Security and Compliance
441 questions
A media streaming company wants to enhance its security posture. The security team needs a solution to achieve two goals: first, they want to continuously monitor their AWS accounts for malicious activity and unauthorized behavior; second, they want to perform automated security assessments on their Amazon EC2 instances to identify software vulnerabilities. Which of the following AWS services should the company use to meet these requirements? (Select two.)
Select all that apply
A financial institution deploying a payment processing application on AWS wants to ensure compliance with the Payment Card Industry Data Security Standard (PCI-DSS). Under the AWS Shared Responsibility Model, which compliance-related task is the sole responsibility of the customer?
A health-tech organization needs to secure its AWS environment to meet compliance standards. The compliance team requires the organization to implement a mechanism that records all historical API activities to identify who made specific configuration changes to security groups, and also run automated scans on their Amazon EC2 instances to check for known software vulnerabilities and package exposures. Which combination of AWS services or responsibility frameworks will meet these requirements?
A startup has just created its first AWS account and wants to secure the account root user. Which of the following actions represent AWS security best practices for protecting the account root user? (Select TWO.)
Select all that apply
A software-as-a-service (SaaS) provider wants to implement Amazon Inspector to enhance the security posture of its application hosting environment. Which of the following tasks can Amazon Inspector perform to assist the provider with vulnerability management? (Select two.)
Select all that apply
A company is developing a new mobile application and decides to store customer profile data in Amazon DynamoDB. Under the AWS Shared Responsibility Model, which of the following tasks is the customer responsible for?
An enterprise wants to allow its employees to log in to the AWS Management Console using their existing corporate credentials managed by an on-premises identity provider. The security team mandates that employees must not have permanent AWS IAM user credentials. Which of the following IAM features or mechanisms should the enterprise use to implement this configuration?
A government transit agency runs a fleet of on-premises database servers and also hosts application servers on Amazon EC2. The agency needs to configure a nightly backup process that uploads database logs to a secured Amazon S3 bucket, while strictly adhering to the principle of least privilege and avoiding the use of long-term credentials on any server. Which TWO of the following configurations represent AWS-recommended security practices for this architecture?
Select all that apply
A retail company has a web application hosted on an Amazon EC2 instance that needs to read and write images to an Amazon S3 bucket. According to AWS security best practices, which of the following is the most secure method to grant the EC2 instance access to the S3 bucket?
A financial services company is setting up AWS access for its newly hired database administrators. The company wants to enforce the principle of least privilege, simplify permissions management as the team grows, and secure individual console access. Which two of the following actions represent recommended AWS Identity and Access Management (IAM) best practices to achieve this?
Select all that apply
A real estate platform is preparing for an external security audit and needs to download official compliance reports, such as ISO certifications and Service Organization Control (SOC) reports, to prove the security of the AWS infrastructure. Which AWS service should the platform use to access these documents?
A digital healthcare startup plans to host a patient telemetry application on AWS. To meet regulatory requirements, the startup needs to obtain the AWS ISO 27001 certification, accept the HIPAA Business Associate Addendum (BAA), and ensure that database records are encrypted. Which of the following actions should the startup take to meet these compliance and governance requirements? (Select TWO.)
Select all that apply
A media streaming company uses Amazon CloudFront to distribute video files to global users. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of AWS?
Select all that apply
A gaming studio wants to automatically identify software vulnerabilities and unintended network exposure on its Amazon EC2 instances. Which AWS service should the studio use to perform these security assessments?
A university is migrating its legacy student registration database to AWS. The database runs on Amazon EC2 instances within a private subnet of a Virtual Private Cloud (VPC). The security team has established two strict requirements:
1. Automatically deny all network traffic originating from a specific list of blacklisted external IP ranges at the subnet boundary.
2. Allow inbound database connections to the database instances on port 1521, while relying on the firewall's stateful behavior to automatically permit the returning outbound database traffic without requiring any explicit outbound rules.
Which of the following security configurations should the university implement to meet these requirements? (Select TWO.)
Select all that apply
A financial services company is hosting a payment processing application on Amazon EC2 instances inside a private subnet. The instances must initiate outbound HTTPS connections (port 443) to an external payment gateway API and receive the responses. The security team requires that network access controls be configured at both the subnet boundary and the instance level. Which two configuration steps must the cloud practitioner take to allow this traffic while maintaining a secure architecture? (Select TWO.)
Select all that apply
A hospitality booking portal hosts its application on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (ECR). The security team wants to continuously monitor their AWS accounts for malicious activity and unauthorized behavior, while also automatically scanning the EC2 instances and container images for software vulnerabilities.
Which two AWS services should the company use to meet these requirements? (Select two.)
Select all that apply
A technology company wants to delegate administrative capabilities by allowing department leads to create and manage IAM roles for their developers. To maintain strict security, the central security team must ensure that these department leads cannot grant permissions that exceed a predefined set of allowed services, even if they create policies with administrator access. Which AWS Identity and Access Management (IAM) feature should the security team implement to enforce this maximum permission limit?
A non-profit organization is setting up its donation portal on AWS and wants to continuously monitor its AWS accounts and workloads for malicious activity, such as unauthorized API calls or potential cryptocurrency mining. Which AWS service should the organization use to detect these threats?
A global travel booking company is preparing for a security audit. The company needs to retrieve AWS compliance documentation, such as SOC reports, and also ensure that their stored customer databases are encrypted. Which of the following actions should the company perform to satisfy these compliance needs? (Select TWO.)
Select all that apply