Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 41Question →

A company is building a hybrid application where an on-premises server must upload log files directly to an Amazon S3 bucket. Additionally, a third-party auditing agency requires temporary, read-only access to inspect the S3 bucket's access configurations. To meet compliance standards, the company must avoid configuring or managing long-term AWS credentials for either the on-premises server or the external auditors. Which of the following solutions should the company implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS Identity and Access Management (IAM) Roles Anywhere to enable the on-premises server to exchange digital certificates for short-term AWS credentials.; Configure identity federation using a SAML 2.0 or OpenID Connect (OIDC) identity provider to allow the external auditors to assume an IAM role.

Answer

The correct solutions are configuring AWS Identity and Access Management (IAM) Roles Anywhere for the on-premises application to exchange digital certificates for temporary credentials, and configuring federation using a SAML 2.0 or OpenID Connect (OIDC) identity provider to allow the external auditors to assume an IAM role.
Configuring AWS Identity and Access Management (IAM) Roles Anywhere allows the on-premises server to authenticate using public key infrastructure (PKI) certificates to dynamically obtain temporary credentials. Setting up SAML 2.0 or OIDC federation allows external auditors to leverage their existing identity provider to assume an IAM role, obtaining temporary credentials for the audit duration without needing permanent IAM user accounts.

Step-by-Step Solution

1
Analyze the requirements for the on-premises server, which needs programmatic access to S3 without managing long-term security keys.
Identify that AWS IAM Roles Anywhere is designed specifically to grant temporary credentials to workloads outside of AWS using public key infrastructure (PKI) certificates.
This satisfies the requirement to avoid managing long-term AWS credentials for on-premises servers.
2
Analyze the requirements for the third-party auditors who need temporary, administrative-free access to read S3 bucket access logs.
Identify that federation using external identity providers (SAML 2.0 or OIDC) allows external users to assume IAM roles with temporary credentials dynamically.
This eliminates the administrative overhead of managing local IAM users for third-party auditing partners.
3
Evaluate the distractors against AWS security best practices and the Shared Responsibility Model.
Discard the options to use the root account credentials, create permanent IAM users with access keys, or rely on AWS Support to configure customer security settings.
These distractors introduce security risks, use long-term credentials, or misinterpret the boundaries of the Shared Responsibility Model.

Key Concept

Programmatic access security using temporary credentials (IAM Roles Anywhere and Identity Federation) in place of long-term credentials (IAM Users and Root accounts).
Question 42Question →

A company is setting up a new multi-department environment on AWS. The security team is defining identity and access management policies for corporate employees, applications running on Amazon EC2 instances, and administrative workflows. Which of the following are recommended AWS IAM best practices for managing access for these entities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign IAM roles to Amazon EC2 instances instead of storing long-term AWS access keys within the application code.; Use AWS IAM Identity Center to federate employee identities from the company's existing identity provider for console access.

Answer

Assigning IAM roles to Amazon EC2 instances to avoid storing hardcoded credentials, and using AWS IAM Identity Center to federate employee identities from an existing identity provider.
The correct practices are to assign IAM roles to EC2 instances so applications can access resources using temporary security credentials, and to use AWS IAM Identity Center to federate employee identities from an existing identity provider. This aligns with the principle of least privilege and avoids managing long-term static credentials.

Step-by-Step Solution

1
Analyze the credentials requirement for applications running on Amazon EC2 instances.
Identify that applications should use temporary credentials retrieved dynamically using IAM roles, rather than storing long-term credentials in the code.
This reduces the risk of credential exposure and complies with AWS security best practices.
2
Analyze the credentials requirement for corporate employee login access.
Identify that centrally managed single sign-on using AWS IAM Identity Center federated with the existing identity provider is the recommended approach.
Federation enables centralized administration, enforces security controls like MFA, and eliminates the need to manage separate long-term IAM users.

Key Concept

AWS IAM best practices for managing credentials and access for applications and human users
Estimated Time:1m 30s
Question 43Question →

A healthcare technology company is deploying a serverless application that processes patient health records. The architecture consists of an HTTPS endpoint hosted on Amazon API Gateway, custom backend logic running in AWS Lambda, and patient data stored in Amazon DynamoDB. Under the AWS Shared Responsibility Model, which two security and operational tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring IAM execution roles and resource-based policies to restrict access between the Lambda functions and DynamoDB tables; Defining authorization mechanisms in API Gateway and securing the custom application code deployed in Lambda

Answer

Configuring IAM execution roles and resource-based policies to restrict access between the Lambda functions and DynamoDB tables, and defining authorization mechanisms in API Gateway and securing the custom application code deployed in Lambda.
For serverless services like AWS Lambda, Amazon DynamoDB, and Amazon API Gateway, AWS assumes responsibility for the entire infrastructure stack, including physical hardware, OS patching, runtime environments, and virtualization. The customer remains responsible for data classification, configuring Identity and Access Management (IAM) execution roles and access policies, API Gateway authorization configurations, and securing the custom application code deployed to the environment.

Step-by-Step Solution

1
Analyze the service models of the resources in the scenario.
Amazon API Gateway, AWS Lambda, and Amazon DynamoDB are fully managed, serverless (Platform as a Service) resources.
Under the Shared Responsibility Model, the boundary between customer and AWS duties shifts depending on the service category.
2
Identify AWS responsibilities for serverless resources.
AWS is responsible for physical security, hardware management, hypervisor security, operating system patching, and runtime updates.
These lower-level infrastructure tasks are fully managed and abstracted away from the customer in serverless offerings.
3
Identify customer responsibilities for serverless resources.
The customer is responsible for configurations, identity and access control (IAM), client-side encryption, API Gateway authentication, and writing secure application code.
Even in a fully managed model, the customer must control access to their data and secure the application logic.
4
Match the options to the correct responsibility boundaries.
Configuring IAM roles and setting up API authorization/securing application code are customer duties, whereas patching container runtimes, physical disk security, and hypervisor management are AWS duties.
This separates customer actions (security in the cloud) from AWS actions (security of the cloud).

Key Concept

Shared Responsibility Model for Serverless Services
Question 44Question →

A company is using Amazon DynamoDB to store application data. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Configuring Identity and Access Management (IAM) policies to control database access

Answer

Configuring Identity and Access Management (IAM) policies to control database access
Configuring Identity and Access Management (IAM) policies to control database access is the correct answer. Under the Shared Responsibility Model, the customer is always responsible for managing access to their data and configuring permissions, regardless of whether the service is managed or unmanaged.

Step-by-Step Solution

1
Identify the AWS service type in the scenario.
Amazon DynamoDB is a fully managed NoSQL database service (PaaS/Managed service).
The level of customer responsibility depends on whether the service is Infrastructure as a Service (IaaS) like Amazon EC2, or a managed service (PaaS) like Amazon DynamoDB.
2
Determine the boundary of responsibility for a managed database service.
AWS handles the physical security, hardware infrastructure, virtualization layer, operating system, and database engine software. The customer is responsible for data classification, encryption settings, and resource access control.
Applying the Shared Responsibility Model rules for managed services.
3
Evaluate the choices to identify the task that falls under the customer's control.
Configuring access policies using IAM is managed by the customer, whereas OS patching, hardware replacement, and physical security are managed by AWS.
Select the option that represents a customer responsibility.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon DynamoDB, AWS handles the infrastructure layers including database software patching, operating system maintenance, and hardware management. The customer remains responsible for configuration tasks, such as managing access controls (IAM) and securing their data.
Estimated Time:45s
Question 45Question →

A software development company is migrating its monolithic API to a serverless architecture using AWS Lambda. As part of this transition, the security team is defining operational tasks under the AWS Shared Responsibility Model. Which of the following tasks remains the sole responsibility of the customer when deploying code to AWS Lambda?

Show answer & explanation

Answer: Configuring the IAM execution roles and resource-based policies that control access to the Lambda functions

Answer

Configuring the IAM execution roles and resource-based policies that control access to the Lambda functions
For serverless services like AWS Lambda, AWS manages the underlying physical infrastructure, virtualization layer, operating systems, and runtimes. The customer is responsible for writing secure application code and managing access control, which includes defining IAM execution roles and configuring resource-based policies to govern function access.

Step-by-Step Solution

1
Analyze the service model of AWS Lambda
AWS Lambda is a serverless (PaaS/managed) compute service.
Understanding the service type helps define the boundary of responsibility; serverless services shift more infrastructure management tasks (like OS patching and runtime maintenance) to AWS.
2
Differentiate between customer and AWS responsibilities for Lambda
AWS manages the physical security, hardware, virtualization layer, operating system, and runtime. The customer manages application code, data, and access permissions (IAM).
This allows identifying which of the options represents a task that is managed by the customer ('security in the cloud') vs AWS ('security of the cloud').

Key Concept

Shared Responsibility Model for Serverless Services
Question 46Question →

A company needs to grant a newly hired security analyst access to the AWS Management Console to audit resource configurations. The analyst requires their own permanent credentials to log in. Which IAM entity should the administrator create to meet this requirement?

Show answer & explanation

Answer: An IAM user

Answer

An IAM user
An IAM user represents a person or service that requires permanent credentials to interact with AWS, making it the correct entity for a new employee requiring long-term console access.

Step-by-Step Solution

1
Identify the requirement for permanent, individual console login credentials.
Determine that the employee needs a unique identity with persistent login credentials.
This helps select the appropriate credential type in AWS IAM.
2
Compare AWS IAM entities to identify the correct resource.
An IAM user provides the long-term credentials (password and access keys) needed for direct console login.
IAM roles are for temporary credentials, and root accounts should not be used for daily tasks.

Key Concept

IAM Users vs. IAM Roles and Credentials Best Practices
Estimated Time:45s
Question 47Question →

A developer using an IAM user in a development account (Account A) requires temporary access to perform administrative tasks on an Amazon DynamoDB table located in a production account (Account B). To adhere to AWS security best practices and the principle of least privilege, which of the following configuration steps must be implemented? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the production account (Account B), create an IAM role with a trust policy that allows the IAM user in the development account (Account A) to assume the role.; In the development account (Account A), attach an identity-based policy to the developer's IAM user that allows the sts:AssumeRole action targeting the role in Account B.

Answer

To establish secure cross-account access, you must create an IAM role in the production account (Account B) with a trust policy that permits the development account user to assume it, and attach an identity-based policy in the development account (Account A) allowing the user to call the sts:AssumeRole action on the production role.
The correct steps require establishing trust between the two accounts using an IAM role and granting the user permissions to assume that role. Creating an IAM role in the destination account with a trust policy defines who can assume the role. Attaching an identity-based policy in the source account allowing the sts:AssumeRole action gives the source user the ability to request the role's temporary credentials. This combination enables secure cross-account access without using permanent credentials.

Step-by-Step Solution

1
Configure trust in the target account
An IAM role is created in the production account (Account B) with a trust policy specifying the AWS account ID or specific IAM user ARN of the development account (Account A) as the trusted principal.
This establishes that the production account trusts the development account's identity to assume the role.
2
Grant delegation permission in the source account
An IAM policy is attached to the IAM user or group in the development account (Account A) containing an 'Allow' effect for the 'sts:AssumeRole' action on the target role's ARN.
This permits the IAM user in Account A to execute the API call required to assume the role and retrieve temporary credentials.

Key Concept

Cross-account access delegation using IAM roles and temporary security credentials
Question 48Question →

A startup has five developers who all need the same administrative permissions to manage Amazon EC2 resources. According to AWS security best practices, which of the following is the most efficient way to manage these permissions?

Show answer & explanation

Answer: Create an IAM group, attach the required IAM policy to the group, and add the developer users to the group.

Answer

Creating an IAM group, attaching the required policy to the group, and adding the users to the group is the recommended method to manage collective permissions.
Creating an IAM group and attaching the required policy to it is the AWS-recommended best practice for managing permissions for multiple users with the same job function. This centralized approach simplifies permission updates and ensures that new developers can quickly inherit the required permissions by simply being added to the group.

Step-by-Step Solution

1
Analyze the scenario requirements.
Five developers require identical administrative permissions to manage Amazon EC2 resources.
To apply AWS security best practices efficiently, we need a method that scales and maintains individual user accountability.
2
Evaluate IAM features for collective permission management.
Using an IAM group allows policies to be attached once and applied to all member users.
This is the standard, secure, and low-maintenance approach recommended by AWS.

Key Concept

AWS IAM Groups and Permission Management
Question 49Question →

A gaming company has a mobile application that needs to securely write game state files to an Amazon S3 bucket. Millions of players will use this application, and they must not have permanent AWS credentials embedded in the app code. Which approach should the company use to grant this access?

Show answer & explanation

Answer: Authenticate users through a public identity provider and assume an IAM role to obtain temporary security credentials.

Answer

Authenticate users through a public identity provider and assume an IAM role to obtain temporary security credentials.
The correct approach is to authenticate users via a public identity provider and assume an IAM role. This leverages web identity federation, allowing mobile users to obtain temporary, limited-privilege security credentials to access Amazon S3 without embedding permanent access keys in the application binary.

Step-by-Step Solution

1
Analyze the requirement of providing access to millions of external mobile application users without embedding static credentials.
Eliminate solutions involving long-term access keys or static IAM user credentials.
Embedding static keys in client-side applications exposes them to extraction.
2
Identify the AWS mechanism designed for providing temporary credentials to external users.
Select IAM roles as the mechanism to provide temporary security credentials.
IAM roles provide short-lived, auto-rotating credentials.
3
Determine how external mobile users can be authenticated before assuming the role.
Use web identity federation with an OIDC-compatible identity provider.
This allows external users to authenticate using existing identity providers (like Google or Amazon) to assume the role.

Key Concept

Temporary security credentials via IAM roles and web identity federation
Estimated Time:2m 0s
Question 50Question →

A media streaming company is deploying a containerized microservice using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team needs to define the operational boundaries between the company and AWS to ensure compliance. Which of the following operational tasks is the sole responsibility of the customer under the AWS Shared Responsibility Model for this architecture?

Show answer & explanation

Answer: Patching vulnerabilities within the application code and software packages packaged inside the container image

Answer

Patching vulnerabilities within the application code and software packages packaged inside the container image
Under the AWS Shared Responsibility Model, AWS Fargate is a serverless compute engine for containers. Because the customer does not manage the underlying virtual servers or host operating systems, AWS is responsible for patching and securing the hypervisor and hosts. However, the customer is responsible for the container image itself, which includes patching the application code, runtimes, and dependencies packaged inside the image.

Step-by-Step Solution

1
Analyze the deployment model and AWS service in use.
The application runs on Amazon ECS using the AWS Fargate launch type, which is a serverless container environment.
Establishing the platform type defines the Shared Responsibility Model boundary; serverless container services shift host management and patching to AWS.
2
Differentiate between the responsibilities of AWS and the customer for serverless container layers.
AWS secures the infrastructure, physical hosts, and hypervisors. The customer remains responsible for everything packaged inside the container image (application code, runtimes, packages) as well as access configurations (IAM roles, security groups).
This separation determines which operations the customer must perform to keep the containerized workload secure.
3
Identify the option that represents a valid, correct customer responsibility.
Securing and patching application code and libraries packaged inside the container image is the customer's responsibility. The other options are managed by AWS, conceptually incorrect, or violate policy.
Validates the correct answer and confirms the distractors are incorrect based on the model boundary.

Key Concept

AWS Shared Responsibility Model applied to serverless container services (AWS Fargate)
Estimated Time:1m 30s
Question 51Question →

A company needs to restrict its database administrators from modifying Amazon RDS instances when they are working outside of the corporate network or outside of standard business hours. Which IAM mechanism should the security team implement to enforce these specific access conditions?

Show answer & explanation

Answer: An IAM policy containing a Condition element with aws:SourceIp and aws:CurrentTime keys attached to the database administrators' role or group

Answer

An IAM policy containing a Condition element with aws:SourceIp and aws:CurrentTime keys attached to the database administrators' role or group
The correct answer is the option that suggests using an IAM policy with a Condition element containing the aws:SourceIp and aws:CurrentTime keys. This allows the security team to specify exactly when and from where the policy permits database administration tasks, conforming to best practices.

Step-by-Step Solution

1
Analyze the access control requirements
Identify that the restrictions are based on network location (IP address) and request time (business hours).
This determines which variables or policy attributes must be evaluated during policy execution.
2
Evaluate the capabilities of IAM Policy elements
Determine that the 'Condition' block in IAM JSON policies allows specifying conditions under which the policy statement is in effect, using global condition keys like 'aws:SourceIp' and 'aws:CurrentTime'.
This matches the exact parameters of the requirement (network source and time constraints).
3
Apply the policy to the appropriate identity
Attach the policy containing these conditions to the IAM group or role used by database administrators.
Attaching the policy directly to the identity ensures that all administrative requests made by those users are evaluated against these rules.

Key Concept

IAM Policy Conditions
Question 52Question →

An administrator has created a new AWS account to host a student portal. To align with AWS security best practices, which action should the administrator perform first regarding the AWS account root user?

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) for the root user and create individual IAM users with administrative permissions for daily tasks.

Answer

Enable multi-factor authentication (MFA) for the root user and create individual IAM users with administrative permissions for daily tasks.
Enabling multi-factor authentication (MFA) for the root user secures the most privileged identity in the AWS account. Daily administrative tasks should be performed by IAM users with appropriate permissions rather than the root user, following the principle of least privilege.

Step-by-Step Solution

1
Identify the security requirements for the root user of a new AWS account.
The root user has complete, unrestricted access to all resources and billing, making its protection paramount.
Understanding the privilege level of the root user highlights the need for immediate securing steps (like MFA) and avoiding daily usage.
2
Compare the proposed actions against AWS security best practices.
Creating individual IAM users with limited or administrative rights for daily tasks and securing the root account with MFA is the recommended path.
This setup limits the risk of exposing root credentials and ensures compliance with the principle of least privilege.

Key Concept

AWS account root user security best practices dictate that the root user should not be used for daily tasks, must be protected by MFA, and daily administration should be delegated to individual IAM users.
Estimated Time:1m 0s
Question 53Question →

A startup is deploying a containerized microservices application using Amazon ECS on AWS Fargate. Under the AWS Shared Responsibility Model, which of the following tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Defining container task settings, including specifying the container images and CPU/memory allocations.; Configuring security groups to control network traffic to the container tasks.

Answer

The customer is responsible for defining container task settings (such as specifying container images and resource allocations) and configuring security groups to control traffic to the tasks.
Under the AWS Shared Responsibility Model for serverless containers using Amazon ECS on AWS Fargate, AWS manages the underlying infrastructure, physical hosts, and host operating system patching. The customer is responsible for configuring the container task definitions (specifying the image, CPU, and memory) and setting up security groups to control network traffic to the tasks.

Step-by-Step Solution

1
Identify the AWS service model type.
Amazon ECS on AWS Fargate is a serverless, managed compute service.
Understanding the service model helps determine where the boundary lies between customer and AWS responsibilities.
2
Separate infrastructure management from application and access configuration.
AWS manages physical security, hosts, hypervisors, and operating systems. The customer manages task configuration and access control (security groups).
In serverless container deployments, everything inside the container task definition and its network access rules remains the customer's responsibility.

Key Concept

Shared Responsibility Model
Estimated Time:1m 0s
Question 54Question →

A logistics company is containerizing its route-optimization API and deploying it using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team is establishing operational workflows to comply with the AWS Shared Responsibility Model. Which of the following tasks remains the sole responsibility of the customer in this deployment model?

Show answer & explanation

Answer: Updating and patching the application libraries, dependencies, and base operating system files packaged inside the container image.

Answer

Updating and patching the application libraries, dependencies, and base operating system files packaged inside the container image.
Under the AWS Shared Responsibility Model for AWS Fargate, AWS manages the physical security, hardware, virtualization hypervisor, and the host operating system. The customer remains fully responsible for everything inside the container, including application code, configuration settings, and patching the packages, libraries, and base operating system files included inside the container image itself.

Step-by-Step Solution

1
Analyze the service type used in the scenario.
Amazon ECS with AWS Fargate launch type is a container execution environment that abstracts host provisioning and management (a managed/serverless model).
Determining the service type defines the boundary of customer responsibility.
2
Identify the boundary of control for AWS Fargate.
AWS manages the host operating system, hypervisor, and physical infrastructure. The customer retains control of the container definition, IAM policies, and container contents.
Differentiates 'security of the cloud' (AWS) from 'security in the cloud' (customer).
3
Evaluate each option against the customer/AWS boundary.
The container image contents (libraries, OS files in the image) are packaged by the customer, making image patching a customer task. Host OS patching and physical security are AWS tasks. NACLs cannot be applied at the task level.
Pinpoints the correct operational task that belongs to the customer.

Key Concept

Under the Shared Responsibility Model for AWS Fargate, the customer is responsible for security 'in' the container (such as patching the container image layers and configuration), while AWS is responsible for security 'of' the container host, virtualization, and physical infrastructure.
Estimated Time:2m 0s
Question 55Question →

A local healthcare provider is setting up access control for its staff in the AWS Cloud. The administrator needs to configure secure access for human users and application services while adhering to AWS Identity and Access Management (IAM) best practices. Which of the following actions represent AWS-recommended IAM security best practices for this setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) for all IAM users who have administrative permissions.; Assign IAM roles to application servers that require access to other AWS services instead of using long-term credentials.

Answer

Enabling multi-factor authentication (MFA) for administrative accounts and assigning IAM roles to application servers needing access to AWS services.
The correct actions are enabling multi-factor authentication (MFA) for accounts with administrative privileges and assigning IAM roles to application servers. MFA provides a critical layer of defense-in-depth, while IAM roles supply temporary, rotating credentials to applications running on AWS, minimizing the threat of credential exposure.

Step-by-Step Solution

1
Identify the security requirements for human administrative access versus application access in AWS.
Human users require secure administrative access, whereas applications require programmatic access to AWS services.
AWS separates access strategies for identity types to maintain strict credential isolation.
2
Apply the principle of least privilege and credential safety: require multi-factor authentication for administrative users to protect access, and use IAM roles to delegate temporary credentials to application servers.
MFA is configured for admin users, and IAM roles are assigned to the servers hosting the applications.
These steps ensure that administrators are strongly authenticated and that applications do not use hardcoded or permanent keys.

Key Concept

AWS IAM Security Best Practices
Estimated Time:1m 0s
Question 56Question →

A retail company's security team is auditing its AWS environment. An application hosted on Amazon EC2 instances must access a private Amazon S3 bucket to process transaction logs, and an external security consultant requires temporary access to review the IAM configurations. Which TWO of the following options represent AWS-recommended security practices to implement these requirements?

Select all that apply

Show answer & explanation

Answer: Attach an IAM role to the EC2 instances that provides the minimum necessary permissions to access the S3 bucket.; Establish cross-account access by creating an IAM role that the external security consultant can assume.

Answer

The correct practices are attaching an IAM role to the EC2 instances for secure S3 access and establishing cross-account access using an IAM role for the external consultant.
The recommended approach to secure application workloads on Amazon EC2 is to attach an IAM role, which automatically manages rotation of temporary credentials. To grant secure access to external auditors, companies should set up cross-account access via an IAM role with a trust policy, ensuring that the external partner uses their own account credentials to authenticate.

Step-by-Step Solution

1
Identify the compute resource security requirements: For Amazon EC2 instances to access other AWS resources like S3, the recommended best practice is to delegate access via IAM roles, which leverage temporary credentials instead of hardcoded long-term keys.
Using IAM roles for EC2 instances removes the need to store long-term keys on the server.
This reduces the risk of credential exposure if the EC2 instance is compromised.
2
Identify the external access requirements: For third-party users or consultants who already have their own AWS accounts, cross-account IAM roles should be configured to allow access without creating local IAM users or sharing credentials.
Establishing cross-account IAM roles allows secure, auditable, and temporary access.
This follows the security principle of identity isolation and avoids sharing credentials or creating unnecessary IAM user profiles.

Key Concept

AWS IAM Best Practices for EC2 Instances and Cross-Account Access
Question 57Question →

A shipping logistics company is deploying its microservices-based application using containers on AWS Fargate. Under the AWS Shared Responsibility Model, which two security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring the security groups to control inbound and outbound traffic to the running container tasks; Managing and patching the application code and libraries packaged inside the container images

Answer

Under the AWS Shared Responsibility Model for AWS Fargate, the customer is responsible for configuring security groups to control network traffic to the container tasks, and managing and patching the application code and libraries packaged inside the container images.
Under the AWS Shared Responsibility Model for managed container services like AWS Fargate, AWS handles the host operating system, virtualization layer, and physical infrastructure security. The customer retains control and responsibility for security 'in' the cloud, which includes configuring network access rules via security groups to restrict traffic to the containers, and managing the security of the container contents, including patching application code and dependencies.

Step-by-Step Solution

1
Analyze the service type in the scenario
AWS Fargate is a serverless compute engine for containers.
Understanding whether a service is IaaS, PaaS, or serverless/managed determines where the Shared Responsibility Model boundary lies.
2
Differentiate between AWS and customer responsibilities for Fargate
AWS manages the infrastructure layer (physical security, hardware, host OS, virtualization, container runtime). The customer manages the container contents (code, packages) and network access controls (security groups).
This establishes which tasks belong to each party under the model.
3
Evaluate the choices based on the established boundaries
Configuring security groups and patching application code/container images are customer responsibilities. Patching the host OS and managing physical hardware are AWS responsibilities. Accessing compliance documents is done via AWS Artifact, not Amazon Inspector.
This identifies the correct options and eliminates the incorrect distractors.

Key Concept

Shared Responsibility Model for Serverless Container Services (AWS Fargate)
Question 58Question →

A healthcare organization is preparing for an external audit to verify HIPAA compliance for its cloud-based medical records application. The application's architecture consists of Amazon Elastic Compute Cloud (Amazon EC2) instances behind an Application Load Balancer, with data stored in an Amazon Aurora MySQL database cluster. To satisfy the audit, the organization must provide documentation of physical data center security, evidence of guest operating system patch compliance, and proof of data-in-transit encryption. Under the AWS Shared Responsibility Model, which combination of actions is the customer responsible for performing to meet these requirements?

Show answer & explanation

Answer: Retrieving AWS compliance reports from AWS Artifact, applying security patches to the guest operating system of the Amazon EC2 instances, and configuring SSL/TLS certificates on the Application Load Balancer.

Answer

The customer is responsible for retrieving AWS compliance reports from AWS Artifact, patching the guest operating system of the EC2 instances, and configuring SSL/TLS certificates on the Application Load Balancer.
The correct option outlines customer responsibilities: retrieving third-party compliance reports from the self-service AWS Artifact portal, patching the guest operating system of EC2 instances, and configuring SSL/TLS certificates on the Application Load Balancer. Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud (physical data centers and the virtualization hypervisor layer), while the customer is responsible for security 'in' the cloud (guest operating systems, load balancer listener certificates, and network traffic protection).

Step-by-Step Solution

1
Determine the resource-specific patching boundary.
Patching the guest operating system of Amazon EC2 instances is a customer responsibility (IaaS), whereas patching the underlying operating system of Amazon Aurora instances and hypervisors is managed by AWS.
AWS manages physical and virtualization layers, as well as managed database platforms, while customers must secure their own guest OS configurations on IaaS.
2
Identify the proper tool and responsibility for physical security verification.
AWS is responsible for physical data center security. Customers verify this compliance by downloading reports from AWS Artifact, not by requesting raw logs from support or security teams.
AWS Artifact is the self-service portal that provides on-demand access to AWS security and compliance reports.
3
Clarify the network security configuration responsibilities.
Enabling SSL/TLS certificates on the Application Load Balancer is a customer task. Additionally, security groups are stateful and operate at the instance level, whereas Network ACLs are stateless and operate at the subnet level.
AWS provides the load balancing infrastructure, but configuring secure listeners and certificate mapping is an application-level customer responsibility.

Key Concept

AWS Shared Responsibility Model boundaries across IaaS, PaaS, and compliance tasks
Estimated Time:2m 0s
Question 59Question →

An organization needs to grant a third-party security auditing application read-only access to review configuration metadata across all AWS resources in their production account. To comply with the AWS Shared Responsibility Model and Identity and Access Management (IAM) security best practices, which configuration should the cloud administrator implement?

Show answer & explanation

Answer: Configure an IAM role with a trust policy that allows the third-party AWS account to assume it, specify an External ID, and attach the SecurityAudit managed policy.

Answer

Configure an IAM role with a trust policy that allows the third-party AWS account to assume it, specify an External ID, and attach the SecurityAudit managed policy.
The correct option outlines the standard AWS security best practice for third-party integrations: creating an IAM role that delegates access using temporary security credentials. The trust policy defines who can assume the role, and the External ID provides an additional security layer (preventing the confused deputy problem) specifically designed for third-party SaaS integrations. The SecurityAudit policy ensures read-only access to resource metadata.

Step-by-Step Solution

1
Determine the type of identity credential required for third-party SaaS integration.
Identify that an IAM role is required to establish secure cross-account delegation instead of creating a permanent IAM user or sharing root credentials.
Roles use temporary security credentials and are recommended for delegating access to external AWS accounts.
2
Select the appropriate trust mechanism and policy to ensure the principle of least privilege.
Create a trust policy specifying the third-party's AWS Account ID and an External ID, and attach a read-only policy such as SecurityAudit.
An External ID prevents the 'confused deputy' security vulnerability in multi-tenant SaaS environments, and the SecurityAudit policy ensures read-only metadata visibility.
3
Verify responsibility boundaries under the Shared Responsibility Model.
Confirm that the customer, not AWS Support, is responsible for executing this configuration.
Customer configuration of IAM identities, roles, and resource access policies is fully within the customer's domain of responsibility.

Key Concept

Delegating cross-account access to third-party integrations using IAM Roles and trust relationships.
Question 60Question →

A financial technology company is preparing for an annual security audit and needs to retrieve the latest AWS Service Organization Control (SOC) reports to verify AWS compliance. Which AWS service or portal provides on-demand access to these third-party audit reports?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact is the AWS portal that provides on-demand access to AWS compliance reports and agreements.
AWS Artifact is the primary, self-service portal for downloading AWS compliance documentation, such as SOC and PCI reports, which are necessary for proving compliance to auditors.

Step-by-Step Solution

1
Identify the business requirement of retrieving external compliance reports (like SOC reports) for AWS infrastructure.
The requirement is to download third-party compliance documents demonstrating AWS security posture.
Knowing what document or certification is required helps identify the correct portal designed for compliance artifacts.
2
Select the specific AWS service that acts as the repository for audit reports and agreements.
AWS Artifact is identified as the service dedicated to providing AWS compliance reports.
AWS Artifact is the only self-service portal on AWS specifically designed to let customers download these reports directly.

Key Concept

AWS compliance reports and agreements retrieval via AWS Artifact
Estimated Time:1m 0s
PreviousPage 3 / 23Next