Examkin

Security and Compliance

441 soru

Tüm türler441Çoktan seçmeli225Çoklu seçim216
Soru 61Soru →

A financial services organization is deploying AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) to enable single sign-on (SSO) for its cloud-based workloads. According to the AWS Shared Responsibility Model, which of the following tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring trust relationships between the AWS Managed Microsoft AD domain and the organization's on-premises Active Directory domains.; Creating and managing Active Directory users, groups, and Group Policy Objects (GPOs) within the directory.

Cevap

The customer is responsible for configuring trust relationships between the AWS Managed AD domain and on-premises domains, and creating and managing Active Directory users, groups, and Group Policy Objects (GPOs) within the directory.
For AWS Managed Microsoft AD, the customer is responsible for defining directory configurations, which includes establishing trust relationships with on-premises directories and managing organizational units, users, groups, and Group Policy Objects (GPOs) inside the directory.

Adım Adım Çözüm

1
Identify the service classification under the AWS Shared Responsibility Model.
AWS Managed Microsoft AD is a managed service. Under this model, AWS manages the physical security, infrastructure, and operating system of the domain controllers, while the customer manages directory content and access configuration.
Managed services shift infrastructure management tasks, such as OS patching, from the customer to AWS.
2
Determine which options represent customer configuration rather than infrastructure maintenance.
Configuring domain trusts and managing AD objects (users, groups, GPOs) are configuration tasks. Patching domain controller operating systems, configuring subnet-level network rules at the instance level, and compiling data center physical compliance documentation are handled by AWS.
This isolates the administrative directory management duties that remain the customer's responsibility.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Tahmini Süre:2m 0s
Soru 62Soru →

A retail company hosts its e-commerce website on Amazon Elastic Compute Cloud (Amazon EC2) instances. Under the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Cevabı ve açıklamayı göster

Cevap: Patching the guest operating system on the instances

Cevap

Patching the guest operating system on the instances
Under the AWS Shared Responsibility Model, Amazon EC2 is treated as an Infrastructure as a Service (IaaS). AWS is responsible for securing the underlying infrastructure (such as the hardware, physical data centers, and virtualization software), while the customer is responsible for configuring, updating, and patching the guest operating system that runs on the instance.

Adım Adım Çözüm

1
Identify the AWS service type being used in the scenario.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering.
The shared responsibility model boundaries vary depending on whether the service is IaaS, PaaS, or SaaS.
2
Determine the boundary of responsibility for IaaS services like Amazon EC2.
AWS manages security 'of' the cloud (hardware, virtualization, physical security), while the customer manages security 'in' the cloud (guest OS, application code, data configuration).
Since the customer has root access to the EC2 instances, they must configure and maintain the guest operating system.
3
Evaluate the choices to find the task that falls under security 'in' the cloud.
Patching the guest operating system is a customer responsibility, whereas physical security, host hardware replacement, and virtualization software maintenance are AWS responsibilities.
Guest OS updates require access to the instance's OS, which only the customer can configure.

Anahtar Kavram

AWS Shared Responsibility Model for IaaS (Amazon EC2)
Soru 63Soru →

An online gaming studio is deploying a multiplayer game database using Amazon RDS for PostgreSQL. To meet security compliance standards, the studio must define the security boundaries between their team and AWS. Which of the following operational tasks remains the responsibility of the customer under the AWS Shared Responsibility Model?

Cevabı ve açıklamayı göster

Cevap: Configuring database-level user permissions and setting up security group rules to control network access to the database instance.

Cevap

Configuring database-level user permissions and setting up security group rules to control network access to the database instance.
Under the AWS Shared Responsibility Model, for a managed service like Amazon RDS, the customer is responsible for configuring access to the database, which includes managing database user permissions and defining firewall rules using security groups to control inbound network traffic.

Adım Adım Çözüm

1
Analyze the service type in the scenario.
Amazon RDS is a managed service (PaaS/DBaaS), meaning AWS manages the underlying operating system, hardware, and database engine maintenance.
The customer's responsibility depends on the type of service deployed (IaaS vs. PaaS).
2
Identify customer-managed controls for Amazon RDS.
The customer is responsible for data security 'in' the database, including user access credentials, database schemas, and security group firewall rules.
Firewalls (security groups) and application/database-level access controls are always customer-managed.

Anahtar Kavram

Shared Responsibility Model for Managed Services (Amazon RDS)
Tahmini Süre:1m 0s
Soru 64Soru →

A financial services institution deploys an AWS Outposts rack in its on-premises data center to run latency-sensitive algorithmic trading applications. Under the AWS Shared Responsibility Model, which TWO tasks are the responsibility of the customer?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Providing physical access security, electrical power, and cooling (HVAC) for the Outposts hardware within the local facility; Configuring security groups and network access control lists (NACLs) to regulate traffic to and from the instances deployed on the Outpost

Cevap

The customer is responsible for providing physical access security, electrical power, and cooling (HVAC) for the Outposts hardware within the local facility, as well as configuring security groups and network access control lists (NACLs) to regulate traffic to and from the instances deployed on the Outpost.
Under the Shared Responsibility Model for AWS Outposts, the customer is responsible for securing the physical location, power, and cooling of the Outposts rack at their site. In addition, the customer is responsible for configuring security groups and network access control lists to regulate traffic flow to and from the instances. AWS maintains responsibility for the infrastructure software, including the virtualization hypervisor, and performs physical hardware replacements.

Adım Adım Çözüm

1
Analyze the deployment architecture and physical location of the resources.
AWS Outposts is a hybrid service where physical hardware owned by AWS is placed within the customer's local on-premises facility.
Shared responsibility boundaries shift when physical infrastructure is housed outside of AWS data centers.
2
Differentiate physical responsibilities between standard AWS regions and AWS Outposts.
Unlike standard services where AWS manages physical data center security, utility power, and HVAC, for Outposts, these site environmental and physical security responsibilities belong to the customer.
AWS has no physical access or control over the customer's on-premises building.
3
Identify logical and virtual resources control responsibilities.
The customer is responsible for configuring security groups and network access control lists (NACLs) to secure logical network traffic.
AWS provides the software-defined networking capability, but the configuration of access rules remains under customer control.
4
Differentiate physical hardware maintenance responsibilities.
AWS is responsible for physical component replacement and hypervisor patching.
AWS manages the infrastructure lifecycle and updates of the Outposts service as a fully managed offering.

Anahtar Kavram

AWS Shared Responsibility Model for AWS Outposts
Soru 65Soru →

A financial technology startup is preparing for a compliance audit. An external auditing firm requires temporary, read-only access to the startup's AWS resources. The external auditors do not possess AWS accounts, and the startup's security policy strictly prohibits creating permanent IAM users for third-party entities. Which of the following is the most secure, AWS-recommended method to grant the auditors access?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role.

Cevap

Configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role.
The correct option is to configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role. This aligns with AWS security best practices by utilizing temporary security credentials, avoiding the creation of long-term IAM credentials (such as access keys), and maintaining the principle of least privilege without creating permanent IAM users in the startup's AWS account.

Adım Adım Çözüm

1
Identify the access requirements and constraints.
The auditors need temporary, read-only access without creating permanent IAM users or using pre-existing AWS accounts.
This establishes the boundaries for acceptable security configurations.
2
Evaluate the mechanism for external user access.
Federating identity using AWS IAM Identity Center maps the external auditor identities to a temporary role.
Federation avoids static credential management and delegates authentication to the trusted third-party provider.
3
Select the option that matches AWS identity best practices.
Using IAM Identity Center to provision temporary access via role assumption is selected.
This follows the principle of least privilege and avoids credentials exposure.

Anahtar Kavram

Identity Federation and Temporary Credentials
Soru 66Soru →

A healthcare company is preparing for an external audit and must retrieve AWS security and compliance documents, such as the AWS Service Organization Control (SOC) reports. Which AWS portal provides on-demand, self-service access to these agreements and reports?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact
AWS Artifact is the primary resource for downloading AWS security and compliance reports (such as SOC and PCI reports) as well as managing agreements with AWS. It provides self-service access to these documents directly from the AWS Management Console.

Adım Adım Çözüm

1
Identify the company's core requirement.
The requirement is to retrieve official compliance reports, such as AWS SOC reports, for audit purposes.
This establishes which category of service is needed (compliance reporting).
2
Evaluate the available AWS services that match this need.
AWS Artifact is the service dedicated to providing on-demand compliance reports and agreements, whereas the others focus on resource scanning, auditing, or configuration tracking.
This confirms the correct service selection.

Anahtar Kavram

AWS Artifact is the primary portal for retrieving AWS compliance reports and agreements.
Soru 67Soru →

A healthcare technology company is hosting its customer portal on AWS. The static frontend files are stored in an Amazon S3 bucket, and the backend application is exposed via Amazon API Gateway. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring bucket policies and access control lists (ACLs) to restrict access to the static web assets; Configuring API Gateway resource policies and authorization to control access to the backend APIs

Cevap

The customer is responsible for configuring S3 bucket policies and access control lists (ACLs) to secure static web assets, as well as configuring API Gateway resource policies and authorization settings to control API access.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes managing identity and access management (IAM), data classification, and configuring resource-specific access controls. For Amazon S3, this entails setting up bucket policies and ACLs. For Amazon API Gateway, this involves establishing authorization methods and resource policies to control API invocation.

Adım Adım Çözüm

1
Determine the AWS service models in use.
Amazon S3 and Amazon API Gateway are fully managed, abstract services.
Knowing the service type helps define the boundary between what AWS manages (underlying OS, virtualization, physical infrastructure) and what the customer configures.
2
Distinguish between security 'of' the cloud and security 'in' the cloud.
AWS handles OS patching, physical data center security, and hardware decommissioning. The customer must configure access controls, identity policies, and resource authorization.
This maps the responsibilities correctly according to the Shared Responsibility Model.
3
Select the options representing customer-managed configurations.
S3 bucket policies/ACLs and API Gateway authorization/resource policies are correct. Hardware and operating system tasks are incorrect.
Only access control configurations on these managed services fall under the customer's scope.

Anahtar Kavram

AWS Shared Responsibility Model
Tahmini Süre:1m 30s
Soru 68Soru →

A software startup wants to allow a third-party vendor to run automated test suites against resources in its AWS development account. The vendor requires programmatic access for a limited time, and the startup must ensure that no long-term credentials are shared or stored. Which of the following is the most secure AWS-recommended method to grant this access?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.

Cevap

Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.
The correct answer is to create an IAM role. IAM roles allow external entities to assume permissions and receive temporary security credentials via the AWS Security Token Service (STS). This avoids the need to distribute or manage long-term secrets, fulfilling the requirement of temporary access securely.

Adım Adım Çözüm

1
Identify the key requirements of the scenario.
The third-party vendor requires programmatic access for a limited time, and credentials must not be long-term or shared.
This establishes that the solution must support temporary access without sharing permanent credentials.
2
Compare the security mechanisms of IAM users, roles, and the root user.
IAM users and root users utilize long-term credentials, whereas IAM roles issue temporary credentials that expire automatically.
Choosing the correct IAM entity ensures adherence to AWS security best practices.
3
Verify ownership and operational boundaries under the Shared Responsibility Model.
Executing scripts and configuring access is a customer-side responsibility, ruling out direct management by AWS Support.
This eliminates options that assume AWS manages tenant-level operational tasks.

Anahtar Kavram

Using IAM roles for temporary, cross-account, or third-party access instead of sharing long-term credentials.
Tahmini Süre:1m 15s
Soru 69Soru →

An educational institution uses Amazon Simple Storage Service (Amazon S3) to store student records. Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring bucket policies to restrict access to authorized users; Enabling encryption on the stored objects

Cevap

Configuring bucket policies to restrict access and enabling encryption on the stored objects are customer responsibilities under the AWS Shared Responsibility Model.
For managed services like Amazon S3, AWS manages the infrastructure, OS patching, and physical security. The customer remains responsible for managing their data, which includes configuring bucket access policies and setting up object encryption.

Adım Adım Çözüm

1
Analyze the AWS service model for Amazon S3.
Amazon S3 is an abstract managed service. AWS maintains the underlying hardware, virtualization, and OS layers.
This helps locate the responsibility boundary for this service.
2
Determine customer responsibilities for data and access within S3.
The customer owns the data and is responsible for setting bucket access policies and managing data protection features like encryption.
This identifies the customer's operational obligations.

Anahtar Kavram

Under the AWS Shared Responsibility Model, AWS manages security 'of' the cloud (hardware, host software, physical facilities), while customers manage security 'in' the cloud (access policies, data encryption, IAM).
Tahmini Süre:1m 0s
Soru 70Soru →

A company has recently created a new AWS account. To ensure the account is secure, which two actions should the administrator perform on the AWS account root user? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable multi-factor authentication (MFA) for the root user.; Delete any active access keys associated with the root user.

Cevap

Enabling multi-factor authentication (MFA) for the root user and deleting any active access keys associated with the root user.
Enabling multi-factor authentication (MFA) and deleting active access keys are primary security best practices for the AWS account root user. MFA provides an additional security layer for console logins, while removing access keys prevents programmatic administrative API access.

Adım Adım Çözüm

1
Identify the recommended practices for securing the AWS account root user.
The root user has unrestricted access and should not be used for daily tasks or programmatic API calls.
Securing the root user prevents full compromise of the AWS account.
2
Select security actions that mitigate credentials exposure and add security layers.
Enabling MFA and removing access keys reduces the risk of credential compromise.
MFA prevents unauthorized console access, and removing access keys prevents unauthorized programmatic access.

Anahtar Kavram

AWS Account Root User Security Best Practices
Soru 71Soru →

A university database administrator needs to grant an administrative application running on a local, on-premises server the ability to read metadata from an Amazon DynamoDB table. Additionally, a new junior administrator has joined the team to assist with day-to-day configuration. Which of the following actions align with the AWS recommended best practices for IAM and access control? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use AWS IAM Roles Anywhere to grant the on-premises server secure access to DynamoDB using temporary credentials.; Create an IAM user for the junior administrator, place them in an IAM group with least-privilege policies, and require Multi-Factor Authentication (MFA).

Cevap

Use AWS IAM Roles Anywhere to grant the on-premises server secure access to DynamoDB using temporary credentials, and create an IAM user for the junior administrator, place them in an IAM group with least-privilege policies, and require Multi-Factor Authentication (MFA).
The correct practices are to use AWS IAM Roles Anywhere to grant temporary security credentials to the on-premises server, and to create an individual IAM user with least-privilege permissions and MFA enabled for the junior administrator. These actions align with the core security principles of minimizing long-term credentials and securing human identities.

Adım Adım Çözüm

1
Identify secure access methods for on-premises servers to interact with AWS resources.
Using temporary credentials via AWS IAM Roles Anywhere is preferred over hardcoding long-lived access keys.
This minimizes the risk of credential exposure and adheres to the security principle of temporary credentials.
2
Identify secure access management practices for human users.
Creating a dedicated IAM user inside a group with least-privilege permissions and enforcing MFA is the recommended standard.
This ensures accountability, limits access to only what is necessary, and adds an extra layer of authentication security.

Anahtar Kavram

AWS IAM Best Practices for User and Workload Access Control
Soru 72Soru →

A real estate platform uses Amazon DynamoDB to store property listing details. Under the AWS Shared Responsibility Model, which of the following security tasks is the sole responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Defining and applying Identity and Access Management (IAM) policies to control access to the DynamoDB tables

Cevap

Defining and applying Identity and Access Management (IAM) policies to control access to the DynamoDB tables
For managed services such as Amazon DynamoDB, AWS is responsible for securing the infrastructure, host operating system, and database software. The customer is responsible for managing data classification and configuring access controls, such as Identity and Access Management (IAM) policies, to determine who can access the database tables.

Adım Adım Çözüm

1
Identify the AWS service type being used in the scenario.
Amazon DynamoDB is a fully managed NoSQL database service.
The service type determines where the boundary of responsibility lies between AWS and the customer under the Shared Responsibility Model.
2
Distinguish between security of the cloud (AWS responsibility) and security in the cloud (customer responsibility) for a managed database service.
AWS handles the hardware, operating system patching, database software patching, and physical security. The customer handles their own data, including configuring access controls (IAM policies).
This division defines who is responsible for configuring access rules versus who maintains the underlying platform.

Anahtar Kavram

Under the Shared Responsibility Model, for managed services like Amazon DynamoDB, AWS manages the infrastructure, operating system, and physical security (security of the cloud), while the customer manages data access controls, configurations, and identity policies (security in the cloud).
Tahmini Süre:45s
Soru 73Soru →

A media streaming company uses Amazon DynamoDB to store user watch histories and profiles. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Defining Identity and Access Management (IAM) policies to restrict read and write access to the database tables

Cevap

Defining Identity and Access Management (IAM) policies to restrict read and write access to the database tables
In the Shared Responsibility Model, AWS manages the security 'of' the cloud (including patching the OS, managing physical infrastructure, and database engines for managed services like DynamoDB). The customer is responsible for security 'in' the cloud, which includes managing their data, configuring client-side encryption, and defining access permissions through Identity and Access Management (IAM) policies to secure access to the tables.

Adım Adım Çözüm

1
Analyze the service model of Amazon DynamoDB.
Amazon DynamoDB is a fully managed NoSQL database service (Platform as a Service / PaaS).
Understanding the service model helps determine the boundary of shared responsibility.
2
Distinguish between customer responsibilities (security 'in' the cloud) and AWS responsibilities (security 'of' the cloud) for managed services.
AWS handles physical security, infrastructure patching, database software updates, and hardware lifecycle. The customer handles data classification, client-side encryption, and IAM permissions to access the tables.
This isolates customer tasks from AWS-managed operations.
3
Evaluate the choices to find the task that falls under customer responsibility.
Defining Identity and Access Management (IAM) policies to restrict read and write access is a customer responsibility, while patching, physical security, and manual compliance document retrieval are handled by AWS or via AWS Artifact.
To identify the correct answer matching the customer's operational obligations.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Tahmini Süre:1m 0s
Soru 74Soru →

An enterprise client in the financial sector is undergoing an annual Payment Card Industry Data Security Standard (PCI DSS) compliance audit. The external auditors require official proof of compliance for the physical and environmental security controls of the AWS data centers where the client's applications are hosted. Which AWS service should the security team use to obtain the necessary reports, and how is the responsibility for physical security partitioned in this context?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact is used to retrieve the PCI DSS Attestation of Compliance (AoC); AWS is solely responsible for managing the physical security and environmental controls of its data centers.

Cevap

AWS Artifact is used to retrieve the PCI DSS Attestation of Compliance (AoC); AWS is solely responsible for managing the physical security and environmental controls of its data centers.
The correct option correctly identifies AWS Artifact as the service for downloading compliance documents and accurately maps data center physical security as the sole responsibility of AWS under the Shared Responsibility Model.

Adım Adım Çözüm

1
Identify the service required to retrieve compliance documents.
AWS Artifact is the primary portal for downloading compliance reports and agreements (such as SOC and PCI reports).
The scenario requires official proof of compliance (PCI DSS Attestation of Compliance) which is distributed directly via AWS Artifact.
2
Determine the party responsible for data center physical and environmental security.
AWS is solely responsible for the physical security of data centers.
Under the AWS Shared Responsibility Model, physical infrastructure, hypervisor virtualization, and data center facilities fall under 'security of the cloud' and are the sole responsibility of AWS.

Anahtar Kavram

AWS compliance report retrieval and the division of physical security under the Shared Responsibility Model.
Soru 75Soru →

A healthcare startup must verify that AWS infrastructure meets compliance regulations for HIPAA and obtain SOC 2 reports for its investors. Which two tasks can the startup perform directly within AWS Artifact?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Download AWS security and compliance documents, such as SOC and PCI reports; Review and accept AWS agreements, such as the HIPAA Business Associate Addendum (BAA)

Cevap

Downloading AWS compliance documents (such as SOC and PCI reports) and reviewing/accepting AWS agreements (such as the HIPAA Business Associate Addendum)
AWS Artifact is the primary self-service portal for on-demand access to AWS compliance reports, such as SOC and PCI reports, and is also used to review and accept AWS agreements like the HIPAA Business Associate Addendum (BAA) for individual accounts or entire organizations.

Adım Adım Çözüm

1
Identify the service designed for retrieving AWS compliance documentation and managing AWS agreements.
AWS Artifact is identified as the central portal for these compliance resources.
AWS Artifact provides self-service access to compliance reports and agreements without requiring support tickets.
2
Filter options to find capabilities provided by AWS Artifact.
Downloading compliance reports and accepting HIPAA agreements are identified as valid AWS Artifact features.
This excludes distractors related to other AWS services like Amazon Inspector and AWS CloudTrail.

Anahtar Kavram

AWS Artifact provides self-service access to AWS compliance reports and agreements.
Soru 76Soru →

A media company is migrating its user authentication store to Amazon DynamoDB. The company must comply with strict industry data security standards. Under the AWS Shared Responsibility Model, which two security tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring AWS Identity and Access Management (IAM) policies to restrict database access to authorized application servers; Encrypting sensitive user password hashes on the client side before writing them to the table

Cevap

The customer is responsible for configuring AWS Identity and Access Management (IAM) policies to restrict database access and encrypting sensitive user password hashes on the client side.
For fully managed services such as Amazon DynamoDB, AWS manages the physical infrastructure, the virtualization layer, the operating system, and the database software itself. The customer is responsible for managing data inside the service, which includes configuring IAM policies to restrict API access and implementing data encryption (such as client-side encryption before writing data to AWS).

Adım Adım Çözüm

1
Analyze the service model of the AWS resource in the scenario.
Amazon DynamoDB is a fully managed NoSQL database service (Platform as a Service / Database as a Service).
The level of customer responsibility depends on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or a managed service.
2
Differentiate between customer responsibilities and AWS responsibilities for fully managed database services.
AWS handles physical security, infrastructure, hardware maintenance, OS patching, and database software updates. The customer handles data classification, IAM access controls, client-side encryption, and service configurations.
This determines which tasks belong to the customer ('security in the cloud') versus AWS ('security of the cloud').
3
Evaluate the choices to select the two customer responsibilities.
IAM policy configuration and client-side encryption are customer responsibilities, whereas OS patching, hardware disk replacement, and table-level security groups (which do not exist for DynamoDB) are not.
To correctly identify the final options that match the customer's domain of control under the model.

Anahtar Kavram

Under the AWS Shared Responsibility Model, for managed services like Amazon DynamoDB, AWS operates the infrastructure layer, the operating system, and the database platform. The customer retains responsibility for securing their data, including access control (IAM) and data encryption.
Soru 77Soru →

An application running on an Amazon EC2 instance needs to securely access files in an Amazon S3 bucket. According to AWS security best practices, which IAM entity should be attached to the EC2 instance to grant these permissions without storing long-term credentials?

Cevabı ve açıklamayı göster

Cevap: An IAM role

Cevap

An IAM role
The correct answer is an IAM role because IAM roles are designed to delegate permissions to AWS services, applications, or users without requiring long-term security credentials. By attaching an IAM role (specifically via an instance profile) to an Amazon EC2 instance, AWS automatically manages and rotates temporary credentials for the application to access Amazon S3.

Adım Adım Çözüm

1
Identify the authentication requirement.
An application on an EC2 instance needs to access an S3 bucket without storing long-term credentials.
Storing long-term credentials on instances exposes them to potential leakage.
2
Determine the appropriate IAM entity for service-to-service authentication.
An IAM role provides temporary security credentials that can be automatically rotated.
AWS services use IAM roles to safely access other AWS resources under the principle of least privilege.

Anahtar Kavram

IAM Roles for AWS Services
Soru 78Soru →

An organization wants to configure an application running on an Amazon EC2 instance to read files from an Amazon S3 bucket. The application must not store long-term AWS credentials on the instance. Which of the following solutions represents the AWS-recommended best practice to grant the necessary permissions?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with S3 read permissions and associate it with the EC2 instance using an instance profile.

Cevap

Create an IAM role with S3 read permissions and associate it with the EC2 instance using an instance profile.
The correct option is to create an IAM role with S3 read permissions and associate it with the EC2 instance. This method uses temporary security credentials that are automatically distributed and rotated by AWS, fulfilling the security requirement of not storing long-term credentials on the instance.

Adım Adım Çözüm

1
Define permissions using an IAM policy that allows read-only access to the target Amazon S3 bucket.
An IAM policy document specifying the allowed S3 actions is created.
This establishes the minimum required permissions following the principle of least privilege.
2
Create an IAM role and attach the read-only S3 policy to it.
An IAM role is created with the necessary permissions associated.
An IAM role allows AWS services to assume permissions dynamically without long-term credentials.
3
Associate the IAM role with the EC2 instance via an instance profile.
The EC2 instance is now authorized to retrieve temporary credentials from the instance metadata service.
This enables the application to authenticate securely and automatically rotate credentials without hardcoding them.

Anahtar Kavram

AWS IAM Roles for EC2 Instances
Soru 79Soru →

An online education platform is expanding its services to support medical residency programs and needs to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA). To do this, the platform's administrator needs to review AWS security documentation and formally accept the AWS Business Associate Addendum (BAA). Which of the following tasks can the administrator perform using AWS Artifact to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Download AWS compliance reports, such as SOC and PCI-DSS documents, to review the security controls of AWS infrastructure; Formally accept agreements with AWS, such as the Business Associate Addendum (BAA) for HIPAA compliance

Cevap

Downloading AWS compliance reports to review security controls of the AWS infrastructure and formally accepting agreements with AWS, such as the Business Associate Addendum (BAA), are correct.
AWS Artifact serves as the self-service portal to download AWS security and compliance reports (such as SOC and PCI reports) and to manage and accept agreements (such as the BAA for HIPAA compliance).

Adım Adım Çözüm

1
Identify the service mentioned in the question.
The question asks about tasks performed using AWS Artifact.
AWS Artifact is the central repository for AWS compliance-related information.
2
Determine the two primary capabilities of AWS Artifact.
AWS Artifact consists of two main sections: AWS Artifact Reports (providing compliance reports like SOC, PCI, ISO) and AWS Artifact Agreements (allowing customers to accept agreements like the HIPAA BAA).
This matches the requirements of downloading compliance reports and signing the BAA.
3
Evaluate the other options to rule out services that are not AWS Artifact.
API logging is handled by AWS CloudTrail, vulnerability scanning is done by Amazon Inspector, and physical data center security audits are not permitted for customers.
This isolates the correct options and ensures no incorrect alternatives are selected.

Anahtar Kavram

AWS Artifact provides on-demand access to AWS compliance reports and allows customers to accept agreements like the Business Associate Addendum (BAA).
Soru 80Soru →

A retail company plans to expand its online operations to Europe and must verify that the underlying AWS infrastructure complies with the General Data Protection Regulation (GDPR). Which AWS service should the company use to download official AWS compliance reports and accept agreements?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact
AWS Artifact is the primary portal for retrieving AWS compliance documentation, including SOC reports, PCI reports, and GDPR compliance resources, and accepting agreements.

Adım Adım Çözüm

1
Identify the core requirement of the retail company.
The company needs to obtain official AWS compliance documents and agreements (such as for GDPR) to verify the security and compliance of the AWS infrastructure.
This establishes that the target service must be a compliance document repository.
2
Evaluate the available AWS services to find the correct document portal.
AWS Artifact is identified as the portal designed specifically for retrieving compliance reports and accepting agreements.
Knowing the functions of AWS Artifact versus other security and management tools allows for selecting the correct answer.

Anahtar Kavram

AWS compliance reports and agreements retrieval via AWS Artifact
Tahmini Süre:45s
ÖncekiSayfa 4 / 23Sonraki
Security and Compliance Alıştırma Soruları — AWS Certified Cloud Practitioner — Sayfa 4 | Examkin