Examkin

Security and Compliance

441 soru

Tüm türler441Çoktan seçmeli225Çoklu seçim216
Soru 181Soru →

A company is onboarding a new team of data analysts who require read-only access to Amazon S3 buckets. Which of the following actions should the company take to configure access in accordance with AWS Identity and Access Management (IAM) best practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create individual IAM users for each analyst to ensure unique credentials and individual accountability.; Create an IAM group, attach the ReadOnlyS3 access policy to the group, and add the analyst users to the group.

Cevap

Create individual IAM users for each analyst, and create an IAM group with read-only permissions to which the analysts are added.
The correct options are to create individual IAM users and to manage permissions via an IAM group. Creating individual users ensures auditability and security accountability. Using an IAM group allows you to define permissions (such as read-only access to S3) once and apply them to all members of the group, which aligns with AWS best practices for managing permissions at scale.

Adım Adım Çözüm

1
Ensure individual accountability for all users.
Identify the need to create unique IAM users rather than sharing accounts.
Individual IAM users allow tracking of actions and secure authentication.
2
Group users by their common access needs.
Create an IAM group with a read-only S3 permission policy and assign the users to it.
Grouping simplifies policy management and ensures the principle of least privilege is applied consistently.

Anahtar Kavram

Identity and Access Management (IAM) Best Practices
Soru 182Soru →

A technology startup runs its backend API on AWS Lambda. Under the AWS Shared Responsibility Model, which of the following security tasks is the responsibility of the startup?

Cevabı ve açıklamayı göster

Cevap: Configuring Identity and Access Management (IAM) execution roles for the Lambda functions

Cevap

Configuring Identity and Access Management (IAM) execution roles for the Lambda functions
Configuring IAM execution roles for Lambda functions is the customer's responsibility. Under the AWS Shared Responsibility Model, identity and access management (IAM) remains a customer responsibility across all service types, ensuring that only authorized users or processes can access the resource.

Adım Adım Çözüm

1
Identify the service model of AWS Lambda.
AWS Lambda is a serverless, abstracted service.
The level of customer responsibility depends on whether the service is categorized as infrastructure (IaaS), container/platform (PaaS), or abstract/serverless.
2
Evaluate the customer's responsibility boundary for a serverless service.
AWS manages the infrastructure layer (hardware, virtualization, operating system, and runtime). The customer retains responsibility for configuring access controls, writing code, and protecting their data.
Under the Shared Responsibility Model, even when infrastructure management is offloaded to AWS, IAM configuration remains the customer's responsibility.

Anahtar Kavram

AWS Shared Responsibility Model for serverless/abstracted services
Soru 183Soru →

A media company is migrating its backend processing workloads to serverless architectures using AWS Lambda. The company wants to ensure that all aspects of this environment conform to their security policies. Under the AWS Shared Responsibility Model, which responsibility falls solely on the customer when deploying these serverless functions?

Cevabı ve açıklamayı göster

Cevap: Configuring the Identity and Access Management (IAM) execution roles that define which AWS resources the functions can access

Cevap

Configuring the Identity and Access Management (IAM) execution roles that define which AWS resources the functions can access
Under the AWS Shared Responsibility Model, AWS Lambda represents a serverless service where AWS manages the entire infrastructure stack, including physical security, hardware, virtualization, the guest operating system, and the application runtime. The customer's responsibility is focused on the security of their code and access management. This includes creating and configuring the Identity and Access Management (IAM) execution roles that specify the exact permissions the function has when interacting with other AWS services.

Adım Adım Çözüm

1
Identify the AWS service type and its deployment model
AWS Lambda is a serverless (managed) compute service.
Managed services shift more infrastructure-level responsibilities (such as OS patching and runtime maintenance) to AWS.
2
Define the boundaries of the Shared Responsibility Model for serverless compute
AWS is responsible for physical security, hardware, virtualization, operating systems, and runtimes. The customer is responsible for application code, data, and access configurations.
This establishes which operational tasks belong to the customer.
3
Evaluate the operational tasks in the options against the boundary
Configuring the IAM execution role is a customer access management configuration, while patching the guest OS, maintaining language runtimes, and managing subnet hosts are AWS responsibilities.
This identifies the correct customer responsibility.

Anahtar Kavram

Shared Responsibility Model for Serverless Services
Tahmini Süre:1m 15s
Soru 184Soru →

A company has hired an external security auditing firm to inspect their AWS resource configurations. The auditors require read-only access to the AWS account for a limited period of two weeks. Which of the following options represents the AWS-recommended best practice to grant the external auditors access?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role that allows the external auditors to assume it and obtain temporary security credentials.

Cevap

Create an IAM role that allows the external auditors to assume it and obtain temporary security credentials.
The correct answer is to create an IAM role that the external auditors can assume. This is the AWS-recommended best practice because IAM roles generate temporary security credentials, minimizing the risk of credential exposure and avoiding the need to manage long-term credentials for external parties.

Adım Adım Çözüm

1
Identify the access requirements for the external auditor.
The auditor requires read-only access for a limited time (two weeks).
This establishes that the access is temporary and delegated to an external entity.
2
Select the correct IAM entity type for temporary third-party access.
An IAM role is the appropriate entity because it grants temporary security credentials via role assumption.
IAM roles prevent the creation of permanent credentials and do not require sharing account credentials.

Anahtar Kavram

Delegating temporary access to third parties using IAM roles
Soru 185Soru →

A startup is designing a secure multi-tier environment in an Amazon VPC. They require a network security control at the subnet boundary that does not track connection state, meaning inbound and outbound traffic must be allowed via explicit, separate rules. For individual Amazon EC2 instances, they require a firewall that automatically allows outbound return traffic if the inbound request is permitted. Which combination of AWS network security features should the startup implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Network Access Control Lists (NACLs) at the subnet level, and Security Groups at the instance level.

Cevap

Network Access Control Lists (NACLs) at the subnet level, and Security Groups at the instance level.
The correct option is correct because Network Access Control Lists (NACLs) are stateless and applied at the subnet boundary, fulfilling the requirement for separate inbound/outbound evaluation. Security Groups are stateful and applied at the instance level, fulfilling the requirement for automatic return traffic permission.

Adım Adım Çözüm

1
Identify the service that operates at the subnet boundary and is stateless.
Network Access Control Lists (NACLs) are stateless firewalls that control traffic at the subnet boundary, requiring explicit rules for both inbound and outbound traffic.
NACLs do not track connection state, meaning return traffic must be explicitly permitted by a corresponding rule in the opposite direction.
2
Identify the service that operates at the instance level and is stateful.
Security Groups are stateful firewalls that secure individual instances (virtual interfaces), automatically allowing return traffic.
Security Groups track the state of connections, allowing response traffic to flow back to the requester automatically without requiring an explicit rule.
3
Select the option combining NACLs at the subnet level and Security Groups at the instance level.
The correct combination aligns NACLs at the subnet layer and Security Groups at the instance layer.
This configuration satisfies both the stateless subnet boundary requirement and the stateful instance firewall requirement.

Anahtar Kavram

Stateful vs. Stateless AWS Network Security Features
Soru 186Soru →

An automobile manufacturer is migrating its web applications to AWS and wants to establish automated security checks. The manufacturer needs to implement software vulnerability assessments on its application hosts and monitor AWS account activity for potential security threats. Which AWS services should be selected to fulfill these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector; Amazon GuardDuty

Cevap

Amazon Inspector and Amazon GuardDuty should be selected to meet the requirements.
Amazon Inspector is the correct choice for host and software vulnerability scanning on instances and containers. Amazon GuardDuty is the correct choice for continuous threat detection and monitoring of malicious activity across AWS accounts.

Adım Adım Çözüm

1
Identify the requirement for software vulnerability assessment on application hosts.
Determine that Amazon Inspector is the AWS service designed to automatically scan EC2 instances and containers for known software vulnerabilities.
Host security scanning is a core feature of Amazon Inspector.
2
Identify the requirement to monitor AWS account activity for active security threats.
Determine that Amazon GuardDuty is the AWS service that uses intelligent threat detection to identify unauthorized or malicious activity across AWS accounts.
Threat detection based on account activity and network logs is a core feature of Amazon GuardDuty.

Anahtar Kavram

AWS threat detection and vulnerability management services
Soru 187Soru →

A retail corporation is migrating its point-of-sale systems to AWS and needs to ensure compliance with industry security regulations. Under the AWS Shared Responsibility Model, which of the following compliance-related tasks is the sole responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Enforcing password complexity policies and multi-factor authentication for application developers

Cevap

Enforcing password complexity policies and multi-factor authentication for application developers
Under the Shared Responsibility Model, the customer is responsible for security and compliance 'in' the cloud. This includes customer-side configurations such as Identity and Access Management (IAM), which encompasses enforcing password complexity policies and enabling multi-factor authentication (MFA) for users.

Adım Adım Çözüm

1
Analyze the scenario to identify the compliance requirement under the AWS Shared Responsibility Model.
The scenario requires identifying a task that falls under customer responsibility ('security in the cloud') rather than AWS responsibility ('security of the cloud').
This establishes the boundary between customer-managed tasks and AWS-managed infrastructure tasks.
2
Evaluate the choices to distinguish between configuration tasks managed by the customer and infrastructure/physical security tasks managed by AWS.
Managing user credentials and IAM access policies (such as password policies and MFA) is a customer responsibility, while physical security, hypervisor patching, and data center compliance are AWS responsibilities.
This identifies the correct task that the customer must perform to satisfy the compliance audit.

Anahtar Kavram

Under the AWS Shared Responsibility Model, compliance is a shared effort. AWS is responsible for the security 'of' the cloud (physical infrastructure, hardware, virtualization layer), while the customer is responsible for security 'in' the cloud (customer data, identity and access management, guest operating systems, and application configurations).
Tahmini Süre:1m 30s
Soru 188Soru →

A multi-department enterprise has hired an external consulting firm to perform a security audit of their AWS environment. The auditors require read-only access to various AWS resources for a limited duration of two weeks. Which of the following is the AWS-recommended best practice to grant this external firm access to the enterprise's AWS account?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a read-only policy and establish a trust relationship allowing the external firm's AWS account to assume it.

Cevap

Create an IAM role with a read-only policy and establish a trust relationship allowing the external firm's AWS account to assume it.
The correct option outlines the practice of creating an IAM role. An IAM role allows the external firm to assume the role using their own AWS account credentials, obtaining temporary security credentials for the duration of the audit without requiring the enterprise to share long-term access keys.

Adım Adım Çözüm

1
Identify the requirement for secure, temporary, and cross-account access for an external auditing firm.
The solution must provide limited-duration access without sharing permanent credentials.
Sharing permanent access keys or root user credentials violates AWS security standards.
2
Evaluate AWS IAM mechanisms for cross-account delegation.
An IAM role with a trust policy is identified as the optimal tool for cross-account access.
IAM roles leverage security token services to issue temporary security credentials, ensuring security and compliance.

Anahtar Kavram

Cross-account access delegation using IAM roles
Soru 189Soru →

A healthcare technology company deploys microservices using AWS Lambda and container images stored in Amazon Elastic Container Registry (Amazon ECR). The security team needs to implement a solution that automatically scans these container images and Lambda functions for software vulnerabilities, and assesses the Lambda functions for unintended network exposure. Which AWS service should the company use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector

Cevap

Amazon Inspector
Amazon Inspector is the AWS service designed to automatically and continuously scan workloads—specifically Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions—for software vulnerabilities (such as Common Vulnerabilities and Exposures, or CVEs) and unintended network path exposure. This directly addresses the requirement to scan container images and Lambda functions.

Adım Adım Çözüm

1
Analyze the business and technical requirements of the scenario.
The company needs automated scanning of container images in Amazon ECR and AWS Lambda functions for software vulnerabilities (CVEs) and unintended network exposure.
Understanding the target resource types (ECR and Lambda) and the activity (vulnerability scanning and network exposure analysis) narrows down the appropriate AWS security services.
2
Evaluate the capabilities of Amazon Inspector.
Amazon Inspector is designed specifically to scan EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and network reachability.
This matches the exact requirements specified in the scenario.
3
Differentiate Amazon Inspector from threat detection and logging services.
Amazon GuardDuty provides threat detection (not vulnerability scanning), AWS CloudTrail provides API logging, and AWS Support does not automate application-level vulnerability scanning.
Verifying that the other choices do not perform the requested vulnerability scanning tasks ensures the selection of the correct service.

Anahtar Kavram

Vulnerability scanning of container images and Lambda functions using Amazon Inspector
Soru 190Soru →

A retail company needs to track and audit all user activity and API calls within their AWS account for security compliance. They want to identify which specific user modified a security group rule or deleted an Amazon S3 bucket. Which AWS service should the company use to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail

Cevap

AWS CloudTrail
AWS CloudTrail is the correct choice because it records actions taken by a user, role, or AWS service. It provides a detailed history of API calls, including who made the call, when it was made, and from which IP address, which meets the company's compliance requirements.

Adım Adım Çözüm

1
Identify the core requirement of the scenario: tracking and auditing all user actions and API calls (e.g., resource modification or deletion).
The requirement is for audit trails of API activity.
This helps narrow down the services that record activity versus those that monitor performance or detect threats.
2
Compare the capabilities of the options relative to logging API actions.
AWS CloudTrail is specifically designed for governance, compliance, and operational auditing of AWS account activity.
Selecting the service that logs AWS API calls ensures compliance and security visibility.

Anahtar Kavram

AWS CloudTrail provides governance, compliance, operational auditing, and risk auditing of your AWS account by logging user activity and API calls.
Tahmini Süre:45s
Soru 191Soru →

An e-commerce company is deploying containerized microservices using AWS Fargate. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring security groups to control inbound and outbound network traffic to the containers; Defining Identity and Access Management (IAM) roles and access policies for the containerized applications

Cevap

The customer is responsible for configuring security groups to control network traffic and defining IAM roles and access policies for the applications. AWS is responsible for physical security, infrastructure auditing, and patching the host operating system.
Under the AWS Shared Responsibility Model, for container services like AWS Fargate, AWS manages the underlying physical infrastructure, virtualization layer, and host operating system. The customer remains responsible for application-level settings, container configuration, network access controls such as security groups, and identity and access management (IAM) permissions for their container tasks.

Adım Adım Çözüm

1
Determine the service type and boundaries.
AWS Fargate is a serverless container platform where AWS manages the underlying host infrastructure and OS.
Identifying the service type helps delineate between infrastructure management (AWS) and application/logical configuration (customer).
2
Select tasks aligned with customer responsibility.
Configuring security groups and setting IAM policies.
Customers are always responsible for access controls, application settings, and firewall configurations 'in' the cloud.

Anahtar Kavram

Shared Responsibility Model for managed container services (AWS Fargate)
Soru 192Soru →

A software company is configuring permissions for its new AWS environment. The IT administrator needs to manage access for ten developers who require the same set of permissions, and also grant an application running on Amazon Elastic Container Service (Amazon ECS) access to an Amazon DynamoDB table. Which of the following actions represent AWS security best practices to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM user group, attach the required permissions policy to it, and add the developers to the group.; Create an IAM role with the necessary permissions policy and associate it with the ECS task definition.

Cevap

Create an IAM user group, attach the required permissions policy to it, and add the developers to the group; and create an IAM role with the necessary permissions policy and associate it with the ECS task definition.
The correct options are to create an IAM user group for the developers and to associate an IAM role with the ECS task definition. Grouping users with similar permissions requirements simplifies access management and ensures consistency. Using IAM roles for applications running on AWS services like ECS provides temporary security credentials dynamically, eliminating the need to hardcode or manage long-term keys.

Adım Adım Çözüm

1
Identify the user access requirement for the ten developers who need identical permissions.
Determine that creating an IAM user group and adding the developers to it is the AWS-recommended method to manage collective permissions.
Attaching policies to a group instead of individual users reduces administrative overhead and ensures consistent policy enforcement.
2
Identify the access requirement for the application running on Amazon ECS to access DynamoDB.
Determine that associating an IAM role with the ECS task definition is the secure way to grant permissions to services.
IAM roles provide temporary security credentials, avoiding the risk of hardcoding or exposing long-term access keys.

Anahtar Kavram

AWS IAM best practices including user groups for organizing user permissions and IAM roles for granting temporary credentials to services and applications.
Soru 193Soru →

A logistics company runs its tracking application using containerized microservices on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. To maintain a robust security posture, the company needs to define the boundaries of the AWS Shared Responsibility Model for this serverless container environment.

Which of the following security tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Patching the software and dependencies running inside the application container images; Configuring security groups to control inbound and outbound network traffic to the ECS tasks

Cevap

The customer is responsible for patching software and dependencies inside the application container images and configuring security groups to control inbound and outbound network traffic to the ECS tasks.
Under the AWS Shared Responsibility Model, serverless services like AWS Fargate shift host management responsibilities to AWS. The customer remains responsible for securing container contents (such as application code and package dependencies) and defining task-level firewall rules (such as security groups).

Adım Adım Çözüm

1
Identify the AWS service type and launch model used in the scenario.
The application runs on Amazon ECS with the AWS Fargate launch type, which is a serverless compute engine for containers.
This determines that the virtualization layer and underlying host operating system are fully managed by AWS.
2
Differentiate between customer responsibilities (security in the cloud) and AWS responsibilities (security of the cloud) for serverless container workloads.
The customer manages application code, data, container images, and network access rules (security groups). AWS manages physical facilities, host hardware, the host OS, and the hypervisor.
Correctly allocating tasks prevents security gaps and mapping errors on the exam.

Anahtar Kavram

Shared Responsibility Model for Serverless Container Services
Soru 194Soru →

A company is establishing its AWS environment and needs to define its identity and access management strategy. The security team must ensure that application servers running on Amazon EC2 can securely access files in Amazon S3, and that emergency administrative actions can be performed securely if primary identity systems fail. Which two AWS Identity and Access Management (IAM) best practices should the company implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate an IAM role with the EC2 instances using an instance profile, allowing the application to use temporary security credentials.; Configure the AWS account root user with multi-factor authentication (MFA), secure its login credentials, and use it only for tasks that explicitly require root permissions.

Cevap

The correct practices are to associate an IAM role with the EC2 instances using an instance profile and to configure the AWS account root user with multi-factor authentication (MFA) while securing its credentials for emergency-only use.
Associating an IAM role with an EC2 instance provides temporary security credentials dynamically, eliminating the need to store long-term access keys. Additionally, securing the AWS account root user with MFA and restricting its usage to emergency-only tasks is a fundamental AWS security best practice.

Adım Adım Çözüm

1
Determine the secure method for applications running on Amazon EC2 to access other AWS services like Amazon S3.
Identify that AWS recommends attaching an IAM role to the EC2 instances using an instance profile to provide temporary credentials.
This avoids hardcoding or storing permanent AWS access keys on the instance, reducing credential exposure risk.
2
Determine the security recommendations for the AWS account root user.
Identify that the root user should have MFA enabled and be reserved only for tasks requiring root privileges, while regular administrative tasks should be performed by IAM identities.
Securing the root user protects the highest-privileged credentials in the AWS account from misuse or compromise.
3
Analyze and eliminate incorrect options based on security best practices.
Eliminate choices recommending permanent access keys, root credential sharing, or using Service Control Policies to grant direct S3 permissions.
These practices either compromise security or misapply the purpose of AWS Organizations and IAM components.

Anahtar Kavram

AWS IAM Best Practices for EC2 access and Root User Security
Soru 195Soru →

An online retail company is preparing for its annual security audit. The internal compliance team needs to access and download official AWS security and compliance documents, such as SOC reports and ISO certifications, to verify the security posture of the AWS infrastructure. Which AWS service or portal provides on-demand access to these compliance reports?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact
AWS Artifact is the central resource for compliance-related information. It provides on-demand access to AWS security and compliance reports (such as SOC, ISO, and PCI reports) and allows customers to accept agreements with AWS.

Adım Adım Çözüm

1
Identify the core requirement of the retail company.
The company needs to download official AWS compliance documents, including SOC reports and ISO certifications.
This is a compliance auditing task rather than account activity logging or security threat monitoring.
2
Determine which AWS service acts as the central repository for compliance documentation.
AWS Artifact is the designated portal where customers can download AWS compliance reports and sign agreements.
AWS Artifact provides on-demand access to these reports at no additional cost.

Anahtar Kavram

AWS Artifact is the self-service portal that provides on-demand access to AWS compliance reports, such as Service Organization Control (SOC) and Payment Card Industry (PCI) reports, as well as agreements.
Soru 196Soru →

A logistics provider runs a custom inventory application on a fleet of Amazon EC2 instances. The provider wants to implement automated checks to identify known software package vulnerabilities and unintended network exposure on these instances. According to the AWS Shared Responsibility Model, which statement correctly identifies the party responsible for configuring these checks, and the AWS service that should be utilized?

Cevabı ve açıklamayı göster

Cevap: The customer is responsible for securing their guest operating systems and applications, and they should use Amazon Inspector to perform the vulnerability scans.

Cevap

The customer is responsible for securing their guest operating systems and applications, and they should configure Amazon Inspector to perform software package vulnerability and network exposure scans.
The correct option correctly identifies that under the AWS Shared Responsibility Model, the customer is responsible for the guest operating system and applications running on Amazon EC2. It also correctly specifies Amazon Inspector as the designated AWS service for scanning EC2 instances for software vulnerabilities and unintended network path exposure.

Adım Adım Çözüm

1
Determine the boundary of responsibility for Amazon EC2 instances under the AWS Shared Responsibility Model.
Since EC2 is an Infrastructure as a Service (IaaS) offering, the customer retains control over the guest operating system, application stack, and security configurations. Therefore, the customer, not AWS, is responsible for vulnerability scanning and patching of the OS and applications.
This step eliminates options that incorrectly shift the guest OS security and vulnerability scanning responsibility to AWS.
2
Identify the AWS service specifically designed for software package vulnerability scanning and network exposure checks on EC2 instances.
Amazon Inspector is the service that automates vulnerability management by scanning EC2 instances, Amazon ECR container images, and AWS Lambda functions for software vulnerabilities (CVEs) and unintended network path exposures.
This step distinguishes Amazon Inspector from other security services like Amazon GuardDuty (which does active threat detection) and AWS CloudTrail (which does API logging).

Anahtar Kavram

Vulnerability scanning on Amazon EC2 falls under the customer's side of the Shared Responsibility Model and is performed using Amazon Inspector.
Tahmini Süre:1m 30s
Soru 197Soru →

A healthcare provider plans to migrate its legacy patient database to Amazon RDS for MySQL. Under the AWS Shared Responsibility Model, which of the following operational tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring database user permissions and access control lists within the MySQL database engine

Cevap

Configuring database user permissions and access control lists within the MySQL database engine
Under the AWS Shared Responsibility Model for managed services such as Amazon RDS, AWS is responsible for the security of the cloud. This includes physical data center security, host operating system patching, and hardware maintenance. The customer remains responsible for security in the cloud, which includes data classification, encryption settings, database user authentication, and managing granular privileges within the database itself.

Adım Adım Çözüm

1
Identify the AWS service type in the scenario.
Amazon RDS is a managed database service (Platform as a Service / Database as a Service).
Defining the service model helps establish the boundary between customer and AWS responsibilities.
2
Differentiate between infrastructure management and data/access management tasks.
Tasks like physical hardware maintenance, host OS patching, and physical security belong to AWS. Database-level user permissions and data access control belong to the customer.
Applying the Shared Responsibility Model principles enables selection of the correct customer task.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Soru 198Soru →

A logistics enterprise is migrating its supply chain systems to AWS and must verify that the AWS infrastructure aligns with global security standards. The compliance team needs to access AWS's independent third-party audit reports and accept online agreements to meet regulatory requirements. Which of the following actions should the team perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Download AWS security and compliance documents, such as SOC and ISO reports, directly from AWS Artifact.; Accept AWS compliance agreements, such as Business Associate Addendums (BAAs), within the AWS Artifact portal.

Cevap

To obtain AWS compliance documentation and verify compliance, the team must download security reports directly from AWS Artifact and accept compliance agreements in the AWS Artifact portal.
The correct options are downloading compliance documents from AWS Artifact and accepting compliance agreements directly within the AWS Artifact portal. AWS Artifact is a self-service portal that provides on-demand access to AWS security and compliance reports and select online agreements.

Adım Adım Çözüm

1
Navigate to the AWS Artifact service in the AWS Management Console to find the self-service compliance reports.
Access to on-demand reports such as Service Organization Control (SOC) and International Organization for Standardization (ISO) certifications.
AWS Artifact is the primary portal for customers to access AWS compliance documentation.
2
Open the AWS Artifact Agreements section to review and accept regulatory agreements required for the workload.
Acceptance of online agreements such as the Business Associate Addendum (BAA) directly inside the console.
AWS Artifact allows customers to review and accept agreements that apply to their AWS accounts to meet regulatory compliance requirements.

Anahtar Kavram

AWS Artifact is the central self-service repository for retrieving AWS compliance reports and managing compliance agreements.
Soru 199Soru →

A fintech startup is deploying a digital wallet application. The environment consists of Amazon EC2 instances running payment processing software and containerized microservices hosted on Amazon Elastic Container Registry (Amazon ECR). The security team requires a solution to automatically scan these instances and container images for software vulnerabilities, and to continuously analyze log sources like VPC Flow Logs and CloudTrail events to detect malicious activity or unauthorized behavior. Which AWS services should the startup use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector; Amazon GuardDuty

Cevap

The correct services are Amazon Inspector and Amazon GuardDuty.
Amazon Inspector satisfies the requirement to scan Amazon EC2 instances and Amazon ECR container images for software vulnerabilities. Amazon GuardDuty satisfies the requirement to continuously monitor log sources like VPC Flow Logs and AWS CloudTrail events for active threats and malicious activity.

Adım Adım Çözüm

1
Analyze the requirement for vulnerability scanning of Amazon EC2 instances and Amazon ECR container images.
Amazon Inspector is identified as the AWS service that automates software vulnerability and network exposure scans for these resources.
Inspector has native integration to scan EC2 instances and ECR repositories.
2
Analyze the requirement for continuous monitoring and threat detection of malicious activity using logs (VPC Flow Logs, CloudTrail, DNS).
Amazon GuardDuty is identified as the service that performs intelligent threat detection using these log sources.
GuardDuty uses machine learning and threat intelligence feeds to detect anomalies and unauthorized behavior in AWS accounts.
3
Evaluate and eliminate incorrect services based on their primary functions.
AWS CloudTrail, Amazon CloudWatch, and Amazon Macie are excluded as they do not perform the requested combination of host vulnerability scanning and broad threat detection.
CloudTrail is for API logging, CloudWatch is for performance monitoring and basic log management, and Macie is restricted to finding sensitive data within S3 buckets.

Anahtar Kavram

Identifying the respective purposes of Amazon Inspector for vulnerability scanning and Amazon GuardDuty for threat detection, while distinguishing them from logging, monitoring, and data privacy services.
Soru 200Soru →

A financial technology startup has deployed application microservices across multiple AWS accounts. To protect their workloads, the startup's security team needs to implement a solution that continuously scans their container images and virtual machines for software vulnerabilities, while also analyzing log sources (such as VPC Flow Logs and DNS query logs) to detect active threats and potential data exfiltration. Which of the following AWS services should the startup configure to address both of these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty to continuously monitor and analyze log sources for active security threats and anomalous behaviors.; Amazon Inspector to automatically scan container images and virtual machine instances for known software vulnerabilities.

Cevap

Amazon GuardDuty for active threat detection and Amazon Inspector for vulnerability scanning
Amazon GuardDuty and Amazon Inspector are the correct choices. Amazon GuardDuty is the managed intelligent threat detection service that monitors VPC Flow Logs, DNS logs, and CloudTrail event logs to identify threats like command-and-control communication or data exfiltration. Amazon Inspector is the automated vulnerability management service that scans EC2 instances and ECR container images for software vulnerabilities and unintended network exposure.

Adım Adım Çözüm

1
Analyze the requirement for active threat detection based on log monitoring.
Identify that the startup needs to detect anomalies and unauthorized activities by analyzing DNS logs and VPC Flow Logs.
Amazon GuardDuty uses machine learning and threat intelligence to analyze AWS logs (CloudTrail, VPC Flow Logs, DNS query logs) to detect active threats.
2
Analyze the requirement for host and container vulnerability management.
Identify that the startup needs to scan virtual machines and container images for software vulnerabilities.
Amazon Inspector is designed specifically to automate vulnerability assessment for Amazon EC2 workloads and Amazon Elastic Container Registry (ECR) images.
3
Evaluate and eliminate incorrect services based on their functions.
Exclude AWS CloudTrail, Amazon Macie, and AWS Shield as they perform auditing, sensitive data discovery, and DDoS protection respectively, rather than host vulnerability scanning or broad log-based threat detection.
Correctly identifying the primary purpose of each AWS security service ensures compliance with the AWS Shared Responsibility Model and architectural best practices.

Anahtar Kavram

AWS Threat Detection and Vulnerability Management using Amazon GuardDuty and Amazon Inspector
Tahmini Süre:2m 0s
ÖncekiSayfa 10 / 23Sonraki
Security and Compliance Alıştırma Soruları — AWS Certified Cloud Practitioner — Sayfa 10 | Examkin