Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 141Question →

A logistics company is deploying a Redis cluster using Amazon ElastiCache to cache high-frequency tracking data. Under the AWS Shared Responsibility Model, which two of the following operational tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Configuring Amazon VPC security groups to restrict network access to the cache nodes; Managing database user authentication and access control policies within the Redis application

Answer

Configuring Amazon VPC security groups to restrict network access to the cache nodes, and managing database user authentication and access control policies within the Redis application.
The correct responsibilities of the customer are configuring Amazon VPC security groups to restrict network access to the cache nodes, and managing database user authentication and access control policies within the Redis application. These actions allow the customer to secure access to the service and its data, which falls under security 'in' the cloud.

Step-by-Step Solution

1
Identify the service deployment model used in the scenario.
Amazon ElastiCache is a managed service (Platform as a Service / PaaS model).
The shared responsibility model boundaries vary depending on whether the service is Infrastructure as a Service (IaaS) like Amazon EC2, or a managed service like Amazon ElastiCache.
2
Determine customer responsibilities for managed caching services.
The customer is responsible for firewall configuration (VPC security groups) and identity and access management within the application (Redis authentication).
In a managed service, AWS manages the operating system, database patching, and physical infrastructure, while the customer retains control over network access rules and application data security.

Key Concept

In the AWS Shared Responsibility Model, the division of tasks depends on the type of service deployed. For managed services (PaaS) like Amazon ElastiCache, AWS takes on responsibility for the guest operating system, patching, and hardware, while the customer remains responsible for network access controls (security groups) and data access management (user authentication).
Estimated Time:2m 0s
Question 142Question →

A university research laboratory is setting up an AWS account. The administrator needs to grant ten student researchers read-only access to a specific Amazon S3 bucket. Which of the following approaches represent AWS Identity and Access Management (IAM) best practices for this scenario? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create an individual IAM user for each student researcher.; Create an IAM group, attach the required permission policy to the group, and add the student users to it.

Answer

The correct practices are to create an individual IAM user for each student researcher, and to manage their permissions collectively by creating an IAM group, attaching the permission policy to that group, and adding the users to the group.
Creating individual IAM users and organizing them into an IAM group to apply policies is the AWS-recommended approach. This pattern ensures clear auditing of actions while minimizing management overhead by applying policy controls at the group level.

Step-by-Step Solution

1
Analyze the access requirement.
Ten student researchers require S3 read-only access under administrative control.
To determine the appropriate identity and access strategy.
2
Apply IAM identity best practices.
Determine that sharing credentials or using the root user violates security principles, while creating individual IAM users and using IAM groups for permission management aligns with AWS best practices.
To ensure individual accountability, ease of management, and adherence to the principle of least privilege.

Key Concept

AWS IAM best practices emphasize using individual identities (IAM users) and grouping them (IAM groups) to simplify policy management, while strictly avoiding the use of shared accounts or the root user for daily activities.
Estimated Time:1m 0s
Question 143Question →

A digital advertising agency must provide its clients with independent audit reports verifying that the AWS infrastructure hosting their campaigns complies with global security standards. The agency also needs to review and accept a Non-Disclosure Agreement (NDA) with AWS. Which two tasks can the agency perform using AWS Artifact to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Downloading AWS compliance reports, such as ISO certifications and Service Organization Control (SOC) reports.; Reviewing, accepting, and managing agreements with AWS, such as global Non-Disclosure Agreements (NDAs).

Answer

Downloading AWS compliance reports (such as ISO or SOC) and reviewing/accepting agreements with AWS (such as Non-Disclosure Agreements).
AWS Artifact provides on-demand access to AWS compliance documentation (including SOC and ISO reports) and allows customers to review, accept, and manage agreements (such as NDAs or BAAs) directly from the AWS Management Console.

Step-by-Step Solution

1
Identify the AWS service designed as a central repository for compliance-related information and agreement management.
AWS Artifact is identified as the service providing on-demand access to AWS compliance reports and agreements.
The scenario requires retrieving third-party audit reports (like ISO/SOC) and signing a Non-Disclosure Agreement (NDA) with AWS.
2
Verify which proposed features belong to AWS Artifact versus other AWS security services or customer responsibilities.
Downloading compliance documents and accepting NDAs are core capabilities of AWS Artifact, whereas patching, vulnerability scanning, and API auditing are handled by other services or customer processes.
This isolates the correct capabilities to fulfill the business requirements.

Key Concept

AWS Artifact provides on-demand download of AWS compliance documents and self-service agreement management.
Question 144Question →

An educational technology company hosting student record databases on AWS must prepare for an audit by its university customers. The customers require verification of the physical security controls of the AWS data centers, and the company must accept the AWS non-disclosure agreements (NDAs) to access these documents. Which TWO actions should the company take to meet these compliance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download AWS compliance documents such as SOC and ISO reports directly from the AWS Artifact console; Accept the required AWS agreements, such as non-disclosure agreements, directly within AWS Artifact

Answer

Download AWS compliance documents such as SOC and ISO reports directly from the AWS Artifact console, and accept the required AWS agreements, such as non-disclosure agreements, directly within AWS Artifact.
To verify AWS physical security controls, the customer must access AWS compliance documents (such as Service Organization Control (SOC) and ISO reports) which are available on-demand in AWS Artifact. To access these documents, the customer must accept the associated AWS agreements and non-disclosure terms, which can be done directly through the AWS Artifact portal.

Step-by-Step Solution

1
Identify the primary service in AWS for retrieving official compliance reports and signing agreements.
Recognize that AWS Artifact is the self-service portal designed for compliance document retrieval and agreement acceptance.
AWS Artifact allows customers to access security and compliance reports and accept AWS agreements on-demand.
2
Determine which action retrieves the physical security control documentation requested by the auditors.
Select the option to download SOC and ISO reports directly from AWS Artifact.
SOC and ISO reports contain the audit evidence for AWS physical infrastructure security.
3
Determine how the company can accept the required non-disclosure agreements (NDAs) to access the documents.
Select the option to accept the required agreements online via the AWS Artifact console.
AWS Artifact Agreements allows customers to review and accept AWS terms and NDAs.

Key Concept

AWS compliance reports retrieval and agreements acceptance under the Shared Responsibility Model.
Question 145Question →

A financial organization is using AWS Storage Gateway (Volume Gateway) deployed as a virtual machine (VM) on their on-premises VMware ESXi hypervisor to replicate local file data to Amazon S3. Under the AWS Shared Responsibility Model, which of the following operational security tasks is the responsibility of AWS?

Show answer & explanation

Answer: Providing and deploying software updates and security patches for the Storage Gateway virtual appliance guest operating system and application software.

Answer

Providing and deploying software updates and security patches for the Storage Gateway virtual appliance guest operating system and application software.
AWS is responsible for providing and deploying software updates and security patches for the Storage Gateway virtual appliance. Because it is a managed virtual appliance, AWS maintains and packages updates for the gateway software and its underlying operating system, though the customer retains control over the schedule for applying these updates.

Step-by-Step Solution

1
Analyze the service model and deployment type.
AWS Storage Gateway is a hybrid storage service. The virtual machine runs on-premises, but the gateway software itself is a managed appliance provided by AWS.
Understanding where the service components run is key to identifying the boundary of the Shared Responsibility Model.
2
Determine the boundary of responsibility for the gateway software appliance.
AWS is responsible for building, patching, and maintaining the VM appliance's guest operating system and gateway software.
AWS maintains operational control over the software image of the appliance, even though it runs on customer-owned hardware.
3
Evaluate the customer's on-premises responsibilities.
The customer is responsible for the physical security of the on-premises data center, the hypervisor configuration, local networking, and the protection of local data.
AWS cannot manage or secure physical hardware, hypervisors, or networks that are outside of its cloud infrastructure.

Key Concept

Shared Responsibility Model for Hybrid Services
Question 146Question →

A startup is establishing its cloud environment and wants to secure access for its development team. The developers currently share a single set of credentials to manage AWS resources. Which TWO AWS Identity and Access Management (IAM) best practices should the startup implement to secure its environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create individual IAM users for each developer and place them in an IAM group with least-privilege permissions attached.; Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to only tasks that require root credentials.

Answer

The correct practices are to create individual IAM users for each developer within an IAM group, and to enable multi-factor authentication (MFA) on the root user while avoiding its use for daily administrative tasks.
To secure the AWS environment, individual IAM users should be created for each developer to ensure accountability, and they should be organized into IAM groups to simplify permission management using policies. Additionally, the AWS account root user must be secured with multi-factor authentication (MFA) and restricted from daily use, as it has unrestricted administrative privileges.

Step-by-Step Solution

1
Analyze the security requirements of a development team currently sharing credentials.
Identified the need to establish individual accountability and protect administrative access.
Sharing credentials violates security guidelines and prevents auditing of individual actions.
2
Evaluate identity and access management options for developers.
Determine that creating individual IAM users and using IAM groups simplifies permission management and enforces individual accountability.
This aligns with the principle of least privilege and AWS IAM best practices.
3
Evaluate root account security options.
Determine that the root user should be secured with MFA and not used for daily administration tasks.
The root user has unrestricted access and poses a significant security risk if compromised.

Key Concept

AWS IAM Best Practices for Account Security and User Management
Question 147Question →

An online retail company wants to implement a service that continuously monitors their AWS accounts and workloads for malicious activity and unauthorized behavior. Which AWS service provides this threat detection capability?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides continuous threat detection by monitoring activities across AWS accounts and workloads to find anomalies, unauthorized behavior, or known malicious signatures.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to continuously monitor AWS accounts and workloads for malicious activity and unauthorized behavior.
This helps determine the category of service needed, specifically threat detection.
2
Map the threat detection requirement to the correct AWS service capability.
Amazon GuardDuty is the AWS service that uses machine learning and threat intelligence to identify anomalous and malicious activities.
Matching the service features to the operational requirement confirms the correct choice.

Key Concept

Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity and unauthorized behavior.
Question 148Question →

An educational technology company is preparing for an audit of its online learning platform. The company needs to obtain official AWS compliance documents, such as SOC and PCI reports, and clarify the division of security responsibilities between the company and AWS for their Amazon EC2 instances. Which of the following actions should the company take to meet these compliance requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Download the required compliance reports directly from AWS Artifact; Apply security patches and updates to the guest operating systems of the EC2 instances

Answer

Downloading the required compliance reports directly from AWS Artifact, and applying security patches and updates to the guest operating systems of the EC2 instances.
AWS Artifact is the self-service portal where customers can download AWS compliance reports. Furthermore, under the AWS Shared Responsibility Model, the customer is responsible for guest operating system patching on Amazon EC2 instances.

Step-by-Step Solution

1
Identify the service needed to access and retrieve official AWS compliance documentation, such as SOC or PCI reports.
AWS Artifact is the central portal for downloading these reports.
AWS Artifact provides on-demand access to AWS compliance documentation and reports.
2
Determine the division of responsibility under the Shared Responsibility Model for Amazon EC2 instances.
The customer is responsible for the guest operating system patching and configuration, while AWS is responsible for physical security of data centers.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, giving the customer complete control over the guest OS, including patches.

Key Concept

AWS Artifact provides access to compliance reports, and the Shared Responsibility Model dictates that customers manage guest OS configuration on EC2.
Question 149Question →

A gaming company is launching a new multiplayer game on AWS and must provide its legal team with the official AWS SOC 2 compliance report. Which AWS service provides on-demand access to these security and compliance reports?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact provides on-demand access to AWS security and compliance reports.
AWS Artifact is the primary portal for secure, on-demand compliance reports (such as SOC 2 and PCI reports) and agreements between AWS and its customers. It allows users to download these reports directly from the AWS Management Console.

Step-by-Step Solution

1
Identify the requirement of retrieving official AWS security and compliance reports (such as SOC 2).
Recognized that the legal team needs a formal third-party compliance document concerning AWS infrastructure.
This establishes the goal of finding the AWS service dedicated to compliance document retrieval.
2
Differentiate between the purposes of AWS Artifact, Amazon Inspector, AWS CloudTrail, and AWS Systems Manager.
Identified AWS Artifact as the primary portal for retrieving compliance reports, whereas other services perform security scanning, API logging, or systems management.
This guarantees selecting the correct service that aligns with the compliance and governance objectives.

Key Concept

AWS Artifact provides on-demand access to AWS compliance reports and agreements.
Estimated Time:45s
Question 150Question →

A logistics company is integrating its on-premises inventory server with AWS. The server must automatically upload daily reports to an Amazon S3 bucket. To comply with strict security standards, the company prohibits storing long-term AWS access keys on the physical on-premises server. Which configuration represents the most secure AWS-recommended best practice to grant this access?

Show answer & explanation

Answer: Configure AWS IAM Roles Anywhere on the on-premises server to obtain temporary, short-lived security credentials using local digital certificates.

Answer

Configure AWS IAM Roles Anywhere on the on-premises server to obtain temporary, short-lived security credentials using local digital certificates.
The configuration utilizing AWS IAM Roles Anywhere is correct because it allows on-premises physical hardware to authenticate using local digital certificates (X.509) and assume an IAM role. This process returns temporary, short-lived security credentials (access key, secret key, and session token), successfully eliminating the need to store long-term keys on the server.

Step-by-Step Solution

1
Analyze the security constraints.
The solution must allow the on-premises server to write to Amazon S3 without storing long-term credentials (like IAM access keys) on the physical hardware.
This filters out any options that rely on permanent IAM user access keys or root user access keys.
2
Identify the AWS mechanism for extending roles to non-AWS hardware.
AWS IAM Roles Anywhere is identified as the service designed to grant secure, temporary AWS credentials to on-premises servers using public key infrastructure (PKI) certificates.
IAM Roles allow applications to obtain temporary security credentials dynamically, removing the need for long-term keys.
3
Evaluate alternative methods to ensure they meet security best practices.
Using public S3 buckets with IP filters is rejected as insecure and an abuse of bucket policies.
AWS access should always be authenticated and authorized via IAM policies and temporary credentials where possible.

Key Concept

AWS IAM Roles Anywhere enables on-premises workloads to securely access AWS resources using temporary IAM credentials derived from local X.509 digital certificates, eliminating long-term credentials.

Alternative Method

An alternative method is to register the on-premises server as an AWS Systems Manager (SSM) managed instance using Systems Manager Hybrid Activations, allowing it to assume IAM roles through the SSM Agent.
Estimated Time:2m 0s
Question 151Question →

A company stores its financial documents in an Amazon Simple Storage Service (Amazon S3) bucket. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enabling server-side encryption on the bucket to protect data at rest; Configuring Amazon S3 bucket policies to restrict access to authorized identities

Answer

The customer is responsible for enabling server-side encryption on the bucket and configuring S3 bucket policies to restrict access.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For Amazon S3, this includes managing data encryption configurations (such as enabling server-side encryption) and controlling access to buckets and objects (such as setting up bucket policies and IAM controls).

Step-by-Step Solution

1
Identify the AWS service type and its place in the Shared Responsibility Model.
Amazon S3 is a managed service (Platform-as-a-Service/Object storage), meaning AWS manages the infrastructure, operating system, and hardware, while the customer manages data classification, encryption, and access permissions.
Understanding the boundary between infrastructure management and data configuration helps isolate customer-managed tasks.
2
Analyze each option to determine whether it involves configuring customer data/access or managing physical infrastructure/compliance documents.
Configuring access policies and enabling data encryption are customer configurations (security 'in' the cloud). Managing server hardware, patching physical operating systems, and retrieving physical logs are AWS infrastructure responsibilities.
This isolates the correct options from the distractors based on the security 'in' the cloud versus security 'of' the cloud principle.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon S3, AWS manages the security 'of' the cloud (physical infrastructure, virtualization layer, operating system), while the customer manages security 'in' the cloud (data encryption, access control policies).
Estimated Time:1m 0s
Question 152Question →

A global pharmaceutical firm is validating its drug development systems on Amazon EC2 for GxP (Good Practice) regulatory compliance. The auditors require the firm to provide official documentation of AWS's physical security certifications and verify who is responsible for patching the virtualization hypervisor host operating system. Which combination of actions correctly addresses these requirements?

Show answer & explanation

Answer: Retrieve the compliance reports from AWS Artifact; AWS is responsible for patching the host operating system of the hypervisor.

Answer

Retrieve the compliance reports from AWS Artifact; AWS is responsible for patching the host operating system of the hypervisor.
The correct action is retrieving the compliance reports from AWS Artifact, with AWS being responsible for patching the host operating system of the hypervisor. AWS Artifact is the central portal for accessing AWS's security and compliance documents on-demand. Under the Shared Responsibility Model, the customer is responsible for security 'in' the cloud (such as the guest OS on EC2), whereas AWS is responsible for security 'of' the cloud, which includes the physical servers, virtualization hypervisors, and host operating systems.

Step-by-Step Solution

1
Identify the service for obtaining official AWS compliance certifications and reports.
AWS Artifact is the dedicated self-service portal that provides on-demand access to AWS security and compliance reports (such as ISO certifications and SOC reports).
Auditors require third-party validated reports proving that the physical infrastructure hosting EC2 meets GxP security standards.
2
Determine the boundary of responsibility for patching the host operating system of the hypervisor.
Under the AWS Shared Responsibility Model, AWS is responsible for the infrastructure components, which include physical security, virtualization hypervisors, and the host operating system.
Since customers do not have access to the physical servers or hypervisor layer, AWS must manage and patch the host operating system.

Key Concept

Retrieving AWS compliance documents using AWS Artifact and distinguishing patching responsibilities for host operating systems under the Shared Responsibility Model.
Estimated Time:2m 0s
Question 153Question →

A pharmaceutical company deploys an AWS Outpost in its on-premises data center to comply with local data residency regulations. The IT team is establishing the operational security procedures for this hybrid deployment. Under the AWS Shared Responsibility Model, which two duties remain the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Providing physical security, power, and cooling for the Outpost hardware rack; Configuring security groups and network access control lists (NACLs) to regulate traffic within the virtual private cloud (VPC) on the Outpost

Answer

The customer is responsible for providing physical security, power, and cooling for the Outpost hardware rack, as well as configuring security groups and network access control lists (NACLs) to regulate traffic within the virtual private cloud (VPC) on the Outpost.
For AWS Outposts, because the physical rack is situated inside the customer's premises, the customer is responsible for physical security, power, and cooling. Additionally, the customer retains control over logical security controls in the cloud, such as security groups and network access control lists (NACLs) for virtual network resources.

Step-by-Step Solution

1
Analyze the service deployment model for AWS Outposts.
AWS Outposts is a hybrid service where AWS-managed hardware is installed in a customer-owned physical facility.
Understanding the hybrid nature of AWS Outposts is necessary to identify how the boundary of physical responsibility shifts compared to standard AWS region deployments.
2
Differentiate the physical security responsibilities.
Since the hardware resides in the customer's facility, the customer must manage physical security, power, and cooling, while AWS remains responsible for hardware replacement and maintenance.
This establishes the physical security boundary under the Shared Responsibility Model for AWS Outposts.
3
Differentiate the logical network and infrastructure responsibilities.
AWS manages the hypervisor and Outpost firmware, while the customer manages virtual private cloud (VPC) configurations, including security groups and network ACLs.
This determines which network configurations are handled by the customer.

Key Concept

Shared Responsibility Model for Hybrid Cloud (AWS Outposts)
Question 154Question →

A developer needs to configure a script running on their local workstation to upload log files to an Amazon S3 bucket. Which of the following is the AWS-recommended method to securely authenticate this script?

Show answer & explanation

Answer: Create an IAM user for the developer, generate programmatic access keys, and assign only the necessary permissions to write to the S3 bucket.

Answer

Create an IAM user for the developer, generate programmatic access keys, and assign only the necessary permissions to write to the S3 bucket.
The correct answer is to create an IAM user for the developer, generate programmatic access keys, and assign only the necessary permissions to write to the S3 bucket. This ensures the script uses programmatic credentials with the minimum required privileges, securing the account.

Step-by-Step Solution

1
Identify the authentication requirement
A local script running outside of AWS requires programmatic credentials to interact with AWS APIs.
Before the script can interact with Amazon S3, it must authenticate with AWS to verify its identity and permissions.
2
Apply the principle of least privilege and root user best practices
Avoid using the AWS account root user, and instead create a dedicated IAM user with only the specific S3 write permissions required.
This limits the potential damage if the credentials are compromised, which aligns with AWS security best practices.

Key Concept

AWS IAM Programmatic Access and Least Privilege
Question 155Question →

A retail company wants to continuously monitor its AWS accounts, Amazon EC2 instances, and container workloads for potential security threats, such as instances communicating with known malicious IP addresses or performing unauthorized API calls. The solution must use threat intelligence and machine learning to identify these anomalies. Which AWS service should the company use to meet these requirements?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct choice because it is a dedicated threat detection service that continuously monitors for malicious activity and unauthorized behavior. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as cryptocurrency mining, credential compromise, or communications with known malicious command-and-control servers.

Step-by-Step Solution

1
Identify the primary security requirement.
The requirement is to continuously monitor AWS workloads and accounts for active threats, such as communication with malicious IPs, using threat intelligence and machine intelligence.
This helps distinguish between active threat detection (analyzing behaviors/logs) and vulnerability scanning (identifying static security flaws).
2
Evaluate the capabilities of the available AWS security services.
Amazon GuardDuty uses machine learning and threat intelligence to analyze data sources like VPC Flow Logs, DNS logs, and CloudTrail logs to detect active threats. Amazon Inspector scans for software vulnerabilities. AWS CloudTrail records API calls. AWS Artifact provides compliance reports.
Matching the requirements to the correct service definition ensures the most appropriate service is chosen.

Key Concept

Continuous threat detection using machine learning and threat intelligence in AWS.
Question 156Question →

A financial company is preparing for an external audit of its application running on Amazon EC2 instances. The company needs to restrict network access to the servers and collect compliance reports showing that the underlying AWS physical infrastructure meets industry security standards. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Configuring the security group rules to restrict inbound network traffic to the EC2 instances.

Answer

Configuring the security group rules to restrict inbound network traffic to the EC2 instances.
Under the AWS Shared Responsibility Model, the customer is responsible for configuring security groups (which operate as a firewall at the instance level) to control inbound and outbound traffic to their resources. This is classified as security 'in' the cloud.

Step-by-Step Solution

1
Analyze the customer's requirements in the scenario.
The customer needs to restrict network access to EC2 instances and obtain compliance reports for the physical infrastructure.
Understanding the required tasks is necessary to map them to the correct side of the Shared Responsibility Model.
2
Determine the boundary of responsibility for each task.
Configuring security groups is a customer responsibility (security in the cloud), while physical data center security and hypervisor maintenance are AWS responsibilities (security of the cloud). Compliance reports for the physical infrastructure are retrieved by the customer using AWS Artifact.
This identifies the specific action that falls under the customer's operational duties.

Key Concept

AWS Shared Responsibility Model boundaries for Infrastructure as a Service (IaaS) resources
Estimated Time:1m 30s
Question 157Question →

An online gaming company hosting its multiplayer game servers on Amazon EC2 wants to continuously monitor its AWS accounts for security threats like cryptocurrency mining, unauthorized API calls, and unusual data access patterns. The security team needs an intelligent service that automatically analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS query logs to detect these anomalies. Which AWS service should the company use to meet this objective?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides continuous, intelligent threat detection. It analyzes data sources such as AWS CloudTrail event logs, VPC Flow Logs, and DNS query logs using machine learning and anomaly detection to identify threats like cryptocurrency mining, credential compromise, and communication with malicious servers.

Step-by-Step Solution

1
Analyze the requirements in the scenario
The requirement is to choose an intelligent threat detection service that continuously analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS query logs for active threats (like cryptocurrency mining and unauthorized API activity).
This helps identify which AWS security services are designed for runtime behavioral analysis and log-based threat detection.
2
Evaluate the options against their core functionality
Amazon GuardDuty is the specific AWS service that uses machine learning and threat intelligence to analyze AWS CloudTrail, VPC Flow Logs, and DNS logs. Amazon Inspector focuses on scanning resources for software vulnerabilities, AWS CloudTrail provides only logging without analysis, and AWS Shield Standard provides managed infrastructure-level DDoS protection.
This isolates the correct tool based on service definitions.

Key Concept

Continuous threat detection using Amazon GuardDuty
Estimated Time:1m 15s
Question 158Question →

An organization hosts a web application on Amazon EC2 instances in a public subnet. The security team wants to allow web clients to access the instances over HTTP (port 80) and HTTPS (port 443). However, to prevent data exfiltration, the EC2 instances must be restricted from initiating any outbound connections to the internet, while still allowing them to return responses to client requests. Which of the following configurations are required to achieve this goal? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the Security Group associated with the EC2 instances to allow inbound traffic on TCP ports 80 and 443 from any source, and remove the default outbound rule that allows all traffic.; Configure the Network Access Control List (Network ACL) of the public subnet to allow inbound traffic on TCP ports 80 and 443 from any source, and add an outbound rule allowing TCP traffic to ephemeral ports 1024-65535.

Answer

Configure the Security Group associated with the EC2 instances to allow inbound traffic on TCP ports 80 and 443 from any source, and remove the default outbound rule that allows all traffic. Additionally, configure the Network Access Control List (Network ACL) of the public subnet to allow inbound traffic on TCP ports 80 and 443 from any source, and add an outbound rule allowing TCP traffic to ephemeral ports 1024-65535.
The correct combination involves understanding the stateful nature of Security Groups and the stateless nature of Network ACLs. The Security Group configuration allows inbound HTTP/HTTPS traffic, which automatically permits outbound responses due to state tracking, while removing outbound rules prevents the instances from initiating outbound connections. The Network ACL configuration requires inbound rules for ports 80/443 and outbound rules for the ephemeral ports (1024-65535) to allow return packets, because Network ACLs do not track connection states.

Step-by-Step Solution

1
Analyze the stateful nature of Security Groups.
Since Security Groups operate at the instance level and are stateful, any inbound traffic allowed is automatically permitted to return outbound. Therefore, to allow incoming web traffic while blocking instances from initiating outbound traffic, we must allow inbound ports 80 and 443, and remove the outbound rule that allows all traffic.
This meets the requirement of allowing inbound HTTP/HTTPS requests and return traffic, while preventing the instances from initiating outbound requests.
2
Analyze the stateless nature of Network ACLs.
Network ACLs operate at the subnet boundary and are stateless. This means we must explicitly define rules for both inbound and outbound directions. To allow inbound client traffic, we permit ports 80 and 443. To allow the return traffic back to those clients, we must add an outbound rule permitting traffic to ephemeral ports (1024-65535).
Since Network ACLs do not track connection states, omitting the outbound ephemeral port rule would block the return traffic.

Key Concept

Stateful vs. Stateless network filtering in AWS (Security Groups vs. Network ACLs)
Question 159Question →

A financial company hosts a transaction processing application on Amazon EC2 instances and stores historical data archives in Amazon S3. The security team must implement a security strategy that achieves two goals: first, automatically identifying software package vulnerabilities and unintended network accessibility on the EC2 instances; second, continuously monitoring the AWS accounts and network traffic for active malicious activity, such as brute-force attacks or communication with known malicious command-and-control servers. Which of the following AWS services should be implemented to address these specific security requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector to scan the EC2 instances for software vulnerabilities and unintended network exposure.; Amazon GuardDuty to continuously monitor account activity and network logs for signatures of malicious behavior.

Answer

The correct services are Amazon Inspector and Amazon GuardDuty.
The correct services are Amazon Inspector and Amazon GuardDuty. Amazon Inspector satisfies the first requirement by continuously scanning EC2 instances for software vulnerability packages and mapping network reachability. Amazon GuardDuty satisfies the second requirement by analyzing VPC Flow Logs, DNS logs, and CloudTrail events to identify active threats like brute-force attacks or communication with malicious IP addresses.

Step-by-Step Solution

1
Analyze the requirement for host-level software vulnerability and network reachability scanning on EC2 instances.
Identify Amazon Inspector as the service that automates software package vulnerability scanning and checks for unintended external network paths.
Vulnerability scanning of EC2 operating system packages and network path analysis is the core function of Amazon Inspector.
2
Analyze the requirement for active, intelligent threat detection and anomaly monitoring at the AWS account level.
Identify Amazon GuardDuty as the service that monitors log metadata (VPC Flow Logs, DNS, CloudTrail) to flag malicious communications and brute-force attempts.
Amazon GuardDuty uses machine learning and threat intelligence feeds to actively identify compromised hosts and unauthorized account activity.

Key Concept

AWS threat detection and vulnerability management services function at different layers of the infrastructure, with Amazon Inspector performing software and reachability assessments, while Amazon GuardDuty performs active log-based threat monitoring.
Question 160Question →

A food delivery platform is preparing for an audit and needs to download official AWS compliance documents, such as SOC and PCI DSS reports, while also verifying its security responsibilities. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the required AWS compliance reports directly using AWS Artifact.; Rely on AWS to manage the physical security and environmental compliance of the data center facilities.

Answer

The correct options are the one to download compliance reports using AWS Artifact and the one relying on AWS to manage physical security and environmental compliance.
To meet compliance auditing needs, a customer uses the self-service AWS Artifact portal to download compliance documents (such as SOC and PCI DSS reports). Additionally, under the Shared Responsibility Model, AWS is responsible for security 'of' the cloud, which includes maintaining physical data center security and environmental compliance.

Step-by-Step Solution

1
Identify the service for compliance documentation
AWS Artifact is identified as the correct service to retrieve compliance reports.
AWS Artifact provides on-demand download of AWS compliance documents such as SOC and PCI reports.
2
Determine the shared responsibility boundary for physical data centers
Physical and environmental security is identified as the responsibility of AWS.
AWS is responsible for the security 'of' the cloud, which includes data center physical security.

Key Concept

AWS compliance reports retrieval via AWS Artifact and boundary of physical security in the Shared Responsibility Model.
PreviousPage 8 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 8 | Examkin