Examkin

Security and Compliance

441 soru

Tüm türler441Çoktan seçmeli225Çoklu seçim216
Soru 401Soru →

An enterprise is launching a new microservice on Amazon Elastic Container Service (Amazon ECS) that needs to write data to an Amazon DynamoDB table. Which configuration represents the most secure method for granting the microservice the necessary permissions?

Cevabı ve açıklamayı göster

Cevap: Associate an IAM role with the container task definition, granting it temporary security credentials with write access to the DynamoDB table.

Cevap

Associating an IAM role with the container task definition, granting it temporary security credentials with write access to the DynamoDB table.
Associating an IAM role with the ECS task definition is the recommended practice. It allows the microservice container to retrieve temporary security credentials automatically. This removes the need to store long-term, hardcoded access keys in the code or container environment, minimizing credential exposure.

Adım Adım Çözüm

1
Identify the entity requiring access (a containerized application on ECS) and the target resource (DynamoDB table).
An application running on an AWS compute service needs access to an AWS database service.
Access requirements dictate what type of IAM identity is most appropriate (e.g., role vs. user).
2
Apply the AWS security best practice of using temporary security credentials for applications running on AWS services.
An IAM role must be created and associated with the container task definition rather than creating an IAM user with long-term access keys.
Roles provide temporary credentials that rotate automatically, avoiding the security risk of exposing hardcoded long-term credentials.
3
Define the scope of customer responsibility under the AWS Shared Responsibility Model.
The customer is responsible for configuring access policies and assigning IAM roles to resources.
AWS does not manage or configure resource-level permissions for the customer.

Anahtar Kavram

Using IAM roles to grant temporary credentials to AWS resources and applications
Tahmini Süre:1m 0s
Soru 402Soru →

An IoT company deploys telemetry collection servers on Amazon EC2 instances within a custom subnet. The cloud practitioner configures a Network Access Control List (Network ACL) at the subnet level to allow inbound TCP traffic on port 8883 from the internet. Although the EC2 instances' Security Groups are configured to allow all outbound traffic, the external sensors are unable to receive acknowledgment responses from the servers. Which of the following configuration changes is required to resolve this issue and allow the acknowledgment traffic back to the sensors?

Cevabı ve açıklamayı göster

Cevap: Add an outbound rule to the subnet's Network ACL that allows traffic to the ephemeral port range of the external sensors.

Cevap

Add an outbound rule to the subnet's Network ACL that allows traffic to the ephemeral port range of the external sensors.
The correct option is correct because Network ACLs are stateless firewalls operating at the subnet level. They evaluate inbound and outbound rules independently. When inbound traffic is allowed on port 8883, the return traffic destined for the client's ephemeral ports will be blocked unless an outbound rule explicitly allows it. Security Groups, on the other hand, are stateful and do not block this return traffic.

Adım Adım Çözüm

1
Analyze the network security configuration and traffic behavior.
The inbound traffic reaches the EC2 instances successfully, but the outbound return traffic is blocked at the subnet boundary.
Since the Security Group is stateful, it automatically permits return traffic. The failure must be occurring at the Network ACL, which controls subnet-level traffic.
2
Apply the rule characteristics of Network ACLs vs. Security Groups.
Network ACLs are stateless. Therefore, allowing inbound traffic on port 8883 does not automatically allow the outbound return traffic.
An explicit outbound rule must be configured in the Network ACL to allow the return traffic (typically using ephemeral ports) back to the client.

Anahtar Kavram

Stateful vs. Stateless Firewalls in AWS (Security Groups vs. Network ACLs)
Tahmini Süre:1m 30s
Soru 403Soru →

A company is hosting a virtual classroom platform with video processing workloads on Amazon EC2 instances inside a private subnet. The security team wants to implement a multi-layered security approach: they need to block a specific range of malicious external IP addresses at the subnet boundary, and they must allow administrative SSH traffic to the instances from a designated bastion host while ensuring that the return traffic is automatically permitted. Which TWO of the following configurations should the team implement?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add an inbound deny rule for the malicious IP range to the Network Access Control List (Network ACL) associated with the subnet; Add an inbound allow rule for SSH from the bastion host IP address to the Security Group associated with the EC2 instances

Cevap

Configure an inbound deny rule for the malicious IP range in the Network Access Control List (Network ACL) associated with the subnet, and configure an inbound allow rule for SSH from the bastion host in the Security Group associated with the EC2 instances.
The correct configurations involve using a Network ACL at the subnet boundary to explicitly deny the malicious IP range, and using a stateful Security Group at the instance level to allow inbound SSH from the bastion host. Since Network ACLs support deny rules and operate at the subnet level, they block the traffic before it reaches the instances. Since Security Groups are stateful, return traffic is automatically allowed, making outbound configurations for this stream unnecessary.

Adım Adım Çözüm

1
Analyze the requirement to block a specific malicious IP range at the subnet boundary.
Network ACLs operate at the subnet level and support explicit deny rules. Therefore, an inbound deny rule must be added to the Network ACL associated with the private subnet.
Security groups operate at the instance level and only support allow rules, so they cannot be used to explicitly deny traffic from a specific IP range.
2
Analyze the requirement to allow SSH traffic to the EC2 instances from a bastion host with automatic return traffic.
Security groups operate at the instance level and are stateful. Adding an inbound allow rule for SSH from the bastion host's IP address will automatically permit the outbound return traffic.
Since security groups are stateful, no matching outbound rule is required to allow return traffic, unlike Network ACLs which are stateless.

Anahtar Kavram

Security Groups are stateful firewalls operating at the instance level (allowing only allow rules), whereas Network ACLs are stateless firewalls operating at the subnet level (supporting both allow and deny rules). Under the Shared Responsibility Model, configuration of these firewalls is the customer's responsibility.
Soru 404Soru →

A financial technology company is deploying a payment processing application on AWS. Their security policy mandates that all transaction logs must be encrypted at rest using cryptographic keys where the customer maintains direct control over key access policies. Furthermore, all data transmitted between their application servers and the database must be encrypted. Which of the following actions are responsibilities of the customer under the AWS Shared Responsibility Model to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring SSL/TLS certificates on the database and enabling secure transport protocols for data in transit; Creating and managing key policies to control user permissions for customer managed keys in AWS Key Management Service (AWS KMS)

Cevap

The correct responsibilities of the customer are configuring SSL/TLS certificates on the database and enabling secure transport protocols for data in transit, and creating and managing key policies to control user permissions for customer managed keys in AWS Key Management Service (AWS KMS).
Under the AWS Shared Responsibility Model, the customer is responsible for data protection parameters they configure within the cloud. This includes configuring secure communication protocols (like SSL/TLS) for data in transit and managing access controls (such as key policies) for customer managed keys at rest.

Adım Adım Çözüm

1
Analyze the requirement for encryption in transit.
The scenario requires securing data in transit between application servers and the database. According to the AWS Shared Responsibility Model, configuring secure connection protocols (SSL/TLS) on the customer's resources is the customer's responsibility.
AWS provides the secure infrastructure, but the customer must configure the network settings, applications, and databases to use secure transport layers.
2
Analyze the requirement for encryption at rest and key policy control.
The customer needs control over key access policies. Using AWS Key Management Service (AWS KMS), the customer must create and configure key policies to determine who can use or manage the keys.
AWS manages the availability and physical security of AWS KMS, but logical control and authorization policies belong to the customer.

Anahtar Kavram

Shared Responsibility Model for Data Protection and Encryption
Soru 405Soru →

A company is deploying an application on Amazon Elastic Compute Cloud (Amazon EC2) that must securely read data from an Amazon Simple Storage Service (Amazon S3) bucket and write results to an Amazon DynamoDB table. The security team mandates that no long-term credentials be stored on the instance and that the principle of least privilege be strictly followed. Which of the following actions should the company perform to meet these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the Amazon EC2 service to assume the role, and associate it with the EC2 instance profile.; Attach an IAM policy to the IAM role that explicitly grants 's3:GetObject' and 'dynamodb:PutItem' permissions on the specific resources.

Cevap

Creating an IAM role with a trust policy that allows the Amazon EC2 service to assume the role, associating it with the EC2 instance profile, and attaching an IAM policy that explicitly grants only the necessary S3 read and DynamoDB write permissions to that role.
To secure applications on EC2, the best practice is to assign an IAM role to the EC2 instance profile. The application can then fetch temporary credentials automatically via the AWS SDK. To follow the principle of least privilege, a policy should be attached to this role that limits access to only the specific S3 and DynamoDB actions required.

Adım Adım Çözüm

1
Create an IAM policy with limited permissions.
An IAM policy document is defined that permits only 's3:GetObject' and 'dynamodb:PutItem' on the specific resources.
This establishes the principle of least privilege by ensuring the application can only perform the actions it requires.
2
Create and configure an IAM role for the EC2 instance.
An IAM role is created with a trust relationship allowing the EC2 service to assume it. The policy from Step 1 is attached to this role, and the role is linked to an EC2 instance profile.
This allows the application running on the EC2 instance to automatically request and use temporary credentials, eliminating the need to store long-term access keys on the instance.

Anahtar Kavram

AWS Identity and Access Management (IAM) Roles and Least Privilege Policy Design
Tahmini Süre:1m 30s
Soru 406Soru →

A media streaming startup deploys its backend APIs using AWS Lambda. Under the AWS Shared Responsibility Model, which of the following operational tasks is the responsibility of the startup?

Cevabı ve açıklamayı göster

Cevap: Configuring the IAM execution role to restrict the function's access to other AWS resources.

Cevap

Configuring the IAM execution role to restrict the function's access to other AWS resources.
Configuring the IAM execution role is the customer's responsibility. Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes data classification, identity and access management (IAM), and the configuration of code and permissions. AWS Lambda is a serverless (PaaS) service, so AWS manages the underlying physical infrastructure, virtualization hypervisor, operating system, and runtime environments.

Adım Adım Çözüm

1
Identify the service model and the service type referenced in the scenario.
The scenario involves AWS Lambda, which is a serverless / Platform as a Service (PaaS) offering.
The division of responsibilities depends on the type of service being used (IaaS, PaaS, or SaaS).
2
Distinguish between the customer's responsibility (security 'in' the cloud) and AWS's responsibility (security 'of' the cloud) for serverless services.
For serverless services, AWS manages the physical security, hardware, hypervisor, OS, and runtime. The customer is responsible for configurations, code, data, and access control (IAM).
This boundary defines which tasks must be performed by the customer and which are handled automatically by AWS.
3
Evaluate the options to find the task that falls under the customer's responsibility.
Configuring the IAM execution role is an access control configuration task and is the customer's responsibility.
This confirms the correct option based on the defined boundary.

Anahtar Kavram

AWS Shared Responsibility Model for Serverless Services
Tahmini Süre:1m 0s
Soru 407Soru →

An online gaming platform is deploying a new database on Amazon EC2 instances to store player profile data. The security team must ensure that all data stored on the EC2 instances' Amazon Elastic Block Store (EBS) volumes is encrypted at rest. According to the AWS Shared Responsibility Model, which of the following is the customer’s responsibility in this scenario?

Cevabı ve açıklamayı göster

Cevap: Enabling encryption on the Amazon EBS volumes during creation or at the account level.

Cevap

Enabling encryption on the Amazon EBS volumes during creation or at the account level.
The correct answer is correct because configuring encryption at rest for storage resources like Amazon EBS volumes falls under security 'in' the cloud, which is the customer's responsibility.

Adım Adım Çözüm

1
Analyze the scenario and identify that the customer is encrypting data at rest on Amazon EBS volumes.
Identify that EBS volume encryption configuration is controlled by the customer.
To determine which part of the task falls under customer control vs. AWS control.
2
Apply the AWS Shared Responsibility Model boundaries to data encryption.
Determine that enabling encryption settings on EBS is security 'in' the cloud (customer responsibility), while maintaining physical infrastructure and hardware security is security 'of' the cloud (AWS responsibility).
To eliminate AWS-managed infrastructure tasks and find the customer action.

Anahtar Kavram

AWS Shared Responsibility Model for Data Encryption at Rest
Soru 408Soru →

An enterprise manages its applications using separate AWS accounts for development and production. A developer in the development account needs to temporarily read logs from an Amazon S3 bucket located in the production account. Which of the following approaches represents the AWS-recommended security best practice to configure this cross-account access?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in the production account that grants read-only access to the S3 bucket, and configure a trust policy allowing the developer's identity in the development account to assume it.

Cevap

Create an IAM role in the production account that grants read-only access to the S3 bucket, and configure a trust policy allowing the developer's identity in the development account to assume it.
The correct option outlines the AWS-recommended way to grant cross-account access. By creating an IAM role in the production account with a trust policy that trusts the development account, the developer can assume the role temporarily. This avoids using permanent credentials and adheres to the principle of least privilege.

Adım Adım Çözüm

1
Define the access policy
An IAM policy is created in the production account specifying read-only permissions for the target Amazon S3 bucket.
To ensure the principle of least privilege is applied, limiting access to only the required resources and actions.
2
Create the cross-account IAM role
An IAM role is created in the production account with the read-only policy attached and a trust policy that references the development AWS account ID.
This establishes trust between the two accounts, enabling identities in the development account to assume the role.
3
Assume the role and access the resource
The developer in the development account uses the AWS Security Token Service (STS) to assume the role, obtaining temporary security credentials to access the production S3 bucket.
To access the logs securely without requiring long-term credentials or creating additional IAM users in the production account.

Anahtar Kavram

Cross-account access using IAM roles allows users from one AWS account to access resources in another account securely via temporary security credentials.
Soru 409Soru →

An inventory management system hosts its database on Amazon EC2 instances within a private subnet. The database instances must only receive inbound database traffic on port 5432 from the application tier EC2 instances. A cloud practitioner configures a Security Group for the database instances with an inbound rule allowing TCP traffic on port 5432 from the application tier's security group. Which of the following outbound configuration options is required on the database security group to allow the database instances to successfully return response traffic back to the application tier?

Cevabı ve açıklamayı göster

Cevap: No outbound rule is required because Security Groups are stateful, meaning allowed inbound traffic automatically permits the corresponding response traffic.

Cevap

No outbound rule is required because Security Groups are stateful, meaning allowed inbound traffic automatically permits the corresponding response traffic.
The correct option is correct because Security Groups in AWS are stateful firewall devices. When an inbound rule permits traffic to enter an instance (such as database traffic on port 5432), the security group automatically allows the return response traffic to leave the instance, regardless of the outbound rules configured.

Adım Adım Çözüm

1
Identify the resource-level security component being configured.
The resource is an Amazon EC2 instance using a Security Group.
Security Groups act as a firewall at the instance level, controlling both inbound and outbound traffic.
2
Determine the stateful nature of the security component.
Security Groups are stateful, which means they automatically allow return traffic for any established connection.
Since the inbound rule already permits the application tier to connect on port 5432, the response traffic is implicitly allowed out without a separate outbound rule.

Anahtar Kavram

Stateful behavior of Security Groups versus stateless behavior of Network ACLs
Tahmini Süre:1m 0s
Soru 410Soru →

A logistics company is migrating its supply chain management system to AWS. The system will store shipment records in Amazon S3 and database backups on Amazon EBS volumes. The company's security policy requires all data to be encrypted at rest and in transit. According to the AWS Shared Responsibility Model, which of the following security actions are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enabling server-side encryption (SSE) on Amazon S3 buckets; Configuring SSL/TLS certificates on Application Load Balancers for data in transit

Cevap

Under the AWS Shared Responsibility Model, the customer is responsible for configuring encryption configurations such as enabling server-side encryption on Amazon S3 buckets and configuring SSL/TLS certificates on Application Load Balancers.
Under the AWS Shared Responsibility Model, the customer is responsible for security configurations 'in the cloud'. Enabling server-side encryption on Amazon S3 buckets protects data at rest by letting customers choose key management options. Configuring SSL/TLS certificates on Application Load Balancers manages the encryption of traffic in transit to the customer application. Both actions are customer responsibilities.

Adım Adım Çözüm

1
Analyze the requirements for data protection in transit and at rest under the AWS Shared Responsibility Model.
Identify that configuring encryption (both at rest using S3 bucket encryption and in transit using SSL/TLS) are settings managed by the customer within the cloud.
This establishes customer responsibility for logical security configurations.
2
Evaluate the remaining tasks related to physical infrastructure, hardware decommissioning, and hypervisor/firmware maintenance.
Identify that AWS is responsible for physical security, physical hardware lifecycle (such as destroying decommissioned drives), and physical host maintenance.
This distinguishes between 'security in the cloud' (customer) and 'security of the cloud' (AWS).

Anahtar Kavram

AWS Shared Responsibility Model for Data Protection and Encryption
Tahmini Süre:1m 30s
Soru 411Soru →

A retail company is deploying a secure three-tier application within an Amazon VPC. The operations team needs to understand how to apply firewall-like controls at both the instance level and the subnet boundary. Which two of the following statements accurately describe the characteristics and behavior of Security Groups and Network Access Control Lists (Network ACLs) in this environment?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security groups are stateful, meaning that allowed inbound traffic automatically permits the corresponding outbound response traffic.; Network ACLs are stateless, meaning that outbound response traffic must be explicitly allowed by a corresponding outbound rule.

Cevap

Security groups are stateful, allowing corresponding outbound response traffic automatically, and Network ACLs are stateless, requiring return traffic to be explicitly allowed by an outbound rule.
Security groups are stateful network firewalls that operate at the instance level; once inbound traffic is allowed, return outbound traffic is permitted automatically. In contrast, Network ACLs operate at the subnet level and are stateless, requiring explicit outbound rules to permit return traffic.

Adım Adım Çözüm

1
Analyze the stateful nature of Security Groups.
Confirm that Security Groups track session state, allowing outbound replies automatically if the inbound request was allowed.
This verifies that the statement about stateful Security Groups is correct.
2
Analyze the stateless nature of Network ACLs.
Confirm that Network ACLs do not track session state, meaning return traffic requires a separate outbound rule.
This verifies that the statement about stateless Network ACLs is correct.
3
Evaluate the levels of operation for both services.
Security Groups operate at the instance level (network interface), while Network ACLs operate at the subnet level.
This helps rule out incorrect statements claiming Security Groups operate at the subnet level.

Anahtar Kavram

Stateful vs. Stateless Network Security in AWS VPC
Soru 412Soru →

An e-learning platform hosts its student database on Amazon RDS. The platform's security policy requires all data to be encrypted in transit between the application servers and the database instance. Under the AWS Shared Responsibility Model, which of the following is a customer responsibility for securing this data in transit?

Cevabı ve açıklamayı göster

Cevap: Enabling and enforcing SSL/TLS connections on the application client side when connecting to the database.

Cevap

Enabling and enforcing SSL/TLS connections on the application client side when connecting to the database.
The correct answer is correct because configuration of database client applications, such as forcing SSL/TLS connections, is an application-level setting controlled and managed by the customer. AWS manages the underlying RDS infrastructure, but the customer must instruct their applications to connect securely.

Adım Adım Çözüm

1
Analyze the security requirement and model boundaries
The requirement is to secure data in transit (encryption in transit) between the application tier and the database tier in AWS.
This establishes what is being protected and where the boundaries of control lie.
2
Distinguish between customer and AWS responsibilities under the Shared Responsibility Model
AWS is responsible for 'Security of the Cloud' (physical infrastructure, virtualization layer, hardware). The customer is responsible for 'Security in the Cloud' (operating system configuration, firewall rules, and application-level settings such as client-side connection parameters).
Enforcing secure client connections belongs to application configuration, which falls under customer responsibility.

Anahtar Kavram

Under the AWS Shared Responsibility Model, AWS manages host-level and network infrastructure security (including providing TLS/SSL capability for managed services), while customers are responsible for configuring application clients, enabling secure transmission protocols, and managing connection settings.
Tahmini Süre:1m 15s
Soru 413Soru →

An organization wants to grant their third-party auditing team temporary access to audit their AWS cloud resources for compliance. At the same time, the organization needs to allow their database administrators to manage Amazon RDS resources without sharing credentials or using individual user policies. Which of the following configurations align with AWS Identity and Access Management (IAM) best practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign the database administrators to an IAM group and attach an IAM policy to that group that grants permissions to manage Amazon RDS.; Create an IAM role for the third-party auditors with a trust policy that allows the external audit account to assume the role.

Cevap

Assigning database administrators to an IAM group with an attached IAM policy, and creating an IAM role for the third-party auditors to assume.
Assigning database administrators to an IAM group and attaching an IAM policy to the group is the recommended way to manage human user permissions efficiently. Creating an IAM role with a trust policy for the third-party auditors enables secure cross-account delegation with temporary credentials, avoiding the risk of credential leakage.

Adım Adım Çözüm

1
Identify the proper access mechanism for the database administrators.
Assign database administrators to an IAM group and attach an IAM policy to that group.
Managing permissions collectively through groups is an AWS best practice that simplifies administration compared to managing individual user policies.
2
Identify the proper access mechanism for external third-party auditors.
Create an IAM role with a trust policy allowing the external auditors to assume it.
IAM roles provide temporary security credentials for cross-account access, eliminating the need to share long-term credentials.

Anahtar Kavram

AWS IAM access control best practices including group-based permissions and cross-account delegation using roles.
Soru 414Soru →

A media streaming startup is configuring network security for its delivery servers within an Amazon VPC. The system administrator needs to block traffic from a list of known malicious IP addresses at the subnet boundary. The administrator must also manually define both inbound and outbound rules because the firewall does not automatically allow return traffic. Which AWS feature meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Network Access Control Lists (Network ACLs)

Cevap

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) operate at the subnet boundary and are stateless. This means that both inbound traffic and outbound response traffic must be explicitly defined in the rules. Additionally, they support explicit deny rules to block specific IP addresses.

Adım Adım Çözüm

1
Analyze the operational boundary required for the network firewall.
The firewall must operate at the subnet boundary rather than the individual instance level.
This rules out Security Groups, which act at the instance level, and focuses attention on Network ACLs.
2
Evaluate the stateful or stateless behavior required for the traffic control.
The requirement states that return traffic is not automatically allowed, necessitating explicit outbound rules.
This indicates stateless behavior, which is a defining characteristic of Network ACLs.

Anahtar Kavram

Network ACLs are stateless firewalls operating at the subnet level that can explicitly allow or deny traffic based on IP addresses.
Tahmini Süre:1m 0s
Soru 415Soru →

A financial technology company hosts a transaction processing application on Amazon EC2 instances within a private subnet. The security team must implement a network security strategy that blocks specific malicious IP addresses at the subnet boundary and restricts instance-level access to only authorized application servers. Which of the following configurations should the cloud practitioner implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Network Access Control List (Network ACL) associated with the subnet to explicitly deny inbound traffic from the malicious IP addresses.; Configure a Security Group associated with the EC2 instances with inbound rules allowing traffic only from the authorized application servers.

Cevap

The correct configurations are to configure a Network Access Control List (Network ACL) associated with the subnet to explicitly deny inbound traffic from the malicious IP addresses, and configure a Security Group associated with the EC2 instances with inbound rules allowing traffic only from the authorized application servers.
The correct options describe configuring a Network ACL to deny traffic from the malicious IP addresses at the subnet boundary and configuring a Security Group to allow traffic only from authorized application servers. Network ACLs operate at the subnet level and support both allow and deny rules, making them the correct choice for blocking specific IPs. Security Groups operate at the instance level, are stateful, and allow specifying which sources are permitted to access the EC2 instances.

Adım Adım Çözüm

1
Analyze the requirement to block malicious IP addresses at the subnet boundary.
Identify that Network Access Control Lists (Network ACLs) operate at the subnet level and support explicit deny rules, which is suitable for blocking specific IP addresses.
Security Groups operate at the instance level and only support allow rules, so they cannot be used to block specific IPs at the subnet boundary.
2
Analyze the requirement to restrict instance-level access to authorized application servers.
Identify that Security Groups operate at the instance level and can be configured with inbound rules to allow traffic from specific sources, such as the authorized application servers.
Security Groups are stateful firewalls that filter traffic at the instance level, making them ideal for restricting access to specific instances.

Anahtar Kavram

Understanding the differences between Security Groups (stateful, instance-level, allow rules only) and Network ACLs (stateless, subnet-level, allow and deny rules).
Tahmini Süre:1m 30s
Soru 416Soru →

A healthcare enterprise needs to store sensitive patient files on Amazon S3. To meet compliance regulations, they require encryption at rest using dedicated, single-tenant cryptographic hardware where they maintain full control over the administration of the hardware security modules (HSMs). Which AWS service or feature should the enterprise configure to manage their encryption keys?

Cevabı ve açıklamayı göster

Cevap: AWS CloudHSM

Cevap

AWS CloudHSM
AWS CloudHSM is the correct choice because it provides dedicated, single-tenant hardware security module (HSM) instances within the customer's VPC. This gives the customer exclusive administrative control over the keys and cryptographic operations, satisfying the strict compliance constraint.

Adım Adım Çözüm

1
Analyze the customer requirements for encryption at rest.
The customer needs dedicated, single-tenant cryptographic hardware (HSMs) and full administrative control over the keys.
This determines whether a multi-tenant managed service (like AWS KMS) or a dedicated single-tenant solution (like AWS CloudHSM) is required.
2
Compare AWS encryption and key management services against the requirements.
AWS CloudHSM satisfies the single-tenant dedicated hardware requirement, whereas AWS KMS uses shared multi-tenant HSMs. SSE-S3 is fully managed by AWS on shared storage, and AWS Artifact is only for compliance documents.
Selecting the service that matches the dedicated, single-tenant hardware and customer control criteria leads to the correct answer.

Anahtar Kavram

Dedicated single-tenant hardware security modules (CloudHSM) versus managed multi-tenant key management (KMS).
Tahmini Süre:1m 0s
Soru 417Soru →

A cloud architect at a media agency needs to manage AWS permissions for a team of 15 video editors and 5 system administrators. The video editors require read-only access to Amazon S3 buckets, while the administrators need full access to Amazon EC2 and Amazon RDS. Which of the following represents the most efficient way to manage and apply these permissions using AWS Identity and Access Management (IAM)?

Cevabı ve açıklamayı göster

Cevap: Create two separate IAM groups, attach the appropriate managed policies to each group, and add the individual user accounts to their respective groups.

Cevap

Create two separate IAM groups, attach the appropriate managed policies to each group, and add the individual user accounts to their respective groups.
Creating separate IAM groups for the video editors and the system administrators is the most efficient and recommended practice. By attaching the relevant policies to the groups and adding the individual users to them, permissions can be centrally managed. When users are added or removed from the team, the administrator only needs to add or remove them from the group, preventing configuration drift.

Adım Adım Çözüm

1
Analyze the operational requirements of the two user categories: 15 video editors requiring S3 read-only access, and 5 system administrators requiring EC2 and RDS full access.
Identified two distinct sets of permission requirements for the two user cohorts.
Understanding permission boundaries helps determine the best IAM structure.
2
Evaluate AWS IAM best practices for managing permissions for multiple users with identical job functions.
Recognized that IAM groups are designed to cluster users and attach policies collectively rather than individually.
Using IAM groups reduces administrative overhead and minimizes errors in permission management.
3
Map the correct policies to two groups and assign the respective individual users to these groups.
Created one group for video editors (with S3 read-only policy) and one group for system administrators (with EC2 and RDS full access policies).
This establishes a scalable, secure, and easily auditable access control structure.

Anahtar Kavram

AWS IAM Groups and Permission Management
Tahmini Süre:1m 30s
Soru 418Soru →

A company is preparing for an internal security audit of its AWS environment. The security team discovers that several developers are sharing a single set of access keys to perform administrative tasks, and an automated application is using the AWS account root user credentials to generate daily billing reports. Which of the following remediation steps should the security team take to align with AWS Identity and Access Management (IAM) best practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create individual IAM users for each developer, place them in an IAM group with administrative policies, and require Multi-Factor Authentication (MFA).; Create an IAM role with the least privilege permissions required to view billing reports, and assign it to the automated application instead of using root credentials.

Cevap

Create individual IAM users for each developer, place them in an IAM group with administrative policies, and require Multi-Factor Authentication (MFA). In addition, create an IAM role with the least privilege permissions required to view billing reports, and assign it to the automated application instead of using root credentials.
The correct remediation involves establishing individual identities for users (individual IAM users in a group with MFA enforced) and utilizing temporary credentials with minimum permissions for applications (an IAM role with least privilege permissions), thus avoiding shared access keys and the root user.

Adım Adım Çözüm

1
Analyze the developer credential sharing issue.
Identify that sharing access keys violates accountability and security boundaries. The correct fix is to create unique IAM users for each person, manage them collectively using an IAM group, and enforce MFA for administrative tasks.
This establishes individual accountability and aligns with identity best practices.
2
Analyze the application using root credentials.
Identify that using the root user for programmatic reports is a severe security risk. The correct fix is to secure the root user and assign a least-privilege IAM role to the application.
This ensures the application only uses temporary, limited credentials and locks down the root account.

Anahtar Kavram

AWS IAM Best Practices for Users, Groups, Roles, and the Root User
Soru 419Soru →

A gaming studio deploys a multiplayer matchmaking backend on Amazon EC2 instances inside a public subnet. The studio wants to ensure that only traffic from a specific list of trusted IP addresses can access these instances, and they want to minimize administrative overhead by relying on a stateful resource. Which AWS resource should be configured directly at the instance level to allow inbound traffic from these IP addresses while automatically permitting the corresponding outbound response traffic?

Cevabı ve açıklamayı göster

Cevap: A security group

Cevap

A security group
A security group acts as a virtual firewall that controls inbound and outbound traffic for Amazon EC2 instances. It operates at the instance level and is stateful, meaning that any allowed inbound traffic is automatically permitted to flow outbound, satisfying the requirement to minimize administrative overhead by avoiding separate outbound configuration.

Adım Adım Çözüm

1
Identify the level of protection required (instance vs. subnet).
The requirement specifies configuring protection 'directly at the instance level', which points to security groups rather than network ACLs.
Security groups act as a firewall for associated Amazon EC2 instances, whereas network ACLs operate at the subnet boundary.
2
Determine the stateful or stateless nature of the required resource.
The resource must automatically permit outbound response traffic when inbound traffic is allowed (stateful behavior).
Security groups are stateful, meaning any allowed inbound traffic is automatically allowed outbound. Network ACLs are stateless and require explicit rules in both directions.
3
Evaluate the customer responsibility vs. AWS responsibility.
Configuring security controls on EC2 instances is the customer's responsibility under the Shared Responsibility Model.
AWS manages security of the cloud (infrastructure), while the customer manages security in the cloud (operating systems and network access controls).

Anahtar Kavram

Instance-level stateful firewalls in AWS (Security Groups)
Soru 420Soru →

A smart home IoT startup is deploying an application on AWS to collect and store telemetry data. The startup's security policy requires encrypting all data at rest using AWS Key Management Service (AWS KMS). Under the AWS Shared Responsibility Model, which of the following represent the responsibilities of the customer and AWS regarding encryption and key management? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Defining the key policies that control access to AWS Key Management Service (AWS KMS) customer managed keys; Maintaining the physical security and infrastructure of the hardware security modules (HSMs) that back AWS Key Management Service (AWS KMS)

Cevap

The customer is responsible for defining the key policies that control access to customer managed keys, and AWS is responsible for maintaining the physical security and infrastructure of the hardware security modules (HSMs) backing AWS Key Management Service (AWS KMS).
Defining key policies is a customer responsibility under the Shared Responsibility Model to secure access to customer managed keys. AWS is responsible for the physical security and operations of the underlying HSM infrastructure that supports AWS KMS.

Adım Adım Çözüm

1
Identify the shared responsibility boundary for AWS Key Management Service (AWS KMS).
AWS manages the physical security, hardware, and operational lifecycle of the HSMs, while the customer manages key configuration, access control, and usage.
AWS KMS is a managed service, meaning AWS handles infrastructure management while the customer manages data and configuration.
2
Compare customer managed keys access control.
Customers must define policies (key policies, IAM policies) to specify who can use or administer the keys.
AWS does not automatically configure user access permissions for customer managed keys.
3
Analyze physical hardware and service differences.
AWS CloudHSM, not AWS KMS, provides dedicated, single-tenant HSMs with OS-level control. Also, imported key material is managed and rotated by the customer, not AWS.
Distinguishing KMS from CloudHSM and understanding key rotation limitations ensures correct mapping of responsibilities.

Anahtar Kavram

Shared responsibility and operational characteristics of AWS Key Management Service (AWS KMS) versus AWS CloudHSM.
Tahmini Süre:1m 30s
ÖncekiSayfa 21 / 23Sonraki
Security and Compliance Alıştırma Soruları — AWS Certified Cloud Practitioner — Sayfa 21 | Examkin