Examkin

Security and Compliance

441 soru

Tüm türler441Çoktan seçmeli225Çoklu seçim216
Soru 1Soru →

A multi-department enterprise wants to secure its AWS environment by implementing the principle of least privilege and reducing security risks associated with credential management. The administrator must configure access for both developers (human users) and applications running on Amazon EC2 instances (machine identities). Which two methods represent AWS security best practices for managing these identities? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use AWS IAM Identity Center to federate human identities and centrally manage user access to AWS accounts.; Attach an IAM role to the Amazon EC2 instances to provide applications with temporary security credentials.

Cevap

The correct practices are to use AWS IAM Identity Center for federated human access, and to attach IAM roles to Amazon EC2 instances for secure machine access using temporary credentials.
Centrally managing human user identities with AWS IAM Identity Center and using IAM roles to assign temporary credentials to EC2 instances are the industry-standard AWS best practices. They eliminate the need for permanent access keys, simplify credential rotation, and preserve detailed accountability in audit logs.

Adım Adım Çözüm

1
Analyze the requirements for human identities (developers).
Identify that AWS IAM Identity Center is the modern, recommended approach to centrally manage federated human access instead of creating static IAM users.
Reduces credential management overhead and aligns with the best practice of avoiding long-term IAM user credentials.
2
Analyze the requirements for machine identities (applications running on EC2 instances).
Identify that IAM roles should be attached to EC2 instances to provide temporary, automatically rotated security credentials.
Eliminates the risk of hardcoding or storing long-term API access keys in application configuration files.
3
Evaluate the incorrect choices to ensure they violate AWS security best practices.
Confirm that using the root user, sharing IAM accounts, or storing long-term access keys on EC2 instances are insecure configurations.
These practices increase the attack surface and violate the principles of least privilege and individual accountability.

Anahtar Kavram

AWS IAM best practices for securing human and machine access using federation and temporary credentials.
Soru 2Soru →

A retail corporation is designing a hybrid cloud architecture and needs to secure its data at rest on AWS. The security compliance policy states that the keys used for encrypting financial transactions must be stored on dedicated, single-tenant cryptographic hardware controlled entirely by the customer. However, for standard application logs stored in Amazon S3, the company wants to use a fully managed service where AWS handles the physical hardware management, but the customer retains control over key policies and rotation.

Which two of the following actions should the company take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions.; Use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.

Cevap

Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions, and use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys. AWS CloudHSM satisfies the need for dedicated, single-tenant hardware cryptographic keys controlled entirely by the customer. AWS KMS with customer managed keys satisfies the requirement for a fully managed multi-tenant key service where AWS manages the underlying HSM hardware while the customer retains control over key policies and key rotation.

Adım Adım Çözüm

1
Analyze the encryption requirements for the financial transaction keys.
The requirement specifies dedicated, single-tenant cryptographic hardware controlled entirely by the customer, which points directly to AWS CloudHSM.
AWS CloudHSM is a dedicated HSM service that gives the customer exclusive administrative control.
2
Analyze the encryption requirements for the application logs stored in Amazon S3.
The requirement specifies a fully managed service where AWS manages the hardware, but the customer controls key policies and rotation. This aligns with AWS KMS customer managed keys.
AWS KMS customer managed keys are managed by the customer but run on AWS-managed multi-tenant HSM infrastructure.
3
Select the correct combination of AWS services that fulfill both conditions.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys.
This combination successfully meets both dedicated and fully-managed encryption needs.

Anahtar Kavram

Selecting appropriate AWS services (AWS KMS vs. AWS CloudHSM) based on multi-tenant versus single-tenant encryption hardware requirements under the shared responsibility model.
Soru 3Soru →

A government contractor is deploying an application on AWS that handles classified public safety records. Compliance regulations mandate that all data at rest must be encrypted using cryptographic keys stored inside dedicated, single-tenant hardware security modules (HSMs) that are physically and logically isolated. Which option correctly identifies the AWS service that meets this requirement and the customer's responsibility for that service under the AWS Shared Responsibility Model?

Cevabı ve açıklamayı göster

Cevap: AWS CloudHSM; the customer is responsible for managing users, keys, and cryptographic partitions on the dedicated HSM instance.

Cevap

AWS CloudHSM; the customer is responsible for managing users, keys, and cryptographic partitions on the dedicated HSM instance.
AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud. It provides dedicated, single-tenant HSM instances under the customer's direct control. Under the AWS Shared Responsibility Model, AWS manages physical security, hardware provisioning, and network connectivity, while the customer maintains sole control over the cryptographic keys, partitions, and user management.

Adım Adım Çözüm

1
Identify the key residency and tenancy requirement.
The requirements mandate dedicated, single-tenant hardware security modules (HSMs), which points to AWS CloudHSM instead of AWS Key Management Service (AWS KMS) which uses shared, multi-tenant HSMs.
AWS CloudHSM provides dedicated HSM instances, whereas AWS KMS is a multi-tenant service.
2
Determine the shared responsibility model boundary for the chosen service.
For AWS CloudHSM, AWS manages hardware provisioning, physical security, and high availability, while the customer manages HSM partitions, cryptographic users, and key generation.
To satisfy the compliance requirements, the customer must maintain exclusive administrative control over the keys and users on the single-tenant HSM.

Anahtar Kavram

AWS CloudHSM vs AWS KMS and the Shared Responsibility Model for dedicated cryptography.
Tahmini Süre:1m 0s
Soru 4Soru →

A retail company is migrating its customer database to Amazon RDS for PostgreSQL to reduce administrative overhead. Which two of the following tasks are the responsibility of the customer under the AWS Shared Responsibility Model?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Managing database user accounts, permissions, and access controls within the database engine; Configuring database security groups to control incoming network traffic to the RDS instance

Cevap

Managing database user accounts, permissions, and access controls within the database engine, as well as configuring database security groups to control incoming network traffic to the RDS instance, are both responsibilities of the customer.
For managed services like Amazon RDS, AWS manages the host operating system, patching, and physical infrastructure. The customer remains responsible for configuration tasks within the database engine (such as user accounts, roles, and privileges) and controlling network access to the database instance using database security groups.

Adım Adım Çözüm

1
Identify the type of service being deployed.
Amazon RDS is a managed database service (PaaS).
The boundary of responsibility shifts depending on whether the service is IaaS (like EC2) or PaaS (like RDS).
2
Determine the split of responsibilities for Amazon RDS.
AWS handles physical security, infrastructure, operating system maintenance, and database patching. The customer handles database configuration, database-level security groups, data encryption, and user access management.
This determines which options represent customer tasks rather than AWS tasks.
3
Evaluate the choices based on the determined responsibilities.
Managing database user accounts/permissions and configuring database security groups are customer tasks. Operating system patching, physical storage drive replacement, and retrieving raw physical facility logs are AWS tasks.
This confirms the correct options.

Anahtar Kavram

Under the AWS Shared Responsibility Model for managed database services (RDS), AWS manages the infrastructure, OS patching, and physical hardware, while the customer manages database access, application configuration, and network security groups.
Tahmini Süre:1m 30s
Soru 5Soru →

A company's backend application instances in Subnet A must query a PostgreSQL database running on an Amazon EC2 instance in Subnet B. To secure this traffic, a network administrator is configuring network access control lists (Network ACLs) for Subnet B and a security group for the database instance. Which two configuration steps are required to allow this database traffic while maintaining the principle of least privilege? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a security group rule to the database instance that allows inbound TCP traffic on port 5432 from the application instances.; Add an outbound rule to the Network ACL of Subnet B that allows TCP traffic on ephemeral ports 1024–65535 to Subnet A.

Cevap

The correct configurations are to add an inbound security group rule on port 5432 from the application instances, and to add a Network ACL outbound rule on the database subnet allowing ephemeral port traffic to the application subnet.
The correct configurations are adding an inbound security group rule on the database instance for port 5432, and adding an outbound Network ACL rule on the database subnet for ephemeral ports. Security groups are stateful, meaning they track connection states and automatically allow return traffic for established inbound connections. Network ACLs are stateless, meaning every packet must be evaluated against rules. When a client initiates a connection to a database, the return traffic is sent from the database to the client's ephemeral ports (ranging from 1024 to 65535). Therefore, the stateless Network ACL must explicitly permit outbound traffic to these ephemeral ports.

Adım Adım Çözüm

1
Analyze the stateful behavior of Security Groups at the instance level.
Identify that allowing inbound database traffic on port 5432 automatically allows the return traffic outbound, making additional outbound rules for this traffic on the Security Group unnecessary.
Security Groups are stateful firewalls.
2
Analyze the stateless behavior of Network ACLs at the subnet level.
Determine that both inbound and outbound traffic must be explicitly allowed. For database responses, the return traffic is sent to the ephemeral ports of the application servers.
Network ACLs are stateless and require explicit rules for return traffic.
3
Evaluate the role of IAM policies vs. network security controls.
Recognize that network-level packet filtering is handled by Security Groups and Network ACLs, not by IAM roles or policies.
IAM controls API and resource authorization, not TCP/IP network packet filtering.

Anahtar Kavram

Distinguishing between the stateful behavior of Security Groups at the instance level and the stateless behavior of Network ACLs at the subnet level.
Soru 6Soru →

A global online learning platform hosts virtual classrooms on Amazon EC2 instances and stores course materials in Amazon S3 buckets. The security team needs to implement a solution that continuously scans their EC2 instances for software vulnerabilities and unintended network exposure. Additionally, they must identify potential security threats across their AWS accounts, such as cryptocurrency mining or brute-force attacks, using machine learning and threat intelligence. Which combination of AWS services will address these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector; Amazon GuardDuty

Cevap

Amazon Inspector and Amazon GuardDuty
Amazon Inspector and Amazon GuardDuty together fulfill both security objectives. Amazon Inspector acts as a static and dynamic vulnerability scanner for EC2 instances and ECR container images to locate software flaws. Amazon GuardDuty acts as an intelligent threat detector that analyzes active telemetry logs to identify operational and account-level security threats in real time.

Adım Adım Çözüm

1
Analyze the requirement for scanning EC2 instances for software vulnerabilities and network reachability issues.
Identify Amazon Inspector as the designated AWS service for automated host vulnerability assessment.
Amazon Inspector automatically discovers EC2 instances and scans them against a database of known vulnerabilities (CVEs) and evaluates network exposure configurations.
2
Analyze the requirement for detecting active threats, suspicious API calls, cryptomining, and brute-force attempts across the AWS account.
Identify Amazon GuardDuty as the primary intelligent threat detection service.
Amazon GuardDuty processes logs (such as VPC Flow Logs, CloudTrail, and DNS logs) using threat intelligence and machine learning to flag abnormal or malicious activity.

Anahtar Kavram

Vulnerability scanning of virtual servers versus intelligent, log-based cloud threat detection.
Soru 7Soru →

A retail company is auditing its AWS account to align with AWS Identity and Access Management (IAM) security best practices. Currently, developers use shared credentials for daily administrative tasks, and multi-factor authentication (MFA) is not enabled on the account. Which of the following actions should the company perform to secure their environment? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to only specific tasks that require root credentials.; Configure AWS IAM Identity Center to delegate daily administrative access to developers using temporary security credentials.

Cevap

To secure the AWS environment, the company should enable multi-factor authentication (MFA) on the AWS account root user and restrict its use, and configure AWS IAM Identity Center to delegate daily administrative access using temporary credentials.
The correct actions are to enable multi-factor authentication (MFA) on the root user to secure the account, and to set up AWS IAM Identity Center to manage developer access. This ensures that developers use temporary, unique credentials for daily operations instead of sharing permanent administrative access.

Adım Adım Çözüm

1
Identify root user credentials security requirements.
Determine that the root user should have MFA enabled and must not be used for daily operations.
Root user credentials have complete administrative access across the entire account and represent a high security risk if compromised.
2
Analyze credential management for daily developer operations.
Determine that developers should use temporary credentials managed via AWS IAM Identity Center rather than permanent or shared keys.
Using temporary credentials minimizes the risk of credential leakage and aligns with the principle of least privilege.

Anahtar Kavram

Implementing IAM best practices including securing the root account with MFA and utilizing temporary credentials via identity federation or IAM Identity Center.
Tahmini Süre:1m 0s
Soru 8Soru →

A logistics company containerizes its shipment tracking application and deploys it on AWS Fargate. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring security group rules to control traffic to and from the container tasks

Cevap

Configuring security group rules to control traffic to and from the container tasks
The configuration of security groups to control inbound and outbound traffic to the container tasks is a customer responsibility. Even though AWS Fargate abstracts the underlying host servers and operating system, the customer retains control and responsibility over network-level access control to their own workloads.

Adım Adım Çözüm

1
Analyze the service type and deployment model
AWS Fargate is a serverless compute engine for containers, which falls under a managed service model where the underlying host operating system and hardware are managed by AWS.
Identifying the service category helps determine the boundary line between the customer's security 'in' the cloud and AWS's security 'of' the cloud.
2
Differentiate between customer and AWS responsibilities for this service
AWS manages physical security, host patching, and hardware. The customer manages application code, container images, IAM roles, and network security configuration (security groups) for the tasks.
This allows us to isolate which configuration task is still controlled by the customer in a serverless container environment.

Anahtar Kavram

Shared Responsibility Model for Serverless Container Services
Soru 9Soru →

An enterprise is establishing access policies for a newly deployed reporting service hosted on an Amazon EC2 instance and a database administrator who requires CLI access for database maintenance. Which of the following identity configurations represent AWS-recommended practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with permissions to read the database and attach it to the EC2 instance.; Create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.

Cevap

Create an IAM role with permissions to read the database and attach it to the EC2 instance, and create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.
The correct configurations involve using an IAM role for the EC2 instance and a dedicated IAM user with restricted permissions for the administrator. Attaching an IAM role to the EC2 instance enables the reporting service to securely access the database using automatically rotated temporary credentials. For the database administrator, a dedicated IAM user with CLI access keys and least-privilege policies ensures accountable, secure programmatic access.

Adım Adım Çözüm

1
Analyze the security requirements for the EC2-hosted application.
The application needs access to the database without exposing long-term credentials.
AWS best practices recommend using IAM roles for applications running on EC2 instances to obtain temporary credentials.
2
Analyze the access requirements for the database administrator.
The administrator needs programmatic access (CLI) to perform manual maintenance.
For human programmatic access, a dedicated IAM user with CLI access keys and least-privilege policies should be created.
3
Identify and eliminate options proposing insecure practices or boundary violations.
Using root user access keys, embedding permanent credentials, or requesting AWS to perform database maintenance are incorrect.
These violate root user best practices, credential storage standards, and the AWS Shared Responsibility Model.

Anahtar Kavram

Identity and Access Management (IAM) Best Practices
Soru 10Soru →

A medical device manufacturer is deploying an IoT monitoring system on AWS. The quality assurance team must retrieve official AWS compliance reports, such as ISO certificates, to complete their regulatory filing. Which AWS service provides on-demand access to these security and compliance reports?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact
AWS Artifact is a self-service portal that provides customers with direct access to AWS compliance documentation. This includes Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and various ISO certifications required by regulators and auditors.

Adım Adım Çözüm

1
Identify the requirement to retrieve third-party compliance reports and certifications (such as ISO certificates) for AWS infrastructure.
The requirement points to AWS compliance and governance documentation.
AWS manages the security of the cloud and provides audit reports to customers to prove compliance.
2
Determine which AWS service acts as the central portal for these compliance documents.
AWS Artifact is identified as the dedicated self-service portal for downloading these reports on demand.
Other services like Systems Manager, GuardDuty, or CloudTrail are used for resource management, threat detection, or API logging rather than document retrieval.

Anahtar Kavram

AWS Artifact provides on-demand access to AWS compliance reports and agreements.
Tahmini Süre:1m 0s
Soru 11Soru →

A fintech startup is deploying a public-facing REST API using Amazon API Gateway to expose financial transaction data. The API must be secured against unauthorized access, and all data transit must be encrypted. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers

Cevap

Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers
Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers is the correct answer because managing identity and access management (IAM) permissions, authentication, and authorization policies for the application's APIs falls under the customer's responsibility for securing their data 'in' the cloud.

Adım Adım Çözüm

1
Identify the AWS service type in the scenario.
Amazon API Gateway is a fully managed (Platform-as-a-Service/Serverless) AWS service.
Managed services shift infrastructure-level maintenance tasks from the customer to AWS.
2
Differentiate between security 'of' the cloud and security 'in' the cloud for a managed service.
AWS handles the physical security, underlying operating systems, and patching. The customer remains responsible for securing data, configuring resource policies, and managing user access.
This determines which task the customer must execute directly to secure their API.
3
Evaluate the choices to find the customer-managed task.
Configuring user pools or Lambda authorizers controls access to the application data, which is 'in' the cloud and thus the customer's responsibility.
API access control is managed at the application layer by the customer.

Anahtar Kavram

Under the AWS Shared Responsibility Model, for managed services like Amazon API Gateway, AWS handles physical security, OS patching, and network infrastructure, while the customer is responsible for application-level security, including client-side encryption, access control (authentication/authorization), and resource configuration.
Soru 12Soru →

A research institute manages high-performance simulation applications running on a fleet of Amazon EC2 instances. The institute's security audit team requires a tool that can continuously scan the operating systems of these instances for known software vulnerabilities and analyze network paths to identify unintended exposure to the internet. Which AWS service is designed to perform these automated vulnerability assessments?

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector

Cevap

Amazon Inspector is the correct service because it automatically evaluates Amazon EC2 instances for software vulnerabilities and unintended network path exposure.
Amazon Inspector is designed to automatically discover and scan Amazon EC2 instances, container images, and AWS Lambda functions for software vulnerabilities (like CVEs) and unintended network exposure.

Adım Adım Çözüm

1
Analyze the core requirement of finding an AWS service that performs automated security assessments, scans for software vulnerabilities, and analyzes network paths on Amazon EC2 instances.
The target service must support host-level operating system scanning and network exposure analysis.
This distinguishes between services that monitor active API threats and those that audit static configuration and patching status.
2
Evaluate the capabilities of Amazon Inspector against other security services.
Amazon Inspector is the only service that performs automated vulnerability scans on host software and checks network accessibility, whereas GuardDuty is for active threat detection, CloudTrail is for auditing API events, and Shield is for DDoS protection.
Identifying the distinct functionality of each option ensures the selection of the correct service.

Anahtar Kavram

Continuous vulnerability assessment and network reachability analysis using Amazon Inspector.
Tahmini Süre:1m 0s
Soru 13Soru →

A financial services company uses Amazon S3 Glacier Flexible Retrieval to archive historical transaction records for compliance auditing. Under the AWS Shared Responsibility Model, which of the following security and operational tasks are the sole responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring Vault Lock policies to enforce compliance and prevent modification of archives; Managing Identity and Access Management (IAM) policies to regulate user access to the vault

Cevap

The customer is responsible for configuring Vault Lock policies to enforce compliance and managing Identity and Access Management (IAM) policies to regulate user access to the vault.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For Amazon S3 Glacier, this includes configuring Vault Lock policies to enforce compliance and managing IAM policies to regulate user access. These are control plane configurations managed entirely by the customer.

Adım Adım Çözüm

1
Identify the service type and model boundary.
Amazon S3 Glacier is a managed service where AWS handles the underlying infrastructure and virtualization.
Understanding the service type helps distinguish between infrastructure tasks managed by AWS and data/access configurations managed by the customer.
2
Evaluate each operational task against the Shared Responsibility Model.
Vault Lock policies and IAM configurations are data integrity and access control responsibilities (customer's job). Media disposal, host OS patching, and compliance portal access are infrastructure and global compliance responsibilities (AWS's job or AWS Artifact's domain).
This isolates the tasks that fall under customer configuration rather than AWS infrastructure management.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Soru 14Soru →

A company hires a new systems administrator who needs daily access to manage Amazon EC2 instances and Amazon RDS databases. Which of the following is the AWS-recommended best practice for granting this administrator access?

Cevabı ve açıklamayı göster

Cevap: Create an individual IAM user for the administrator, attach policies granting only the necessary permissions, and require multi-factor authentication (MFA).

Cevap

Create an individual IAM user for the administrator, attach policies granting only the necessary permissions, and require multi-factor authentication (MFA).
The correct approach is to create an individual IAM user with policies that grant only the required permissions for managing EC2 and RDS, and to secure the user with multi-factor authentication. This adheres to the principle of least privilege and ensures individual accountability.

Adım Adım Çözüm

1
Identify the security requirements for daily administrative access to AWS resources.
Determine that the administrator needs specific access to EC2 and RDS, requiring individual credentials and multi-factor authentication.
Individual accountability and multi-factor authentication are core security practices.
2
Evaluate the options against AWS Identity and Access Management (IAM) best practices.
Determine that using individual IAM users with least privilege permissions meets these best practices, while avoiding the root user, permanent role login, or outsourcing IAM tasks to AWS.
This alignment ensures the account remains secure and follows the principle of least privilege.

Anahtar Kavram

IAM Best Practices for Daily Administration
Soru 15Soru →

A cloud architect is designing the network security for a SaaS application's web servers running on Amazon EC2 instances in a VPC. To establish a defense-in-depth strategy, the architect plans to use both Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the characteristics and differences between these two firewall layers? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security groups operate at the Amazon EC2 instance level, whereas Network ACLs operate at the subnet level.; Security groups are stateful, meaning return traffic is automatically allowed, whereas Network ACLs are stateless and require explicit outbound rules for return traffic.

Cevap

Security groups operate at the Amazon EC2 instance level and are stateful firewalls, while Network ACLs operate at the subnet level and are stateless firewalls.
Security groups are stateful firewalls operating at the instance level (ENI), allowing return traffic automatically without needing an explicit outbound rule. Network ACLs are stateless firewalls operating at the subnet level, requiring explicit rules for both inbound and outbound traffic paths.

Adım Adım Çözüm

1
Determine the operating boundary of Security Groups and Network ACLs.
Security groups are applied directly to EC2 instances (via elastic network interfaces), whereas Network ACLs are associated with entire subnets.
This establishes the scope of control for each firewall layer.
2
Analyze how connection states are processed by both firewalls.
Security groups automatically allow return traffic for established connections (stateful), while Network ACLs do not remember connection states and require matching rules in both directions (stateless).
This differentiates the traffic flow logic between the two security mechanisms.

Anahtar Kavram

Understanding the architectural differences between Security Groups and Network ACLs, specifically focusing on their evaluation level (instance vs. subnet) and state tracking behavior (stateful vs. stateless).
Tahmini Süre:1m 30s
Soru 16Soru →

A software-as-a-service (SaaS) provider is preparing for an ISO 27001 certification audit of its order management application. To satisfy the auditors, the company must verify that the underlying AWS physical infrastructure is certified and identify which specific AWS services in their deployment are covered under this compliance standard. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Access AWS Artifact to retrieve the AWS ISO 27001 compliance report.; Refer to the AWS Services in Scope by Compliance Program documentation.

Cevap

The company should access AWS Artifact to retrieve the AWS ISO 27001 compliance report and refer to the AWS Services in Scope by Compliance Program documentation to confirm which services are certified.
The correct options involve retrieving compliance documents from AWS Artifact and checking service certification scope. AWS Artifact is the self-service portal for AWS compliance reports, such as ISO 27001 certificates. Since not all AWS services are in scope for every standard, verifying the service-specific compliance status via the AWS Services in Scope documentation is required to confirm that the architecture meets audit criteria.

Adım Adım Çözüm

1
Obtain physical infrastructure compliance reports.
Access the AWS Artifact console and download the ISO 27001 certification report, which serves as the official compliance documentation for AWS data centers.
AWS is responsible for physical security and provides third-party audit reports to customers for compliance verification.
2
Verify service-specific compliance scope.
Check the AWS Services in Scope by Compliance Program online documentation to confirm that the specific services used in the application are certified.
Not all AWS services are immediately covered under every compliance standard, so verifying in-scope services is a necessary audit step.

Anahtar Kavram

AWS Compliance and Governance via AWS Artifact and Services in Scope documentation
Soru 17Soru →

A global retail company is preparing for an annual PCI-DSS audit of its payment processing workload hosted on AWS. The compliance team needs to gather official documentation proving the physical security compliance of AWS data centers and establish a workflow to continuously audit and evaluate AWS resource configurations against regulatory standards. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Download the AWS PCI-DSS compliance package and related security reports from AWS Artifact.; Use AWS Config to continuously record and evaluate resource configuration changes against compliance guidelines.

Cevap

Retrieve the compliance documents from AWS Artifact, and use AWS Config to record and evaluate resource configuration compliance.
The correct options are downloading compliance documents from AWS Artifact and utilizing AWS Config for resource evaluation. AWS Artifact serves as the direct portal for retrieving official AWS audit reports (such as PCI-DSS packages) to verify the security of the AWS infrastructure. AWS Config provides the mechanism to continuously monitor, record, and evaluate resource configurations to ensure they align with compliance guidelines.

Adım Adım Çözüm

1
Determine the resource responsible for providing AWS's third-party compliance reports and agreements.
Identify AWS Artifact as the self-service portal to download reports like SOC and PCI-DSS compliance packages.
AWS Artifact provides on-demand access to AWS compliance documentation to satisfy external audit requirements.
2
Determine the service designed to continuously audit, record, and evaluate resource configurations against compliance rules.
Select AWS Config as the configuration management and compliance auditing tool.
AWS Config tracks configuration history and evaluates changes against predefined rules to ensure governance.

Anahtar Kavram

Compliance and Governance
Soru 18Soru →

A logistics company is migrating its tracking application to AWS and needs to set up a comprehensive monitoring and auditing solution. The company wants to track all administrative actions and API modifications made to their AWS resources for compliance auditing. Additionally, they need to collect system-level metrics, such as CPU utilization from their Amazon EC2 instances, and automatically send alerts if thresholds are exceeded.

Which of the following AWS services should the company configure to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to audit and record all API calls, user activity, and resource modifications; Amazon CloudWatch to collect metrics, monitor resource performance, and trigger alarms based on thresholds

Cevap

AWS CloudTrail and Amazon CloudWatch are the correct services to configure.
AWS CloudTrail tracks and logs user activity and API transactions to provide a complete history of actions for compliance. Amazon CloudWatch collects and monitors real-time performance metrics (like CPU utilization) and sends alerts when pre-defined resource thresholds are breached.

Adım Adım Çözüm

1
Identify the service required to track administrative actions and API modifications for auditing.
AWS CloudTrail logs all API actions and management events.
This satisfies the requirement to maintain a record of all modifications and user actions for compliance.
2
Identify the service required to monitor performance metrics like CPU utilization and trigger alarms.
Amazon CloudWatch collects system-level metrics and manages alarms.
This satisfies the operational monitoring and alerting requirements.

Anahtar Kavram

AWS CloudTrail logs API calls and management events for compliance auditing, while Amazon CloudWatch monitors resource performance metrics and triggers operational alarms.
Soru 19Soru →

A financial technology company is preparing for a security audit and must establish robust auditing and monitoring controls. The company needs to maintain a complete history of all API calls made within their AWS environment for compliance verification. Additionally, the security team needs to receive immediate notifications if any unauthorized modifications are made to network security configurations, such as security group rules.

Which of the following actions should the company take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable AWS CloudTrail to capture and log API calls, storing them in a secure Amazon S3 bucket for compliance auditing.; Create Amazon CloudWatch metric filters and alarms to notify security administrators in real-time when specific unauthorized API patterns occur in the logs.

Cevap

Enable AWS CloudTrail to capture API calls for compliance auditing, and create Amazon CloudWatch metric filters and alarms for real-time notifications.
To satisfy both requirements, the company must use AWS CloudTrail to record a complete log of all API operations (like creating or modifying resources) and deliver them to S3. They must also use Amazon CloudWatch Logs to collect the logs, create metric filters for unauthorized patterns (e.g., security group updates), and configure CloudWatch Alarms to send real-time alerts.

Adım Adım Çözüm

1
Identify the service responsible for auditing API requests and user activity.
AWS CloudTrail is identified as the service that records API activity and stores the history in an Amazon S3 bucket.
CloudTrail provides operational and risk auditing, governance, and compliance of your AWS account.
2
Identify the service responsible for monitoring metrics and setting up real-time alarms.
Amazon CloudWatch is identified as the service that can monitor logs, define metric filters, and configure alarms.
CloudWatch is used for monitoring resource utilization, log files, and triggering actions or alerts based on metrics.
3
Eliminate options that misrepresent the AWS Shared Responsibility Model or confuse services.
Options recommending Amazon Inspector for log analysis or requesting AWS-managed physical logs are eliminated.
Under the Shared Responsibility Model, physical infrastructure logs are AWS's responsibility and are not shared. Vulnerability scanning is distinct from active threat monitoring and log analysis.

Anahtar Kavram

AWS CloudTrail provides API auditing and activity logging, while Amazon CloudWatch provides performance metrics, log monitoring, and real-time alarms.
Soru 20Soru →

A financial technology startup is setting up its AWS environment. An application running on Amazon ECS tasks needs to retrieve records from an Amazon DynamoDB table, while an external compliance auditor requires weekly console access to inspect security configurations without modifying any resources. Which TWO of the following identity and access management actions should the startup implement to meet these requirements securely? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with the necessary DynamoDB read permissions and associate it with the Amazon ECS task definition.; Create a dedicated IAM user for the external auditor, require Multi-Factor Authentication (MFA), and attach a policy allowing read-only access to security settings.

Cevap

The startup should configure an IAM role with DynamoDB read permissions for the ECS task definition and establish a dedicated IAM user with MFA and read-only permissions for the auditor.
The correct identity setup involves creating an IAM role for the ECS container tasks to assume temporary access credentials dynamically, and establishing a dedicated IAM user for the external auditor with a read-only policy and MFA enabled for safe administrative console access.

Adım Adım Çözüm

1
Analyze the application's access requirements.
The ECS task running the application requires access to DynamoDB. Hardcoding or passing static credentials is a security risk, so an IAM role must be configured for the ECS task (task role) to provide temporary, automatically rotated security credentials.
This follows the principle of least privilege and eliminates long-term credentials for applications.
2
Analyze the auditor's access requirements.
The auditor requires access to the console to view security configurations. This is a human access requirement, which requires a dedicated IAM user or federated login, coupled with Multi-Factor Authentication (MFA) and a read-only policy.
This secures administrative/auditing endpoints and ensures individual accountability without granting write permissions.
3
Evaluate the distractors against AWS best practices and the Shared Responsibility Model.
Using the root account keys is highly discouraged. Reusing human IAM user credentials for application workloads is insecure. Asking AWS to manage IAM audit operations misinterprets the customer's responsibility under the Shared Responsibility Model.
This isolates human vs. machine identity and defines ownership of cloud security configurations.

Anahtar Kavram

The core of AWS identity security relies on isolating human identities (using IAM users/federation with MFA) and machine identities (using IAM roles for temporary credentials), whilst adhering to the Shared Responsibility Model where the customer owns resource access configuration.
Tahmini Süre:2m 30s
Sayfa 1 / 23Sonraki