource.

The boundary of the Shared Responsibility Model depends on whether a service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS).

Determine the boundary of responsibility for IaaS services.

For IaaS resources, the customer is responsible for the guest operating system and anything installed or configured on top of it, while AWS is responsible for the underlying infrastructure and physical facilities.

This division defines what falls under 'security in the cloud' (customer) versus 'security of the cloud' (AWS).

Evaluate the choices to locate a customer-managed operational task.

Patching the guest operating system is a customer responsibility, whereas physical hardware maintenance, hypervisor management, and media disposal are AWS responsibilities.

Operating system updates require administrative access to the instance, which only the customer possesses.

Key Concept

The customer is responsible for security 'in' the cloud (such as guest operating systems), while AWS is responsible for security 'of' the cloud (such as physical infrastructure and virtualization layers).

Estimated Time:45s

Question 31Question →

A financial technology company deploys a transactional database using Amazon Relational Database Service (Amazon RDS). As part of a security audit, the company must document the division of operational tasks based on the AWS Shared Responsibility Model. Which of the following tasks is the customer's responsibility under the AWS Shared Responsibility Model for this database deployment?

Applying security patches and updates to the guest operating system hosting the database engine

Managing the physical security and environmental controls of the storage servers containing the database volumes

Configuring database-level user access controls and network access rules via database security groups

Generating third-party compliance certification reports, such as SOC 2, for the AWS data center physical infrastructure

Show answer & explanation

Answer: Configuring database-level user access controls and network access rules via database security groups

Answer

Configuring database-level user access controls and network access rules via database security groups

Configuring network access rules using database security groups and managing database-level user access are customer responsibilities (security 'in' the cloud). Even under a managed database service like Amazon RDS, the customer must configure who can access the database resources.

Step-by-Step Solution

Identify the type of service being utilized in the scenario.

Amazon RDS is identified as a managed platform-as-a-service (PaaS) database offering.

The Shared Responsibility Model shifts the operational boundary depending on whether the service is classified as IaaS or PaaS/managed.

Determine the boundary of responsibility for a managed database service.

AWS manages physical hardware, infrastructure, and virtual machines (including guest OS patching). The customer maintains responsibility for the data, database engine configurations, access credentials, and network firewall configurations.

This establishes which operations are handled by AWS and which must be configured by the customer's administrative team.

Evaluate the choices to isolate the customer-managed task.

Managing database security groups and user access privileges is a customer task, whereas patching the OS, securing physical hardware, and auditing facilities are AWS responsibilities.

Applying the Shared Responsibility Model rules eliminates AWS-side responsibilities and isolates the correct customer action.

Key Concept

AWS Shared Responsibility Model for Managed Services

Question 32Question →

A company is deploying a web application on an Amazon EC2 instance that needs to read and write files to an Amazon S3 bucket. Which of the following is the AWS-recommended best practice to grant the application access to the S3 bucket?

Create an IAM user with S3 permissions, generate access keys, and store them directly in the application configuration files on the EC2 instance.

Use the AWS account root user credentials inside the application configuration to guarantee access to the S3 bucket.

Create an IAM role with the necessary S3 permissions and attach it to the Amazon EC2 instance.

Rely on the AWS shared responsibility model, which automatically grants access permissions between compute and storage services within the same account.

Show answer & explanation

Answer: Create an IAM role with the necessary S3 permissions and attach it to the Amazon EC2 instance.

Answer

Create an IAM role with the necessary S3 permissions and attach it to the Amazon EC2 instance.

Creating an IAM role and attaching it to the Amazon EC2 instance is the recommended practice. AWS handles the rotation of temporary security credentials automatically, preventing the security risks associated with managing and storing long-term credentials on the instance.

Step-by-Step Solution

Determine if the requester is an AWS service or a human user.

The requester is an Amazon EC2 instance running a web application.

AWS services should use roles with temporary credentials rather than users with permanent access keys to access other AWS services.

Identify the permissions needed and apply the principle of least privilege.

Create a policy that permits only read and write actions on the specific S3 bucket.

Ensuring least privilege minimizes the potential impact of a security compromise.

Associate the permissions with the EC2 instance using a role.

Attach the policy to an IAM role, and then associate that role with the EC2 instance.

The application on the EC2 instance can then retrieve temporary security credentials automatically from instance metadata.

Key Concept

Granting temporary credentials to AWS resources using IAM roles is a fundamental security best practice.

Estimated Time:1m 0s

Question 33Question →

An administrator needs to configure an application running on an Amazon EC2 instance to read files from an Amazon S3 bucket. According to AWS security best practices, which approach should the administrator use to grant the EC2 instance the necessary permissions?

Create an IAM user with S3 read permissions, generate access keys, and embed them in the application code running on the EC2 instance.

Generate access keys for the AWS account root user and store them in a configuration file on the EC2 instance.

Create an IAM role with S3 read permissions and associate it with the EC2 instance.

Submit a request to AWS Support to manage and configure the permissions for the EC2 instance's access to the S3 bucket.

Show answer & explanation

Answer: Create an IAM role with S3 read permissions and associate it with the EC2 instance.

Answer

Create an IAM role with S3 read permissions and associate it with the EC2 instance.

Associating an IAM role with the EC2 instance is the recommended practice because it delegates temporary credentials to the instance. This prevents the need to manage, store, or rotate static access keys on the instance itself.

Step-by-Step Solution

Determine if the accessing entity is an AWS resource or a human user.

The accessing entity is an Amazon EC2 instance (an AWS service resource).

AWS services should authenticate using temporary credentials rather than permanent, hardcoded credentials.

Identify the AWS security best practice for resource-to-resource authentication.

Create an IAM role with the minimum required S3 read permissions and attach it to the EC2 instance.

IAM roles leverage AWS Security Token Service (STS) to deliver temporary, automatically rotating credentials to the EC2 instance.

Key Concept

IAM Roles for AWS Services

Question 34Question →

A company has a fleet of Amazon EC2 instances that need to dynamically retrieve customer reports from a private Amazon S3 bucket. The lead developer wants to ensure that the application on these instances has secure, programmatic access without hardcoding credentials or exposing the account to security risks. Which approach aligns with the AWS-recommended best practice for granting this access?

Create an IAM role with an attached policy allowing S3 read permissions, and associate this role with an EC2 instance profile.

Create an IAM user, generate long-term access keys with S3 read permissions, and store them in the application configuration files on the EC2 instances.

Use the AWS account root user credentials to configure the AWS Command Line Interface (CLI) on each EC2 instance to guarantee uninterrupted bucket access.

Submit a request to AWS Support asking them to configure the underlying hypervisor to allow the EC2 instances to bypass S3 bucket policies.

Show answer & explanation

Answer: Create an IAM role with an attached policy allowing S3 read permissions, and associate this role with an EC2 instance profile.

Answer

Create an IAM role with an attached policy allowing S3 read permissions, and associate this role with an EC2 instance profile.

The correct approach is to create an IAM role with the appropriate S3 permissions and attach it to the EC2 instances using an instance profile. This allows the application on the EC2 instances to retrieve temporary security credentials dynamically, eliminating the need to store static, long-term access keys on the instance.

Step-by-Step Solution

Analyze the access requirement for an EC2 instance application to retrieve data from a private S3 bucket.

The application needs programmatic access to S3 bucket APIs.

Identifying the resource and access pattern helps narrow down correct credential types.

Eliminate choices suggesting the use of permanent, long-term credentials or root user access on EC2 instances.

Discard methods relying on hardcoded IAM user access keys or root account credentials.

Hardcoding access keys or using the root user violates the principle of least privilege and exposes the account to significant security risks.

Distinguish between customer and AWS responsibility regarding resource configuration and access control.

Understand that S3 bucket policies and EC2 access permissions are managed by the customer, not AWS Support.

According to the AWS Shared Responsibility Model, Identity and Access Management configuration is 'security in the cloud' and lies entirely with the customer.

Apply the recommended IAM mechanism for temporary programmatic access from AWS services.

Select the option that configures an IAM role associated with an EC2 instance profile.

IAM roles provide temporary, automatically rotated security credentials to applications running on EC2 instances, eliminating key management overhead and security leaks.

Key Concept

Identity and Access Management (IAM) Roles and Access Control Best Practices

Estimated Time:2m 0s

Question 35Question →

A multi-department enterprise needs to grant a third-party auditing firm temporary, read-only access to specific AWS Billing reports and Amazon CloudTrail logs in their production AWS account. The auditing firm has its own AWS account. Which of the following approaches is the most secure and aligns with AWS Identity and Access Management (IAM) best practices to accomplish this?

Create an IAM role in the enterprise account that trusts the auditing firm's AWS account, requiring an external ID, and attach a policy that grants read-only access to the billing and CloudTrail resources.

Generate access keys for the enterprise account's root user and configure a strict IP-based policy to restrict the auditing firm's access to the enterprise's office network.

Create a dedicated IAM user in the enterprise account, assign permanent access keys to the auditing firm, and enable Multi-Factor Authentication (MFA) for the API access.

Open an AWS Support ticket requesting AWS to manage the secure transfer of billing data and CloudTrail logs to the auditing firm's account under the AWS Shared Responsibility Model.

Show answer & explanation

Answer: Create an IAM role in the enterprise account that trusts the auditing firm's AWS account, requiring an external ID, and attach a policy that grants read-only access to the billing and CloudTrail resources.

Answer

The correct option correctly identifies using a cross-account IAM role with an external ID. An IAM role is designed for delegating secure access without needing to share long-term AWS credentials. The trust policy permits the third party's AWS account to assume the role, and the external ID prevents the confused deputy security issue.

Step-by-Step Solution

Evaluate identity delegation options for external third parties.

Determine that cross-account access using IAM roles is the secure path as it generates temporary credentials rather than using static access keys.

This minimizes the risk of credential leakage and simplifies access management by avoiding IAM user creation for external entities.

Apply the principle of least privilege and security mitigations.

Ensure the role has read-only permissions and utilizes an external ID in the trust policy.

Least privilege limits exposure, and the external ID mitigates the confused deputy security vulnerability in multi-tenant environments.

Key Concept

Delegating access to AWS resources using IAM roles for cross-account third-party entities

Question 36Question →

A multinational retail company is hosting its web applications on Amazon EC2 instances and is preparing for an upcoming external security audit. The company needs to document the exact division of security tasks between themselves and AWS. Which of the following tasks is the sole responsibility of AWS under the AWS Shared Responsibility Model?

Patching and maintaining the hypervisor software that virtualizes the physical hosts running the instances

Installing security patches and operating system updates on the guest operating system of the EC2 instances

Configuring stateless Network Access Control Lists (NACLs) to secure subnet-level traffic

Retrieving third-party compliance reports and certifications from the AWS Artifact portal to present to the auditors

Show answer & explanation

Answer: Patching and maintaining the hypervisor software that virtualizes the physical hosts running the instances

Answer

Patching and maintaining the hypervisor software that virtualizes the physical hosts running the instances

Under the AWS Shared Responsibility Model, AWS is responsible for 'Security of the Cloud,' which encompasses the physical infrastructure, global network, hardware, and virtualization hypervisor. For Amazon EC2, which is an Infrastructure as a Service (IaaS) service, the hypervisor layer is managed exclusively by AWS, making the patching of this layer the sole responsibility of AWS.

Step-by-Step Solution

Identify the service type in the scenario

The scenario specifies Amazon EC2, which is an Infrastructure as a Service (IaaS) offering.

The division of responsibilities under the AWS Shared Responsibility Model depends heavily on whether the service is IaaS, PaaS, or SaaS.

Determine the boundary between AWS and customer responsibilities for IaaS

For EC2, AWS manages the physical security, hardware, and the virtualization layer (hypervisor). The customer manages everything from the guest operating system upward, including network traffic configurations and IAM permissions.

This helps isolate which options belong to AWS (security of the cloud) and which belong to the customer (security in the cloud).

Evaluate the options against this boundary

Hypervisor maintenance is an infrastructure/virtualization layer task managed by AWS. Guest OS patching, NACL configuration, and compliance document retrieval from the portal are active tasks performed by the customer.

To select the correct option representing the sole responsibility of AWS.

Key Concept

Shared Responsibility Model IaaS boundaries

Estimated Time:2m 0s

Question 37Question →

A financial services company is migrating a multi-tier application to AWS. The web tier will be deployed on Amazon EC2 instances, while the data tier will utilize Amazon RDS for PostgreSQL. The company's security policy requires guest operating system patching and firewall port configurations to be strictly maintained. According to the AWS Shared Responsibility Model, which of the following statements correctly identifies the division of operational responsibilities between the customer and AWS for this deployment?

AWS is responsible for guest operating system patching on both the EC2 and RDS instances, while the customer is responsible for configuring security groups for the EC2 instances and network access control lists (NACLs) for the RDS instances.

The customer is responsible for guest operating system patching on both the EC2 and RDS instances, while AWS is responsible for configuring the security groups and firewall ports across all tiers of the VPC.

The customer is responsible for guest operating system patching on the EC2 instances, while AWS is responsible for guest operating system patching on the RDS database instances; configuring security groups for both tiers remains the customer's responsibility.

The customer is responsible for guest operating system patching on the EC2 instances, while AWS is responsible for both guest operating system patching and configuring the security groups on the RDS database instances.

Show answer & explanation

Answer: The customer is responsible for guest operating system patching on the EC2 instances, while AWS is responsible for guest operating system patching on the RDS database instances; configuring security groups for both tiers remains the customer's responsibility.

Answer

Under the AWS Shared Responsibility Model, the division of labor depends on the type of service. For Infrastructure as a Service (IaaS) offerings like Amazon EC2, the customer is responsible for guest operating system patching. For managed database services like Amazon RDS, AWS is responsible for patching the guest operating system and the database engine. However, configuring network access controls (such as security groups and firewall ports) is a customer responsibility across both IaaS and managed database tiers to ensure secure access control.

Step-by-Step Solution

Analyze the service model for the web tier using Amazon EC2.

Identify EC2 as Infrastructure as a Service (IaaS).

Under the Shared Responsibility Model, IaaS gives the customer full control over the guest operating system, making them responsible for patching it.

Analyze the service model for the data tier using Amazon RDS.

Identify RDS as a managed database platform service (PaaS).

Because RDS is a managed service, AWS abstracts the operating system layer, meaning AWS is responsible for patching the guest operating system and database engine.

Evaluate the firewall configuration requirements (Security Groups).

Determine that security group configuration for both EC2 and RDS is a customer task.

Although AWS provides the security group infrastructure, configuring the inbound/outbound rules to protect applications and data represents security 'in' the cloud, which is always the customer's responsibility.

Synthesize the findings to identify the correct division of responsibilities.

The customer patches EC2, AWS patches RDS, and the customer configures security groups for both.

This correctly separates IaaS responsibilities from managed database platform responsibilities.

Key Concept

IaaS vs. Managed Database Shared Responsibility Boundaries

Question 38Question →

A financial services company uses an Amazon Simple Storage Service (Amazon S3) bucket to store sensitive customer account statements. Which of the following tasks are the responsibility of the customer under the AWS Shared Responsibility Model? (Select TWO.)

Select all that apply

Configuring S3 bucket policies to restrict access to authorized users

Enabling server-side encryption for objects uploaded to the bucket

Replacing faulty physical disk drives within the AWS data centers

Patching and upgrading the operating systems running the S3 storage nodes

Managing physical access controls for the facilities hosting the storage infrastructure

Show answer & explanation

Answer: Configuring S3 bucket policies to restrict access to authorized users; Enabling server-side encryption for objects uploaded to the bucket

Answer

Configuring S3 bucket policies to restrict access to authorized users and enabling server-side encryption for objects uploaded to the bucket are customer responsibilities.

Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed service like Amazon S3, this includes managing data access permissions (such as bucket policies) and configuring encryption settings (such as server-side encryption). AWS is responsible for security 'of' the cloud, which includes the physical infrastructure and the underlying software platform.

Step-by-Step Solution

Analyze the service type in the scenario.

Amazon S3 is a fully managed object storage service.

For managed services, AWS handles the infrastructure, physical security, and underlying operating systems, while the customer manages data classification, access permissions, and encryption settings.

Evaluate the customer-side responsibilities (security 'in' the cloud) for S3.

Configuring bucket policies and enabling server-side encryption are operations performed by the customer on their own data.

These controls determine who can access the objects and whether the data is encrypted at rest, which are customer responsibilities.

Evaluate the AWS-side responsibilities (security 'of' the cloud) for S3.

Managing physical drives, patching the storage node operating systems, and data center physical security are handled by AWS.

These tasks involve physical infrastructure and the virtualization/management layer of the storage service, which are fully managed by AWS.

Key Concept

Shared Responsibility Model for Managed Services

Question 39Question →

A healthcare organization stores medical imaging files and patient records in Amazon Simple Storage Service (Amazon S3) buckets. Under the AWS Shared Responsibility Model, which of the following security tasks are the sole responsibility of the customer? (Select TWO.)

Select all that apply

Configuring bucket policies and Access Control Lists (ACLs) to restrict access to the buckets

Enabling server-side encryption to protect data at rest within the buckets

Disposing of decommissioned physical storage drives that hold the data

Managing and updating the virtualization hypervisor layer hosting the storage service

Patching the operating system of the physical servers hosting Amazon S3

Show answer & explanation

Answer: Configuring bucket policies and Access Control Lists (ACLs) to restrict access to the buckets; Enabling server-side encryption to protect data at rest within the buckets

Answer

The customer is responsible for configuring bucket policies and Access Control Lists (ACLs) to restrict access, and enabling server-side encryption to protect data at rest.

Under the AWS Shared Responsibility Model, the customer maintains control and responsibility for security 'in' the cloud. For a managed service like Amazon S3, this includes managing data access permissions through bucket policies and Access Control Lists (ACLs), as well as configuring server-side encryption to secure stored data at rest.

Step-by-Step Solution

Analyze the service model of Amazon S3.

Amazon S3 is a fully managed cloud object storage service, meaning the physical infrastructure, virtualization, and host operating system are managed by AWS.

Understanding the service type helps delineate where the customer controls settings versus where AWS manages infrastructure.

Identify customer-controlled data security settings.

The customer controls who can access the data (via bucket policies and Access Control Lists) and whether the data is encrypted at rest (via server-side encryption configuration).

Under the Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes data protection and access management.

Differentiate customer tasks from AWS infrastructure tasks.

Tasks like physical drive disposal, hypervisor management, and server OS patching belong to the infrastructure layer, which AWS secures ('of' the cloud).

Eliminating infrastructure management tasks allows isolating the correct customer-side responsibilities.

Key Concept

Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud (infrastructure, physical hardware, virtualization, and managed service OS patching), while the customer is responsible for security 'in' the cloud (data classification, access management via bucket policies/ACLs, and encryption settings).

Question 40Question →

A startup is setting up its first AWS account and wants to follow AWS Identity and Access Management (IAM) best practices to secure access for its developers and services. Which two recommendations should the startup implement to secure the account? (Select TWO.)

Select all that apply

Enable multi-factor authentication (MFA) on the AWS account root user and avoid using it for everyday tasks.

Create individual IAM users for each developer and manage their permissions using IAM groups.

Use the AWS account root user for daily administrative tasks to prevent permission blockage.

Embed permanent IAM user access keys directly in the application code running on EC2 instances instead of using IAM roles.

Rely on AWS to automatically configure and manage the operating system firewall and user access controls inside your EC2 instances.

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) on the AWS account root user and avoid using it for everyday tasks.; Create individual IAM users for each developer and manage their permissions using IAM groups.

Answer

Enabling multi-factor authentication (MFA) on the AWS account root user while avoiding its everyday use, and creating individual IAM users for each developer to manage their permissions using IAM groups.

According to AWS security best practices, the AWS account root user should have multi-factor authentication (MFA) enabled and should not be used for daily administrative tasks. Instead, individual IAM users should be created for each developer, and their permissions should be managed collectively using IAM groups to adhere to the principle of least privilege.

Step-by-Step Solution

Analyze AWS security recommendations for the root account.

Identify that enabling MFA on the root account and restricting its everyday use is a fundamental best practice.

The root user has complete access to all resources and represents a single point of failure if compromised.

Analyze AWS security recommendations for human identity and access management.

Identify that creating individual IAM users and using IAM groups to manage permissions is the standard approach.

This establishes individual accountability and simplifies administration, aligning with the principle of least privilege.

Key Concept

AWS IAM Best Practices for User Management and Root Account Security

PreviousPage 2 / 23Next

Security and Compliance

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept