Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 101Question →

A biotechnology startup is preparing to host sensitive clinical trial data on AWS. To satisfy regulatory requirements, the startup's compliance team must review AWS's third-party audit reports detailing the physical security and environmental controls of the AWS data centers. Which AWS service should the startup use to retrieve these documents?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the primary self-service portal for on-demand access to AWS's compliance reports, such as SOC and ISO reports, and agreements like the Business Associate Addendum (BAA).

Step-by-Step Solution

1
Identify the core requirement of the biotechnology startup, which is to retrieve third-party audit reports of AWS infrastructure.
The startup needs access to AWS compliance reports like SOC 2 or ISO certificates.
These documents prove the security and compliance of the underlying AWS infrastructure.
2
Evaluate the available AWS services to determine which one functions as a portal for compliance documentation.
AWS Artifact is identified as the portal providing on-demand download of AWS compliance agreements and reports.
It is the direct, secure portal where customers access security and compliance documents provided by AWS.

Key Concept

AWS Artifact provides on-demand access to AWS security and compliance reports and select online agreements.
Question 102Question →

A retail company is migrating a legacy web application to Amazon Elastic Compute Cloud (Amazon EC2) instances. Under the AWS Shared Responsibility Model, which TWO of the following security tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Patching the guest operating system installed on the EC2 instances; Configuring the security group rules to control traffic to the EC2 instances

Answer

The customer is responsible for patching the guest operating system and configuring the security group rules.
Under the AWS Shared Responsibility Model, customers are responsible for security 'in' the cloud. For Amazon EC2 (an Infrastructure as a Service model), this includes managing the guest operating system (such as patching and updates) and configuring security group rules to control network traffic to and from the instances.

Step-by-Step Solution

1
Analyze the service model for Amazon EC2.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering. AWS manages the physical facilities, hardware, and virtualization hypervisor, while the customer manages everything from the guest operating system upward.
To define the boundary of control between AWS and the customer.
2
Evaluate each task against the customer responsibility boundary.
Guest operating system patching and security group configurations are performed within the customer's administrative control. Physical security, hypervisor patching, and hardware destruction are performed by AWS at the infrastructure layer.
To determine which options represent customer responsibilities.

Key Concept

Shared Responsibility Model for IaaS
Estimated Time:1m 0s
Question 103Question →

A financial data analysis firm uses a multi-node Amazon Redshift cluster to store and analyze large volumes of proprietary market data. Under the AWS Shared Responsibility Model, which TWO of the following security-related tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring security groups to restrict network access to the Amazon Redshift cluster; Managing database user accounts, roles, and permissions within the Redshift database

Answer

Configuring security groups to restrict network access to the Amazon Redshift cluster, and managing database user accounts, roles, and permissions within the Redshift database.
The correct responsibilities for the customer include configuring security groups to restrict network access to the cluster and managing database-level user accounts, roles, and permissions. These represent security 'in' the cloud, where the customer determines who can access the database and how network traffic is routed. AWS is responsible for security 'of' the cloud, which includes operating system patching, hardware maintenance, and physical media decommissioning.

Step-by-Step Solution

1
Identify the service type and shared responsibility boundaries.
Amazon Redshift is a managed data warehouse service. AWS manages the infrastructure (hardware, physical security, virtualization) and the platform/OS (patching, backups).
Understanding the service type helps differentiate between customer tasks (security 'in' the cloud) and AWS tasks (security 'of' the cloud).
2
Evaluate each option against customer versus AWS responsibilities.
Configuring network firewalls (security groups) and managing database-level authentication/authorization are customer responsibilities. Patching the underlying OS, replacing hardware, and decommissioning storage drives are AWS responsibilities.
This isolates the correct options from the distractors based on the Shared Responsibility Model.

Key Concept

Under the AWS Shared Responsibility Model for managed services like Amazon Redshift, AWS manages the operating system, hardware, and physical infrastructure, while the customer is responsible for data classification, network access controls (security groups), and identity and access management (IAM and database users).
Question 104Question →

A software developer needs to access Amazon S3 buckets using the AWS Command Line Interface (CLI) from their local development workstation. According to AWS security best practices, which method should the developer use to authenticate and run these commands?

Show answer & explanation

Answer: Use AWS IAM Identity Center to authenticate the session and obtain short-lived, temporary credentials.

Answer

Use AWS IAM Identity Center to authenticate the session and obtain short-lived, temporary credentials.
Using AWS IAM Identity Center allows human users to authenticate and receive short-lived, temporary credentials for command-line access. This aligns with the security best practice of avoiding long-lived access keys, which are prone to accidental exposure.

Step-by-Step Solution

1
Determine the user type and access method.
A human developer requires programmatic access to AWS via the local CLI.
Identifying the actor and tool determines which credential strategies are applicable.
2
Evaluate credential lifetimes against AWS security best practices.
Temporary credentials should always be preferred over long-lived credentials for human access.
Minimizes the blast radius and risk of credential exposure.
3
Select the modern AWS service that provides temporary credentials via single sign-on.
AWS IAM Identity Center.
It dynamically issues short-lived programmatic credentials for the CLI and simplifies multi-account access.

Key Concept

IAM Credential Management and Best Practices
Estimated Time:1m 0s
Question 105Question →

A pharmaceutical company is launching a new research database containing proprietary clinical trial data on AWS. To meet strict regulatory standards, the compliance team must download the AWS SOC 2 Type II report and verify that data protection standards are maintained. Which of the following actions must the company take to meet these compliance objectives? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Retrieve the AWS SOC 2 Type II report through the self-service portal in AWS Artifact.; Enable encryption at rest for the Amazon RDS DB instances storing the clinical trial data.

Answer

Retrieve the AWS SOC 2 Type II report through the self-service portal in AWS Artifact, and enable encryption at rest for the Amazon RDS DB instances storing the clinical trial data.
Retrieving compliance documents like SOC 2 reports is done via the self-service AWS Artifact console. Additionally, securing data at rest in Amazon RDS DB instances is a customer responsibility under the Shared Responsibility Model.

Step-by-Step Solution

1
Identify the service for compliance documentation.
Determine that AWS Artifact is the repository for on-demand compliance reports, eliminating the need to contact AWS support.
Retrieving the SOC 2 Type II report is necessary to verify the security of the AWS physical and cloud infrastructure.
2
Delineate security responsibilities under the Shared Responsibility Model.
Confirm that database encryption at rest (data protection) and guest operating system patching on EC2 instances are customer responsibilities, whereas physical security and hypervisor maintenance are AWS responsibilities.
This determines which security actions must be configured directly by the company's administrators.
3
Select the correct combination of customer-managed settings and compliance report retrieval.
Choose the option to retrieve the SOC 2 report from AWS Artifact and the option to configure RDS encryption at rest.
This satisfies both the compliance documentation requirement and the customer data protection obligation.

Key Concept

AWS Compliance and the Shared Responsibility Model
Estimated Time:2m 0s
Question 106Question →

An organization is setting up AWS accounts for its new development team. To ensure a secure cloud environment, which of the following are AWS Identity and Access Management (IAM) best practices that the organization should implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply the principle of least privilege by granting only the minimum permissions required for developers to perform their tasks.; Enable Multi-Factor Authentication (MFA) for the AWS account root user and administrative users.

Answer

Implementing the principle of least privilege and enabling Multi-Factor Authentication (MFA) for privileged accounts are essential IAM security best practices.
Granting only the permissions required to perform a job (least privilege) and enabling Multi-Factor Authentication (MFA) for administrative and root accounts are fundamental AWS security practices that reduce unauthorized access risk.

Step-by-Step Solution

1
Analyze each option to determine if it aligns with AWS Identity and Access Management (IAM) security guidelines.
Identified that least privilege and multi-factor authentication (MFA) are recommended best practices, while sharing root credentials, hardcoding user access keys, and expecting AWS to manage permissions are incorrect practices.
AWS security best practices emphasize minimizing access (least privilege) and securing credentials (MFA), while delegating tasks to specific IAM roles instead of using root or permanent user keys.

Key Concept

AWS IAM Best Practices
Question 107Question →

A financial trading firm hosts its transaction database on Amazon EC2 instances and stores historical backups in Amazon S3. To prepare for an upcoming audit, the compliance team must review the physical security controls of the AWS data centers and ensure the database infrastructure is patched in accordance with regulatory requirements. Which of the following actions should the team take to meet these compliance and governance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS SOC 1 report from AWS Artifact to review the physical and environmental security controls of the AWS infrastructure.; Apply operating system updates and security patches directly to the Amazon EC2 instances hosting the database.

Answer

To meet compliance requirements, the compliance team must download the AWS SOC 1 report from AWS Artifact to review physical and environmental security controls, and they must directly apply operating system updates and security patches to the Amazon EC2 instances hosting the database.
The correct options are downloading the SOC 1 report from AWS Artifact and applying OS patches directly to the EC2 instances. AWS Artifact is the dedicated platform for compliance document retrieval, which allows customers to verify AWS physical controls. In addition, because the transaction database is hosted on Amazon EC2, the customer is fully responsible for configuring and patching the guest operating system under the Shared Responsibility Model.

Step-by-Step Solution

1
Determine the source for physical and environmental security compliance reports of AWS infrastructure.
Identify AWS Artifact as the centralized portal where AWS hosts compliance documents like SOC 1, SOC 2, and PCI reports.
AWS manages the physical security of the cloud, and customers verify this through official third-party audit reports provided via AWS Artifact.
2
Understand the confidentiality rules associated with AWS compliance reports.
Recognize that AWS Artifact documents require accepting a non-disclosure agreement (NDA) and cannot be distributed publicly.
Sharing proprietary and confidential audit reports publicly violates the terms of service.
3
Apply the Shared Responsibility Model to the database architecture (Amazon EC2).
Confirm that the customer is responsible for guest operating system patching, application management, and data configuration on EC2.
Since EC2 is an infrastructure service, the customer has root/administrator access and sole control over the operating system, making them responsible for applying OS security updates.

Key Concept

AWS compliance reporting via AWS Artifact and the division of patching duties under the Shared Responsibility Model.
Question 108Question →

A financial institution is deploying AWS Outposts inside its on-premises corporate data center to run low-latency applications. Under the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Show answer & explanation

Answer: Providing physical security, power, cooling, and network connectivity for the Outposts rack.

Answer

Providing physical security, power, cooling, and network connectivity for the Outposts rack.
For AWS Outposts, the hardware is deployed within the customer's physical facility. Consequently, the customer is responsible for the physical security of the site, as well as providing the necessary power, cooling, and network connectivity to keep the rack operational.

Step-by-Step Solution

1
Identify the deployment model of AWS Outposts.
AWS Outposts is a hybrid cloud service where AWS-owned hardware is physically installed within the customer's on-premises environment.
Understanding the physical location of the resources helps establish the boundary for physical security and environmental controls.
2
Map physical and environmental responsibilities under this model.
Since AWS cannot control or monitor access to the customer's private data center, the responsibility for securing the rack physically and supplying power, cooling, and networking falls to the customer.
This isolates the tasks that cannot logically be performed by AWS due to lack of physical access.
3
Map infrastructure and hardware responsibilities under this model.
AWS continues to manage infrastructure software (such as hypervisors and firmware) and provides hardware maintenance and replacements.
This clarifies why the other operational tasks belong to AWS rather than the customer.

Key Concept

AWS Shared Responsibility Model for AWS Outposts
Question 109Question →

A company needs to perform automated security assessments on its Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
Amazon Inspector is the correct service because it provides automated security assessments that scan Amazon EC2 instances, container images, and Lambda functions for known software vulnerabilities and unintended network reachability.

Step-by-Step Solution

1
Identify the core requirement of the scenario: the company needs to perform automated security assessments on Amazon EC2 instances to find software vulnerabilities and unintended network exposure.
The requirement is focused on host-level vulnerability scanning and network exposure checks.
This narrows down the potential services to those that inspect the internal state of EC2 instances and network paths.
2
Evaluate the functions of the available AWS security services to find the correct match.
Amazon Inspector is identified as the service designed specifically for automated vulnerability management and scanning of EC2 workloads, whereas the other options focus on threat detection, API logging, or DDoS protection.
Selecting the service that matches the host-level vulnerability scanning definition ensures compliance with AWS best practices.

Key Concept

Amazon Inspector is the primary AWS service for automated vulnerability scanning of EC2 instances, container images, and Lambda functions.
Estimated Time:45s
Question 110Question →

A startup is setting up its first AWS account to host a web application. The company's IT lead needs to perform daily operations, such as creating Amazon EC2 instances and configuring Amazon S3 buckets. Which AWS security best practice should the IT lead follow to manage these daily administrative tasks?

Show answer & explanation

Answer: Create an individual IAM user with administrative permissions, enable multi-factor authentication, and use this user for daily activities.

Answer

Create an individual IAM user with administrative permissions, enable multi-factor authentication, and use this user for daily activities.
The correct answer is to create an individual IAM user with administrative permissions, enable multi-factor authentication, and use this user for daily activities. This aligns with the AWS best practice of protecting the root user credentials and ensuring that administrative tasks are performed by authenticated IAM identities.

Step-by-Step Solution

1
Identify the requirement for administrative daily access in a newly created AWS account.
Identified that the IT lead needs administrative privileges to create instances and configure S3 buckets.
Ensures the correct level of access is provisioned for daily operations.
2
Evaluate access options against AWS security best practices.
Determined that using the AWS account root user is discouraged for daily activities, while IAM roles cannot be used as permanent direct login identities.
Prevents credential exposure and aligns with organizational security standards.
3
Select the best practice approach of using an administrative IAM user with multi-factor authentication (MFA) enabled.
Secure administrative operations are established while keeping root user credentials protected.
Minimizes security risks and complies with the principle of least privilege.

Key Concept

AWS Account Root User and IAM Identity Best Practices
Question 111Question →

A digital media startup is developing a mobile photo-sharing application that requires millions of end-users to upload images directly to a private Amazon S3 bucket. Which of the following approaches aligns with AWS Identity and Access Management (IAM) best practices for granting access to these users?

Show answer & explanation

Answer: Configure web identity federation using Amazon Cognito to provide users with temporary AWS security credentials.

Answer

Configure web identity federation using Amazon Cognito to provide users with temporary AWS security credentials.
The correct option is to configure web identity federation using Amazon Cognito. According to AWS IAM best practices, mobile application users should authenticate against an identity provider (such as Amazon Cognito, Google, or Apple) and exchange their identity token for temporary AWS security credentials. These temporary credentials have limited permissions and automatically expire, removing the need to distribute long-term AWS credentials.

Step-by-Step Solution

1
Analyze the access requirement for external mobile application users who do not have AWS accounts.
Identify that creating individual IAM users for millions of end-users is unmanageable and violates security practices.
IAM users are designed for internal employees, administrators, or application services, not for transient public application consumers.
2
Evaluate how to secure client-side resource uploads without storing permanent credentials in the client application.
Determine that temporary security credentials derived from an IAM role are required.
Temporary credentials expire automatically and do not require hardcoding secrets in the client application.
3
Select the appropriate service for external identity federation.
Choose Amazon Cognito web identity federation.
Amazon Cognito acts as an identity broker, allowing users to sign in via social or enterprise identity providers and exchange their login tokens for temporary AWS credentials.

Key Concept

Identity Federation and Temporary Security Credentials
Estimated Time:2m 0s
Question 112Question →

An online retail company is auditing its cloud deployment to verify compliance with industry security standards. Under the AWS shared responsibility model, which of the following operational tasks is the sole responsibility of the customer?

Show answer & explanation

Answer: Patching the guest operating system and configuring security groups on Amazon EC2 instances

Answer

Patching the guest operating system and configuring security groups on Amazon EC2 instances
The task of patching the guest operating system and configuring security groups on Amazon EC2 instances is a customer responsibility under the shared responsibility model. Because customers launch and manage their own EC2 instances, they have full control over the guest operating system and its network access control settings, making it security 'in' the cloud.

Step-by-Step Solution

1
Identify the boundary of responsibility under the AWS Shared Responsibility Model.
AWS is responsible for security 'of' the cloud (infrastructure, physical security, virtualization), while the customer is responsible for security 'in' the cloud (data, guest OS, network configuration).
This distinction determines which operational task belongs to the customer.
2
Evaluate the options against the customer responsibility boundary.
Managing guest operating systems and local firewall configurations (security groups) on EC2 instances falls under security 'in' the cloud.
Because the customer has direct control and access to the guest OS of EC2 instances, AWS cannot manage these configurations for them.

Key Concept

Shared Responsibility Model for Compliance
Estimated Time:45s
Question 113Question →

A logistics company is deploying a tracking application on a fleet of Amazon EC2 instances that requires access to a private Amazon DynamoDB table. Additionally, an external audit team needs temporary access to view the company's billing dashboards for a period of one week. Which of the following configurations should the administrator implement to meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with DynamoDB access permissions and associate it with the EC2 instances using an instance profile.; Create an IAM role with billing read-only permissions that the external audit team can assume temporarily.

Answer

The correct configurations are to create an IAM role with DynamoDB access permissions for the EC2 instances, and to create an IAM role with billing read-only permissions that the external audit team can assume temporarily.
Creating an IAM role with DynamoDB access permissions and associating it with the EC2 instances allows the application to dynamically retrieve temporary credentials. Creating a separate IAM role with billing read-only permissions allows the external audit team to assume the role temporarily for the duration of the audit without possessing permanent user accounts.

Step-by-Step Solution

1
Evaluate the requirement for applications running on EC2 instances to access DynamoDB.
AWS security best practice dictates using IAM roles (attached via instance profiles) for application authentication rather than hardcoded long-lived credentials.
This prevents credentials leakage and automatically rotates temporary security credentials.
2
Evaluate the requirement to grant temporary access to external auditors for viewing billing dashboards.
Creating a dedicated IAM role for the third-party auditors to temporarily assume meets the security requirement.
This adheres to the principle of least privilege and avoids the need to share permanent root credentials or create long-term IAM users.

Key Concept

AWS Identity and Access Management (IAM) Roles and Access Control Best Practices
Estimated Time:1m 30s
Question 114Question →

A human resources software provider hosting its applications on AWS is undergoing an external compliance audit. The provider must officially accept a global Data Processing Addendum (DPA) with AWS and obtain the official ISO 27001 certification report for the underlying AWS data center infrastructure. Which AWS service should the provider use to satisfy both of these requirements?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact is the correct service because it serves as the central resource for retrieving AWS compliance reports and managing compliance agreements.
The correct option is AWS Artifact. AWS Artifact contains two main sections: AWS Artifact Reports, which provides on-demand downloads of AWS security and compliance reports (such as ISO certifications and SOC reports), and AWS Artifact Agreements, which allows customers to review and accept agreements (such as the Data Processing Addendum) on behalf of their AWS accounts.

Step-by-Step Solution

1
Identify the primary requirement: retrieving official AWS compliance documentation (ISO 27001 certification) and accepting a legal agreement (Data Processing Addendum) with AWS.
Recognize that these are standard compliance tasks involving AWS-managed infrastructure audits and terms of service.
AWS manages and audits its own physical infrastructure, providing these reports and agreements to customers for their compliance verification.
2
Evaluate the capabilities of AWS Artifact.
AWS Artifact Reports provides the ISO certification, and AWS Artifact Agreements allows accepting the Data Processing Addendum.
AWS Artifact is specifically designed as the self-service portal for compliance-related documents and agreements.

Key Concept

AWS Artifact is the self-service portal that provides on-demand access to AWS compliance reports and allows customers to accept agreements with AWS.
Question 115Question →

A cloud administrator needs to grant the same read-only permissions to ten new security analysts. Which AWS Identity and Access Management (IAM) feature should the administrator use to manage and apply these permissions to all ten analysts at once?

Show answer & explanation

Answer: IAM User Groups

Answer

IAM User Groups
IAM User Groups allow administrators to specify permissions for a collection of users. This makes it easy to manage permissions for multiple users at once, ensuring consistency and adhering to AWS best practices.

Step-by-Step Solution

1
Identify the goal: granting the same set of permissions to a collective set of individual IAM users (ten security analysts).
Determine that individual policy attachments are inefficient and error-prone.
Grouping users simplifies administrative overhead.
2
Evaluate the available IAM features for managing permissions for multiple users collectively.
Identify that IAM User Groups are designed specifically to attach permission policies to multiple users simultaneously.
IAM User Groups promote the best practice of managing permissions at the group level rather than the user level.

Key Concept

IAM User Groups are collections of IAM users that allow administrators to specify and manage permissions for multiple users easily.
Question 116Question →

A healthcare provider uses Amazon Simple Storage Service (Amazon S3) to store encrypted patient records. During a security audit, it is discovered that a bucket policy was improperly configured, allowing public read access to the records. Under the AWS Shared Responsibility Model, which of the following statements correctly identifies the party responsible for this configuration error and the reason?

Show answer & explanation

Answer: The customer is responsible, because they are responsible for configuring data access control, bucket policies, and identity management in the cloud.

Answer

The customer is responsible, because they are responsible for configuring data access control, bucket policies, and identity management in the cloud.
The correct answer states that the customer is responsible for configuring access control, bucket policies, and identity management. S3 is a managed object storage service, but under the AWS Shared Responsibility Model, the customer is always responsible for data access permissions and configuration (security 'in' the cloud).

Step-by-Step Solution

1
Analyze the service type and resource configuration described in the scenario.
The scenario involves Amazon S3 bucket policy configuration, which controls access to data stored in S3.
Identifying the resource and setting helps determine where it falls under the Shared Responsibility Model.
2
Determine the boundary between security 'of' the cloud and security 'in' the cloud.
AWS manages security 'of' the cloud (infrastructure, physical security, virtualization layer). The customer manages security 'in' the cloud (data classification, identity and access management, and configuration of resource policies).
Differentiating these boundaries shows that configuring S3 bucket access policies is a customer responsibility.

Key Concept

Under the AWS Shared Responsibility Model, customers are responsible for configuring access controls and bucket policies for data stored in Amazon S3 (security 'in' the cloud), while AWS manages the underlying storage infrastructure (security 'of' the cloud).
Question 117Question →

A media streaming company is deploying a serverless image processing pipeline using AWS Lambda. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Writing and securing the application code run within the Lambda functions; Managing the IAM execution roles and access policies assigned to the Lambda functions

Answer

The customer is responsible for writing and securing the application code run within the Lambda functions and managing the IAM execution roles and access policies assigned to the Lambda functions.
For serverless services like AWS Lambda, AWS manages the entire underlying execution environment, including the physical infrastructure, virtualization layer, operating system, and runtime. The customer retains control and responsibility for the application code written and deployed, as well as the Identity and Access Management (IAM) configurations, such as the execution roles that grant the function permissions to interact with other AWS resources.

Step-by-Step Solution

1
Identify the AWS service type in the scenario.
AWS Lambda is a serverless (managed) service.
The customer's responsibilities vary depending on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Serverless.
2
Apply the Shared Responsibility Model boundaries for serverless services.
AWS manages the physical infrastructure, virtualization, host operating system, and runtime. The customer manages application code, data, and access configurations.
This determines which tasks belong to the customer ('security in the cloud') versus AWS ('security of the cloud').
3
Evaluate the choices against these boundaries.
Writing secure code and configuring IAM execution roles are customer responsibilities, whereas OS/runtime patching, physical security, and virtualization maintenance are AWS responsibilities.
This identifies the two correct customer-managed security actions.

Key Concept

Shared Responsibility Model for Serverless Services
Question 118Question →

A startup is designing a secure architecture on AWS. The security team wants to implement a solution that continuously monitors the AWS environment for unauthorized behavior, such as unusual API calls or potential database attacks. Additionally, they need to run automated scans on their container images to check for known software vulnerabilities before deployment. Which AWS services should the startup use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides continuous threat detection, while Amazon Inspector provides automated vulnerability scanning for container images.
Amazon GuardDuty is the correct choice for threat detection because it continuously monitors log sources for malicious or unauthorized activities. Amazon Inspector is the correct choice for vulnerability management because it automatedly scans container images in Amazon ECR for software vulnerabilities.

Step-by-Step Solution

1
Identify the service responsible for continuous monitoring and active threat detection in the AWS environment.
Amazon GuardDuty is identified as the service that monitors logs (like CloudTrail and VPC Flow Logs) to detect unauthorized behavior and threats.
The requirement specifies the need to continuously monitor the AWS environment for unauthorized behavior.
2
Identify the service responsible for automated software vulnerability scanning of container images.
Amazon Inspector is identified as the service that scans container images in Amazon ECR for known vulnerabilities.
The requirement specifies the need to run automated scans on container images for software vulnerabilities.

Key Concept

AWS threat detection and vulnerability management services
Estimated Time:1m 0s
Question 119Question →

A company needs to grant programmatic access to an external third-party Software-as-a-Service (SaaS) monitoring tool to read configuration metrics from their AWS account. The SaaS tool does not run on AWS infrastructure. According to AWS Identity and Access Management (IAM) best practices, which configuration should the administrator implement to grant this access?

Show answer & explanation

Answer: Configure a cross-account IAM role with a trust policy that allows the third-party AWS account to assume the role, requiring an external ID.

Answer

Configure a cross-account IAM role with a trust policy that allows the third-party AWS account to assume the role, requiring an external ID.
The correct option outlines the standard AWS security recommendation for granting third-party access. By configuring a cross-account IAM role, the third-party tool can obtain temporary security credentials to perform API actions. Requiring an external ID is a vital security best practice that prevents the 'confused deputy' problem in multi-tenant integrations.

Step-by-Step Solution

1
Analyze the access requirement for an external SaaS tool that does not run on AWS infrastructure.
The tool requires programmatic access to AWS APIs from outside the company's AWS environment.
Understanding the caller's origin is necessary to choose between identity federation, IAM users, or cross-account roles.
2
Evaluate the credentials policy for third-party access.
Using temporary credentials via IAM roles is identified as the secure, recommended method instead of sharing static, long-term access keys.
IAM roles allow the external entity to assume permissions dynamically, eliminating the need to store and rotate permanent access keys.
3
Define the relationship using a cross-account role with an external ID.
A trust relationship is configured between the customer account and the SaaS provider account, utilizing an external ID to mitigate the confused deputy vulnerability.
This establishes secure delegation of access specifically tailored for multi-tenant third-party SaaS integrations.

Key Concept

Cross-account IAM delegation and external ID best practices for third-party integrations
Question 120Question →

A company hosts its customer database on an Amazon EC2 instance. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

Show answer & explanation

Answer: Installing security patches on the guest operating system

Answer

Installing security patches on the guest operating system
Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud'. For Amazon EC2 (an Infrastructure as a Service offering), this includes configuration, updates, and security patching of the guest operating system. The correct option correctly identifies guest operating system patching as the customer's responsibility.

Step-by-Step Solution

1
Determine the service category for Amazon EC2
Amazon EC2 is classified as an Infrastructure as a Service (IaaS) offering.
IaaS services require the customer to perform administrative and configuration tasks starting from the operating system layer.
2
Distinguish between 'security in the cloud' and 'security of the cloud'
Guest operating system maintenance belongs to the customer ('security in the cloud'), whereas physical, hardware, and virtualization infrastructure security belongs to AWS ('security of the cloud').
This allocation defines the boundaries of the Shared Responsibility Model.

Key Concept

Shared Responsibility Model (IaaS Boundary)
Estimated Time:45s
PreviousPage 6 / 23Next