Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 121Question →

A financial technology startup is developing a mobile payment application and decides to use Amazon Cognito User Pools for user identity management and authentication. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Defining password strength requirements and enabling multi-factor authentication (MFA) configurations for the user pool; Configuring the app client settings and securing the client secrets used by the mobile application to interact with the user pool

Answer

Defining password strength requirements and enabling multi-factor authentication (MFA) configurations for the user pool, and configuring the app client settings and securing the client secrets used by the mobile application to interact with the user pool.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed service like Amazon Cognito, this includes configuring security controls such as password policies, enabling multi-factor authentication (MFA), setting up app client credentials, and protecting application-side secrets. AWS handles the security 'of' the cloud, which includes physical host security, OS patching, database management, and service availability.

Step-by-Step Solution

1
Analyze the service model of Amazon Cognito.
Amazon Cognito is classified as a managed platform service. For managed services, AWS takes care of the underlying infrastructure, operating system, and platform layer, while the customer remains responsible for configuration, data classification, and access management.
Understanding the service type (IaaS vs. PaaS/Managed) is the first step in delineating responsibilities in the Shared Responsibility Model.
2
Evaluate the customer-side responsibilities for Amazon Cognito.
The customer controls identity policy definitions (e.g., password strength, MFA enforcement) and user access parameters. Additionally, because the client application integrates with Cognito, securing the client credentials/secrets and configuring these integration clients falls on the customer.
Configuring security settings inside the service and securing customer-facing application integration are aspects of security 'in' the cloud.
3
Evaluate the AWS-side responsibilities for Amazon Cognito.
AWS handles physical security of the storage facilities, operating system updates for the servers running Cognito, and the database persistence/replication layer.
Infrastructure tasks, hardware maintenance, and physical security belong to security 'of' the cloud, handled by AWS.

Key Concept

Shared Responsibility Model for Managed Services
Question 122Question →

A global telecommunications provider is preparing for a regulatory audit of its customer portal. The compliance team must review the confidential AWS ISO 27001 Certification report to verify physical security, and ensure that the guest operating system patches are applied on their database running on Amazon EC2. Which combination of actions should the provider take to satisfy both requirements?

Show answer & explanation

Answer: Download the ISO 27001 Certification report through AWS Artifact after accepting the online non-disclosure agreement, and manage the guest operating system updates on the Amazon EC2 instances.

Answer

Download the ISO 27001 Certification report through AWS Artifact after accepting the online non-disclosure agreement, and manage the guest operating system updates on the Amazon EC2 instances.
The correct action is to download the confidential ISO 27001 Certification report through AWS Artifact, which requires accepting an online NDA, and to manage the guest operating system updates on the Amazon EC2 instances because under the AWS Shared Responsibility Model, patching the guest OS on an EC2 instance is the customer's responsibility.

Step-by-Step Solution

1
Identify the appropriate channel to retrieve confidential AWS compliance reports.
AWS Artifact is identified as the central portal for secure, on-demand download of AWS compliance documents, which requires accepting a non-disclosure agreement (NDA) before downloading confidential reports like the ISO 27001 Certification.
Confidential compliance reports are not publicly available or stored in operational logs like CloudTrail.
2
Determine the responsibility boundaries for patching the operating system of an Amazon EC2 instance under the AWS Shared Responsibility Model.
The customer is fully responsible for managing the guest operating system, including applying security patches and updates.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, meaning AWS manages security 'of' the cloud (physical infrastructure, virtualization layer), while the customer is responsible for security 'in' the cloud (guest OS, applications, data).

Key Concept

Retrieving compliance documentation via AWS Artifact and applying the AWS Shared Responsibility Model to Infrastructure as a Service (IaaS) resources.
Estimated Time:1m 30s
Question 123Question →

A global e-commerce corporation is preparing for an annual security audit to verify compliance with payment card industry and international security standards. The compliance team needs to obtain AWS's formal compliance reports and verify the division of security obligations for their hosted databases. Which of the following actions should the team perform to meet these compliance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download AWS SOC and PCI-DSS compliance reports directly from AWS Artifact; Review the AWS Shared Responsibility Model to identify which database security controls are managed by AWS versus the customer

Answer

Downloading AWS SOC and PCI-DSS compliance reports directly from AWS Artifact, and reviewing the AWS Shared Responsibility Model to identify which database security controls are managed by AWS versus the customer.
AWS Artifact provides on-demand access to AWS security and compliance reports, such as SOC and PCI-DSS documents. Additionally, reviewing the AWS Shared Responsibility Model helps organizations clarify their compliance boundaries by defining which database security controls are AWS's responsibility and which must be managed by the customer.

Step-by-Step Solution

1
Access AWS Artifact to retrieve official compliance documents.
The team obtains the required SOC and PCI-DSS compliance reports directly from the console.
AWS Artifact is the primary portal for retrieving AWS's compliance reports and agreements.
2
Consult the AWS Shared Responsibility Model to determine security boundaries.
The team distinguishes database security controls managed by AWS (like physical hardware security) from customer-managed controls (like database configuration).
The Shared Responsibility Model clearly defines security obligations between AWS and the customer.

Key Concept

AWS Compliance and Governance via AWS Artifact and the Shared Responsibility Model
Estimated Time:1m 30s
Question 124Question →

An enterprise is auditing its AWS environment. The audit team discovers that the development group shares a single set of IAM access keys to perform administrative actions. Additionally, the AWS account root user is frequently used to run daily database backup scripts. Which of the following actions should the security team take to remediate these security findings in accordance with AWS best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create individual IAM users for each developer, assign them to an IAM group with an administrative policy attached, and require multi-factor authentication (MFA) for console access.; Configure an IAM role with the required permissions for the database backup scripts, and assign this role to the Amazon EC2 instance running the database.

Answer

To remediate these issues, the security team should establish individual IAM users within an administrator group requiring MFA, and assign an IAM role to the EC2 instance hosting the database backup scripts.
Remediating administrative access requires implementing individual accountability. Creating individual IAM users, placing them into an administrative group, and enabling MFA ensures that administrative operations can be tracked and secured. For the backup scripts, assigning an IAM role directly to the EC2 instance allows it to retrieve temporary credentials automatically, removing both the root user dependency and the risk of exposing long-term access keys.

Step-by-Step Solution

1
Identify credentials risk for administrative staff.
Sharing a single set of IAM access keys prevents individual accountability and violates the principle of individual user identity.
Establishing individual IAM users mapped to groups with MFA enforces secure administrative access.
2
Identify credentials risk for the automated backup scripts.
Using the root user or root access keys for automated tasks presents an extreme security risk, as root access cannot be restricted.
Transitioning the script to use an IAM role attached to the EC2 instance provides secure, temporary credentials without hardcoded keys.
3
Map the remediation to AWS security best practices.
Select the options that implement individual IAM users/groups with MFA, and service roles for AWS compute resources.
This alignment ensures compliance with the principle of least privilege and credential safety.

Key Concept

Applying IAM identity best practices, securing the root account, using group-based permissions with MFA, and leveraging IAM roles for EC2 instances to avoid hardcoded credentials.
Question 125Question →

A retail company is designing its access management strategy on AWS. The company needs to configure access for its application developers and an application running on an Amazon EC2 instance. Which of the following actions follow AWS Identity and Access Management (IAM) best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Organize developer IAM users into an IAM group and attach permissions policies directly to the group.; Attach an IAM role to the Amazon EC2 instance to grant the application temporary credentials for accessing other AWS resources.

Answer

Organizing developer IAM users into an IAM group and attaching permissions to the group, and attaching an IAM role to the Amazon EC2 instance to grant the application temporary credentials.
Organizing developer IAM users into an IAM group and attaching policies to the group makes permission management efficient and consistent. Attaching an IAM role to the Amazon EC2 instance ensures the application uses temporary, secure credentials rather than hardcoded secrets.

Step-by-Step Solution

1
Determine how to manage credentials for applications running on Amazon EC2 instances.
IAM roles should be used to provide temporary, automatically rotated security credentials to applications.
This avoids storing permanent, hardcoded access keys on the instance, which is a major security risk.
2
Determine how to manage permissions for multiple application developers.
IAM users should be added to an IAM group, and policies should be attached to the group rather than individual users.
This simplifies administration and ensures consistent permissions management as the team changes.
3
Examine the remaining options against the AWS Shared Responsibility Model and root account best practices.
Sharing root user credentials and expecting AWS to rotate customer access keys are flagged as incorrect.
The root user must not be shared for daily tasks, and managing IAM credentials falls under the customer's responsibility for security in the cloud.

Key Concept

AWS Identity and Access Management (IAM) Best Practices
Question 126Question →

A financial analytics firm is deploying a containerized API using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team must define the security controls for which they are solely responsible. Under the AWS Shared Responsibility Model, which of the following operational tasks is the responsibility of the customer for this deployment?

Show answer & explanation

Answer: Configuring security groups to restrict traffic to the individual tasks and managing task execution IAM roles

Answer

Configuring security groups to restrict traffic to the individual tasks and managing task execution IAM roles
Under the AWS Shared Responsibility Model for AWS Fargate, the customer does not manage or access the underlying EC2 instances or host operating system. The customer is responsible for configuring application-level security, which includes security groups applied directly to the container tasks, and managing task-related access policies using IAM roles.

Step-by-Step Solution

1
Analyze the service type in the scenario
The deployment uses Amazon ECS with the AWS Fargate launch type, which is an abstraction layer (managed serverless container service).
Identifying Fargate as a managed/serverless service shifts the underlying host and infrastructure responsibilities from the customer to AWS.
2
Determine the boundary of customer responsibilities for AWS Fargate
The customer is responsible for container definitions, task execution IAM roles, application security groups, application code, data encryption, and identity management.
Since the customer does not have access to the underlying EC2 instances in Fargate, host-level management, host patching, and virtualization security are managed by AWS.
3
Evaluate the options against this boundary
The option to configure task-level security groups and IAM roles is a customer responsibility, while patching host operating systems, managing physical infrastructure isolation, and securing physical networks are AWS responsibilities.
Allows selecting the correct customer task and discarding AWS-managed tasks.

Key Concept

AWS Shared Responsibility Model for Container/Serverless Services (AWS Fargate)
Question 127Question →

A software development team is deploying a serverless API using AWS Lambda to process incoming customer orders. Under the AWS Shared Responsibility Model, which operational task is the responsibility of the customer?

Show answer & explanation

Answer: Writing and securing the application code deployed within the Lambda function

Answer

Writing and securing the application code deployed within the Lambda function
In the Shared Responsibility Model, AWS Lambda is a serverless service where AWS manages the underlying physical infrastructure, virtualization layer, operating system, and runtime. The customer remains responsible for writing, maintaining, and securing the actual application code that is executed within the function.

Step-by-Step Solution

1
Identify the AWS service type being used in the scenario.
AWS Lambda is a serverless (Function-as-a-Service) compute service.
The service type determines the boundary of responsibility under the Shared Responsibility Model.
2
Determine the customer's responsibility boundary for serverless services.
For serverless services, the customer's operational burden is reduced. The customer is responsible for data, IAM configurations, and the application code itself.
AWS manages the operating system, hardware, virtualization layer, and runtime environments for serverless offerings.
3
Evaluate the options against the customer's responsibility boundary.
Writing and securing the application code is a customer responsibility. Managing the OS, physical security, and runtimes are AWS responsibilities.
This identifies the correct option based on the defined shared responsibility boundaries.

Key Concept

Shared Responsibility Model for Serverless Services
Question 128Question →

A municipal utility provider is migrating its operations to AWS and must review the security compliance reports of the AWS physical data centers to satisfy local government auditing requirements. How can the provider obtain these official AWS compliance documents?

Show answer & explanation

Answer: Access the AWS Artifact portal to retrieve and download the AWS SOC and ISO reports.

Answer

Access the AWS Artifact portal to retrieve and download the AWS SOC and ISO reports.
AWS Artifact is a free, self-service portal that provides AWS customers with on-demand access to AWS security and compliance reports, such as Service Organization Control (SOC) reports and International Organization for Standardization (ISO) certificates.

Step-by-Step Solution

1
Identify the entity responsible for the physical security of the data centers.
Under the AWS Shared Responsibility Model, AWS is solely responsible for physical security and compliance of the cloud infrastructure.
This narrows the search to AWS-provided compliance reports rather than customer-driven scanning or logging.
2
Determine the appropriate AWS tool for downloading official compliance documents.
AWS Artifact is the self-service portal where customers can access and download security reports (like SOC and ISO certifications) and accept agreements.
This matches the requirement to obtain official compliance documents for third-party or governmental audits.

Key Concept

AWS Artifact provides on-demand access to AWS security and compliance reports.
Estimated Time:1m 0s
Question 129Question →

A healthcare organization hires a new compliance officer who needs permanent, individual access to log into the AWS Management Console to review compliance reports. Which AWS Identity and Access Management (IAM) entity should be created to grant this access?

Show answer & explanation

Answer: An IAM user

Answer

An IAM user
An IAM user is the correct entity to create because it represents a specific person or service that requires permanent credentials to interact with AWS, such as logging into the AWS Management Console.

Step-by-Step Solution

1
Identify the access requirement, which is a new permanent employee (compliance officer) needing individual login credentials to the AWS Management Console.
The scenario requires permanent, individual credentials rather than temporary or shared access.
Understanding the nature of the worker's access requirement determines whether an IAM user or IAM role is appropriate.
2
Evaluate the AWS security best practices for daily operational access.
Individual IAM users should be created for daily tasks, and root user usage should be restricted.
Applying the principle of least privilege and administrative isolation secures the account.

Key Concept

AWS Identity and Access Management (IAM) Entities
Estimated Time:45s
Question 130Question →

An organization is configuring a secure network architecture on AWS with public-facing web servers and a private database tier. To meet strict compliance guidelines, the security team must implement a layered defense-in-depth strategy. They need to understand how Security Groups and Network Access Control Lists (Network ACLs) behave when filtering traffic across these tiers.

Which of the following statements accurately describe the behavior and configuration of Security Groups and Network ACLs in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security groups are stateful, meaning that if an inbound HTTP request is allowed on port 80, the outbound response traffic is automatically allowed regardless of outbound security group rules.; Network ACLs are stateless, requiring explicit rules in both directions (inbound and outbound) to allow traffic to flow between subnets.

Answer

Security groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit inbound and outbound rules).
Security groups operate at the instance level and are stateful. When inbound traffic is allowed, corresponding outbound traffic is permitted automatically. Conversely, Network ACLs operate at the subnet level and are stateless, meaning return traffic must be explicitly permitted by a rule in the opposite direction.

Step-by-Step Solution

1
Examine the operational boundary and stateful tracking of Security Groups.
Security groups operate at the instance level (Elastic Network Interface) and automatically track connection states, allowing return traffic regardless of outbound rules.
This identifies the stateful traffic rule for Security Groups.
2
Examine the operational boundary and stateless behavior of Network ACLs.
Network ACLs operate at the subnet boundary and do not track connection states, requiring separate rules for inbound and outbound traffic.
This identifies the stateless traffic rule for Network ACLs.
3
Verify responsibility boundaries for security configurations.
Defining rules in Security Groups and Network ACLs falls under the customer's responsibility (Security in the Cloud).
This eliminates the choice regarding AWS configuring customer Network ACLs.
4
Evaluate the role of monitoring and vulnerability detection tools.
Amazon Inspector checks hosts/images for vulnerabilities and does not act as an automated network traffic filter.
This rules out using Amazon Inspector for active Network ACL block automation.

Key Concept

Statefulness versus statelessness and subnet-level versus instance-level enforcement of AWS network security controls.
Question 131Question →

A healthcare startup needs to verify its compliance posture by reviewing official security documentation and accepting a Business Associate Addendum (BAA) with AWS. Which of the following actions can the startup perform using AWS Artifact to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download AWS compliance reports, such as ISO certifications and SOC reports.; Review and accept agreements with AWS, such as the Business Associate Addendum (BAA).

Answer

The correct options are downloading AWS compliance reports (such as ISO certifications and SOC reports) and reviewing and accepting agreements with AWS (such as the Business Associate Addendum).
AWS Artifact is a self-service compliance portal. It allows customers to download AWS security and compliance documents (such as ISO certifications and SOC reports) and to review and accept agreements with AWS (such as the Business Associate Addendum needed for HIPAA compliance).

Step-by-Step Solution

1
Identify the AWS service that provides on-demand access to compliance documents and agreements.
AWS Artifact is the central portal for AWS compliance reports and agreements.
AWS Artifact is specifically designed to provide access to security documents and to allow accepting agreements like the Business Associate Addendum (BAA).
2
Determine which options correspond to the capabilities of AWS Artifact.
Downloading ISO/SOC reports and accepting agreements (like HIPAA BAA) are core features of AWS Artifact, whereas vulnerability scanning, API auditing, and physical security management are handled by Amazon Inspector, AWS CloudTrail, and AWS respectively.
This isolates the correct AWS Artifact features from other security services and shared responsibility boundaries.

Key Concept

AWS Artifact capabilities and compliance reporting
Question 132Question →

An organization hosts a multi-tier web application where Amazon EC2 instances in a private subnet receive traffic from a public-facing Application Load Balancer (ALB). The security team configures the EC2 instances' Security Group to allow inbound HTTP traffic on port 80 only from the ALB's Security Group, and allowed all outbound traffic. At the subnet level, the Network ACL (NACL) is modified to allow inbound HTTP traffic on port 80 from the ALB's private IP range, and allow outbound HTTP traffic on port 80 to the ALB's private IP range, with all other traffic blocked by default rules. Users report receiving 502 Bad Gateway errors from the ALB. Which configuration change is required to resolve this issue and allow successful traffic flow?

Show answer & explanation

Answer: Modify the subnet's outbound Network ACL rules to allow traffic to the ALB's private IP range on ephemeral ports (1024-65535).

Answer

Modify the subnet's outbound Network ACL rules to allow traffic to the ALB's private IP range on ephemeral ports (1024-65535).
The correct option is to modify the subnet's outbound Network ACL to allow traffic to the ALB's private IP range on ephemeral ports (1024-65535). Because Network ACLs are stateless, return traffic from the EC2 instances back to the ALB must be explicitly allowed. A client connection (from the ALB) uses a random ephemeral port to initiate the request, meaning the EC2 instance must reply to a destination port in the 1024-65535 range rather than port 80.

Step-by-Step Solution

1
Analyze the stateful nature of Security Groups.
Since the security group allows inbound traffic on port 80, return traffic is automatically tracked and allowed outbound at the instance layer without additional outbound rules.
Security Groups operate at the instance level and are stateful.
2
Analyze the stateless nature of Network ACLs.
Subnet-level Network ACLs do not track connection states. For any allowed inbound request, the corresponding return traffic must be explicitly permitted in the outbound rules.
Network ACLs operate at the subnet level and are stateless.
3
Determine the destination port of the return traffic.
When a client (the ALB) establishes a TCP connection to a server (the EC2 instance on port 80), the client uses a temporary, high-numbered port known as an ephemeral port (typically 1024-65535) to receive the response.
TCP return connections are directed to the client's ephemeral port, not the service port.
4
Identify the misconfiguration and correct it.
The current outbound Network ACL only allows outbound traffic on port 80, causing the return packets destined for the ALB's ephemeral ports to be blocked by the default deny rule. Allowing outbound traffic to the ALB's IP range on ports 1024-65535 resolves the issue.
Explicitly permitting ephemeral port traffic in the outbound Network ACL is mandatory for stateless return path communications.

Key Concept

The stateful behavior of Security Groups versus the stateless behavior of Network ACLs, and the requirement of ephemeral ports for return traffic in stateless configurations.
Estimated Time:2m 0s
Question 133Question →

A retail company runs its e-commerce website on several Amazon Elastic Compute Cloud (Amazon EC2) instances. Under the AWS Shared Responsibility Model, which of the following security tasks is the sole responsibility of AWS?

Show answer & explanation

Answer: Decommissioning and physically destroying retired storage hardware

Answer

Decommissioning and physically destroying retired storage hardware
Decommissioning and physically destroying retired storage hardware is the correct answer because physical security, infrastructure maintenance, and hardware disposal are part of security 'of' the cloud, which is the sole responsibility of AWS.

Step-by-Step Solution

1
Analyze the service type in the scenario
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, where the customer manages the operating system, applications, and data, while AWS manages the physical infrastructure, virtualization hypervisor, and hardware.
Identifying the service type determines the boundary of responsibilities between the customer and AWS.
2
Evaluate the operational tasks against the Shared Responsibility Model
Physical hardware disposal and destruction belong to the security 'of' the cloud (managed by AWS). Configuring firewalls (security groups), patching the guest OS, and application compliance belong to security 'in' the cloud (managed by the customer).
Differentiating between security of the cloud and security in the cloud allows us to select the task owned by AWS.

Key Concept

Shared Responsibility Model
Estimated Time:45s
Question 134Question →

A smart-vehicle manufacturer is launching an autonomous fleet management platform on AWS. To meet regional regulatory requirements, the manufacturer's legal department must execute a Business Associate Addendum (BAA) with AWS, and the risk assessment team must download the ISO/IEC 27001 certification report for the AWS physical infrastructure. Which AWS resource should the manufacturer use to accept this online agreement and retrieve the required certification?

Show answer & explanation

Answer: AWS Artifact, which provides on-demand access to AWS security and compliance reports and allows customers to accept online agreements.

Answer

AWS Artifact, which provides on-demand access to AWS security and compliance reports and allows customers to accept online agreements.
AWS Artifact is the primary portal for retrieving AWS's independent compliance reports (such as ISO/IEC 27001 and SOC reports) and formally accepting online agreements (such as the Business Associate Addendum) on behalf of AWS accounts.

Step-by-Step Solution

1
Identify the service that acts as a central repository for AWS's third-party compliance reports.
AWS Artifact is the correct portal to download AWS's independent security audits, such as ISO/IEC 27001 certifications.
AWS Artifact is designed specifically to share AWS compliance documents with customers on demand.
2
Determine the portal where customers can review and accept online agreements like the Business Associate Addendum (BAA).
AWS Artifact Agreements allows customers to accept and manage agreements for single accounts or across AWS Organizations.
AWS Artifact serves both compliance report retrieval and agreement management needs.

Key Concept

AWS compliance reports and agreements portal
Question 135Question →

A financial services company is setting up its application environment on AWS. The environment will consist of developers who need to configure resources and applications running on Amazon EC2 instances that need to retrieve data from Amazon S3. Which two of the following actions align with AWS-recommended security best practices for managing identity and access in this scenario?

Select all that apply

Show answer & explanation

Answer: Configure an IAM role with the required Amazon S3 access permissions and attach it to the Amazon EC2 instances.; Enable Multi-Factor Authentication (MFA) on the AWS account root user and restrict its use to only essential account management tasks.

Answer

The correct practices are configuring an IAM role with S3 permissions for the EC2 instances, and enabling MFA on the root user while restricting its daily usage.
Configuring an IAM role for EC2 instances allows applications to securely access Amazon S3 using temporary, auto-rotated credentials. Additionally, securing the root user with Multi-Factor Authentication (MFA) and restricting its use to essential tasks protects the account from unauthorized administrative actions.

Step-by-Step Solution

1
Evaluate application-to-service access requirements.
Identify that applications running on Amazon EC2 need to access Amazon S3. AWS best practice is to assign roles with temporary credentials rather than hardcoding static access keys.
This limits the risk of credential leakage and simplifies secret rotation.
2
Evaluate root account management policies.
Identify that the AWS account root user must be secured with Multi-Factor Authentication (MFA) and restricted from daily operations.
This protects the account from unauthorized administrative actions since root privileges cannot be limited.
3
Evaluate shared responsibility boundaries.
Understand that customer operating system user permissions inside EC2 instances are managed by the customer, not AWS.
This ensures the security configuration matches the company's internal compliance requirements.

Key Concept

AWS IAM security best practices, including temporary credentials via roles and root user protection.
Question 136Question →

A financial technology company wants to continuously monitor its AWS accounts for malicious activity and unauthorized behavior. The company needs a service that can analyze AWS CloudTrail event logs, VPC Flow Logs, and DNS logs using threat intelligence and machine learning to detect issues like compromised EC2 instances or unauthorized API calls. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
The correct service is Amazon GuardDuty because it is a threat detection service that continuously monitors AWS accounts and workloads for malicious activity. It analyzes metadata from AWS CloudTrail event logs, VPC Flow Logs, and DNS logs to identify threats like compromised credentials, communication with known malicious IPs, or anomalous behavior.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to continuously monitor AWS accounts for malicious activity, unauthorized behavior, and potential threats by analyzing CloudTrail event logs, VPC Flow Logs, and DNS logs.
Understanding the source data (logs) and the desired outcome (threat detection) allows for the selection of the correct specialized security service.
2
Evaluate the capabilities of the available AWS security services.
Amazon GuardDuty is the specific service designed for intelligent threat detection via log analysis, whereas Amazon Inspector is for vulnerability scanning, AWS CloudTrail is for logging API calls, and AWS Shield is for DDoS protection.
Differentiating between vulnerability management, logging, protection, and threat detection determines the correct tool.

Key Concept

Intelligent threat detection using log analysis
Question 137Question →

A company is migrating its relational database to Amazon RDS (Relational Database Service) to reduce operational overhead. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring database-level user access and permissions; Enabling encryption at rest for the database instances

Answer

Configuring database-level user access and permissions AND Enabling encryption at rest for the database instances
Under the AWS Shared Responsibility Model for Amazon RDS, the customer is responsible for security 'in' the cloud. This includes configuring database-level user access and permissions to control access to the data, and enabling data encryption features (such as encryption at rest). AWS, on the other hand, is responsible for security 'of' the cloud, which includes managing the underlying physical infrastructure, virtualization layer, and OS-level patching.

Step-by-Step Solution

1
Identify the AWS service and its type in the Shared Responsibility Model.
Amazon RDS is a managed service (PaaS-like database service), which offloads operating system and database engine maintenance to AWS.
Understanding the service type helps determine the boundary of responsibilities between AWS and the customer.
2
Evaluate the proposed tasks against customer-side responsibilities (security 'in' the cloud) for Amazon RDS.
Configuring database-level user permissions and enabling encryption at rest are customer responsibilities. Tasks like OS patching, hardware replacement, and hypervisor updates are handled by AWS.
To select the correct options, we must classify each task as either the customer's or AWS's responsibility.

Key Concept

Shared Responsibility Model for Managed Services (PaaS)
Estimated Time:1m 0s
Question 138Question →

A logistics company is onboarding a new shipping partner that requires proof of AWS's ISO 9001 compliance. Which AWS service should the company use to download the required audit reports and certifications?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the correct service because it serves as the central, self-service portal for downloading AWS compliance reports, including SOC reports, PCI DSS agreements, and ISO certifications.

Step-by-Step Solution

1
Identify the business requirement for obtaining AWS's third-party audit reports and compliance certificates.
The requirement is to retrieve official certifications (such as ISO 9001) for AWS infrastructure.
This determines which type of service or portal is needed to retrieve official security documentation.
2
Select the specific AWS tool designed as a central repository for compliance documentation.
AWS Artifact is the designated portal providing on-demand access to AWS compliance reports.
AWS Artifact allows customers to download compliance documents to share with auditors or business partners.

Key Concept

AWS Artifact is the primary portal for retrieving AWS compliance reports and agreements.
Estimated Time:45s
Question 139Question →

A smart-home IoT device manufacturer is preparing for a security audit of its database systems. The compliance team must review AWS physical infrastructure security controls via a SOC 2 report and verify who is responsible for patching the guest operating systems on their Amazon EC2 instances. Which of the following actions should the company take to meet these compliance and operational requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS SOC 2 report from AWS Artifact.; Apply security patches to the guest operating systems of the Amazon EC2 instances.

Answer

Downloading the AWS SOC 2 report from AWS Artifact and patching the guest operating systems on the Amazon EC2 instances.
The correct actions are downloading the compliance reports directly from AWS Artifact and taking responsibility for patching the guest operating system on EC2 instances. AWS Artifact is the self-service portal for AWS compliance reports, and under the Shared Responsibility Model, patching the guest operating system of EC2 instances is the customer's responsibility.

Step-by-Step Solution

1
Identify where third-party compliance reports are stored and retrieved in AWS.
Determine that AWS Artifact is the central portal for downloading reports like SOC 2.
AWS Artifact provides on-demand, self-service access to AWS compliance documentation.
2
Analyze the division of patching responsibilities for Amazon EC2 instances under the Shared Responsibility Model.
Identify that AWS patches the physical host and hypervisor, while the customer patches the guest operating system.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, giving the customer full control and responsibility over the operating system.

Key Concept

AWS compliance reports retrieval via AWS Artifact and the division of patching responsibilities under the Shared Responsibility Model.
Question 140Question →

A logistics company wants to secure its cloud infrastructure. The development team needs a service to automatically scan their container images in Amazon Elastic Container Registry (ECR) for known software vulnerabilities. At the same time, the security team needs a service to continuously monitor their AWS accounts for malicious activity and unauthorized behavior. Which two AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty are the correct services for vulnerability scanning of container images and intelligent threat detection, respectively.
Amazon Inspector is correct because it is the AWS service that automatically discovers and scans workloads, including Amazon ECR container images, for software vulnerabilities. Amazon GuardDuty is correct because it continuously monitors AWS accounts, workloads, and data for malicious activity and anomalies, such as credential compromise or data exfiltration.

Step-by-Step Solution

1
Identify the requirement for software vulnerability scanning in Amazon ECR.
Amazon Inspector is identified as the AWS service designed to automatically scan container images in Amazon ECR for known vulnerabilities.
This matches the development team's need to check their software packages and dependencies.
2
Identify the requirement for continuous threat detection and monitoring for malicious activity.
Amazon GuardDuty is identified as the intelligent threat detection service that monitors AWS accounts and workloads for anomalous behavior.
This matches the security team's need to identify potential threats and unauthorized actions.

Key Concept

AWS threat detection and vulnerability management services
PreviousPage 7 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 7 | Examkin