Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 61Question →

A financial services organization is deploying AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) to enable single sign-on (SSO) for its cloud-based workloads. According to the AWS Shared Responsibility Model, which of the following tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring trust relationships between the AWS Managed Microsoft AD domain and the organization's on-premises Active Directory domains.; Creating and managing Active Directory users, groups, and Group Policy Objects (GPOs) within the directory.

Answer

The customer is responsible for configuring trust relationships between the AWS Managed AD domain and on-premises domains, and creating and managing Active Directory users, groups, and Group Policy Objects (GPOs) within the directory.
For AWS Managed Microsoft AD, the customer is responsible for defining directory configurations, which includes establishing trust relationships with on-premises directories and managing organizational units, users, groups, and Group Policy Objects (GPOs) inside the directory.

Step-by-Step Solution

1
Identify the service classification under the AWS Shared Responsibility Model.
AWS Managed Microsoft AD is a managed service. Under this model, AWS manages the physical security, infrastructure, and operating system of the domain controllers, while the customer manages directory content and access configuration.
Managed services shift infrastructure management tasks, such as OS patching, from the customer to AWS.
2
Determine which options represent customer configuration rather than infrastructure maintenance.
Configuring domain trusts and managing AD objects (users, groups, GPOs) are configuration tasks. Patching domain controller operating systems, configuring subnet-level network rules at the instance level, and compiling data center physical compliance documentation are handled by AWS.
This isolates the administrative directory management duties that remain the customer's responsibility.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:2m 0s
Question 62Question →

A retail company hosts its e-commerce website on Amazon Elastic Compute Cloud (Amazon EC2) instances. Under the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Show answer & explanation

Answer: Patching the guest operating system on the instances

Answer

Patching the guest operating system on the instances
Under the AWS Shared Responsibility Model, Amazon EC2 is treated as an Infrastructure as a Service (IaaS). AWS is responsible for securing the underlying infrastructure (such as the hardware, physical data centers, and virtualization software), while the customer is responsible for configuring, updating, and patching the guest operating system that runs on the instance.

Step-by-Step Solution

1
Identify the AWS service type being used in the scenario.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering.
The shared responsibility model boundaries vary depending on whether the service is IaaS, PaaS, or SaaS.
2
Determine the boundary of responsibility for IaaS services like Amazon EC2.
AWS manages security 'of' the cloud (hardware, virtualization, physical security), while the customer manages security 'in' the cloud (guest OS, application code, data configuration).
Since the customer has root access to the EC2 instances, they must configure and maintain the guest operating system.
3
Evaluate the choices to find the task that falls under security 'in' the cloud.
Patching the guest operating system is a customer responsibility, whereas physical security, host hardware replacement, and virtualization software maintenance are AWS responsibilities.
Guest OS updates require access to the instance's OS, which only the customer can configure.

Key Concept

AWS Shared Responsibility Model for IaaS (Amazon EC2)
Question 63Question →

An online gaming studio is deploying a multiplayer game database using Amazon RDS for PostgreSQL. To meet security compliance standards, the studio must define the security boundaries between their team and AWS. Which of the following operational tasks remains the responsibility of the customer under the AWS Shared Responsibility Model?

Show answer & explanation

Answer: Configuring database-level user permissions and setting up security group rules to control network access to the database instance.

Answer

Configuring database-level user permissions and setting up security group rules to control network access to the database instance.
Under the AWS Shared Responsibility Model, for a managed service like Amazon RDS, the customer is responsible for configuring access to the database, which includes managing database user permissions and defining firewall rules using security groups to control inbound network traffic.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon RDS is a managed service (PaaS/DBaaS), meaning AWS manages the underlying operating system, hardware, and database engine maintenance.
The customer's responsibility depends on the type of service deployed (IaaS vs. PaaS).
2
Identify customer-managed controls for Amazon RDS.
The customer is responsible for data security 'in' the database, including user access credentials, database schemas, and security group firewall rules.
Firewalls (security groups) and application/database-level access controls are always customer-managed.

Key Concept

Shared Responsibility Model for Managed Services (Amazon RDS)
Estimated Time:1m 0s
Question 64Question →

A financial services institution deploys an AWS Outposts rack in its on-premises data center to run latency-sensitive algorithmic trading applications. Under the AWS Shared Responsibility Model, which TWO tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Providing physical access security, electrical power, and cooling (HVAC) for the Outposts hardware within the local facility; Configuring security groups and network access control lists (NACLs) to regulate traffic to and from the instances deployed on the Outpost

Answer

The customer is responsible for providing physical access security, electrical power, and cooling (HVAC) for the Outposts hardware within the local facility, as well as configuring security groups and network access control lists (NACLs) to regulate traffic to and from the instances deployed on the Outpost.
Under the Shared Responsibility Model for AWS Outposts, the customer is responsible for securing the physical location, power, and cooling of the Outposts rack at their site. In addition, the customer is responsible for configuring security groups and network access control lists to regulate traffic flow to and from the instances. AWS maintains responsibility for the infrastructure software, including the virtualization hypervisor, and performs physical hardware replacements.

Step-by-Step Solution

1
Analyze the deployment architecture and physical location of the resources.
AWS Outposts is a hybrid service where physical hardware owned by AWS is placed within the customer's local on-premises facility.
Shared responsibility boundaries shift when physical infrastructure is housed outside of AWS data centers.
2
Differentiate physical responsibilities between standard AWS regions and AWS Outposts.
Unlike standard services where AWS manages physical data center security, utility power, and HVAC, for Outposts, these site environmental and physical security responsibilities belong to the customer.
AWS has no physical access or control over the customer's on-premises building.
3
Identify logical and virtual resources control responsibilities.
The customer is responsible for configuring security groups and network access control lists (NACLs) to secure logical network traffic.
AWS provides the software-defined networking capability, but the configuration of access rules remains under customer control.
4
Differentiate physical hardware maintenance responsibilities.
AWS is responsible for physical component replacement and hypervisor patching.
AWS manages the infrastructure lifecycle and updates of the Outposts service as a fully managed offering.

Key Concept

AWS Shared Responsibility Model for AWS Outposts
Question 65Question →

A financial technology startup is preparing for a compliance audit. An external auditing firm requires temporary, read-only access to the startup's AWS resources. The external auditors do not possess AWS accounts, and the startup's security policy strictly prohibits creating permanent IAM users for third-party entities. Which of the following is the most secure, AWS-recommended method to grant the auditors access?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role.

Answer

Configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role.
The correct option is to configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role. This aligns with AWS security best practices by utilizing temporary security credentials, avoiding the creation of long-term IAM credentials (such as access keys), and maintaining the principle of least privilege without creating permanent IAM users in the startup's AWS account.

Step-by-Step Solution

1
Identify the access requirements and constraints.
The auditors need temporary, read-only access without creating permanent IAM users or using pre-existing AWS accounts.
This establishes the boundaries for acceptable security configurations.
2
Evaluate the mechanism for external user access.
Federating identity using AWS IAM Identity Center maps the external auditor identities to a temporary role.
Federation avoids static credential management and delegates authentication to the trusted third-party provider.
3
Select the option that matches AWS identity best practices.
Using IAM Identity Center to provision temporary access via role assumption is selected.
This follows the principle of least privilege and avoids credentials exposure.

Key Concept

Identity Federation and Temporary Credentials
Question 66Question →

A healthcare company is preparing for an external audit and must retrieve AWS security and compliance documents, such as the AWS Service Organization Control (SOC) reports. Which AWS portal provides on-demand, self-service access to these agreements and reports?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the primary resource for downloading AWS security and compliance reports (such as SOC and PCI reports) as well as managing agreements with AWS. It provides self-service access to these documents directly from the AWS Management Console.

Step-by-Step Solution

1
Identify the company's core requirement.
The requirement is to retrieve official compliance reports, such as AWS SOC reports, for audit purposes.
This establishes which category of service is needed (compliance reporting).
2
Evaluate the available AWS services that match this need.
AWS Artifact is the service dedicated to providing on-demand compliance reports and agreements, whereas the others focus on resource scanning, auditing, or configuration tracking.
This confirms the correct service selection.

Key Concept

AWS Artifact is the primary portal for retrieving AWS compliance reports and agreements.
Question 67Question →

A healthcare technology company is hosting its customer portal on AWS. The static frontend files are stored in an Amazon S3 bucket, and the backend application is exposed via Amazon API Gateway. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring bucket policies and access control lists (ACLs) to restrict access to the static web assets; Configuring API Gateway resource policies and authorization to control access to the backend APIs

Answer

The customer is responsible for configuring S3 bucket policies and access control lists (ACLs) to secure static web assets, as well as configuring API Gateway resource policies and authorization settings to control API access.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes managing identity and access management (IAM), data classification, and configuring resource-specific access controls. For Amazon S3, this entails setting up bucket policies and ACLs. For Amazon API Gateway, this involves establishing authorization methods and resource policies to control API invocation.

Step-by-Step Solution

1
Determine the AWS service models in use.
Amazon S3 and Amazon API Gateway are fully managed, abstract services.
Knowing the service type helps define the boundary between what AWS manages (underlying OS, virtualization, physical infrastructure) and what the customer configures.
2
Distinguish between security 'of' the cloud and security 'in' the cloud.
AWS handles OS patching, physical data center security, and hardware decommissioning. The customer must configure access controls, identity policies, and resource authorization.
This maps the responsibilities correctly according to the Shared Responsibility Model.
3
Select the options representing customer-managed configurations.
S3 bucket policies/ACLs and API Gateway authorization/resource policies are correct. Hardware and operating system tasks are incorrect.
Only access control configurations on these managed services fall under the customer's scope.

Key Concept

AWS Shared Responsibility Model
Estimated Time:1m 30s
Question 68Question →

A software startup wants to allow a third-party vendor to run automated test suites against resources in its AWS development account. The vendor requires programmatic access for a limited time, and the startup must ensure that no long-term credentials are shared or stored. Which of the following is the most secure AWS-recommended method to grant this access?

Show answer & explanation

Answer: Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.

Answer

Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.
The correct answer is to create an IAM role. IAM roles allow external entities to assume permissions and receive temporary security credentials via the AWS Security Token Service (STS). This avoids the need to distribute or manage long-term secrets, fulfilling the requirement of temporary access securely.

Step-by-Step Solution

1
Identify the key requirements of the scenario.
The third-party vendor requires programmatic access for a limited time, and credentials must not be long-term or shared.
This establishes that the solution must support temporary access without sharing permanent credentials.
2
Compare the security mechanisms of IAM users, roles, and the root user.
IAM users and root users utilize long-term credentials, whereas IAM roles issue temporary credentials that expire automatically.
Choosing the correct IAM entity ensures adherence to AWS security best practices.
3
Verify ownership and operational boundaries under the Shared Responsibility Model.
Executing scripts and configuring access is a customer-side responsibility, ruling out direct management by AWS Support.
This eliminates options that assume AWS manages tenant-level operational tasks.

Key Concept

Using IAM roles for temporary, cross-account, or third-party access instead of sharing long-term credentials.
Estimated Time:1m 15s
Question 69Question →

An educational institution uses Amazon Simple Storage Service (Amazon S3) to store student records. Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring bucket policies to restrict access to authorized users; Enabling encryption on the stored objects

Answer

Configuring bucket policies to restrict access and enabling encryption on the stored objects are customer responsibilities under the AWS Shared Responsibility Model.
For managed services like Amazon S3, AWS manages the infrastructure, OS patching, and physical security. The customer remains responsible for managing their data, which includes configuring bucket access policies and setting up object encryption.

Step-by-Step Solution

1
Analyze the AWS service model for Amazon S3.
Amazon S3 is an abstract managed service. AWS maintains the underlying hardware, virtualization, and OS layers.
This helps locate the responsibility boundary for this service.
2
Determine customer responsibilities for data and access within S3.
The customer owns the data and is responsible for setting bucket access policies and managing data protection features like encryption.
This identifies the customer's operational obligations.

Key Concept

Under the AWS Shared Responsibility Model, AWS manages security 'of' the cloud (hardware, host software, physical facilities), while customers manage security 'in' the cloud (access policies, data encryption, IAM).
Estimated Time:1m 0s
Question 70Question →

A company has recently created a new AWS account. To ensure the account is secure, which two actions should the administrator perform on the AWS account root user? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) for the root user.; Delete any active access keys associated with the root user.

Answer

Enabling multi-factor authentication (MFA) for the root user and deleting any active access keys associated with the root user.
Enabling multi-factor authentication (MFA) and deleting active access keys are primary security best practices for the AWS account root user. MFA provides an additional security layer for console logins, while removing access keys prevents programmatic administrative API access.

Step-by-Step Solution

1
Identify the recommended practices for securing the AWS account root user.
The root user has unrestricted access and should not be used for daily tasks or programmatic API calls.
Securing the root user prevents full compromise of the AWS account.
2
Select security actions that mitigate credentials exposure and add security layers.
Enabling MFA and removing access keys reduces the risk of credential compromise.
MFA prevents unauthorized console access, and removing access keys prevents unauthorized programmatic access.

Key Concept

AWS Account Root User Security Best Practices
Question 71Question →

A university database administrator needs to grant an administrative application running on a local, on-premises server the ability to read metadata from an Amazon DynamoDB table. Additionally, a new junior administrator has joined the team to assist with day-to-day configuration. Which of the following actions align with the AWS recommended best practices for IAM and access control? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use AWS IAM Roles Anywhere to grant the on-premises server secure access to DynamoDB using temporary credentials.; Create an IAM user for the junior administrator, place them in an IAM group with least-privilege policies, and require Multi-Factor Authentication (MFA).

Answer

Use AWS IAM Roles Anywhere to grant the on-premises server secure access to DynamoDB using temporary credentials, and create an IAM user for the junior administrator, place them in an IAM group with least-privilege policies, and require Multi-Factor Authentication (MFA).
The correct practices are to use AWS IAM Roles Anywhere to grant temporary security credentials to the on-premises server, and to create an individual IAM user with least-privilege permissions and MFA enabled for the junior administrator. These actions align with the core security principles of minimizing long-term credentials and securing human identities.

Step-by-Step Solution

1
Identify secure access methods for on-premises servers to interact with AWS resources.
Using temporary credentials via AWS IAM Roles Anywhere is preferred over hardcoding long-lived access keys.
This minimizes the risk of credential exposure and adheres to the security principle of temporary credentials.
2
Identify secure access management practices for human users.
Creating a dedicated IAM user inside a group with least-privilege permissions and enforcing MFA is the recommended standard.
This ensures accountability, limits access to only what is necessary, and adds an extra layer of authentication security.

Key Concept

AWS IAM Best Practices for User and Workload Access Control
Question 72Question →

A real estate platform uses Amazon DynamoDB to store property listing details. Under the AWS Shared Responsibility Model, which of the following security tasks is the sole responsibility of the customer?

Show answer & explanation

Answer: Defining and applying Identity and Access Management (IAM) policies to control access to the DynamoDB tables

Answer

Defining and applying Identity and Access Management (IAM) policies to control access to the DynamoDB tables
For managed services such as Amazon DynamoDB, AWS is responsible for securing the infrastructure, host operating system, and database software. The customer is responsible for managing data classification and configuring access controls, such as Identity and Access Management (IAM) policies, to determine who can access the database tables.

Step-by-Step Solution

1
Identify the AWS service type being used in the scenario.
Amazon DynamoDB is a fully managed NoSQL database service.
The service type determines where the boundary of responsibility lies between AWS and the customer under the Shared Responsibility Model.
2
Distinguish between security of the cloud (AWS responsibility) and security in the cloud (customer responsibility) for a managed database service.
AWS handles the hardware, operating system patching, database software patching, and physical security. The customer handles their own data, including configuring access controls (IAM policies).
This division defines who is responsible for configuring access rules versus who maintains the underlying platform.

Key Concept

Under the Shared Responsibility Model, for managed services like Amazon DynamoDB, AWS manages the infrastructure, operating system, and physical security (security of the cloud), while the customer manages data access controls, configurations, and identity policies (security in the cloud).
Estimated Time:45s
Question 73Question →

A media streaming company uses Amazon DynamoDB to store user watch histories and profiles. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Defining Identity and Access Management (IAM) policies to restrict read and write access to the database tables

Answer

Defining Identity and Access Management (IAM) policies to restrict read and write access to the database tables
In the Shared Responsibility Model, AWS manages the security 'of' the cloud (including patching the OS, managing physical infrastructure, and database engines for managed services like DynamoDB). The customer is responsible for security 'in' the cloud, which includes managing their data, configuring client-side encryption, and defining access permissions through Identity and Access Management (IAM) policies to secure access to the tables.

Step-by-Step Solution

1
Analyze the service model of Amazon DynamoDB.
Amazon DynamoDB is a fully managed NoSQL database service (Platform as a Service / PaaS).
Understanding the service model helps determine the boundary of shared responsibility.
2
Distinguish between customer responsibilities (security 'in' the cloud) and AWS responsibilities (security 'of' the cloud) for managed services.
AWS handles physical security, infrastructure patching, database software updates, and hardware lifecycle. The customer handles data classification, client-side encryption, and IAM permissions to access the tables.
This isolates customer tasks from AWS-managed operations.
3
Evaluate the choices to find the task that falls under customer responsibility.
Defining Identity and Access Management (IAM) policies to restrict read and write access is a customer responsibility, while patching, physical security, and manual compliance document retrieval are handled by AWS or via AWS Artifact.
To identify the correct answer matching the customer's operational obligations.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:1m 0s
Question 74Question →

An enterprise client in the financial sector is undergoing an annual Payment Card Industry Data Security Standard (PCI DSS) compliance audit. The external auditors require official proof of compliance for the physical and environmental security controls of the AWS data centers where the client's applications are hosted. Which AWS service should the security team use to obtain the necessary reports, and how is the responsibility for physical security partitioned in this context?

Show answer & explanation

Answer: AWS Artifact is used to retrieve the PCI DSS Attestation of Compliance (AoC); AWS is solely responsible for managing the physical security and environmental controls of its data centers.

Answer

AWS Artifact is used to retrieve the PCI DSS Attestation of Compliance (AoC); AWS is solely responsible for managing the physical security and environmental controls of its data centers.
The correct option correctly identifies AWS Artifact as the service for downloading compliance documents and accurately maps data center physical security as the sole responsibility of AWS under the Shared Responsibility Model.

Step-by-Step Solution

1
Identify the service required to retrieve compliance documents.
AWS Artifact is the primary portal for downloading compliance reports and agreements (such as SOC and PCI reports).
The scenario requires official proof of compliance (PCI DSS Attestation of Compliance) which is distributed directly via AWS Artifact.
2
Determine the party responsible for data center physical and environmental security.
AWS is solely responsible for the physical security of data centers.
Under the AWS Shared Responsibility Model, physical infrastructure, hypervisor virtualization, and data center facilities fall under 'security of the cloud' and are the sole responsibility of AWS.

Key Concept

AWS compliance report retrieval and the division of physical security under the Shared Responsibility Model.
Question 75Question →

A healthcare startup must verify that AWS infrastructure meets compliance regulations for HIPAA and obtain SOC 2 reports for its investors. Which two tasks can the startup perform directly within AWS Artifact?

Select all that apply

Show answer & explanation

Answer: Download AWS security and compliance documents, such as SOC and PCI reports; Review and accept AWS agreements, such as the HIPAA Business Associate Addendum (BAA)

Answer

Downloading AWS compliance documents (such as SOC and PCI reports) and reviewing/accepting AWS agreements (such as the HIPAA Business Associate Addendum)
AWS Artifact is the primary self-service portal for on-demand access to AWS compliance reports, such as SOC and PCI reports, and is also used to review and accept AWS agreements like the HIPAA Business Associate Addendum (BAA) for individual accounts or entire organizations.

Step-by-Step Solution

1
Identify the service designed for retrieving AWS compliance documentation and managing AWS agreements.
AWS Artifact is identified as the central portal for these compliance resources.
AWS Artifact provides self-service access to compliance reports and agreements without requiring support tickets.
2
Filter options to find capabilities provided by AWS Artifact.
Downloading compliance reports and accepting HIPAA agreements are identified as valid AWS Artifact features.
This excludes distractors related to other AWS services like Amazon Inspector and AWS CloudTrail.

Key Concept

AWS Artifact provides self-service access to AWS compliance reports and agreements.
Question 76Question →

A media company is migrating its user authentication store to Amazon DynamoDB. The company must comply with strict industry data security standards. Under the AWS Shared Responsibility Model, which two security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring AWS Identity and Access Management (IAM) policies to restrict database access to authorized application servers; Encrypting sensitive user password hashes on the client side before writing them to the table

Answer

The customer is responsible for configuring AWS Identity and Access Management (IAM) policies to restrict database access and encrypting sensitive user password hashes on the client side.
For fully managed services such as Amazon DynamoDB, AWS manages the physical infrastructure, the virtualization layer, the operating system, and the database software itself. The customer is responsible for managing data inside the service, which includes configuring IAM policies to restrict API access and implementing data encryption (such as client-side encryption before writing data to AWS).

Step-by-Step Solution

1
Analyze the service model of the AWS resource in the scenario.
Amazon DynamoDB is a fully managed NoSQL database service (Platform as a Service / Database as a Service).
The level of customer responsibility depends on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or a managed service.
2
Differentiate between customer responsibilities and AWS responsibilities for fully managed database services.
AWS handles physical security, infrastructure, hardware maintenance, OS patching, and database software updates. The customer handles data classification, IAM access controls, client-side encryption, and service configurations.
This determines which tasks belong to the customer ('security in the cloud') versus AWS ('security of the cloud').
3
Evaluate the choices to select the two customer responsibilities.
IAM policy configuration and client-side encryption are customer responsibilities, whereas OS patching, hardware disk replacement, and table-level security groups (which do not exist for DynamoDB) are not.
To correctly identify the final options that match the customer's domain of control under the model.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon DynamoDB, AWS operates the infrastructure layer, the operating system, and the database platform. The customer retains responsibility for securing their data, including access control (IAM) and data encryption.
Question 77Question →

An application running on an Amazon EC2 instance needs to securely access files in an Amazon S3 bucket. According to AWS security best practices, which IAM entity should be attached to the EC2 instance to grant these permissions without storing long-term credentials?

Show answer & explanation

Answer: An IAM role

Answer

An IAM role
The correct answer is an IAM role because IAM roles are designed to delegate permissions to AWS services, applications, or users without requiring long-term security credentials. By attaching an IAM role (specifically via an instance profile) to an Amazon EC2 instance, AWS automatically manages and rotates temporary credentials for the application to access Amazon S3.

Step-by-Step Solution

1
Identify the authentication requirement.
An application on an EC2 instance needs to access an S3 bucket without storing long-term credentials.
Storing long-term credentials on instances exposes them to potential leakage.
2
Determine the appropriate IAM entity for service-to-service authentication.
An IAM role provides temporary security credentials that can be automatically rotated.
AWS services use IAM roles to safely access other AWS resources under the principle of least privilege.

Key Concept

IAM Roles for AWS Services
Question 78Question →

An organization wants to configure an application running on an Amazon EC2 instance to read files from an Amazon S3 bucket. The application must not store long-term AWS credentials on the instance. Which of the following solutions represents the AWS-recommended best practice to grant the necessary permissions?

Show answer & explanation

Answer: Create an IAM role with S3 read permissions and associate it with the EC2 instance using an instance profile.

Answer

Create an IAM role with S3 read permissions and associate it with the EC2 instance using an instance profile.
The correct option is to create an IAM role with S3 read permissions and associate it with the EC2 instance. This method uses temporary security credentials that are automatically distributed and rotated by AWS, fulfilling the security requirement of not storing long-term credentials on the instance.

Step-by-Step Solution

1
Define permissions using an IAM policy that allows read-only access to the target Amazon S3 bucket.
An IAM policy document specifying the allowed S3 actions is created.
This establishes the minimum required permissions following the principle of least privilege.
2
Create an IAM role and attach the read-only S3 policy to it.
An IAM role is created with the necessary permissions associated.
An IAM role allows AWS services to assume permissions dynamically without long-term credentials.
3
Associate the IAM role with the EC2 instance via an instance profile.
The EC2 instance is now authorized to retrieve temporary credentials from the instance metadata service.
This enables the application to authenticate securely and automatically rotate credentials without hardcoding them.

Key Concept

AWS IAM Roles for EC2 Instances
Question 79Question →

An online education platform is expanding its services to support medical residency programs and needs to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA). To do this, the platform's administrator needs to review AWS security documentation and formally accept the AWS Business Associate Addendum (BAA). Which of the following tasks can the administrator perform using AWS Artifact to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download AWS compliance reports, such as SOC and PCI-DSS documents, to review the security controls of AWS infrastructure; Formally accept agreements with AWS, such as the Business Associate Addendum (BAA) for HIPAA compliance

Answer

Downloading AWS compliance reports to review security controls of the AWS infrastructure and formally accepting agreements with AWS, such as the Business Associate Addendum (BAA), are correct.
AWS Artifact serves as the self-service portal to download AWS security and compliance reports (such as SOC and PCI reports) and to manage and accept agreements (such as the BAA for HIPAA compliance).

Step-by-Step Solution

1
Identify the service mentioned in the question.
The question asks about tasks performed using AWS Artifact.
AWS Artifact is the central repository for AWS compliance-related information.
2
Determine the two primary capabilities of AWS Artifact.
AWS Artifact consists of two main sections: AWS Artifact Reports (providing compliance reports like SOC, PCI, ISO) and AWS Artifact Agreements (allowing customers to accept agreements like the HIPAA BAA).
This matches the requirements of downloading compliance reports and signing the BAA.
3
Evaluate the other options to rule out services that are not AWS Artifact.
API logging is handled by AWS CloudTrail, vulnerability scanning is done by Amazon Inspector, and physical data center security audits are not permitted for customers.
This isolates the correct options and ensures no incorrect alternatives are selected.

Key Concept

AWS Artifact provides on-demand access to AWS compliance reports and allows customers to accept agreements like the Business Associate Addendum (BAA).
Question 80Question →

A retail company plans to expand its online operations to Europe and must verify that the underlying AWS infrastructure complies with the General Data Protection Regulation (GDPR). Which AWS service should the company use to download official AWS compliance reports and accept agreements?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the primary portal for retrieving AWS compliance documentation, including SOC reports, PCI reports, and GDPR compliance resources, and accepting agreements.

Step-by-Step Solution

1
Identify the core requirement of the retail company.
The company needs to obtain official AWS compliance documents and agreements (such as for GDPR) to verify the security and compliance of the AWS infrastructure.
This establishes that the target service must be a compliance document repository.
2
Evaluate the available AWS services to find the correct document portal.
AWS Artifact is identified as the portal designed specifically for retrieving compliance reports and accepting agreements.
Knowing the functions of AWS Artifact versus other security and management tools allows for selecting the correct answer.

Key Concept

AWS compliance reports and agreements retrieval via AWS Artifact
Estimated Time:45s
PreviousPage 4 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 4 | Examkin