Examkin

Security and Compliance

441 soru

Tüm türler441Çoktan seçmeli225Çoklu seçim216
Soru 341Soru →

A game development studio is deploying dedicated multiplayer game servers on Amazon Elastic Compute Cloud (Amazon EC2). According to the AWS Shared Responsibility Model, which two operational security tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Patching the guest operating system of the game server instances; Configuring the guest operating system firewalls on the EC2 instances

Cevap

The customer is responsible for patching the guest operating system of the game server instances and configuring the guest operating system firewalls on the EC2 instances.
Under the AWS Shared Responsibility Model, Amazon EC2 is treated as an Infrastructure as a Service (IaaS) model. In this setup, the customer maintains control of the guest operating system, which includes the responsibility to apply OS patches and configure software firewalls within the instances. AWS handles the physical infrastructure and the virtualization layer.

Adım Adım Çözüm

1
Identify the service type and model boundary in the scenario.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, meaning the customer maintains full control over the guest operating system, network configurations, and data.
Determining whether the service is IaaS, PaaS, or SaaS helps establish where the boundary between customer and AWS responsibility lies.
2
Differentiate between security 'of' the cloud and security 'in' the cloud.
AWS secures the global infrastructure, physical hardware, and virtualization layers. The customer secures their data, operating systems, and network access controls.
Categorizing tasks using this distinction helps identify which responsibilities belong to the customer.

Anahtar Kavram

Shared Responsibility Model for IaaS Services
Soru 342Soru →

A municipal public transit authority is migrating its ticketing database and web applications to the AWS Cloud. During an audit, the compliance officer asks who is responsible for configuring firewall rules (such as security groups) to protect the applications, and how the authority can verify AWS's physical infrastructure compliance. Which of the following statements correctly identifies the responsibility mapping and the service needed to retrieve the necessary AWS compliance reports?

Cevabı ve açıklamayı göster

Cevap: The customer is responsible for configuring security groups; AWS compliance documents are retrieved using AWS Artifact.

Cevap

The customer is responsible for configuring security groups, and AWS compliance documents are retrieved using AWS Artifact.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes defining firewall rules via security groups. To download AWS's official compliance documentation (like ISO and PCI certifications), the customer must use AWS Artifact, which is the central portal for these agreements and reports.

Adım Adım Çözüm

1
Identify the security group configuration responsibility within the Shared Responsibility Model.
Customers are responsible for security 'in' the cloud, which includes configuring guest operating systems, network access control lists, and security groups.
AWS manages the global infrastructure, while the customer controls their resources and access configurations.
2
Identify the AWS service dedicated to providing compliance reports and agreements.
AWS Artifact provides on-demand access to AWS security and compliance reports (such as SOC and PCI reports) and online agreements.
Other services like CloudTrail or Trusted Advisor serve different auditing or optimization functions.

Anahtar Kavram

Understanding compliance reports retrieval and the Shared Responsibility Model boundaries.
Tahmini Süre:1m 0s
Soru 343Soru →

An organization runs automated database backup scripts on its on-premises servers. These scripts need to upload backups to an Amazon S3 bucket. To comply with security best practices, the organization wants to avoid storing long-term access keys on the physical servers. Which IAM solution should the organization implement to grant these scripts secure, temporary access?

Cevabı ve açıklamayı göster

Cevap: AWS IAM Roles Anywhere

Cevap

AWS IAM Roles Anywhere
AWS IAM Roles Anywhere is the correct solution because it allows workloads running outside of AWS, such as on-premises servers, to use digital certificates to authenticate and obtain temporary AWS credentials by assuming an IAM role. This eliminates the security risk of storing long-term AWS access keys on physical infrastructure.

Adım Adım Çözüm

1
Identify the requirements: the workload runs on-premises, needs access to Amazon S3, and must not store long-term access keys.
Conclude that standard IAM roles cannot be directly assumed by on-premises servers without a secure mechanism to authenticate them.
On-premises servers do not have access to the AWS Instance Metadata Service, which automatically distributes credentials to AWS-native resources.
2
Evaluate AWS services designed for hybrid security integration.
Determine that AWS IAM Roles Anywhere is the designated feature that allows external workloads to exchange X.509 digital certificates for temporary AWS credentials.
This establishes trust between the on-premises environment and AWS to provision short-term security credentials dynamically without storing long-term access keys.

Anahtar Kavram

AWS IAM Roles Anywhere provides temporary security credentials for workloads outside of AWS.
Soru 344Soru →

A newly hired cloud administrator needs to perform daily operational tasks in the AWS Management Console, such as configuring network settings and managing Amazon S3 buckets. Which AWS security best practice should be followed to grant these permissions?

Cevabı ve açıklamayı göster

Cevap: Create an individual IAM user with the necessary permissions for the administrator's daily tasks.

Cevap

Create an individual IAM user with the necessary permissions for the administrator's daily tasks.
Creating an individual IAM user for daily tasks aligns with the AWS best practice of maintaining separate identities for auditing and applying the principle of least privilege, while avoiding the use of the root user.

Adım Adım Çözüm

1
Analyze the operational requirements.
A new internal administrator needs persistent access to the AWS Management Console to perform everyday administrative tasks such as configuring networks and S3.
Understanding the identity type and access frequency helps determine the correct IAM entity to use.
2
Apply AWS security best practices for identity management.
The AWS account root user should not be used for daily tasks. Instead, an individual IAM user should be created with standard administrator permissions mapped to their specific identity.
This establishes individual accountability, supports the principle of least privilege, and protects the root account.

Anahtar Kavram

AWS IAM Best Practices - Avoiding Root User and Using Individual IAM Users
Tahmini Süre:45s
Soru 345Soru →

A SaaS provider hosts its web application on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (Amazon ECR). The security team needs to implement automated tools to accomplish two tasks:
1. Continually scan the EC2 instances and container images for software vulnerabilities and unintended network exposure.
2. Monitor AWS account activity and network traffic to detect anomalous behavior, potential unauthorized access, and malicious threats.

Which two AWS services should the company use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector; Amazon GuardDuty

Cevap

Amazon Inspector and Amazon GuardDuty should be used to scan for software vulnerabilities and detect malicious threats, respectively.
Amazon Inspector automatically and continuously scans EC2 instances and ECR container images for software vulnerabilities and unintended network exposure. Amazon GuardDuty provides continuous threat detection by monitoring AWS account activity and network traffic to identify potential malicious activity.

Adım Adım Çözüm

1
Identify the service responsible for scanning EC2 instances and ECR container images for software vulnerabilities and network exposure.
Amazon Inspector performs vulnerability scanning on Amazon EC2 instances and Amazon ECR images.
This meets the first requirement of detecting software vulnerabilities and unintended network exposure.
2
Identify the service responsible for monitoring AWS account activity and network traffic to detect anomalous or malicious behavior.
Amazon GuardDuty provides continuous threat detection by analyzing events and log data.
This meets the second requirement of detecting threats, unauthorized access, and malicious activity.

Anahtar Kavram

AWS threat detection and vulnerability management services
Tahmini Süre:1m 30s
Soru 346Soru →

A media broadcasting company is preparing for an annual governance review of its cloud-based video archiving system. The governance team needs to acquire official AWS ISO 27001 certification documents and clarify how the security of AWS's physical infrastructure is validated. Which two of the following options represent correct actions or concepts that meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Retrieve the AWS ISO 27001 certification report directly from AWS Artifact.; Rely on AWS compliance reports for physical infrastructure security, as AWS is responsible for security of the cloud.

Cevap

To meet the governance requirements, the company should retrieve the AWS ISO 27001 certification report directly from AWS Artifact, and rely on AWS compliance reports for physical infrastructure security, as AWS is responsible for security of the cloud.
Retrieving the AWS ISO 27001 certification report directly from AWS Artifact is correct because AWS Artifact is the self-service portal that provides on-demand access to AWS security and compliance reports. Relying on AWS compliance reports for physical infrastructure security is correct because, under the Shared Responsibility Model, AWS is responsible for security of the cloud (the physical infrastructure), and customers verify this inheritance through these reports.

Adım Adım Çözüm

1
Identify where to retrieve official AWS compliance documents.
AWS Artifact is identified as the portal providing on-demand access to AWS security and compliance reports (such as SOC and ISO certifications).
This resolves the requirement of acquiring the official AWS ISO 27001 certification.
2
Determine the boundary of security responsibility for physical infrastructure under the Shared Responsibility Model.
Under the model, AWS is responsible for security 'of' the cloud, which includes the physical infrastructure of data centers.
This clarifies how physical security is validated without needing custom audits.

Anahtar Kavram

AWS compliance reports retrieval via AWS Artifact and boundaries of physical security under the Shared Responsibility Model.
Soru 347Soru →

A logistics company is building a package tracking system on AWS. The company's security policy requires that all package destination logs must be encrypted at rest. Which of the following are customer responsibilities for protecting this data? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enabling encryption on the AWS storage services where the logs are stored; Managing access permissions for the keys used to encrypt the logs

Cevap

Under the AWS Shared Responsibility Model, the customer is responsible for enabling encryption on the storage services where their logs reside, and managing the access permissions for the keys used to encrypt those logs.
Under the AWS Shared Responsibility Model, customers are responsible for data protection settings within the services they use ('security in the cloud'). This includes configuring encryption at rest for storage resources (such as Amazon S3 buckets or Amazon EBS volumes) and managing access permissions for the cryptographic keys used to encrypt that data. AWS, on the other hand, is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud ('security of the cloud').

Adım Adım Çözüm

1
Identify the boundary between customer responsibility and AWS responsibility regarding data protection.
Recognize that 'security in the cloud' (such as configuring encryption on storage services and managing key access) is the customer's responsibility, while 'security of the cloud' (physical security and hardware maintenance) is AWS's responsibility.
This helps eliminate options that involve physical data center security or hardware replacements.
2
Evaluate the remaining options to identify correct key management and encryption practices.
Confirm that configuring encryption on storage services and managing key permissions are correct customer duties, whereas AWS CloudHSM is a dedicated service requiring manual key administration rather than automatic global service integration.
This isolates the two correct actions.

Anahtar Kavram

AWS Shared Responsibility Model for Data Encryption
Tahmini Süre:45s
Soru 348Soru →

An online education platform is deploying a new serverless application using AWS Lambda functions. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring the Identity and Access Management (IAM) execution role and access policies for the Lambda function.

Cevap

Configuring the Identity and Access Management (IAM) execution role and access policies for the Lambda function.
Configuring the IAM execution role and access policies is a customer responsibility under security 'in' the cloud. The customer must define permissions to ensure the function only accesses the resources it requires (least privilege rule).

Adım Adım Çözüm

1
Analyze the service classification specified in the scenario.
The application runs on AWS Lambda, which is classified as a serverless/managed service.
Different service categories (IaaS vs. PaaS/Serverless) shift the boundaries of the Shared Responsibility Model, with AWS taking on more administrative responsibilities for managed services.
2
Determine the boundary between AWS and customer responsibilities for managed serverless resources.
AWS manages physical security, virtualization, container OS, and execution runtimes. The customer manages application code, data classification, and Identity and Access Management (IAM) permissions.
This division isolates infrastructure maintenance from application-level configurations and security settings.
3
Evaluate the choices to locate the one that describes a customer configuration task.
Configuring IAM execution roles is an access management task performed by the customer inside the console or API.
IAM settings are always managed by the customer to maintain control over authorization and resource access.

Anahtar Kavram

Shared Responsibility Model for Serverless Services
Tahmini Süre:1m 30s
Soru 349Soru →

A company is setting up a new AWS account and needs to organize access permissions for several system administrators and developers. According to AWS Identity and Access Management (IAM) best practices, which TWO statements correctly describe the characteristics and usage of IAM groups? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: They allow administrators to assign permissions to multiple IAM users simultaneously by attaching a policy to the group.; They are collections of IAM users and do not possess their own login credentials or access keys.

Cevap

The correct statements are that IAM groups allow administrators to assign permissions to multiple users at once by attaching a policy, and that they are collections of users without their own security credentials.
IAM groups are designed to simplify permission management by allowing administrators to apply policies to multiple users at once. Because they are administrative collections rather than entities that take action, they do not have login credentials or access keys of their own.

Adım Adım Çözüm

1
Analyze the role and capabilities of IAM groups in AWS.
Identify that IAM groups are collections of IAM users used to simplify permission management. Policies attached to a group are inherited by all member users.
This helps determine which options correctly state how groups function.
2
Examine the credentials and structure of IAM groups.
Confirm that IAM groups do not have their own password or access keys, and cannot be nested or assumed by AWS services.
This allows us to identify the second correct statement and rule out the incorrect statements.

Anahtar Kavram

IAM groups simplify access management by applying policies to multiple users at once, and they do not have credentials or support nesting.
Soru 350Soru →

A digital publishing company requires a solution to track changes made to its AWS infrastructure resources, specifically recording who made a configuration change and when. At the same time, the company needs to monitor application log files for specific error patterns and trigger automated alerts. Which AWS services are designed to address these requirements?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail for tracking user and API activity, and Amazon CloudWatch for monitoring log files and sending alerts.

Cevap

AWS CloudTrail for tracking user and API activity, and Amazon CloudWatch for monitoring log files and sending alerts.
AWS CloudTrail records user activity and API calls, allowing the company to track changes and audit who performed specific actions. Amazon CloudWatch is used to collect logs, monitor application performance, and configure alarms when specific log patterns or thresholds are met.

Adım Adım Çözüm

1
Identify the service responsible for auditing API actions and user modifications to resources.
AWS CloudTrail records AWS Management Console actions and API calls.
CloudTrail provides operational and risk auditing of AWS account activity.
2
Identify the service responsible for collecting application logs, monitoring metrics, and triggering alerts.
Amazon CloudWatch monitors resource performance and collects logs to trigger alarms.
CloudWatch provides real-time monitoring and alerting for application metrics and log patterns.

Anahtar Kavram

AWS CloudTrail provides compliance auditing of API calls, while Amazon CloudWatch provides performance monitoring and log alerting.
Tahmini Süre:1m 5s
Soru 351Soru →

A multi-department enterprise is setting up its AWS environment. The security team must define access controls for two distinct groups: a finance audit team that requires read-only access to AWS billing information, and an operations team that needs to start, stop, and reboot Amazon EC2 instances. Which TWO of the following configurations represent AWS-recommended IAM best practices to implement this access? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM user group for the audit team, attach the AWS-managed Billing policy to it, and assign individual audit users to this group.; Create an IAM user group for the operations team, attach a customer-managed policy that permits the necessary EC2 actions to it, and assign individual operations users to this group.

Cevap

Create an IAM user group for the audit team, attach the AWS-managed Billing policy to it, and assign individual audit users to this group; and create an IAM user group for the operations team, attach a customer-managed policy that permits the necessary EC2 actions to it, and assign individual operations users to this group.
The correct configurations involve creating separate IAM user groups for the audit and operations teams, attaching targeted permission policies, and placing individual users into those groups. This aligns with AWS security best practices by avoiding direct policy assignment to users and applying the principle of least privilege.

Adım Adım Çözüm

1
Analyze the access requirements for the audit and operations teams.
The audit team needs read-only billing access. The operations team needs partial EC2 access (start, stop, reboot).
This establishes the minimum permissions needed for each team to apply the principle of least privilege.
2
Identify the AWS identity best practices for organizing access.
Instead of assigning policies to individual users or sharing credentials, users should be placed in IAM user groups with specific permission policies attached.
Grouping users simplifies permission management and ensures consistency across roles.
3
Evaluate the option configurations against security standards.
Creating separate groups for audit and operations with specific policies is correct. Using root accounts, sharing users, or requesting AWS to manage OS access are incorrect configurations.
This rules out distractors based on security anti-patterns and the Shared Responsibility Model.

Anahtar Kavram

Principle of least privilege and IAM user groups management
Tahmini Süre:1m 30s
Soru 352Soru →

An organization is deploying a web application on Amazon EC2 instances. The security team must ensure that inbound HTTP traffic to port 80 is permitted, and that the corresponding outbound response traffic is automatically allowed back to the client without needing a corresponding outbound rule. Which AWS security feature should be configured to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Security Groups

Cevap

Security Groups are stateful firewalls that operate at the instance level. When you allow inbound traffic on port 80, the return traffic is automatically allowed regardless of outbound rules. Network Access Control Lists (NACLs) are stateless and would require an explicit outbound rule. Amazon Inspector is a vulnerability scanner, and AWS Shield is for DDoS protection.
Security Groups are stateful firewalls operating at the instance level. Any permitted inbound traffic automatically allows the outbound response traffic to flow back, bypassing outbound rules. This aligns perfectly with the requirement to allow inbound HTTP traffic on port 80 and have the response traffic automatically permitted.

Adım Adım Çözüm

1
Analyze the requirement for automatic return traffic.
The requirement specifies that outbound response traffic must be automatically permitted without an explicit outbound rule, indicating a stateful firewall behavior.
Identifying the stateful nature narrows the choices down to Security Groups, since they are stateful at the EC2 instance level.
2
Compare Security Groups and Network ACLs.
Security Groups are stateful (allowing return traffic automatically), while Network ACLs are stateless (requiring explicit rules in both directions).
This confirms that Security Groups are the correct configuration option to meet the organization's requirements.

Anahtar Kavram

Stateful vs. stateless network security controls in AWS VPC (Security Groups vs. Network ACLs)
Tahmini Süre:1m 0s
Soru 353Soru →

A retail company wants to store its weekly sales reports in Amazon Simple Storage Service (Amazon S3). To protect this data, they want to enable encryption at rest using cryptographic keys that are fully managed by AWS. Which AWS service is designed to easily create and manage these encryption keys?

Cevabı ve açıklamayı göster

Cevap: AWS Key Management Service (AWS KMS)

Cevap

AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) is a fully managed service that integrates with many AWS services (such as Amazon S3) to easily create, manage, and rotate cryptographic keys used to secure data at rest.

Adım Adım Çözüm

1
Identify the core requirement from the scenario.
The requirement is to encrypt data at rest in Amazon S3 using a fully managed key management service.
This narrows down the choice to services that deal with encryption and key management.
2
Evaluate the managed services offered by AWS for cryptographic key management.
AWS Key Management Service (AWS KMS) is the standard multi-tenant managed service for creating and managing keys. AWS CloudHSM offers dedicated hardware security modules but requires manual management by the customer.
Since the scenario specifies a fully managed service that easily creates and manages keys, AWS KMS is the correct fit.

Anahtar Kavram

AWS Key Management Service (AWS KMS) provides a fully managed, secure solution for creating and controlling cryptographic keys to encrypt data at rest across AWS services.
Tahmini Süre:45s
Soru 354Soru →

A logistics company is using Amazon Simple Queue Service (SQS) to decouple its order processing systems. Under the AWS Shared Responsibility Model, which TWO of the following tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring IAM policies to authorize specific applications and microservices to send and receive messages from the queues; Configuring server-side encryption (SSE) for the queues and managing the access permissions of the associated KMS keys

Cevap

Configuring IAM policies to authorize specific applications and microservices, and configuring server-side encryption (SSE) for the queues.
Under the AWS Shared Responsibility Model, customers are responsible for securing their data and access to resources (security 'in' the cloud). For a managed service like Amazon SQS, this includes defining IAM policies to regulate queue access and configuring server-side encryption (SSE) along with permissions for AWS KMS keys. AWS maintains the security 'of' the cloud, managing SQS server OS patches, infrastructure scaling, and message replication.

Adım Adım Çözüm

1
Differentiate between customer-managed tasks and AWS-managed tasks for fully managed services under the Shared Responsibility Model.
Identify that AWS manages host OS patching and queue replication across Availability Zones.
This rules out tasks related to physical infrastructure and service maintenance.
2
Determine tasks that fall under customer-controlled data protection and access management configurations.
Identify that configuring IAM policies and enabling KMS encryption keys are customer responsibilities.
This establishes the correct actions for securing queue access and data.
3
Analyze how AWS compliance reports are retrieved and audited.
Determine that reports are obtained via AWS Artifact rather than querying CloudWatch Logs.
This eliminates the incorrect auditing method option.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Soru 355Soru →

A travel booking startup wants to establish a logging and monitoring workflow on AWS. The security team needs to audit and track all API calls and user changes made within the AWS account for compliance. The operations team needs to monitor the CPU usage of their Amazon EC2 instances and receive alerts if utilization goes above a threshold. Which AWS services should the startup implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to capture and audit API activity across the AWS infrastructure; Amazon CloudWatch to collect resource metrics and trigger alerts when performance thresholds are exceeded

Cevap

AWS CloudTrail and Amazon CloudWatch should be implemented.
AWS CloudTrail is correct because it provides continuous tracking of user actions and API calls across AWS services, serving the compliance and auditing needs. Amazon CloudWatch is correct because it monitors performance metrics like CPU usage and supports automated alarms when specified thresholds are exceeded.

Adım Adım Çözüm

1
Identify the requirement to audit and track API calls and user changes for compliance.
AWS CloudTrail is selected as the primary service for recording API activity and user actions.
CloudTrail provides operational and risk auditing, governance, and compliance logs.
2
Identify the requirement to monitor EC2 CPU usage and receive threshold alerts.
Amazon CloudWatch is selected to monitor performance metrics and configure alarms.
CloudWatch collects monitoring data and enables real-time alarms on performance metrics like CPU utilization.

Anahtar Kavram

AWS logging, monitoring, and auditing services
Soru 356Soru →

A company wants to share a dataset stored in an Amazon S3 bucket with a partner organization's AWS account. The company wants to grant this access by attaching a policy directly to the S3 bucket itself, specifying who can access it. Which type of policy should the company use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Resource-based policy

Cevap

Resource-based policy
A resource-based policy, such as an Amazon S3 bucket policy, is attached directly to the resource itself. It allows the owner of the resource to specify which principals (including users, roles, or other AWS accounts) have permission to access that specific resource.

Adım Adım Çözüm

1
Identify where the permissions policy needs to be attached according to the scenario.
The scenario requires the policy to be attached directly to the S3 bucket (which is a resource) rather than an IAM user or role.
This establishes that the solution requires a resource-level control mechanism.
2
Determine which AWS policy type is designed to be attached directly to resources and support cross-account principals.
Resource-based policies (such as S3 bucket policies) meet this requirement by directly identifying external AWS account IDs in the 'Principal' element.
This confirms that a resource-based policy is the correct mechanism for this resource-sharing scenario.

Anahtar Kavram

Resource-based policies are attached directly to AWS resources (like S3 buckets or KMS keys) and define which principals (including external AWS accounts) can access that resource.
Soru 357Soru →

A company is configuring a multi-tier web application within an Amazon VPC and needs to implement granular network security controls. The network architect plans to use a combination of Security Groups and Network Access Control Lists (Network ACLs) to secure the application instances and subnets. Which of the following statements correctly describe how Security Groups and Network ACLs handle inbound and outbound traffic? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security Groups are stateful, meaning allowed inbound traffic is automatically permitted to flow outbound as return traffic.; Network ACLs are stateless, meaning return traffic for allowed inbound requests must be explicitly permitted by an outbound rule.

Cevap

Security Groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit rules for return traffic).
Security Groups are stateful firewalls that operate at the instance level (network interface level). Any allowed inbound traffic automatically permits the corresponding outbound return traffic. In contrast, Network ACLs are stateless firewalls that operate at the subnet level. They do not remember connection states, so outbound return traffic must be explicitly allowed by an outbound rule.

Adım Adım Çözüm

1
Analyze how Security Groups process traffic state.
Security Groups are stateful; once inbound traffic is allowed, the outbound return traffic is automatically allowed.
This is a fundamental design feature of Security Groups to simplify instance-level firewall management.
2
Analyze how Network ACLs process traffic state.
Network ACLs are stateless; they do not track connection state, meaning separate rules are required for inbound and outbound traffic.
This allows subnet-level filtering to have separate controls for ingress and egress traffic.
3
Identify the correct statements and eliminate incorrect options.
The statements defining Security Groups as stateful and Network ACLs as stateless are correct. The statements suggesting the opposite, reversing their operational levels (subnet vs. instance), or misdefining Amazon Inspector are incorrect.
This aligns with the AWS Shared Responsibility Model and core networking concepts in VPC.

Anahtar Kavram

Stateful Security Groups vs. Stateless Network ACLs
Soru 358Soru →

A software development firm is deploying its microservices-based application using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring security groups to control network traffic allowed to reach the containers

Cevap

Configuring security groups to control network traffic allowed to reach the containers
Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud.' When using AWS Fargate, AWS handles the host operating system, hypervisor, and physical security. The customer maintains control over, and responsibility for, configuring the security groups to manage inbound and outbound network traffic to their container tasks.

Adım Adım Çözüm

1
Identify the service deployment model used in the scenario.
The application runs on Amazon ECS using the AWS Fargate launch type, which is a serverless/managed container environment.
Determining the service type helps define the boundary lines of the Shared Responsibility Model, separating customer tasks from AWS infrastructure tasks.
2
Evaluate the operational tasks against customer and AWS boundaries.
Configuring security groups to filter container traffic is a customer task, while host patching, physical security, and direct host compliance access are managed by AWS.
Under the Shared Responsibility Model, customers are responsible for managing access configurations (security in the cloud) such as security groups for container tasks.

Anahtar Kavram

Shared Responsibility Model
Soru 359Soru →

A logistics company suspects that credentials for one of its administrative accounts have been compromised, leading to unauthorized resource creation in multiple AWS Regions. The security team wants to implement a service that continuously monitors their AWS accounts for malicious activity and anomalies, such as unauthorized API calls or unusual network traffic, without needing to write custom detection rules. Which AWS service should the company use to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty

Cevap

Amazon GuardDuty is the correct AWS service to continuously monitor accounts for malicious activity and anomalies, such as unauthorized API calls, using intelligent threat detection.
Amazon GuardDuty is correct because it is a managed threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity, utilizing machine learning and anomaly detection to identify compromised credentials, unauthorized access, and malicious API patterns.

Adım Adım Çözüm

1
Analyze the requirement for continuous, automated threat detection and account-level monitoring for compromised credentials and malicious activity.
Identify that the solution must analyze sources like CloudTrail events, VPC Flow Logs, and DNS logs to discover anomalies automatically.
This establishes the scope of security monitoring and logging needed for the scenario.
2
Evaluate the AWS security services to find the one that performs intelligent threat detection without requiring manual detection rule creation.
Select Amazon GuardDuty, as it uses machine learning and anomaly detection to identify threats like credential compromise across AWS accounts.
This distinguishes Amazon GuardDuty from performance monitoring tools, vulnerability scanners, or infrastructure DDoS protection.

Anahtar Kavram

AWS Security Logging, Monitoring, and Auditing using Amazon GuardDuty for threat detection.
Soru 360Soru →

A startup is setting up an application on AWS and must encrypt its customer data at rest. According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility regarding data protection?

Cevabı ve açıklamayı göster

Cevap: Enabling and configuring encryption for the application's storage volumes

Cevap

Enabling and configuring encryption for the application's storage volumes
The correct answer is correct because configuring and enabling encryption for customer-controlled assets (such as storage volumes and database instances) is a customer responsibility ('Security in the Cloud') under the AWS Shared Responsibility Model.

Adım Adım Çözüm

1
Identify the boundary between customer and AWS responsibilities under the Shared Responsibility Model.
AWS is responsible for 'Security of the Cloud' (physical infrastructure, hardware, virtualization layer), while the customer is responsible for 'Security in the Cloud' (customer data, platform, applications, identity and access management).
This establishes which operations fall under AWS control versus customer control.
2
Evaluate the choices to determine which action is performed by the customer.
Enabling and configuring encryption on storage volumes is a configuration task performed by the customer on their own resources ('Security in the Cloud'). Tasks like physical security of hardware and drive decommissioning are 'Security of the Cloud' managed by AWS.
This identifies the correct customer responsibility.

Anahtar Kavram

Under the AWS Shared Responsibility Model, customers are responsible for data protection configuration (Security in the Cloud), such as enabling encryption on storage volumes, while AWS manages the physical security and infrastructure (Security of the Cloud).
ÖncekiSayfa 18 / 23Sonraki
Security and Compliance Alıştırma Soruları — AWS Certified Cloud Practitioner — Sayfa 18 | Examkin