Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 381Question →

A gaming company is deploying multiplayer session backends on Amazon Elastic Compute Cloud (Amazon EC2) instances. The system requires temporary outbound ports to be opened dynamically to send traffic back to clients. The security team wants to ensure that any outbound response traffic for established inbound connections is allowed automatically without needing to define explicit outbound rules. Additionally, these rules must apply directly at the instance level. Which AWS network security feature should the company use to meet these requirements?

Show answer & explanation

Answer: Security Groups

Answer

Security Groups
Security groups act as stateful firewalls for EC2 instances, operating at the virtual interface level. Because they are stateful, any allowed inbound traffic automatically permits the corresponding outbound response traffic, regardless of any outbound security group rules.

Step-by-Step Solution

1
Analyze the requirement for instance-level traffic filtering.
Identify that firewalls at the instance level in AWS are Security Groups, whereas Network ACLs operate at the subnet level.
This narrows the choice down to instance-level firewalls.
2
Evaluate the requirement for automatically allowing return traffic without explicit outbound rules.
Understand that stateful firewalls automatically track connection state and allow return traffic, which is a key feature of Security Groups.
This distinguishes the stateful nature of Security Groups from the stateless nature of Network ACLs, which require explicit rules for return traffic.

Key Concept

Stateful instance-level security versus stateless subnet-level security in VPCs
Estimated Time:1m 15s
Question 382Question →

A digital art platform stores high-resolution images in an Amazon S3 bucket. The platform's compliance team requires all stored images to be encrypted at rest. The platform wants a fully managed solution where AWS handles the maintenance, clustering, and scaling of the underlying hardware security modules (HSMs), while the customer manages access policies for the encryption keys. Which AWS service should the platform use to meet this requirement?

Show answer & explanation

Answer: AWS Key Management Service (AWS KMS)

Answer

AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) is a fully managed service that allows customers to create, manage, and control cryptographic keys. With AWS KMS, AWS manages the underlying hardware security modules (HSMs) for operations such as maintenance, clustering, and scaling, while the customer remains responsible for key access policies and key usage, satisfying the requirement for a fully managed key storage solution.

Step-by-Step Solution

1
Identify the primary requirement of the scenario.
The platform needs to encrypt S3 data at rest using a managed key service where AWS maintains the physical hardware security modules (HSMs) and the customer manages access control.
Defining the technical requirements helps narrow down the service options between fully managed key management and dedicated hardware modules.
2
Compare AWS Key Management Service (AWS KMS) and AWS CloudHSM.
AWS KMS is a multi-tenant, fully managed service where AWS manages HSM provisioning and scaling. AWS CloudHSM is a single-tenant, dedicated HSM service where the customer is responsible for HSM cluster management and administration.
Distinguishing between managed services and dedicated hardware modules determines which service meets the operational and compliance constraints of the platform.

Key Concept

AWS Key Management Service (AWS KMS) vs AWS CloudHSM and Shared Responsibility for Data Protection
Question 383Question →

A company wants to allow its corporate employees to log in to the AWS Management Console using their existing Active Directory credentials. The security team wants to avoid the administrative overhead of creating and managing individual IAM users for each employee. Which of the following is the AWS-recommended approach to grant this access?

Show answer & explanation

Answer: Configure identity federation to grant employees temporary security credentials by assuming an IAM role.

Answer

Configure identity federation to grant employees temporary security credentials by assuming an IAM role.
Identity federation enables external users to access AWS resources securely using their existing corporate credentials. Instead of creating individual IAM users, the identity provider authenticates the users, and AWS maps their identity to an IAM role. The role provides them with temporary security credentials to access the AWS Management Console.

Step-by-Step Solution

1
Identify the requirement for using existing Active Directory credentials without creating individual IAM users in the AWS account.
The requirement points to identity federation, which maps external identities to AWS resources.
Identity federation eliminates the administrative overhead of managing separate credentials in AWS.
2
Select the secure mechanism to delegate permissions to these federated identities.
IAM roles are used to delegate temporary security credentials to trusted external entities.
Using roles ensures that external users do not require permanent IAM user credentials to access AWS resources.

Key Concept

Identity federation and IAM roles for external user access
Estimated Time:1m 0s
Question 384Question →

A financial services firm hosts a reporting database on Amazon EC2 instances in a private subnet. A cloud practitioner needs to configure network security controls to protect the database. They must implement both a security group and a network access control list (network ACL). Which of the following statements correctly describe the behavior of these security controls? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The security group automatically allows outbound response traffic if the inbound request is allowed on port 33063306, because security groups are stateful.; The network ACL requires an outbound rule to allow response traffic even if the inbound request on port 33063306 is allowed, because network ACLs are stateless.

Answer

The correct answers are the statements describing that security groups automatically allow return traffic because they are stateful, and that network ACLs require an outbound rule to allow return traffic because they are stateless.
Security groups are stateful, which means they automatically allow return traffic for any established connection. Network ACLs are stateless, meaning they evaluate traffic going in and out of the subnet independently. Therefore, to support a database connection, a network ACL requires explicit rules for both inbound database request traffic and outbound return traffic, whereas a security group only requires an inbound rule.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups.
Since security groups are stateful, allowing inbound traffic on port 33063306 automatically allows return outbound traffic.
Stateful firewalls track the connection state and allow response traffic automatically.
2
Analyze the stateless behavior of Network ACLs.
Since network ACLs are stateless, allowing inbound traffic on port 33063306 does not automatically allow return outbound traffic. An outbound rule must be explicitly created.
Stateless firewalls evaluate rules for inbound and outbound traffic independently without tracking connection states.
3
Verify subnet vs. instance level placement and responsibilities.
Security groups apply at the instance/network interface level, while network ACLs apply at the subnet level. Both are customer-configured security controls.
This confirms that the other options mischaracterize their operating boundaries or misapply the Shared Responsibility Model.

Key Concept

Stateful vs. Stateless Network Security Controls (Security Groups and Network ACLs)
Estimated Time:1m 30s
Question 385Question →

A media production company has migrated its collaborative design assets from on-premises storage to Amazon FSx for Windows File Server. Under the AWS Shared Responsibility Model, which of the following operational tasks are the sole responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring security groups to control network traffic to and from the file system.; Managing file-level and directory-level access control lists (NTFS permissions) for shared folders.

Answer

The customer is responsible for configuring security groups to control network traffic to the file system, and managing NTFS permissions for files and folders.
For managed services such as Amazon FSx for Windows File Server, AWS takes responsibility for infrastructure security (security 'of' the cloud), which includes data center physical security, hardware repairs, and operating system updates. The customer remains responsible for security configurations within the service (security 'in' the cloud), such as managing resource-level access permissions (NTFS ACLs) and implementing network access controls through security groups.

Step-by-Step Solution

1
Identify the AWS service type for Amazon FSx for Windows File Server.
It is a fully managed storage service.
Managed services shift the operational burden of infrastructure, hardware, and OS patching to AWS.
2
Differentiate between customer and AWS responsibilities for this managed service.
AWS handles physical security, hardware replication, and Windows Server OS patching. The customer retains control over network access rules and folder/file permissions.
This classification determines which tasks fall under 'security in the cloud' versus 'security of the cloud'.
3
Select the two options representing customer-managed security tasks.
Configuring security groups and managing NTFS folder permissions are identified as the customer's responsibility.
These are access control configurations executed by the customer within their virtual environment.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:1m 30s
Question 386Question →

An organization has just created a new AWS account and is planning its initial security and access control setup. The IT manager needs to secure the account access and configure day-to-day administrative privileges. Which of the following actions align with AWS security best practices for managing access in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure multi-factor authentication (MFA) on the root account and lock away its credentials, using it only for specific tasks that strictly require root privileges.; Generate distinct IAM identities for each IT administrator with administrative policies attached, ensuring they use these credentials for routine management tasks.

Answer

Configuring multi-factor authentication (MFA) on the root account and restricting its usage, along with generating distinct IAM identities for each administrator for routine operations, are the recommended security practices.
Securing the root account with MFA and locking away its credentials ensures that the highest-privileged identity in the account is protected against unauthorized access. Creating individual IAM identities for daily administrative duties provides proper tracking, logging, and access control without exposing the root account.

Step-by-Step Solution

1
Evaluate root account safety requirements.
The root account has full permissions and should be secured using multi-factor authentication (MFA), and its credentials should not be shared or used for everyday administrative tasks.
This minimizes the blast radius and reduces the risk of accidental configuration changes or unauthorized root access.
2
Determine the proper method for configuring administrative access.
Individual IAM users or identities must be created for each administrator with the necessary permissions attached for daily tasks.
This establishes individual accountability and aligns with the principle of least privilege by not relying on root credentials.

Key Concept

AWS Identity and Access Management (IAM) best practices focus on securing the root user with MFA and creating individual identities with appropriate permissions for daily operational tasks.
Question 387Question →

A research laboratory is building a web application on AWS that handles sensitive clinical trials data. The regulatory authority requires the laboratory to encrypt all trial results at rest using dedicated, single-tenant hardware security modules (HSMs) that they control directly. They must also ensure that database credentials are encrypted and automatically rotated. Which of the following AWS services should the laboratory use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudHSM; AWS Secrets Manager

Answer

The research laboratory should use AWS CloudHSM to manage keys on dedicated, single-tenant hardware security modules, and AWS Secrets Manager to encrypt and automatically rotate database credentials.
To meet the compliance requirement for dedicated, single-tenant cryptographic hardware, the laboratory must use AWS CloudHSM. To encrypt and rotate database credentials, AWS Secrets Manager should be implemented.

Step-by-Step Solution

1
Analyze the requirement for dedicated, single-tenant cryptographic hardware.
Identify AWS CloudHSM as the correct service because AWS Key Management Service (AWS KMS) relies on shared, multi-tenant hardware security modules.
AWS CloudHSM is designed for compliance workloads that strictly require single-tenant dedicated HSM instances.
2
Analyze the requirement to encrypt and automatically rotate database credentials.
Identify AWS Secrets Manager as the service designed for securely storing and rotating credentials.
AWS Secrets Manager allows rotation configuration without deploying custom code or scripts.

Key Concept

Data Protection and Encryption services (AWS CloudHSM vs. AWS KMS) and secret management (AWS Secrets Manager).
Question 388Question →

A financial technology company is using Amazon Cognito user pools to manage customer authentication and authorization for its mobile banking application. Under the AWS Shared Responsibility Model, which of the following is a responsibility of the customer?

Show answer & explanation

Answer: Configuring password complexity requirements and multi-factor authentication (MFA) settings for the user pool.

Answer

Configuring password complexity requirements and multi-factor authentication (MFA) settings for the user pool.
Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud.' For Amazon Cognito user pools, this responsibility entails setting password complexity policies, configuring multi-factor authentication (MFA) protocols, and managing client-side authorization parameters.

Step-by-Step Solution

1
Determine the service type and the division of operational duties.
Amazon Cognito is classified as a managed platform-as-a-service (PaaS) or software-as-a-service (SaaS) utility, where AWS handles the underlying infrastructure, operating system, and database tiers.
Correct classification of the AWS service is essential to identifying the boundaries of the Shared Responsibility Model.
2
Differentiate between security 'of' the cloud and security 'in' the cloud for the identified service type.
The customer's responsibility focuses on data and configuration options (security 'in' the cloud), such as setting custom password standards and configuring MFA rules. AWS's responsibility focuses on infrastructure and platform software integrity (security 'of' the cloud).
Distinguishing configuration and data access settings from infrastructure maintenance identifies who is responsible for the task.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:1m 0s
Question 389Question →

A SaaS company is hosting a collaborative document editing application on Amazon EC2 instances. The system administrator wants to allow incoming HTTP/HTTPS traffic to the EC2 instances, ensuring that any corresponding outbound response traffic is automatically permitted regardless of outbound rules. Which AWS network security feature should be configured to meet this requirement?

Show answer & explanation

Answer: Security groups

Answer

Security groups
Security groups are stateful firewalls that operate at the instance level. When you allow inbound traffic to an instance, the return traffic is automatically allowed regardless of any outbound security group rules.

Step-by-Step Solution

1
Analyze the requirements for instance-level traffic filtering and stateful behavior.
The requirement specifies allowing inbound traffic to EC2 instances and automatically permitting the return outbound traffic without explicit configuration.
This matches the definition of stateful packet filtering.
2
Compare the firewalls available in an Amazon VPC.
Security groups are stateful and operate at the instance level. Network ACLs are stateless and operate at the subnet level.
Only security groups track connection state and automatically allow return traffic.

Key Concept

Security groups act as stateful firewalls for Amazon EC2 instances, automatically allowing return traffic for any permitted inbound connection.
Question 390Question →

A media streaming company is storing user account information in Amazon S3 and database backups in Amazon RDS. The company's compliance policy requires all of this data to be encrypted at rest. According to the AWS Shared Responsibility Model, which of the following is a customer responsibility in this scenario?

Show answer & explanation

Answer: Configuring server-side encryption and managing access policies for the cryptographic keys

Answer

Configuring server-side encryption and managing access policies for the cryptographic keys
Under the AWS Shared Responsibility Model, the customer is responsible for data encryption configurations (security in the cloud), which includes enabling server-side encryption on services like Amazon S3 and Amazon RDS and specifying who has permissions to use the encryption keys.

Step-by-Step Solution

1
Identify that the requirement is for encrypting data at rest (stored in Amazon S3 and Amazon RDS).
Recognized that this falls under data protection and key management.
Encryption of data at rest involves both selecting the encryption mechanism and managing the access controls to the keys used for encryption.
2
Apply the AWS Shared Responsibility Model, dividing tasks into customer responsibility (security in the cloud) and AWS responsibility (security of the cloud).
Differentiated infrastructure management from resource configuration.
AWS manages physical data centers, hardware security, hypervisors, and storage sanitization, while customers configure resources, access permissions, and choose whether/how to enable encryption.
3
Select the option that represents a customer-managed action.
Identified that enabling server-side encryption and managing key access policies is the customer's duty.
Only configuring the encryption settings and controlling access policies is under the customer's direct control within the AWS Management Console or APIs.

Key Concept

Data protection at rest and the Shared Responsibility Model
Estimated Time:1m 0s
Question 391Question →

A biotechnology startup uses Amazon DynamoDB to store and query gene sequencing metadata. To comply with industry security regulations, the startup must implement strict access control and verify compliance of the cloud environment. Under the AWS Shared Responsibility Model, which of the following is a responsibility of the customer?

Show answer & explanation

Answer: Managing the identity and access management (IAM) policies that regulate access to the database tables

Answer

Managing the identity and access management (IAM) policies that regulate access to the database tables
For managed services like Amazon DynamoDB, AWS handles infrastructure, hardware, and operating system management. The customer remains responsible for data access controls, which is achieved by defining and managing identity and access management (IAM) policies.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon DynamoDB is classified as a managed platform-as-a-service (PaaS) database service.
Determining the service type helps define where the boundary lies between AWS and customer responsibilities.
2
Evaluate customer versus AWS responsibilities for Amazon DynamoDB.
AWS is responsible for physical security, infrastructure, operating system patching, and database engine maintenance. The customer is responsible for data classification, encryption settings, and identity and access management (IAM) policies.
This isolates the task that belongs to the customer under the Shared Responsibility Model.

Key Concept

Under the AWS Shared Responsibility Model, security of the database platform and infrastructure is the responsibility of AWS, while configuring data access controls (such as IAM policies) remains the responsibility of the customer.
Estimated Time:1m 30s
Question 392Question →

A company is designing the network security architecture for a new web application deployed across multiple subnets in a Virtual Private Cloud (VPC). The cloud practitioner needs to configure instance-level firewalls that automatically allow return traffic for established connections, as well as subnet-level firewalls where rules must be explicitly configured for both inbound and outbound traffic.

Which of the following AWS network security features should be configured to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security groups to control traffic at the instance level; Network access control lists (network ACLs) to control traffic at the subnet level

Answer

Security groups should be configured to control traffic at the instance level, and network access control lists (network ACLs) should be configured to control traffic at the subnet level.
Security groups operate at the instance level (specifically the elastic network interface) and are stateful, meaning any allowed inbound request automatically allows return outbound traffic. Network Access Control Lists (network ACLs) operate at the subnet level and are stateless, meaning rules must be explicitly defined for both inbound and outbound traffic to allow return communication.

Step-by-Step Solution

1
Analyze the requirements for instance-level security and automatically allowed return traffic.
Identify that security groups are applied at the instance level (elastic network interface) and are stateful, which automatically permits return traffic for allowed connections.
This matches the requirement for stateful, instance-level protection.
2
Analyze the requirements for subnet-level security and explicit inbound/outbound rules.
Identify that network access control lists (network ACLs) operate at the subnet level and are stateless, requiring explicit rules for both traffic directions.
This matches the requirement for stateless, subnet-level protection.

Key Concept

The difference between stateful security groups operating at the instance level and stateless network ACLs operating at the subnet level.
Estimated Time:1m 30s
Question 393Question →

A financial services company is deploying an application on AWS. The application will store credit card transactions in an Amazon S3 bucket and use Amazon RDS for MySQL to manage active customer accounts. The company's compliance policy requires all data to be encrypted at rest and encrypted in transit.

According to the AWS Shared Responsibility Model, which two of the following actions are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enabling server-side encryption (SSE) on the Amazon S3 bucket; Configuring SSL/TLS connections for data transmitted to the Amazon RDS database

Answer

Enabling server-side encryption (SSE) on the Amazon S3 bucket and configuring SSL/TLS connections for data transmitted to the Amazon RDS database are the responsibilities of the customer.
Under the AWS Shared Responsibility Model, the customer is responsible for configuring data protection settings within AWS services. Enabling server-side encryption (SSE) on the Amazon S3 bucket protects data at rest, while configuring SSL/TLS connections for the Amazon RDS database protects data in transit. Both are customer-controlled configurations.

Step-by-Step Solution

1
Identify the service data protection requirements in the scenario.
The scenario requires encryption at rest for Amazon S3 and Amazon RDS, and encryption in transit for database traffic.
To classify responsibilities, we must first identify what security features are being configured.
2
Apply the AWS Shared Responsibility Model to the identified tasks.
Configuring encryption settings (such as enabling SSE on S3 and setting up SSL/TLS for database connections) is 'security in the cloud' and thus a customer responsibility. Managing hardware security, replacing disk drives, and provisioning KMS multi-tenant infrastructure is 'security of the cloud' and thus AWS's responsibility.
Distinguishing between customer responsibilities (logical configuration and data protection) and AWS responsibilities (physical infrastructure and service management) determines the correct options.

Key Concept

Under the AWS Shared Responsibility Model, AWS manages security *of* the cloud (physical infrastructure, virtualization layer, and global infrastructure). The customer is responsible for security *in* the cloud, which includes data protection (encryption at rest and in transit) and access management.

AreaCustomer Responsibility (Security IN the Cloud)AWS Responsibility (Security OF the Cloud)
Data at RestEnabling server-side encryption (SSE), managing customer master keys (CMKs)Physical security of HSMs, media disposal, physical storage maintenance
Data in TransitConfiguring SSL/TLS, managing network traffic encryptionMaintaining the physical network and AWS global infrastructure
Estimated Time:1m 30s
Question 394Question →

An AWS IAM user has two identity-based policies attached to their identity. The first policy explicitly allows the 's3:GetObject' action on all Amazon S3 resources, while the second policy explicitly denies the 's3:GetObject' action on a specific S3 bucket named 'financial-records'. Which of the following describes the final access decision when the user attempts to retrieve an object from the 'financial-records' bucket?

Show answer & explanation

Answer: Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.

Answer

Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.
The correct answer is that access is denied because in AWS IAM policy evaluation, an explicit deny always overrides any explicit allows. Even though the first policy grants read access to all S3 buckets, the second policy's explicit deny on the specific bucket ensures that any request to retrieve objects from that bucket is blocked.

Step-by-Step Solution

1
Analyze the attached IAM policies to identify all applicable statements.
There is one policy statement that explicitly allows the action on all S3 resources, and another statement that explicitly denies the action on the 'financial-records' bucket.
AWS evaluates all policies attached to the user identity simultaneously to determine permissions.
2
Apply the AWS IAM policy evaluation hierarchy.
The explicit deny on the specific bucket takes precedence over the general explicit allow.
By default, all requests are denied in AWS. An explicit allow overrides the default deny, but any explicit deny always overrides any explicit allows.

Key Concept

AWS IAM Policy Evaluation Logic (Explicit Deny Override)
Question 395Question →

A startup is establishing its initial AWS environment and wants to secure access controls for its development team and applications running on Amazon EC2. Which of the following actions represent AWS-recommended security best practices? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Enable Multi-Factor Authentication (MFA) on the AWS account root user and restrict its usage to essential account management tasks.; Define IAM roles with temporary credentials to grant applications running on Amazon EC2 instances access to other AWS resources.

Answer

The correct practices are to enable Multi-Factor Authentication (MFA) on the root user and restrict its use, and to use IAM roles with temporary credentials for applications running on EC2 instances.
The correct options are to enable MFA on the AWS account root user and restrict its usage, and to define IAM roles with temporary credentials for applications running on EC2. These follow AWS security guidelines by locking down the root user and avoiding the use of hardcoded, permanent credentials for applications.

Step-by-Step Solution

1
Review the requirements to secure developer access and EC2 applications.
Identify that developer access requires distinct credentials and applications must avoid hardcoded secret keys.
AWS security practices advise against sharing access credentials and storing static credentials in environments where they can be compromised.
2
Select the correct AWS Identity and Access Management (IAM) configurations that support these principles.
Identify that enabling MFA on the root user protects the account, and assigning IAM roles to EC2 instances provides temporary credentials dynamically.
MFA prevents unauthorized root level access, and IAM roles prevent credential leaks by avoiding the use of permanent keys.

Key Concept

AWS Identity and Access Management (IAM) Best Practices
Question 396Question →

A company is using Amazon ElastiCache (Redis OSS) to cache session data for a high-traffic web application. Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring security groups to restrict network access to the cache nodes; Enabling and managing encryption in transit and Redis authentication for client access

Answer

Configuring security groups to restrict network access to the cache nodes, and enabling and managing encryption in transit and Redis authentication for client access.
For managed services like Amazon ElastiCache, AWS manages the underlying virtual machines, OS patching, and physical infrastructure. The customer is responsible for configuring access controls, such as security groups, and managing authentication and encryption options to secure data within the cache.

Step-by-Step Solution

1
Identify the AWS service type in the scenario.
Amazon ElastiCache is a managed service (Platform as a Service/PaaS model).
The division of responsibilities depends on whether a service is Infrastructure as a Service (IaaS) or a managed service (PaaS).
2
Differentiate customer responsibilities from AWS responsibilities for managed services.
AWS handles underlying infrastructure, including physical security, hardware replacement, hypervisor management, and operating system patching. The customer handles configuration, data encryption settings, user authentication, and network access controls (security groups).
This alignment helps identify which tasks fall under customer ownership ('security in the cloud') vs AWS ownership ('security of the cloud').

Key Concept

Shared Responsibility Model for Managed Services
Question 397Question →

A digital publishing company hosts its content management system on Amazon Elastic Compute Cloud (Amazon EC2) instances within a public subnet. Following a security audit, the team needs to implement a rule that blocks a specific list of malicious IP addresses from reaching any resources within that subnet. Additionally, the security team notes that the control must evaluate both inbound and outbound traffic separately since it does not automatically track connection states. Which AWS resource should the company configure to meet these requirements?

Show answer & explanation

Answer: Network Access Control Lists (Network ACLs)

Answer

Network Access Control Lists (Network ACLs)
The correct answer is Network Access Control Lists (Network ACLs). Network ACLs act as a stateless firewall at the subnet level. They support both allow and deny rules (enabling the block of specific IP addresses) and require separate configuration for inbound and outbound traffic because they do not track connection states.

Step-by-Step Solution

1
Analyze the requirement for blocking traffic at the subnet level.
The solution must operate at the subnet boundary to protect all resources within the subnet, ruling out instance-level controls.
Security Groups operate at the instance level, whereas Network ACLs operate at the subnet level.
2
Evaluate the requirement for blocking specific IP addresses (explicit deny).
The service must support deny rules.
Security Groups only support allow rules, meaning you cannot explicitly deny specific IP addresses. Network ACLs support both allow and deny rules.
3
Verify the connection tracking requirement (stateless vs. stateful).
The control must evaluate inbound and outbound traffic separately because it does not track connection states (stateless).
Network ACLs are stateless, requiring explicit configuration of inbound and outbound rules, which matches the scenario's requirements.

Key Concept

Stateful vs. Stateless AWS Firewall Features at Subnet and Instance Levels
Estimated Time:1m 30s
Question 398Question →

A ride-sharing company is deploying an application on AWS that processes passenger location coordinates. To ensure data privacy, the developer wants to encrypt this coordinate data while it is transmitted from the passenger's mobile app to the application backend on AWS. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility in this scenario?

Show answer & explanation

Answer: Configuring SSL/TLS certificates and protocols on the application endpoints

Answer

Configuring SSL/TLS certificates and protocols on the application endpoints
Under the AWS Shared Responsibility Model, the customer is responsible for protecting data in transit ('Security in the Cloud'). This includes configuring SSL/TLS certificates and secure protocols (like HTTPS) on their application endpoints, such as load balancers, API gateways, or EC2 instances.

Step-by-Step Solution

1
Analyze the security requirement: the company needs to encrypt coordinate data in transit between mobile apps and the AWS backend.
Identified encryption in transit as the primary security goal.
Understanding the context helps determine which security controls are applicable.
2
Apply the AWS Shared Responsibility Model to data in transit.
Determine that while AWS secures the underlying physical network infrastructure, the customer is responsible for configuring encryption protocols on their logical endpoints.
This isolates the boundary between AWS infrastructure security and customer data/application configuration.
3
Identify the correct option that reflects this customer-side configuration.
Configuring SSL/TLS certificates on endpoints like Application Load Balancers or API Gateways matches the customer's responsibility.
This implements the required encryption in transit at the application layer.

Key Concept

Shared Responsibility Model for Data in Transit
Estimated Time:1m 0s
Question 399Question →

A healthcare provider deploys AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) to manage employee access to clinical applications. Under the AWS Shared Responsibility Model, which two tasks are the sole responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Creating and managing organizational units (OUs), user accounts, and group memberships within the directory; Configuring Group Policy Objects (GPOs) to enforce security compliance on domain-joined instances

Answer

Creating and managing organizational units (OUs), user accounts, and group memberships within the directory, as well as configuring Group Policy Objects (GPOs) to enforce security compliance on domain-joined instances, are the responsibility of the customer.
Under the AWS Shared Responsibility Model for managed services, AWS manages the host environment, operating system patching, and domain controller hardware availability. The customer retains full control over the logical administration of the directory, which includes managing directory objects (users, groups, organizational units) and configuring policies (such as GPOs) for domain-joined resources.

Step-by-Step Solution

1
Analyze the service model in use.
AWS Managed Microsoft AD is a managed directory service.
Managed services shift infrastructure and platform maintenance duties (like OS patching and hardware replication) to AWS, leaving data and access configuration duties to the customer.
2
Evaluate operational actions against the Shared Responsibility Model boundary.
Administrative actions inside the directory (managing users, groups, and GPOs) belong to the customer, while maintenance of domain controller servers belongs to AWS.
AWS secures the infrastructure running the service (security 'of' the cloud), while the customer secures the data and configurations put into the service (security 'in' the cloud).

Key Concept

For managed services like AWS Managed Microsoft AD, AWS handles host deployment, patching, physical security, and replication of domain controllers, while the customer is responsible for directory administrative tasks, user and group management, and policy configurations.
Question 400Question →

A logistics company is hosting a dispatch coordinate management system on Amazon EC2 instances within a Virtual Private Cloud (VPC). A security administrator needs to implement a network security design that meets two criteria:

1. Block a list of specific malicious IP addresses at the subnet boundary before the traffic reaches any resources.
2. Automatically allow return traffic for any authorized inbound connections to the EC2 instances without needing to configure outbound rules.

Which of the following configurations should the administrator implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply a Network Access Control List (Network ACL) at the subnet level with deny rules to block the malicious IP addresses.; Apply a Security Group at the instance level to allow inbound traffic, relying on its stateful nature to automatically permit return traffic.

Answer

Apply a Network Access Control List (Network ACL) at the subnet level with deny rules to block the malicious IP addresses, and apply a Security Group at the instance level to allow inbound traffic, relying on its stateful nature to automatically permit return traffic.
The correct strategy combines a subnet-level Network Access Control List (Network ACL) to explicitly block malicious IP addresses (since Network ACLs support deny rules at the subnet boundary) and an instance-level Security Group to control application access (since Security Groups are stateful and automatically permit return traffic for established connections without needing outbound rule configuration).

Step-by-Step Solution

1
Analyze the requirement to block specific IP addresses at the subnet boundary.
Identify that Network Access Control Lists (NACLs) operate at the subnet level and support explicit deny rules.
Security Groups do not support deny rules and operate at the instance level, so NACLs must be used to block IPs at the subnet boundary.
2
Analyze the requirement to automatically allow return traffic for established connections.
Identify that Security Groups are stateful and automatically track connection states to allow return traffic.
Network ACLs are stateless and require explicit configuration of outbound rules for return traffic, whereas Security Groups automatically handle return traffic.

Key Concept

Stateful vs. Stateless network firewalls in AWS (Security Groups vs. Network ACLs)
PreviousPage 20 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 20 | Examkin