Examkin

Security and Compliance

441 soru

Tüm türler441Çoktan seçmeli225Çoklu seçim216
Soru 381Soru →

A gaming company is deploying multiplayer session backends on Amazon Elastic Compute Cloud (Amazon EC2) instances. The system requires temporary outbound ports to be opened dynamically to send traffic back to clients. The security team wants to ensure that any outbound response traffic for established inbound connections is allowed automatically without needing to define explicit outbound rules. Additionally, these rules must apply directly at the instance level. Which AWS network security feature should the company use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Security Groups

Cevap

Security Groups
Security groups act as stateful firewalls for EC2 instances, operating at the virtual interface level. Because they are stateful, any allowed inbound traffic automatically permits the corresponding outbound response traffic, regardless of any outbound security group rules.

Adım Adım Çözüm

1
Analyze the requirement for instance-level traffic filtering.
Identify that firewalls at the instance level in AWS are Security Groups, whereas Network ACLs operate at the subnet level.
This narrows the choice down to instance-level firewalls.
2
Evaluate the requirement for automatically allowing return traffic without explicit outbound rules.
Understand that stateful firewalls automatically track connection state and allow return traffic, which is a key feature of Security Groups.
This distinguishes the stateful nature of Security Groups from the stateless nature of Network ACLs, which require explicit rules for return traffic.

Anahtar Kavram

Stateful instance-level security versus stateless subnet-level security in VPCs
Tahmini Süre:1m 15s
Soru 382Soru →

A digital art platform stores high-resolution images in an Amazon S3 bucket. The platform's compliance team requires all stored images to be encrypted at rest. The platform wants a fully managed solution where AWS handles the maintenance, clustering, and scaling of the underlying hardware security modules (HSMs), while the customer manages access policies for the encryption keys. Which AWS service should the platform use to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: AWS Key Management Service (AWS KMS)

Cevap

AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) is a fully managed service that allows customers to create, manage, and control cryptographic keys. With AWS KMS, AWS manages the underlying hardware security modules (HSMs) for operations such as maintenance, clustering, and scaling, while the customer remains responsible for key access policies and key usage, satisfying the requirement for a fully managed key storage solution.

Adım Adım Çözüm

1
Identify the primary requirement of the scenario.
The platform needs to encrypt S3 data at rest using a managed key service where AWS maintains the physical hardware security modules (HSMs) and the customer manages access control.
Defining the technical requirements helps narrow down the service options between fully managed key management and dedicated hardware modules.
2
Compare AWS Key Management Service (AWS KMS) and AWS CloudHSM.
AWS KMS is a multi-tenant, fully managed service where AWS manages HSM provisioning and scaling. AWS CloudHSM is a single-tenant, dedicated HSM service where the customer is responsible for HSM cluster management and administration.
Distinguishing between managed services and dedicated hardware modules determines which service meets the operational and compliance constraints of the platform.

Anahtar Kavram

AWS Key Management Service (AWS KMS) vs AWS CloudHSM and Shared Responsibility for Data Protection
Soru 383Soru →

A company wants to allow its corporate employees to log in to the AWS Management Console using their existing Active Directory credentials. The security team wants to avoid the administrative overhead of creating and managing individual IAM users for each employee. Which of the following is the AWS-recommended approach to grant this access?

Cevabı ve açıklamayı göster

Cevap: Configure identity federation to grant employees temporary security credentials by assuming an IAM role.

Cevap

Configure identity federation to grant employees temporary security credentials by assuming an IAM role.
Identity federation enables external users to access AWS resources securely using their existing corporate credentials. Instead of creating individual IAM users, the identity provider authenticates the users, and AWS maps their identity to an IAM role. The role provides them with temporary security credentials to access the AWS Management Console.

Adım Adım Çözüm

1
Identify the requirement for using existing Active Directory credentials without creating individual IAM users in the AWS account.
The requirement points to identity federation, which maps external identities to AWS resources.
Identity federation eliminates the administrative overhead of managing separate credentials in AWS.
2
Select the secure mechanism to delegate permissions to these federated identities.
IAM roles are used to delegate temporary security credentials to trusted external entities.
Using roles ensures that external users do not require permanent IAM user credentials to access AWS resources.

Anahtar Kavram

Identity federation and IAM roles for external user access
Tahmini Süre:1m 0s
Soru 384Soru →

A financial services firm hosts a reporting database on Amazon EC2 instances in a private subnet. A cloud practitioner needs to configure network security controls to protect the database. They must implement both a security group and a network access control list (network ACL). Which of the following statements correctly describe the behavior of these security controls? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The security group automatically allows outbound response traffic if the inbound request is allowed on port 33063306, because security groups are stateful.; The network ACL requires an outbound rule to allow response traffic even if the inbound request on port 33063306 is allowed, because network ACLs are stateless.

Cevap

The correct answers are the statements describing that security groups automatically allow return traffic because they are stateful, and that network ACLs require an outbound rule to allow return traffic because they are stateless.
Security groups are stateful, which means they automatically allow return traffic for any established connection. Network ACLs are stateless, meaning they evaluate traffic going in and out of the subnet independently. Therefore, to support a database connection, a network ACL requires explicit rules for both inbound database request traffic and outbound return traffic, whereas a security group only requires an inbound rule.

Adım Adım Çözüm

1
Analyze the stateful behavior of Security Groups.
Since security groups are stateful, allowing inbound traffic on port 33063306 automatically allows return outbound traffic.
Stateful firewalls track the connection state and allow response traffic automatically.
2
Analyze the stateless behavior of Network ACLs.
Since network ACLs are stateless, allowing inbound traffic on port 33063306 does not automatically allow return outbound traffic. An outbound rule must be explicitly created.
Stateless firewalls evaluate rules for inbound and outbound traffic independently without tracking connection states.
3
Verify subnet vs. instance level placement and responsibilities.
Security groups apply at the instance/network interface level, while network ACLs apply at the subnet level. Both are customer-configured security controls.
This confirms that the other options mischaracterize their operating boundaries or misapply the Shared Responsibility Model.

Anahtar Kavram

Stateful vs. Stateless Network Security Controls (Security Groups and Network ACLs)
Tahmini Süre:1m 30s
Soru 385Soru →

A media production company has migrated its collaborative design assets from on-premises storage to Amazon FSx for Windows File Server. Under the AWS Shared Responsibility Model, which of the following operational tasks are the sole responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring security groups to control network traffic to and from the file system.; Managing file-level and directory-level access control lists (NTFS permissions) for shared folders.

Cevap

The customer is responsible for configuring security groups to control network traffic to the file system, and managing NTFS permissions for files and folders.
For managed services such as Amazon FSx for Windows File Server, AWS takes responsibility for infrastructure security (security 'of' the cloud), which includes data center physical security, hardware repairs, and operating system updates. The customer remains responsible for security configurations within the service (security 'in' the cloud), such as managing resource-level access permissions (NTFS ACLs) and implementing network access controls through security groups.

Adım Adım Çözüm

1
Identify the AWS service type for Amazon FSx for Windows File Server.
It is a fully managed storage service.
Managed services shift the operational burden of infrastructure, hardware, and OS patching to AWS.
2
Differentiate between customer and AWS responsibilities for this managed service.
AWS handles physical security, hardware replication, and Windows Server OS patching. The customer retains control over network access rules and folder/file permissions.
This classification determines which tasks fall under 'security in the cloud' versus 'security of the cloud'.
3
Select the two options representing customer-managed security tasks.
Configuring security groups and managing NTFS folder permissions are identified as the customer's responsibility.
These are access control configurations executed by the customer within their virtual environment.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Tahmini Süre:1m 30s
Soru 386Soru →

An organization has just created a new AWS account and is planning its initial security and access control setup. The IT manager needs to secure the account access and configure day-to-day administrative privileges. Which of the following actions align with AWS security best practices for managing access in this scenario? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure multi-factor authentication (MFA) on the root account and lock away its credentials, using it only for specific tasks that strictly require root privileges.; Generate distinct IAM identities for each IT administrator with administrative policies attached, ensuring they use these credentials for routine management tasks.

Cevap

Configuring multi-factor authentication (MFA) on the root account and restricting its usage, along with generating distinct IAM identities for each administrator for routine operations, are the recommended security practices.
Securing the root account with MFA and locking away its credentials ensures that the highest-privileged identity in the account is protected against unauthorized access. Creating individual IAM identities for daily administrative duties provides proper tracking, logging, and access control without exposing the root account.

Adım Adım Çözüm

1
Evaluate root account safety requirements.
The root account has full permissions and should be secured using multi-factor authentication (MFA), and its credentials should not be shared or used for everyday administrative tasks.
This minimizes the blast radius and reduces the risk of accidental configuration changes or unauthorized root access.
2
Determine the proper method for configuring administrative access.
Individual IAM users or identities must be created for each administrator with the necessary permissions attached for daily tasks.
This establishes individual accountability and aligns with the principle of least privilege by not relying on root credentials.

Anahtar Kavram

AWS Identity and Access Management (IAM) best practices focus on securing the root user with MFA and creating individual identities with appropriate permissions for daily operational tasks.
Soru 387Soru →

A research laboratory is building a web application on AWS that handles sensitive clinical trials data. The regulatory authority requires the laboratory to encrypt all trial results at rest using dedicated, single-tenant hardware security modules (HSMs) that they control directly. They must also ensure that database credentials are encrypted and automatically rotated. Which of the following AWS services should the laboratory use to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudHSM; AWS Secrets Manager

Cevap

The research laboratory should use AWS CloudHSM to manage keys on dedicated, single-tenant hardware security modules, and AWS Secrets Manager to encrypt and automatically rotate database credentials.
To meet the compliance requirement for dedicated, single-tenant cryptographic hardware, the laboratory must use AWS CloudHSM. To encrypt and rotate database credentials, AWS Secrets Manager should be implemented.

Adım Adım Çözüm

1
Analyze the requirement for dedicated, single-tenant cryptographic hardware.
Identify AWS CloudHSM as the correct service because AWS Key Management Service (AWS KMS) relies on shared, multi-tenant hardware security modules.
AWS CloudHSM is designed for compliance workloads that strictly require single-tenant dedicated HSM instances.
2
Analyze the requirement to encrypt and automatically rotate database credentials.
Identify AWS Secrets Manager as the service designed for securely storing and rotating credentials.
AWS Secrets Manager allows rotation configuration without deploying custom code or scripts.

Anahtar Kavram

Data Protection and Encryption services (AWS CloudHSM vs. AWS KMS) and secret management (AWS Secrets Manager).
Soru 388Soru →

A financial technology company is using Amazon Cognito user pools to manage customer authentication and authorization for its mobile banking application. Under the AWS Shared Responsibility Model, which of the following is a responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring password complexity requirements and multi-factor authentication (MFA) settings for the user pool.

Cevap

Configuring password complexity requirements and multi-factor authentication (MFA) settings for the user pool.
Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud.' For Amazon Cognito user pools, this responsibility entails setting password complexity policies, configuring multi-factor authentication (MFA) protocols, and managing client-side authorization parameters.

Adım Adım Çözüm

1
Determine the service type and the division of operational duties.
Amazon Cognito is classified as a managed platform-as-a-service (PaaS) or software-as-a-service (SaaS) utility, where AWS handles the underlying infrastructure, operating system, and database tiers.
Correct classification of the AWS service is essential to identifying the boundaries of the Shared Responsibility Model.
2
Differentiate between security 'of' the cloud and security 'in' the cloud for the identified service type.
The customer's responsibility focuses on data and configuration options (security 'in' the cloud), such as setting custom password standards and configuring MFA rules. AWS's responsibility focuses on infrastructure and platform software integrity (security 'of' the cloud).
Distinguishing configuration and data access settings from infrastructure maintenance identifies who is responsible for the task.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Tahmini Süre:1m 0s
Soru 389Soru →

A SaaS company is hosting a collaborative document editing application on Amazon EC2 instances. The system administrator wants to allow incoming HTTP/HTTPS traffic to the EC2 instances, ensuring that any corresponding outbound response traffic is automatically permitted regardless of outbound rules. Which AWS network security feature should be configured to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Security groups

Cevap

Security groups
Security groups are stateful firewalls that operate at the instance level. When you allow inbound traffic to an instance, the return traffic is automatically allowed regardless of any outbound security group rules.

Adım Adım Çözüm

1
Analyze the requirements for instance-level traffic filtering and stateful behavior.
The requirement specifies allowing inbound traffic to EC2 instances and automatically permitting the return outbound traffic without explicit configuration.
This matches the definition of stateful packet filtering.
2
Compare the firewalls available in an Amazon VPC.
Security groups are stateful and operate at the instance level. Network ACLs are stateless and operate at the subnet level.
Only security groups track connection state and automatically allow return traffic.

Anahtar Kavram

Security groups act as stateful firewalls for Amazon EC2 instances, automatically allowing return traffic for any permitted inbound connection.
Soru 390Soru →

A media streaming company is storing user account information in Amazon S3 and database backups in Amazon RDS. The company's compliance policy requires all of this data to be encrypted at rest. According to the AWS Shared Responsibility Model, which of the following is a customer responsibility in this scenario?

Cevabı ve açıklamayı göster

Cevap: Configuring server-side encryption and managing access policies for the cryptographic keys

Cevap

Configuring server-side encryption and managing access policies for the cryptographic keys
Under the AWS Shared Responsibility Model, the customer is responsible for data encryption configurations (security in the cloud), which includes enabling server-side encryption on services like Amazon S3 and Amazon RDS and specifying who has permissions to use the encryption keys.

Adım Adım Çözüm

1
Identify that the requirement is for encrypting data at rest (stored in Amazon S3 and Amazon RDS).
Recognized that this falls under data protection and key management.
Encryption of data at rest involves both selecting the encryption mechanism and managing the access controls to the keys used for encryption.
2
Apply the AWS Shared Responsibility Model, dividing tasks into customer responsibility (security in the cloud) and AWS responsibility (security of the cloud).
Differentiated infrastructure management from resource configuration.
AWS manages physical data centers, hardware security, hypervisors, and storage sanitization, while customers configure resources, access permissions, and choose whether/how to enable encryption.
3
Select the option that represents a customer-managed action.
Identified that enabling server-side encryption and managing key access policies is the customer's duty.
Only configuring the encryption settings and controlling access policies is under the customer's direct control within the AWS Management Console or APIs.

Anahtar Kavram

Data protection at rest and the Shared Responsibility Model
Tahmini Süre:1m 0s
Soru 391Soru →

A biotechnology startup uses Amazon DynamoDB to store and query gene sequencing metadata. To comply with industry security regulations, the startup must implement strict access control and verify compliance of the cloud environment. Under the AWS Shared Responsibility Model, which of the following is a responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Managing the identity and access management (IAM) policies that regulate access to the database tables

Cevap

Managing the identity and access management (IAM) policies that regulate access to the database tables
For managed services like Amazon DynamoDB, AWS handles infrastructure, hardware, and operating system management. The customer remains responsible for data access controls, which is achieved by defining and managing identity and access management (IAM) policies.

Adım Adım Çözüm

1
Analyze the service type in the scenario.
Amazon DynamoDB is classified as a managed platform-as-a-service (PaaS) database service.
Determining the service type helps define where the boundary lies between AWS and customer responsibilities.
2
Evaluate customer versus AWS responsibilities for Amazon DynamoDB.
AWS is responsible for physical security, infrastructure, operating system patching, and database engine maintenance. The customer is responsible for data classification, encryption settings, and identity and access management (IAM) policies.
This isolates the task that belongs to the customer under the Shared Responsibility Model.

Anahtar Kavram

Under the AWS Shared Responsibility Model, security of the database platform and infrastructure is the responsibility of AWS, while configuring data access controls (such as IAM policies) remains the responsibility of the customer.
Tahmini Süre:1m 30s
Soru 392Soru →

A company is designing the network security architecture for a new web application deployed across multiple subnets in a Virtual Private Cloud (VPC). The cloud practitioner needs to configure instance-level firewalls that automatically allow return traffic for established connections, as well as subnet-level firewalls where rules must be explicitly configured for both inbound and outbound traffic.

Which of the following AWS network security features should be configured to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security groups to control traffic at the instance level; Network access control lists (network ACLs) to control traffic at the subnet level

Cevap

Security groups should be configured to control traffic at the instance level, and network access control lists (network ACLs) should be configured to control traffic at the subnet level.
Security groups operate at the instance level (specifically the elastic network interface) and are stateful, meaning any allowed inbound request automatically allows return outbound traffic. Network Access Control Lists (network ACLs) operate at the subnet level and are stateless, meaning rules must be explicitly defined for both inbound and outbound traffic to allow return communication.

Adım Adım Çözüm

1
Analyze the requirements for instance-level security and automatically allowed return traffic.
Identify that security groups are applied at the instance level (elastic network interface) and are stateful, which automatically permits return traffic for allowed connections.
This matches the requirement for stateful, instance-level protection.
2
Analyze the requirements for subnet-level security and explicit inbound/outbound rules.
Identify that network access control lists (network ACLs) operate at the subnet level and are stateless, requiring explicit rules for both traffic directions.
This matches the requirement for stateless, subnet-level protection.

Anahtar Kavram

The difference between stateful security groups operating at the instance level and stateless network ACLs operating at the subnet level.
Tahmini Süre:1m 30s
Soru 393Soru →

A financial services company is deploying an application on AWS. The application will store credit card transactions in an Amazon S3 bucket and use Amazon RDS for MySQL to manage active customer accounts. The company's compliance policy requires all data to be encrypted at rest and encrypted in transit.

According to the AWS Shared Responsibility Model, which two of the following actions are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enabling server-side encryption (SSE) on the Amazon S3 bucket; Configuring SSL/TLS connections for data transmitted to the Amazon RDS database

Cevap

Enabling server-side encryption (SSE) on the Amazon S3 bucket and configuring SSL/TLS connections for data transmitted to the Amazon RDS database are the responsibilities of the customer.
Under the AWS Shared Responsibility Model, the customer is responsible for configuring data protection settings within AWS services. Enabling server-side encryption (SSE) on the Amazon S3 bucket protects data at rest, while configuring SSL/TLS connections for the Amazon RDS database protects data in transit. Both are customer-controlled configurations.

Adım Adım Çözüm

1
Identify the service data protection requirements in the scenario.
The scenario requires encryption at rest for Amazon S3 and Amazon RDS, and encryption in transit for database traffic.
To classify responsibilities, we must first identify what security features are being configured.
2
Apply the AWS Shared Responsibility Model to the identified tasks.
Configuring encryption settings (such as enabling SSE on S3 and setting up SSL/TLS for database connections) is 'security in the cloud' and thus a customer responsibility. Managing hardware security, replacing disk drives, and provisioning KMS multi-tenant infrastructure is 'security of the cloud' and thus AWS's responsibility.
Distinguishing between customer responsibilities (logical configuration and data protection) and AWS responsibilities (physical infrastructure and service management) determines the correct options.

Anahtar Kavram

Under the AWS Shared Responsibility Model, AWS manages security *of* the cloud (physical infrastructure, virtualization layer, and global infrastructure). The customer is responsible for security *in* the cloud, which includes data protection (encryption at rest and in transit) and access management.

AreaCustomer Responsibility (Security IN the Cloud)AWS Responsibility (Security OF the Cloud)
Data at RestEnabling server-side encryption (SSE), managing customer master keys (CMKs)Physical security of HSMs, media disposal, physical storage maintenance
Data in TransitConfiguring SSL/TLS, managing network traffic encryptionMaintaining the physical network and AWS global infrastructure
Tahmini Süre:1m 30s
Soru 394Soru →

An AWS IAM user has two identity-based policies attached to their identity. The first policy explicitly allows the 's3:GetObject' action on all Amazon S3 resources, while the second policy explicitly denies the 's3:GetObject' action on a specific S3 bucket named 'financial-records'. Which of the following describes the final access decision when the user attempts to retrieve an object from the 'financial-records' bucket?

Cevabı ve açıklamayı göster

Cevap: Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.

Cevap

Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.
The correct answer is that access is denied because in AWS IAM policy evaluation, an explicit deny always overrides any explicit allows. Even though the first policy grants read access to all S3 buckets, the second policy's explicit deny on the specific bucket ensures that any request to retrieve objects from that bucket is blocked.

Adım Adım Çözüm

1
Analyze the attached IAM policies to identify all applicable statements.
There is one policy statement that explicitly allows the action on all S3 resources, and another statement that explicitly denies the action on the 'financial-records' bucket.
AWS evaluates all policies attached to the user identity simultaneously to determine permissions.
2
Apply the AWS IAM policy evaluation hierarchy.
The explicit deny on the specific bucket takes precedence over the general explicit allow.
By default, all requests are denied in AWS. An explicit allow overrides the default deny, but any explicit deny always overrides any explicit allows.

Anahtar Kavram

AWS IAM Policy Evaluation Logic (Explicit Deny Override)
Soru 395Soru →

A startup is establishing its initial AWS environment and wants to secure access controls for its development team and applications running on Amazon EC2. Which of the following actions represent AWS-recommended security best practices? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable Multi-Factor Authentication (MFA) on the AWS account root user and restrict its usage to essential account management tasks.; Define IAM roles with temporary credentials to grant applications running on Amazon EC2 instances access to other AWS resources.

Cevap

The correct practices are to enable Multi-Factor Authentication (MFA) on the root user and restrict its use, and to use IAM roles with temporary credentials for applications running on EC2 instances.
The correct options are to enable MFA on the AWS account root user and restrict its usage, and to define IAM roles with temporary credentials for applications running on EC2. These follow AWS security guidelines by locking down the root user and avoiding the use of hardcoded, permanent credentials for applications.

Adım Adım Çözüm

1
Review the requirements to secure developer access and EC2 applications.
Identify that developer access requires distinct credentials and applications must avoid hardcoded secret keys.
AWS security practices advise against sharing access credentials and storing static credentials in environments where they can be compromised.
2
Select the correct AWS Identity and Access Management (IAM) configurations that support these principles.
Identify that enabling MFA on the root user protects the account, and assigning IAM roles to EC2 instances provides temporary credentials dynamically.
MFA prevents unauthorized root level access, and IAM roles prevent credential leaks by avoiding the use of permanent keys.

Anahtar Kavram

AWS Identity and Access Management (IAM) Best Practices
Soru 396Soru →

A company is using Amazon ElastiCache (Redis OSS) to cache session data for a high-traffic web application. Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring security groups to restrict network access to the cache nodes; Enabling and managing encryption in transit and Redis authentication for client access

Cevap

Configuring security groups to restrict network access to the cache nodes, and enabling and managing encryption in transit and Redis authentication for client access.
For managed services like Amazon ElastiCache, AWS manages the underlying virtual machines, OS patching, and physical infrastructure. The customer is responsible for configuring access controls, such as security groups, and managing authentication and encryption options to secure data within the cache.

Adım Adım Çözüm

1
Identify the AWS service type in the scenario.
Amazon ElastiCache is a managed service (Platform as a Service/PaaS model).
The division of responsibilities depends on whether a service is Infrastructure as a Service (IaaS) or a managed service (PaaS).
2
Differentiate customer responsibilities from AWS responsibilities for managed services.
AWS handles underlying infrastructure, including physical security, hardware replacement, hypervisor management, and operating system patching. The customer handles configuration, data encryption settings, user authentication, and network access controls (security groups).
This alignment helps identify which tasks fall under customer ownership ('security in the cloud') vs AWS ownership ('security of the cloud').

Anahtar Kavram

Shared Responsibility Model for Managed Services
Soru 397Soru →

A digital publishing company hosts its content management system on Amazon Elastic Compute Cloud (Amazon EC2) instances within a public subnet. Following a security audit, the team needs to implement a rule that blocks a specific list of malicious IP addresses from reaching any resources within that subnet. Additionally, the security team notes that the control must evaluate both inbound and outbound traffic separately since it does not automatically track connection states. Which AWS resource should the company configure to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Network Access Control Lists (Network ACLs)

Cevap

Network Access Control Lists (Network ACLs)
The correct answer is Network Access Control Lists (Network ACLs). Network ACLs act as a stateless firewall at the subnet level. They support both allow and deny rules (enabling the block of specific IP addresses) and require separate configuration for inbound and outbound traffic because they do not track connection states.

Adım Adım Çözüm

1
Analyze the requirement for blocking traffic at the subnet level.
The solution must operate at the subnet boundary to protect all resources within the subnet, ruling out instance-level controls.
Security Groups operate at the instance level, whereas Network ACLs operate at the subnet level.
2
Evaluate the requirement for blocking specific IP addresses (explicit deny).
The service must support deny rules.
Security Groups only support allow rules, meaning you cannot explicitly deny specific IP addresses. Network ACLs support both allow and deny rules.
3
Verify the connection tracking requirement (stateless vs. stateful).
The control must evaluate inbound and outbound traffic separately because it does not track connection states (stateless).
Network ACLs are stateless, requiring explicit configuration of inbound and outbound rules, which matches the scenario's requirements.

Anahtar Kavram

Stateful vs. Stateless AWS Firewall Features at Subnet and Instance Levels
Tahmini Süre:1m 30s
Soru 398Soru →

A ride-sharing company is deploying an application on AWS that processes passenger location coordinates. To ensure data privacy, the developer wants to encrypt this coordinate data while it is transmitted from the passenger's mobile app to the application backend on AWS. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility in this scenario?

Cevabı ve açıklamayı göster

Cevap: Configuring SSL/TLS certificates and protocols on the application endpoints

Cevap

Configuring SSL/TLS certificates and protocols on the application endpoints
Under the AWS Shared Responsibility Model, the customer is responsible for protecting data in transit ('Security in the Cloud'). This includes configuring SSL/TLS certificates and secure protocols (like HTTPS) on their application endpoints, such as load balancers, API gateways, or EC2 instances.

Adım Adım Çözüm

1
Analyze the security requirement: the company needs to encrypt coordinate data in transit between mobile apps and the AWS backend.
Identified encryption in transit as the primary security goal.
Understanding the context helps determine which security controls are applicable.
2
Apply the AWS Shared Responsibility Model to data in transit.
Determine that while AWS secures the underlying physical network infrastructure, the customer is responsible for configuring encryption protocols on their logical endpoints.
This isolates the boundary between AWS infrastructure security and customer data/application configuration.
3
Identify the correct option that reflects this customer-side configuration.
Configuring SSL/TLS certificates on endpoints like Application Load Balancers or API Gateways matches the customer's responsibility.
This implements the required encryption in transit at the application layer.

Anahtar Kavram

Shared Responsibility Model for Data in Transit
Tahmini Süre:1m 0s
Soru 399Soru →

A healthcare provider deploys AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) to manage employee access to clinical applications. Under the AWS Shared Responsibility Model, which two tasks are the sole responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Creating and managing organizational units (OUs), user accounts, and group memberships within the directory; Configuring Group Policy Objects (GPOs) to enforce security compliance on domain-joined instances

Cevap

Creating and managing organizational units (OUs), user accounts, and group memberships within the directory, as well as configuring Group Policy Objects (GPOs) to enforce security compliance on domain-joined instances, are the responsibility of the customer.
Under the AWS Shared Responsibility Model for managed services, AWS manages the host environment, operating system patching, and domain controller hardware availability. The customer retains full control over the logical administration of the directory, which includes managing directory objects (users, groups, organizational units) and configuring policies (such as GPOs) for domain-joined resources.

Adım Adım Çözüm

1
Analyze the service model in use.
AWS Managed Microsoft AD is a managed directory service.
Managed services shift infrastructure and platform maintenance duties (like OS patching and hardware replication) to AWS, leaving data and access configuration duties to the customer.
2
Evaluate operational actions against the Shared Responsibility Model boundary.
Administrative actions inside the directory (managing users, groups, and GPOs) belong to the customer, while maintenance of domain controller servers belongs to AWS.
AWS secures the infrastructure running the service (security 'of' the cloud), while the customer secures the data and configurations put into the service (security 'in' the cloud).

Anahtar Kavram

For managed services like AWS Managed Microsoft AD, AWS handles host deployment, patching, physical security, and replication of domain controllers, while the customer is responsible for directory administrative tasks, user and group management, and policy configurations.
Soru 400Soru →

A logistics company is hosting a dispatch coordinate management system on Amazon EC2 instances within a Virtual Private Cloud (VPC). A security administrator needs to implement a network security design that meets two criteria:

1. Block a list of specific malicious IP addresses at the subnet boundary before the traffic reaches any resources.
2. Automatically allow return traffic for any authorized inbound connections to the EC2 instances without needing to configure outbound rules.

Which of the following configurations should the administrator implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply a Network Access Control List (Network ACL) at the subnet level with deny rules to block the malicious IP addresses.; Apply a Security Group at the instance level to allow inbound traffic, relying on its stateful nature to automatically permit return traffic.

Cevap

Apply a Network Access Control List (Network ACL) at the subnet level with deny rules to block the malicious IP addresses, and apply a Security Group at the instance level to allow inbound traffic, relying on its stateful nature to automatically permit return traffic.
The correct strategy combines a subnet-level Network Access Control List (Network ACL) to explicitly block malicious IP addresses (since Network ACLs support deny rules at the subnet boundary) and an instance-level Security Group to control application access (since Security Groups are stateful and automatically permit return traffic for established connections without needing outbound rule configuration).

Adım Adım Çözüm

1
Analyze the requirement to block specific IP addresses at the subnet boundary.
Identify that Network Access Control Lists (NACLs) operate at the subnet level and support explicit deny rules.
Security Groups do not support deny rules and operate at the instance level, so NACLs must be used to block IPs at the subnet boundary.
2
Analyze the requirement to automatically allow return traffic for established connections.
Identify that Security Groups are stateful and automatically track connection states to allow return traffic.
Network ACLs are stateless and require explicit configuration of outbound rules for return traffic, whereas Security Groups automatically handle return traffic.

Anahtar Kavram

Stateful vs. Stateless network firewalls in AWS (Security Groups vs. Network ACLs)
ÖncekiSayfa 20 / 23Sonraki
Security and Compliance Alıştırma Soruları — AWS Certified Cloud Practitioner — Sayfa 20 | Examkin