Examkin

Security and Compliance

162 questions

All types162Multiple choice83Multiple select79
Question 1Question →

A SysOps administrator is launching a new Amazon EC2 instance that must run an application that accesses an Amazon S3 bucket. An IAM role with the necessary S3 permissions has already been created. The administrator needs to configure the EC2 instance to run the application using this role.

Which two actions are required to successfully complete this configuration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate the IAM role with an instance profile, and attach the instance profile to the EC2 instance.; Ensure the administrator's IAM user identity is granted the iam:PassRole permission for the specific IAM role.

Answer

The correct actions are associating the IAM role with an instance profile to attach it to the EC2 instance, and ensuring the administrator's IAM user identity has the iam:PassRole permission.
To configure an EC2 instance to run an application with specific IAM permissions, you must wrap the IAM role inside an instance profile and attach it to the EC2 instance. Furthermore, the administrator who performs this attachment must possess the iam:PassRole permission to authorize passing the role to the EC2 service.

Step-by-Step Solution

1
Determine how roles are attached to EC2 instances.
EC2 instances require an instance profile wrapper to hold the IAM role.
The EC2 service uses instance profiles to pass role credentials to the instance's metadata service.
2
Determine the required user permissions for delegating the role.
The user launching or configuring the instance must have the iam:PassRole permission.
To prevent unauthorized delegation of administrative privileges, AWS requires that users have explicit permission to pass roles to services.

Key Concept

Delegating AWS permissions to EC2 instances using Instance Profiles and the iam:PassRole permission
Question 2Question →

A SysOps Administrator is configuring an AWS Lambda function in AWS Account 555555555555555555555555 to decrypt sensitive application configuration files. The configuration files are encrypted using a customer managed KMS key. The Administrator has attached an IAM policy to the Lambda function's execution role that grants permission for the `kms:Decrypt` action on the KMS key. However, when executing, the Lambda function fails with an AccessDeniedException during the decryption step.

Upon inspecting the KMS key policy, the Administrator finds only the following statement:

{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::555555555555:role/SysOpsAdminRole"
},
"Action": "kms:*",
"Resource": "*"
}

Which modification to the KMS key policy will resolve this issue by allowing the Lambda function's IAM policy to take effect?

Show answer & explanation

Answer: Add a statement to the KMS key policy that grants the root user of account 555555555555555555555555 (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).

Answer

Add a statement to the KMS key policy that grants the root user of the account (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).
In AWS KMS, for IAM policies to grant access to a customer managed key, the key policy must contain a statement that delegates authority to the AWS account. This is typically done by granting the root user principal (`arn:aws:iam::account-id:root`) permission to perform actions on the key. Once this statement is present, AWS evaluates both the key policy and the IAM policies. Since the Lambda execution role already has an IAM policy allowing `kms:Decrypt`, adding the account root principal statement to the key policy resolves the AccessDeniedException.

Step-by-Step Solution

1
Analyze the existing configurations of the Lambda execution role and the KMS key policy.
The Lambda role contains a policy granting `kms:Decrypt`. However, the KMS key policy only lists a specific administrator role (`SysOpsAdminRole`) and does not grant the account root principal permission to manage permissions via IAM.
By default, KMS key policies must explicitly delegate permission authority to the AWS account for any IAM policies within that account to have effect on the key.
2
Identify the standard delegation statement required in KMS key policies.
The statement must target the AWS account root principal (`arn:aws:iam::555555555555:root`) and grant `kms:*` permissions.
This configuration establishes the link between the key policy and IAM policies, allowing AWS to evaluate IAM policies for roles or users attempting to access the key.
3
Select the option that implements this configuration.
Adding a statement to the key policy that permits the account root user enables evaluation of the Lambda function's execution role policy, resolving the AccessDeniedException.
Once the root user is added to the key policy, the Lambda execution role's policy is successfully evaluated, granting the necessary decryption permissions.

Key Concept

AWS KMS Key Policy Delegation to IAM
Question 3Question →

An administrator wants to implement automatic remediation for non-compliant resources detected by an AWS Config rule. The rule identifies Amazon S3 buckets that allow public read access. The administrator plans to use the `AWS-DisableS3BucketPublicReadWrite` Systems Manager (SSM) Automation document as the remediation action. During configuration, the administrator encounters permission errors and the remediation fails to run.

Which actions must the administrator take to successfully resolve the permission issues and enable the automated remediation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an IAM execution role with a trust policy that allows the ssm.amazonaws.com service principal to assume it, and attach policies granting permissions to modify S3 bucket settings.; Grant iam:PassRole permissions for the Systems Manager execution role to the IAM identity configuring the AWS Config remediation action.

Answer

The administrator must configure an IAM execution role with a trust policy that allows the ssm.amazonaws.com service principal to assume it (with permissions to modify S3 settings), and grant the iam:PassRole permission for the execution role to the IAM identity configuring the remediation.
To remediate non-compliant resources automatically via AWS Config and Systems Manager Automation, two requirements must be satisfied. First, a role assumed by Systems Manager (ssm.amazonaws.com) must exist and have permissions to perform the corrective actions on S3. Second, the user or service principal initiating the automation setup must possess the iam:PassRole permission to pass this execution role to Systems Manager.

Step-by-Step Solution

1
Create an IAM role for Systems Manager execution.
An IAM role is created with a trust relationship for ssm.amazonaws.com and a policy allowing the required S3 bucket configuration changes.
Systems Manager needs permissions to perform the actual remediation steps on S3 buckets.
2
Assign the PassRole permission to the configuring administrator.
The administrator has iam:PassRole permission explicitly defined for the target execution role ARN in their IAM policy.
This permission allows the administrator to pass the Systems Manager execution role to the service for performing remediation actions.

Key Concept

AWS Config automated remediation using Systems Manager Automation documents requires configuring service trust relationships and granting the administrator iam:PassRole permissions to delegate roles to the service.
Question 4Question →

A SysOps Administrator is securing a customer managed KMS key in the us-west-2 Region that is used to encrypt Amazon Elastic Block Store (EBS) volumes. The administrator wants to enforce the following security requirements:
- Users in the AWS account must be able to administer the key (such as enabling rotation or updating policies) using IAM policies.
- The key must only be allowed to encrypt and decrypt EBS volumes when the request is made by Amazon EC2 on behalf of a user, preventing direct API calls using the AWS CLI or SDKs.

Which two actions must the administrator take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Include a statement in the KMS key policy that grants `kms:*` permissions to the account's root principal (`arn:aws:iam::111122223333:root`).; Add a condition to the KMS key policy's cryptographic operations statement that specifies `"StringEquals": { "kms:ViaService": "ec2.us-west-2.amazonaws.com" }`.

Answer

The administrator must add a statement to the KMS key policy that grants `kms:*` permissions to the account's root principal (`arn:aws:iam::111122223333:root`) and add a condition to the KMS key policy's cryptographic operations statement specifying `"kms:ViaService": "ec2.us-west-2.amazonaws.com"`.
To allow IAM policies to manage the key, the KMS key policy must delegate administrative permissions to the root principal of the AWS account. Additionally, to restrict key usage to EBS volume operations while blocking direct API calls, the key policy must include a condition restricting requests to the EC2 service in the appropriate Region using the `kms:ViaService` condition key set to `ec2.us-west-2.amazonaws.com`.

Step-by-Step Solution

1
Enable IAM policy delegation in the KMS key policy.
Allows IAM policies attached to users and roles within the account to control access permissions for the KMS key.
By default, a KMS key is only manageable via its key policy unless it explicitly grants permissions to the account root principal.
2
Add the `kms:ViaService` condition to the key policy for cryptographic operations.
Restricts key usage to requests made by specified AWS services on behalf of the user.
This prevents users from performing direct decrypt/encrypt actions via the CLI/SDK, forcing the requests to go through EC2 when attaching the EBS volume.
3
Set the service principal to `ec2.us-west-2.amazonaws.com`.
Ensures the restriction correctly matches EBS operations in the us-west-2 Region.
EBS uses the EC2 service endpoint under the hood for volume attachment and encryption.

Key Concept

KMS key policies control authorization, and IAM policies can only manage a KMS key if the key policy explicitly delegates authority to the account root principal. The `kms:ViaService` condition key restricts KMS key usage to requests coming from specific AWS services.
Question 5Question →

An application running on an Amazon EC2 instance in Account B (444455556666) needs to decrypt sensitive files stored in an Amazon S3 bucket in Account A (111122223333). The files in the S3 bucket are encrypted using Server-Side Encryption with AWS KMS (SSE-KMS) and a customer managed KMS key in Account A. The KMS key currently has the following key policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

An IAM role named AppRole is attached as the instance profile for the EC2 instance in Account B. Which TWO configurations are required to allow AppRole in Account B to decrypt the objects in the S3 bucket? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the KMS key policy in Account A to allow the IAM role AppRole in Account B to perform the kms:Decrypt action.; Attach an IAM policy to the IAM role AppRole in Account B that allows the kms:Decrypt action on the KMS key ARN in Account A.

Answer

To configure cross-account decryption, update the KMS key policy in Account A to grant permission to the external role, and attach an IAM policy to the role in Account B allowing decryption on the key ARN.
To establish cross-account access to a customer managed KMS key, permissions must be granted on both sides. The key policy of the KMS key in Account A must be configured to trust the external role (or Account B's root principal), and the IAM policy attached to the EC2 instance role in Account B must allow the kms:Decrypt action on the ARN of the KMS key in Account A. Together, these two configurations authorize the cross-account decryption request.

Step-by-Step Solution

1
Review the requirements for cross-account AWS KMS key access.
Identify that cross-account access requires permissions to be granted in both the KMS key policy of the owning account and the IAM policy of the calling account.
AWS KMS requires explicit authorization from both the key owner and the caller's account when requests cross AWS accounts.
2
Update the KMS key policy in Account A (the key owner).
Add a statement to the key policy that permits the external IAM role (arn:aws:iam::444455556666:role/AppRole) to perform the kms:Decrypt action.
The customer managed key policy must trust the external identity before Account B can delegate or use the key.
3
Attach an IAM policy to the EC2 instance role in Account B (the caller).
Add a policy allowing the kms:Decrypt action on the target key's ARN in Account A.
The caller's identity must be explicitly permitted by its own account's IAM policy to access the external key resource.

Key Concept

Cross-account AWS KMS access requires configuring both the KMS key policy in the source account to trust the destination principal, and an IAM policy in the destination account to permit the caller to use the external KMS key.
Question 6Question →

A SysOps Administrator is configuring an AWS Config rule to monitor whether Amazon EC2 instances have public IP addresses. The administrator sets up automatic remediation using the AWS-StopEC2Instance Systems Manager (SSM) Automation document. The administrator creates an IAM role named ConfigRemediationRole that has a trust relationship with ssm.amazonaws.com and has the necessary permissions to stop EC2 instances. When the administrator attempts to associate this role with the AWS Config remediation configuration, the AWS Config console displays an error: 'Insufficient permissions to pass the remediation role.' Which action will resolve this issue?

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.
The correct answer is to grant the administrator the iam:PassRole permission. When configuring AWS services to act on your behalf using an IAM role, your IAM identity (user or role) must be authorized to pass that role. Without this permission, the AWS Config console and API prevent you from completing the configuration to protect against unauthorized privilege escalation.

Step-by-Step Solution

1
Identify the role delegation flow in AWS Config automated remediation.
AWS Config uses AWS Systems Manager (SSM) Automation to execute remediation. The user configuring this setup must pass an IAM execution role to the SSM service.
Understanding the service interaction helps pinpoint which permissions are required for the configuration step.
2
Analyze the error message 'Insufficient permissions to pass the remediation role'.
The error explicitly indicates a failure in the iam:PassRole authorization check for the administrator's identity.
When an AWS service or user associates an IAM role with a service, the user's IAM identity must be explicitly authorized to pass that role.
3
Determine the correct policy configuration to authorize role passage.
Attach a policy with iam:PassRole to the administrator's IAM user or role, targeting the ARN of ConfigRemediationRole.
This grants the administrator the necessary privilege to complete the configuration of the automated remediation.

Key Concept

AWS Config automated remediation and IAM role delegation (iam:PassRole requirements)
Question 7Question →

A SysOps administrator is configuring a Python script hosted on an Amazon EC2 instance in Account A (111111111111111111111111) to automate the provisioning of temporary worker instances. The script uses the AWS SDK to call the `RunInstances` API and associates the new instances with an IAM instance profile that contains an IAM role named `WorkerExecutionRole`.

The EC2 instance running the script is associated with an IAM role named `AutomationAdminRole` which has the following IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:DescribeInstances"
],
"Resource": "*"
}
]
}

When the script execution is triggered, it fails with an `UnauthorizedOperation` error during instance launch.

Which modification to the IAM configuration of `AutomationAdminRole` is required to resolve this error?

Show answer & explanation

Answer: Add a statement to the IAM policy of AutomationAdminRole that allows the iam:PassRole action on the WorkerExecutionRole resource.

Answer

Add a statement to the IAM policy of AutomationAdminRole that allows the iam:PassRole action on the WorkerExecutionRole resource.
The correct action is to add the iam:PassRole permission to the policy of the calling role (AutomationAdminRole) targeting the IAM role resource (WorkerExecutionRole). This allows the script running under AutomationAdminRole to associate WorkerExecutionRole with the new EC2 instances during the RunInstances API call.

Step-by-Step Solution

1
Analyze the IAM identities involved in the script execution.
The script runs under the AutomationAdminRole identity and attempts to associate a new EC2 instance with the WorkerExecutionRole.
Identifying the active identity and the target role resource determines where the permission must be applied.
2
Identify the root cause of the provisioning error.
The script attempts to pass the WorkerExecutionRole to the EC2 service during the RunInstances call, which requires the iam:PassRole permission.
AWS requires explicit permission to pass an IAM role to an AWS service to prevent unauthorized privilege escalation.
3
Update the execution role's permissions policy.
Modify the policy attached to AutomationAdminRole to include the iam:PassRole action targeting the WorkerExecutionRole's Amazon Resource Name (ARN).
This satisfies the authorization check performed when the RunInstances call attempts to assign the role.

Key Concept

Using iam:PassRole to delegate permissions to AWS resources via service roles and instance profiles.
Question 8Question →

A SysOps administrator is configuring a third-party monitoring application running on Amazon EC2 instances in a Shared Services account (333333333333333333333333). The application needs to analyze logs stored in an Amazon S3 bucket within a Production account (444444444444444444444444). The S3 bucket is encrypted with an AWS KMS Customer Managed Key (CMK) in the Production account. The application runs under an IAM instance profile associated with a role named `EC2MonitorRole` in the Shared Services account, and it must assume an IAM role named `CrossAccountReaderRole` in the Production account to read the S3 objects. Which of the following configuration steps are required to establish this cross-account access? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Modify the trust policy of the `CrossAccountReaderRole` in the Production account (444444444444444444444444) to allow the `sts:AssumeRole` action for the `arn:aws:iam::333333333333:role/EC2MonitorRole` principal.; Attach a permissions policy to the `EC2MonitorRole` in the Shared Services account (333333333333333333333333) that allows the `sts:AssumeRole` action on `arn:aws:iam::444444444444:role/CrossAccountReaderRole`.

Answer

Modify the trust policy of the target role in the Production account to trust the source role, and attach an IAM policy to the source role allowing it to assume the target role.
Establishing cross-account access requires configuring permissions on both sides of the trust boundary. First, the source role must have permissions to initiate the assume-role request. Second, the target role's trust policy must list the source role as a trusted principal to allow the request.

Step-by-Step Solution

1
Determine the delegation mechanism for cross-account access.
The EC2 instance profile's role (EC2MonitorRole) in the Shared Services account must call AWS STS to assume the target role (CrossAccountReaderRole) in the Production account.
This establishes a security boundary where temporary credentials are used to access the destination account's resources.
2
Configure the trust relationship on the target role.
The target role (CrossAccountReaderRole) trusts the source role (EC2MonitorRole) as a principal for the sts:AssumeRole action.
The target account must explicitly authorize which external entities are allowed to assume its roles.
3
Configure permissions on the source role.
The source role (EC2MonitorRole) is granted permission to perform sts:AssumeRole on the target role's ARN.
The source account's IAM policies must allow the identity to make the outbound sts:AssumeRole API call.

Key Concept

Cross-account trust delegation using IAM roles and AWS STS.
Question 9Question →

A SysOps administrator is using Amazon S3 Batch Operations to copy a large volume of objects from a source S3 bucket to a destination S3 bucket. The administrator creates an IAM role named S3BatchCopyRole to allow S3 Batch Operations to perform the copy on their behalf. The trust policy of S3BatchCopyRole is configured to allow the batchoperations.s3.amazonaws.com service principal to assume the role. However, when the administrator attempts to create the S3 Batch Operations job and specifies S3BatchCopyRole, the operation fails with an Access Denied error. The administrator's IAM user already has an attached policy granting full permissions to S3 (s3:*). Which action must be taken to successfully create the S3 Batch Operations job?

Show answer & explanation

Answer: Add a policy statement to the administrator's IAM user policy that allows the iam:PassRole action on the S3BatchCopyRole resource.

Answer

Add a policy statement to the administrator's IAM user policy that allows the iam:PassRole action on the S3BatchCopyRole resource.
The correct action is to grant the administrator the iam:PassRole permission on the S3BatchCopyRole resource. When creating resources or jobs that run using a service role, AWS requires the initiating user to have permission to delegate (pass) that role to the service, preventing unauthorized privilege escalation.

Step-by-Step Solution

1
Analyze the error context and identify the workflow.
An administrator is attempting to pass a service role (S3BatchCopyRole) to S3 Batch Operations to execute actions on their behalf.
When configuring AWS services to act on behalf of a user, the user's IAM identity must possess permission to pass the role.
2
Differentiate between iam:PassRole and sts:AssumeRole permissions.
The service principal (batchoperations.s3.amazonaws.com) requires sts:AssumeRole (configured in the role's trust policy), whereas the user configuring the service job requires iam:PassRole.
This prevents unauthorized users from configuring services with highly privileged roles that they themselves do not have access to.
3
Determine the necessary policy addition for the administrator.
Add an IAM policy granting 'iam:PassRole' on the target ARN of S3BatchCopyRole to the administrator's IAM user or group.
This permits the administrator to associate the role with the S3 Batch Operations job, resolving the Access Denied error.

Key Concept

IAM PassRole Permission
Question 10Question →

A SysOps Administrator is implementing a security monitoring solution to detect whenever an AWS Identity and Access Management (IAM) access key is created or updated. The administrator configures an Amazon EventBridge rule in the eu-west-1 region with an Amazon Simple Notification Service (Amazon SNS) topic as the target. Although IAM access keys are being created and updated, the security team is not receiving any SNS notifications. Which of the following configurations should the SysOps Administrator implement to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Recreate the Amazon EventBridge rule in the us-east-1 (US East (N. Virginia)) region.; Ensure that an active AWS CloudTrail trail is configured to capture global service events.

Answer

Recreate the Amazon EventBridge rule in the us-east-1 region and ensure that an active AWS CloudTrail trail is configured to capture global service events.
Because IAM is a global AWS service, all of its API activities are processed and logged in the us-east-1 region. To monitor these activities in real time using Amazon EventBridge, the EventBridge rule must be created in the us-east-1 region. In addition, EventBridge relies on AWS CloudTrail logs to detect AWS API call events; hence, an active CloudTrail trail must be configured to log global service events.

Step-by-Step Solution

1
Determine the regional scope of the AWS service being monitored.
IAM is a global service whose API endpoints reside in the us-east-1 region.
This determines where the API call events are delivered and processed.
2
Identify the event source for API detection in Amazon EventBridge.
EventBridge uses CloudTrail logs to detect API calls via the 'AWS API Call via CloudTrail' event source.
CloudTrail must be active and logging global events for EventBridge to trigger.
3
Verify target configuration and rule requirements.
EventBridge rules targeting SNS do not require iam:PassRole permissions.
This rules out standard IAM delegation misconfigurations.

Key Concept

Monitoring global service events with EventBridge and CloudTrail
Question 11Question →

A SysOps administrator has the following IAM policy attached to their IAM user:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EC2LaunchPermissions",
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:AssociateIamInstanceProfile"
],
"Resource": "*"
}
]
}

The administrator attempts to launch an Amazon EC2 instance and associate it with an existing IAM role named `WebServerRole` by running the following AWS CLI command:

`aws ec2 run-instances --image-id ami-0c55b159cbfafe1f0 --instance-type t3.micro --iam-instance-profile Name=WebServerProfile`

The command fails with the following error message:
`An error occurred (UnauthorizedOperation) when calling the RunInstances operation: User: arn:aws:iam::123456789012:user/AdminUser is not authorized to perform: iam:PassRole on resource: arn:aws:iam::123456789012:role/WebServerRole`

What modification should the administrator make to their user's IAM policy to successfully run the command?

Show answer & explanation

Answer: Add a statement to the user's IAM policy that allows the iam:PassRole action with the resource set to the ARN of the WebServerRole.

Answer

Add a statement to the user's IAM policy that allows the iam:PassRole action with the resource set to the ARN of the WebServerRole.
To launch an EC2 instance with an IAM role, the administrator must have permission to associate that role with the instance. This is governed by the iam:PassRole permission. Adding a statement to the user's policy allowing the iam:PassRole action on the WebServerRole ARN grants this permission.

Step-by-Step Solution

1
Identify the missing permission from the CLI error message.
The error message explicitly states that the user is not authorized to perform the iam:PassRole action on the WebServerRole resource.
Before an AWS service like EC2 can assume an IAM role, the user setting up the resource must possess permission to pass that role to the service.
2
Add the required permission to the administrator's IAM policy.
The iam:PassRole action is added, targeting the specific ARN of the WebServerRole.
This grants the administrator the client-side privilege to delegate the WebServerRole to the EC2 instance.

Key Concept

Delegating permissions to AWS services using the iam:PassRole action
Question 12Question →

An enterprise monitoring system runs on an Amazon EC2 instance in Subnet Management (10.50.10.0/2410.50.10.0/24). It needs to scrape metrics from a Node Exporter service running on EC2 instances in Subnet Production (10.50.20.0/2410.50.20.0/24) on custom TCP port 91009100. Subnet Production is associated with a custom Network Access Control List (NACL) that currently blocks all inbound and outbound traffic by default.

Which combination of rules must be added to the Subnet Production NACL to allow the monitoring server to scrape metrics? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An inbound rule allowing TCP traffic from 10.50.10.0/2410.50.10.0/24 on destination port 91009100; An outbound rule allowing TCP traffic to 10.50.10.0/2410.50.10.0/24 on destination ports 1024−655351024-65535

Answer

The correct combination of rules requires an inbound rule allowing TCP traffic from the Management subnet on destination port 91009100, and an outbound rule allowing TCP traffic to the Management subnet on destination ports 1024−655351024-65535.
The correct combination consists of an inbound rule allowing TCP traffic from 10.50.10.0/2410.50.10.0/24 on destination port 91009100 and an outbound rule allowing TCP traffic to 10.50.10.0/2410.50.10.0/24 on destination ports 1024−655351024-65535. The inbound rule is necessary because the monitoring client initiates a request to the Node Exporter on port 91009100. The outbound rule is necessary because NACLs are stateless, meaning return traffic must be explicitly permitted. Response packets are sent back to the client's ephemeral port range (1024−655351024-65535).

Step-by-Step Solution

1
Analyze the direction and ports of the initial request.
The monitoring server in Subnet Management (10.50.10.0/2410.50.10.0/24) initiates a connection to the Node Exporter in Subnet Production (10.50.20.0/2410.50.20.0/24) on destination port 91009100. This requires an inbound rule in the Production subnet's NACL to permit TCP traffic from 10.50.10.0/2410.50.10.0/24 on port 91009100.
NACL rules are applied at the subnet boundary and must permit traffic entering the subnet.
2
Determine the return path port requirements.
The client (monitoring server) uses a random ephemeral port (typically 1024−655351024-65535) as the source port for the request. When the Node Exporter replies, the response packets will have the destination port set to this ephemeral port.
Standard TCP client-server communication uses client-side ephemeral ports for return traffic.
3
Configure the stateless outbound rule.
Because NACLs are stateless and do not automatically track connections, an outbound rule must be added to the Production subnet's NACL allowing TCP traffic to 10.50.10.0/2410.50.10.0/24 on destination ports 1024−655351024-65535.
Outbound return traffic would otherwise be dropped by the default deny rule of the stateless NACL.

Key Concept

Network Access Control Lists (NACLs) are stateless packet filters that require explicit rules for both inbound and outbound traffic directions, including ephemeral ports for response traffic.
Question 13Question →

A SysOps administrator is configuring an Amazon ECS task to run on an Amazon EC2 instance. The task must read data from an Amazon S3 bucket. The administrator creates an IAM role named ECSTaskS3AccessRole with an attached policy that allows S3 read access.

The trust policy for ECSTaskS3AccessRole is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the administrator attempts to run the task using the AWS CLI under the SysOpsAdmin IAM user identity, the command fails with the following error:
`ClientError: An error occurred (AccessDenied) when calling the RunTask operation: User: arn:aws:iam::123456789012:user/SysOpsAdmin is not authorized to perform: iam:PassRole on resource: arn:aws:iam::123456789012:role/ECSTaskS3AccessRole`

Which of the following actions are required to resolve this error and ensure the ECS task can successfully run with the required permissions? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add an IAM policy statement to the SysOpsAdmin user that allows the iam:PassRole action targeting the ECSTaskS3AccessRole resource ARN.; Update the trust policy of the ECSTaskS3AccessRole to list ecs-tasks.amazonaws.com as the trusted service principal instead of ecs.amazonaws.com.

Answer

To resolve the error, the administrator must add an IAM policy statement to the SysOpsAdmin user allowing the iam:PassRole action on the role, and update the role's trust policy to use the ecs-tasks.amazonaws.com service principal.
To run an Amazon ECS task with an IAM role, the user performing the action must have the iam:PassRole permission to pass the role to the ECS service. Additionally, the trust policy of the role must trust the ECS tasks service principal (ecs-tasks.amazonaws.com) to assume the role. Therefore, adding an IAM policy statement allowing iam:PassRole to the SysOpsAdmin user and updating the trust policy to use ecs-tasks.amazonaws.com are both required.

Step-by-Step Solution

1
Identify the missing user permission
The error output explicitly states that the SysOpsAdmin user is not authorized to perform iam:PassRole on the role resource.
When launching an ECS task that uses a task role, AWS requires the calling user to have permission to pass that role to the service.
2
Grant the iam:PassRole permission
Add an identity-based policy statement to the SysOpsAdmin user containing Effect: Allow, Action: iam:PassRole, and Resource: arn:aws:iam::123456789012:role/ECSTaskS3AccessRole.
This authorizes the administrator to associate the role with the ECS task.
3
Correct the service trust relationship principal
Modify the 'Service' field in the role's trust policy from 'ecs.amazonaws.com' to 'ecs-tasks.amazonaws.com'.
The 'ecs.amazonaws.com' principal is for the core ECS service (e.g., managing instances/services), whereas ECS containers running tasks require the 'ecs-tasks.amazonaws.com' principal to assume the task role.

Key Concept

IAM PassRole permissions and service trust relationships for ECS tasks
Question 14Question →

A company hosts an API on Amazon EC2 instances behind an Application Load Balancer (ALB), which is protected by an AWS WAF Web ACL. A SysOps administrator notices that legitimate API clients receive HTTP 403 Forbidden responses when uploading payload files larger than 64 KB64\text{ KB}. The AWS WAF logs indicate that these requests are blocked by a custom rule designed to inspect the request body for SQL injection (SQLi) attacks. The administrator needs to ensure that clients can upload large payloads while maintaining SQLi threat protection on the inspectable portion of the request body. Which configuration change should the administrator implement to meet these requirements?

Show answer & explanation

Answer: Modify the custom SQLi rule and set the request body oversize handling setting to Continue.

Answer

Modify the custom SQLi rule and set the request body oversize handling setting to Continue.
Setting the request body oversize handling to 'Continue' allows AWS WAF to inspect the request up to the maximum inspectable size (which is 64 KB64\text{ KB} for Application Load Balancers) and evaluate it against the rule. The rest of the payload is ignored by this specific rule, but the request itself is not automatically blocked, allowing legitimate large uploads to proceed.

Step-by-Step Solution

1
Analyze the AWS WAF logs to identify why requests exceeding 64 KB64\text{ KB} are blocked.
The logs confirm the custom SQL injection (SQLi) rule is blocking the requests because the body size exceeds the WAF inspection limit for Application Load Balancers.
Before making changes, the administrator must verify which specific rule and limit are triggering the block.
2
Locate the custom SQLi rule in the Web ACL configuration and evaluate its oversize handling setting.
The rule's oversize handling is set to Match or Block, causing any request exceeding the 64 KB64\text{ KB} body limit to be treated as a match and blocked.
By default, if oversize handling is not set to Continue, WAF will block requests that exceed the inspectable size limit when the rule action is set to Block.
3
Update the oversize handling configuration of the custom SQLi rule to Continue.
AWS WAF will now inspect the first 64 KB64\text{ KB} of the request body for SQLi threats and allow the request to proceed without evaluating the remainder of the payload.
This configuration meets the requirement to allow large uploads while maintaining security inspection on the first part of the payload.

Key Concept

AWS WAF Body Inspection Limits and Oversize Handling
Estimated Time:1m 30s
Question 15Question →

A company has an AWS Lambda function that needs to decrypt data using a customer managed KMS key in the same AWS account. A SysOps Administrator has attached an IAM policy to the Lambda execution role that allows the `kms:Decrypt` action on the KMS key. However, when the Lambda function runs, it fails with an `AccessDeniedException` error during the decryption operation. The customer managed KMS key policy contains only the following statement:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
"
}
]
}

Which modification to the configuration will resolve this error?

Show answer & explanation

Answer: Modify the KMS key policy to include a statement that grants the root account principal (`arn:aws:iam::123456789012:root`) permissions for KMS actions, thereby enabling the Lambda execution role's IAM policy to take effect.

Answer

Modify the KMS key policy to include a statement that grants the root account principal permissions for KMS actions, enabling the Lambda execution role's IAM policy to take effect.
The correct answer explains that the key policy must grant the root account principal access to the key. In AWS KMS, a customer managed key policy must explicitly delegate authorization control to the AWS account to make identity-based IAM policies effective. Adding this statement allows the Lambda execution role's IAM policy to grant the decryption permission.

Step-by-Step Solution

1
Analyze the customer managed key policy and the identity-based IAM policy on the execution role.
The Lambda function's execution role has an IAM policy allowing `kms:Decrypt`, but the KMS key policy lacks a statement enabling IAM delegation (specifically, a statement permitting the root principal of the account `arn:aws:iam::123456789012:root`).
Identify the cause of the authorization failure by checking the KMS evaluation order, which requires the key policy to explicitly authorize the caller or delegate authorization to the AWS account.
2
Determine the necessary change in the KMS key policy to enable IAM policy authorization.
Adding a statement to the customer managed key policy that grants the root principal (`arn:aws:iam::<AccountID>:root`) access to the key will allow IAM policies in the same account to grant KMS permissions.
Without this root delegation statement, any identity-based IAM policy trying to grant permissions to the customer managed key will be ignored.
3
Select the correct option that specifies root delegation in the key policy.
The option describing the addition of a statement to grant the root principal access is selected.
This configuration enables the Lambda execution role's identity-based policy to successfully authorize the decryption action.

Key Concept

By default, customer managed KMS keys are governed strictly by their key policies. To allow identity-based IAM policies in the same account to grant access to the key, the key policy must contain a statement that grants the account's root principal (`arn:aws:iam::<account-id>:root`) permission to perform KMS actions. If this root delegation statement is missing, all identity-based policies granting access to that key will be ignored, resulting in an AccessDeniedException.
Question 16Question →

A SysOps Administrator is configuring an AWS CodeBuild project to decrypt sensitive environment variables retrieved from AWS Systems Manager Parameter Store. The parameters are encrypted with a customer managed KMS key in AWS Account `111122223333`. The administrator has already added `kms:Decrypt` and `kms:DescribeKey` permissions to the CodeBuild service role's IAM policy.

The customer managed KMS key has the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow direct access to key administrators",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/KMSAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

When CodeBuild attempts to decrypt the parameters, the build fails with an Access Denied error.

Which of the following modifications will resolve this issue?

Show answer & explanation

Answer: Add a statement to the KMS key policy that grants the AWS account root principal (arn:aws:iam::111122223333:root) permission to perform kms:* actions, which allows IAM policies in the account to delegate key permissions.

Answer

Add a statement to the KMS key policy that grants the AWS account root principal (arn:aws:iam::111122223333:root) permission to perform kms:* actions, which allows IAM policies in the account to delegate key permissions.
In AWS KMS, the key policy is the primary controller of access. For IAM policies in the same account to grant access to a KMS key, the key policy must contain a statement that enables IAM policies. This is typically achieved by granting the AWS account root principal (arn:aws:iam::111122223333:root) permissions to perform KMS actions (kms:*). Since the current key policy only allows administrative actions for the KMSAdminRole and does not have the default delegation statement for the account root, the CodeBuild role's IAM policy has no effect and results in an Access Denied error. Adding the delegation statement to the key policy enables IAM policies to delegate key access.

Step-by-Step Solution

1
Analyze the IAM policy of the CodeBuild service role.
The identity-based IAM policy has the correct kms:Decrypt and kms:DescribeKey permissions attached.
This ensures the identity-side configuration is correct and that the failure is due to the key policy.
2
Evaluate the KMS key policy.
The key policy only lists KMSAdminRole and only for administration actions. The default statement delegating control to the account root (arn:aws:iam::111122223333:root) is missing.
KMS key policies must explicitly allow IAM delegation (via the root principal) for identity-based IAM policies to have any effect.
3
Identify the remediation step.
Add the root principal statement to the key policy to enable IAM delegation.
This establishes key policy delegation, permitting the CodeBuild service role's IAM policy to grant the decryption permissions.

Key Concept

KMS Key Policy Delegation
Estimated Time:1m 30s
Question 17Question →

A SysOps Administrator is configuring AWS CloudTrail to deliver log events to Amazon CloudWatch Logs for real-time compliance monitoring. The administrator needs to ensure that the integration is secure and log delivery is successful.

Which two configuration steps must the administrator perform to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with a trust policy that allows the CloudTrail service principal to assume it, and attach a permissions policy allowing the logs:CreateLogStream and logs:PutLogEvents actions.; Specify a target CloudWatch Logs log group that resides in the same AWS Region as the CloudTrail trail.

Answer

The correct configurations are to create an IAM role with a trust policy that allows the CloudTrail service principal to assume it (with permissions for creating log streams and putting log events) and to specify a CloudWatch Logs log group in the same AWS Region as the CloudTrail trail.
The correct configuration requires establishing a cross-service trust and permission model. First, the CloudWatch Logs log group must exist in the same region as the CloudTrail trail. Second, an IAM role must be configured with a trust policy allowing the CloudTrail service principal to perform the assume role action, along with a permissions policy that grants the ability to create log streams and write log events into that specific log group.

Step-by-Step Solution

1
Set up the destination log group.
A CloudWatch Logs log group is created in the same AWS Region as the CloudTrail trail.
CloudTrail cannot send logs to a log group in a different region.
2
Configure the IAM role and policy.
An IAM role is created with a trust relationship allowing 'cloudtrail.amazonaws.com' to assume the role (sts:AssumeRole), and permissions are granted for logs:CreateLogStream and logs:PutLogEvents on the log group resource.
This allows CloudTrail to authenticate and securely write the log stream events to CloudWatch Logs.
3
Associate the role and log group with CloudTrail.
The CloudTrail trail is updated with the CloudWatch Logs log group ARN and the role ARN.
This completes the integration, allowing automated log forwarding to commence.

Key Concept

AWS CloudTrail integration with CloudWatch Logs requires a same-region destination log group and an IAM service role that trusts CloudTrail to write log streams.
Question 18Question →

A company's regional API Gateway REST API is protected by an AWS WAF Web ACL. During a security audit, the SysOps administrator identifies a brute-force attempt targeting the `/checkout` endpoint. To mitigate this threat, the administrator must restrict each client IP address to a maximum of 100100 requests per 55 minutes on the `/checkout` path only. Traffic to other endpoints must not be affected.

Which configuration should the SysOps administrator implement to meet these requirements?

Show answer & explanation

Answer: Create an AWS WAF Web ACL rule with a rate-based statement set to a limit of 100100, and configure a scope-down statement that matches the URI path `/checkout`.

Answer

Create an AWS WAF Web ACL rule with a rate-based statement set to a limit of 100100, and configure a scope-down statement that matches the URI path `/checkout`.
The correct option correctly uses an AWS WAF rate-based rule with a scope-down statement matching the `/checkout` URI. AWS WAF evaluates the request rate per client IP address over a sliding 55-minute window and blocks traffic exceeding 100100 requests on that path, satisfying the requirements without affecting other endpoints.

Step-by-Step Solution

1
Select the AWS WAF Web ACL associated with the regional API Gateway.
The Web ACL configuration page is opened.
Threat protection rules must be configured directly within the Web ACL protecting the target API Gateway.
2
Add a new rule with a rate-based statement set to a threshold of 100100 requests.
The rule is set up to count requests per client IP address over a sliding 55-minute window.
This establishes the client-based rate limiting required to mitigate brute-force attempts.
3
Configure a scope-down statement within the rate-based rule to evaluate only requests where the URI path matches `/checkout`.
Only requests targeting the `/checkout` path will count towards the rate limit.
This ensures that traffic to other API paths remains unaffected by the rate-based rule.

Key Concept

AWS WAF rate-based rules evaluate the rate of requests from client IP addresses. To apply rate limiting to a subset of requests, a scope-down statement restricts evaluation to matching criteria, such as a specific URI path.
Estimated Time:1m 30s
Question 19Question →

A SysOps Administrator is configuring an AWS Lambda function to stop underutilized EC2 instances. The administrator has already created the required IAM execution role for Lambda with the correct permissions. However, when the administrator attempts to update the Lambda function configuration to use this execution role, the AWS Management Console displays an Access Denied error.

Which permission must be granted to the SysOps Administrator's IAM user policy to resolve this error?

Show answer & explanation

Answer: iam:PassRole on the Lambda execution role resource

Answer

iam:PassRole on the Lambda execution role resource
The correct answer is the option specifying 'iam:PassRole on the Lambda execution role resource'. When configuring an AWS service to assume an IAM role, the user performing the configuration action must have the iam:PassRole permission. This security control ensures that users cannot escalate their privileges by passing a highly privileged role to a service that they could then interact with or trigger.

Step-by-Step Solution

1
Identify the action causing the failure
The SysOps Administrator is attempting to associate (pass) an IAM role to an AWS service (AWS Lambda).
AWS services require permission to assume roles. To prevent users from passing roles with higher privileges than they themselves possess, AWS requires the configuring user to have the iam:PassRole permission.
2
Determine the required IAM permission for the configuring user
The configuring user's policy must include the iam:PassRole action with the Lambda execution role's ARN as the resource.
This grants the administrator the capability to delegate the role's permissions to the AWS Lambda service.

Key Concept

Delegating permissions to AWS services using the iam:PassRole policy permission
Estimated Time:1m 0s
Question 20Question →

A SysOps administrator is configuring a daily backup plan in AWS Backup to protect Amazon RDS databases. The administrator wants to use a custom IAM role to execute the backup jobs. Which of the following configuration steps are required to allow AWS Backup to run the backup jobs using this custom role? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A trust policy on the custom IAM role that allows the backup.amazonaws.com service principal to perform the sts:AssumeRole action; An IAM policy attached to the administrator's IAM identity that grants the iam:PassRole permission for the custom IAM role

Answer

The correct configurations are: a trust policy on the custom IAM role allowing the backup service to assume it, and an IAM policy on the administrator's identity allowing the role to be passed.
To delegate permissions to an AWS service like AWS Backup, the service needs a trust policy allowing it to assume the role via sts:AssumeRole. Additionally, the administrator configuring the service must have the iam:PassRole permission to safely associate that role with the service.

Step-by-Step Solution

1
Configure the trust relationship on the custom IAM role to trust the AWS Backup service.
The custom IAM role trust policy permits the backup.amazonaws.com service principal to execute the sts:AssumeRole API action.
This allows the AWS Backup service to dynamically assume the role and inherit its permissions when running backup jobs.
2
Configure the administrator's permissions to allow passing the role to AWS Backup.
The administrator's IAM policy is updated with the iam:PassRole action targeting the ARN of the custom IAM role.
This ensures the administrator is authorized to delegate the specific IAM role to the service, preventing unauthorized role escalation.

Key Concept

Delegating permissions to AWS services using trust relationships and PassRole authorization
Estimated Time:1m 0s
Page 1 / 9Next