Examkin

Security and Compliance

441 soru

Tüm türler441Çoktan seçmeli225Çoklu seçim216
Soru 161Soru →

A media streaming company wants to enhance its security posture. The security team needs a solution to achieve two goals: first, they want to continuously monitor their AWS accounts for malicious activity and unauthorized behavior; second, they want to perform automated security assessments on their Amazon EC2 instances to identify software vulnerabilities. Which of the following AWS services should the company use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty; Amazon Inspector

Cevap

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides active threat detection across AWS accounts, while Amazon Inspector performs vulnerability scanning on Amazon EC2 instances.
Amazon GuardDuty continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior. Amazon Inspector provides automated vulnerability scanning for Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Together, they satisfy the requirements for threat detection and vulnerability management.

Adım Adım Çözüm

1
Identify the service required for active threat detection and continuous monitoring of malicious behavior across AWS accounts.
Amazon GuardDuty is identified as the service that monitors account activity using machine learning and threat intelligence.
To satisfy the requirement of detecting unauthorized or malicious activity at the account level.
2
Identify the service required for scanning Amazon EC2 instances for software vulnerabilities.
Amazon Inspector is identified as the service that automatically scans EC2 instances and ECR container images for software vulnerabilities.
To satisfy the requirement of detecting host-level software vulnerabilities.

Anahtar Kavram

AWS threat detection and vulnerability management services
Soru 162Soru →

A financial institution deploying a payment processing application on AWS wants to ensure compliance with the Payment Card Industry Data Security Standard (PCI-DSS). Under the AWS Shared Responsibility Model, which compliance-related task is the sole responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring data encryption at rest and in transit within the payment application.

Cevap

Configuring data encryption at rest and in transit within the payment application.
Under the AWS Shared Responsibility Model, AWS is responsible for 'security of the cloud,' which includes the physical infrastructure, hardware, and hypervisor virtualization layer. The customer is responsible for 'security in the cloud,' which includes customer data encryption, firewall configuration, and application-level security settings. Therefore, configuring encryption for cardholder data within the application is the customer's sole responsibility.

Adım Adım Çözüm

1
Analyze the Shared Responsibility Model boundaries for a PCI-DSS compliance scenario.
Identify that physical security (data centers) and infrastructure maintenance (hypervisor patching) belong to AWS ('security of the cloud').
This isolates the options that are managed by AWS rather than the customer.
2
Determine the customer's responsibility for protecting data ('security in the cloud').
Recognize that managing encryption settings, keys, and application-level configurations for PCI data is the customer's responsibility.
This confirms the correct compliance task under customer ownership.

Anahtar Kavram

AWS Shared Responsibility Model for Compliance
Soru 163Soru →

A health-tech organization needs to secure its AWS environment to meet compliance standards. The compliance team requires the organization to implement a mechanism that records all historical API activities to identify who made specific configuration changes to security groups, and also run automated scans on their Amazon EC2 instances to check for known software vulnerabilities and package exposures. Which combination of AWS services or responsibility frameworks will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to record API activity, and Amazon Inspector to scan Amazon EC2 instances for software vulnerabilities.

Cevap

The combination of AWS CloudTrail to record API activity and Amazon Inspector to scan Amazon EC2 instances for software vulnerabilities.
The correct answer combines AWS CloudTrail and Amazon Inspector. AWS CloudTrail records and logs AWS API calls, enabling auditing of modifications to security configurations such as security groups. Amazon Inspector is the service that automatically assesses EC2 instances for software vulnerabilities (CVEs) and unintended network exposure.

Adım Adım Çözüm

1
Identify the requirement for tracking and auditing API configuration history.
Determine that AWS CloudTrail is the service responsible for auditing and logging AWS API calls and user activities.
AWS CloudTrail tracks actions taken by a user, role, or an AWS service, which allows the security team to audit who modified the security groups.
2
Identify the requirement for automated vulnerability scanning on Amazon EC2 instances.
Determine that Amazon Inspector is designed to automatically scan EC2 instances for software vulnerabilities (CVEs) and network reachability.
Amazon Inspector continuously scans workloads for software vulnerabilities, whereas GuardDuty focuses on active threat detection, and guest OS security is the customer's responsibility.

Anahtar Kavram

Auditing API activity using AWS CloudTrail and managing EC2 software vulnerabilities using Amazon Inspector under the AWS Shared Responsibility Model.
Soru 164Soru →

A startup has just created its first AWS account and wants to secure the account root user. Which of the following actions represent AWS security best practices for protecting the account root user? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable multi-factor authentication (MFA) for the root user.; Avoid using the root user for daily administrative tasks.

Cevap

Enabling multi-factor authentication (MFA) for the root user and avoiding using the root user for daily administrative tasks.
Securing the AWS account root user requires enabling multi-factor authentication (MFA) to prevent unauthorized access and using IAM users or roles for daily administration rather than using the root user directly.

Adım Adım Çözüm

1
Identify the options that follow the principle of least privilege and root user protection rules.
Enabling multi-factor authentication (MFA) adds an essential security layer, and avoiding root usage for everyday tasks prevents accidental or unauthorized administrative actions.
AWS strongly recommends securing the root user immediately after account creation and using IAM entities instead.

Anahtar Kavram

Root user security best practices, including enabling MFA and delegating administrative tasks to IAM users or roles.
Soru 165Soru →

A software-as-a-service (SaaS) provider wants to implement Amazon Inspector to enhance the security posture of its application hosting environment. Which of the following tasks can Amazon Inspector perform to assist the provider with vulnerability management? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Scanning software packages on running Amazon EC2 instances for known vulnerabilities; Scanning container images stored in Amazon Elastic Container Registry (Amazon ECR) for package vulnerabilities

Cevap

The correct tasks are scanning software packages on running Amazon EC2 instances for known vulnerabilities, and scanning container images stored in Amazon Elastic Container Registry (Amazon ECR) for package vulnerabilities.
Amazon Inspector is a vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It supports automated scanning of software packages installed on running Amazon EC2 instances and container images pushed to Amazon Elastic Container Registry (Amazon ECR).

Adım Adım Çözüm

1
Identify the primary capability of Amazon Inspector.
Amazon Inspector is an automated vulnerability management service designed to scan workloads for software vulnerabilities and unintended network exposure.
This helps determine which options align with vulnerability scanning vs other security activities.
2
Evaluate the workload scanning targets supported by Amazon Inspector.
Amazon Inspector supports scanning Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions.
This matches the options for EC2 package scanning and ECR container image scanning as the correct tasks.
3
Differentiate Amazon Inspector from other security services and user responsibilities.
Anomalous API activity log analysis is performed by Amazon GuardDuty. Applying OS patches is a customer responsibility under the Shared Responsibility Model. Metric monitoring is done by Amazon CloudWatch.
This eliminates the distractors based on the correct division of services and responsibilities.

Anahtar Kavram

Amazon Inspector automated vulnerability scanning for EC2 workloads and container images
Tahmini Süre:1m 30s
Soru 166Soru →

A company is developing a new mobile application and decides to store customer profile data in Amazon DynamoDB. Under the AWS Shared Responsibility Model, which of the following tasks is the customer responsible for?

Cevabı ve açıklamayı göster

Cevap: Configuring identity and access management (IAM) policies to control access to the tables.

Cevap

Configuring identity and access management (IAM) policies to control access to the tables.
In the AWS Shared Responsibility Model, Amazon DynamoDB is a fully managed service. For managed services, AWS takes care of the infrastructure, OS patching, and database software maintenance. The customer remains responsible for securing access to the data, which includes configuring IAM policies to control who can read or write to the database tables.

Adım Adım Çözüm

1
Identify the AWS service model type for Amazon DynamoDB.
Amazon DynamoDB is a fully managed NoSQL database service.
Understanding the service type determines where the line of responsibility is drawn. In managed services, AWS takes over more operational responsibilities.
2
Determine the customer's responsibility boundary for managed database services.
For Amazon DynamoDB, AWS manages the hardware, operating system, and database software. The customer is responsible for data classification, encryption settings, and access control (IAM).
This allows us to identify that configuring access permissions is the customer's duty, while patching and physical maintenance are AWS's duty.

Anahtar Kavram

Shared Responsibility Model
Tahmini Süre:45s
Soru 167Soru →

An enterprise wants to allow its employees to log in to the AWS Management Console using their existing corporate credentials managed by an on-premises identity provider. The security team mandates that employees must not have permanent AWS IAM user credentials. Which of the following IAM features or mechanisms should the enterprise use to implement this configuration?

Cevabı ve açıklamayı göster

Cevap: Federate identities using an IAM role that trusts the external corporate identity provider

Cevap

Federate identities using an IAM role that trusts the external corporate identity provider
Federating identities with an IAM role that trusts the external corporate identity provider allows employees to obtain temporary credentials to access the AWS Management Console. This avoids the administrative overhead and security risks associated with creating and managing permanent IAM users for each employee.

Adım Adım Çözüm

1
Analyze the business and security requirements
The solution must integrate an on-premises identity provider with AWS to allow console access without creating permanent AWS IAM users.
This establishes the constraints: federation/temporary credentials must be used, and IAM users must be avoided.
2
Evaluate the IAM capabilities for external identity integration
AWS IAM supports identity federation using OpenID Connect (OIDC) or SAML 2.0. By establishing a trust relationship, external users are mapped to temporary security credentials via IAM roles.
This matches the requirement for no permanent credentials while enabling single sign-on.
3
Identify and eliminate incorrect options
Creating individual IAM users creates permanent credentials. Sharing root user credentials violates root security practices. Assuming AWS manages on-premises identity systems is a misunderstanding of the Shared Responsibility Model.
This leaves the role-based identity federation option as the only secure and compliant answer.

Anahtar Kavram

IAM Identity Federation and Temporary Access
Tahmini Süre:1m 0s
Soru 168Soru →

A government transit agency runs a fleet of on-premises database servers and also hosts application servers on Amazon EC2. The agency needs to configure a nightly backup process that uploads database logs to a secured Amazon S3 bucket, while strictly adhering to the principle of least privilege and avoiding the use of long-term credentials on any server. Which TWO of the following configurations represent AWS-recommended security practices for this architecture?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role to the Amazon EC2 instances hosting the application servers to grant temporary security credentials for Amazon S3 bucket access.; Use AWS IAM Roles Anywhere to allow the on-premises database servers to assume an IAM role and obtain temporary security credentials using X.509 digital certificates.

Cevap

The correct configurations are attaching an IAM role to the EC2 instances for application server access, and using AWS IAM Roles Anywhere to allow the on-premises database servers to obtain temporary credentials using X.509 digital certificates.
AWS-recommended security practices mandate the use of temporary credentials instead of long-term access keys whenever possible. Attaching an IAM role to EC2 instances allows applications running on them to access AWS resources using temporary, rotated credentials without storing secrets. For resources outside of AWS, such as the on-premises database servers, AWS IAM Roles Anywhere provides a secure way to exchange X.509 digital certificates for temporary AWS credentials, eliminating the need for long-term IAM user access keys on physical hardware.

Adım Adım Çözüm

1
Analyze the organization's requirements for nightly database backups to Amazon S3.
Identify that the solution must support EC2 application servers and on-premises database servers while avoiding the use of long-term credentials on any system.
To determine which IAM features can provide temporary credentials for both AWS-native and non-AWS environments.
2
Evaluate options for providing credentials to the EC2 application servers.
Confirm that attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials without hardcoding secrets.
To securely grant access to AWS resources from EC2 instances in accordance with the principle of least privilege.
3
Evaluate options for providing credentials to the on-premises database servers.
Identify AWS IAM Roles Anywhere as the mechanism to obtain temporary AWS security credentials using X.509 certificates.
To extend the use of temporary IAM roles to workloads running outside of AWS, avoiding static keys on on-premises hardware.
4
Rule out options recommending root user access keys, static shared IAM users, or public access policies.
Exclude root user credential generation, static IAM user key distribution, and public bucket policies as they violate the principle of least privilege and root user best practices.
To avoid severe security risks and adhere to the customer's responsibility under the AWS Shared Responsibility Model.

Anahtar Kavram

Identity and Access Management (IAM)
Soru 169Soru →

A retail company has a web application hosted on an Amazon EC2 instance that needs to read and write images to an Amazon S3 bucket. According to AWS security best practices, which of the following is the most secure method to grant the EC2 instance access to the S3 bucket?

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role with the required S3 permissions to the EC2 instance.

Cevap

Attach an IAM role with the required S3 permissions to the EC2 instance.
Attaching an IAM role to the EC2 instance is the recommended best practice. AWS automatically provides temporary, short-lived security credentials to the EC2 instance through the Instance Metadata Service (IMDS). This eliminates the need to hardcode or store permanent AWS access keys on the instance, reducing the risk of credential exposure.

Adım Adım Çözüm

1
Identify the AWS resource (EC2 instance) that requires permission to access another service (S3).
An application on EC2 needs to communicate with S3.
AWS services requiring access to other AWS services should use temporary credentials instead of long-lived access keys.
2
Determine the AWS-recommended mechanism for granting permissions to applications running on EC2 instances.
IAM roles are designed to grant applications on EC2 temporary access to other AWS resources.
This removes the need to store and manage static AWS credentials on the server, enhancing overall security.

Anahtar Kavram

Using IAM Roles for AWS Services
Tahmini Süre:45s
Soru 170Soru →

A financial services company is setting up AWS access for its newly hired database administrators. The company wants to enforce the principle of least privilege, simplify permissions management as the team grows, and secure individual console access. Which two of the following actions represent recommended AWS Identity and Access Management (IAM) best practices to achieve this?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign the database administrators to an IAM group and attach the necessary permissions policy to that group.; Configure multi-factor authentication (MFA) on the database administrators' individual IAM user accounts.

Cevap

Assign the database administrators to an IAM group and attach the necessary permissions policy to that group, and configure multi-factor authentication (MFA) on the database administrators' individual IAM user accounts.
The correct practices are to assign the administrators to an IAM group and attach policies to that group, and to enforce multi-factor authentication (MFA) on the individual IAM user accounts. Using IAM groups simplifies permissions management as the team grows, and enabling MFA ensures that console access is secured with an additional authentication layer.

Adım Adım Çözüm

1
Evaluate the requirement for managing permissions easily as the team grows.
Using IAM groups allows policies to be attached once and automatically applied to any user added to the group, satisfying the scalability requirement.
Managing permissions at the group level reduces administrative overhead and potential configuration errors.
2
Evaluate the requirement for securing individual console access.
Enabling Multi-Factor Authentication (MFA) on individual IAM user accounts enforces an extra security layer beyond password authentication.
MFA is the standard AWS recommendation for securing console access.
3
Analyze and eliminate incorrect alternatives.
Discard sharing the root user due to security risks; discard attaching roles with permanent access keys since roles only use temporary credentials; discard AWS patching workstations since client-side device security belongs to the customer.
This aligns with the AWS Shared Responsibility Model and core IAM security boundaries.

Anahtar Kavram

AWS IAM best practices including group-based permissions and multi-factor authentication (MFA).
Soru 171Soru →

A real estate platform is preparing for an external security audit and needs to download official compliance reports, such as ISO certifications and Service Organization Control (SOC) reports, to prove the security of the AWS infrastructure. Which AWS service should the platform use to access these documents?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact
AWS Artifact is the central resource for secure, on-demand compliance reports and agreements. It allows customers to download AWS security and compliance documents, such as SOC and ISO reports, to share with their auditors.

Adım Adım Çözüm

1
Identify the primary requirement in the scenario, which is to retrieve third-party compliance reports and certificates (such as ISO and SOC) for the AWS infrastructure.
The platform needs a service that provides secure, on-demand download capabilities for AWS's compliance documents.
AWS manages physical security and infrastructure compliance, and shares these audit reports with customers to help them meet their compliance requirements.
2
Compare the available AWS services and select the correct repository for these compliance documents.
AWS Artifact is identified as the portal designed specifically for retrieving these documents.
AWS Artifact provides on-demand access to AWS's security and compliance reports, whereas services like Amazon Inspector, AWS CloudTrail, and Amazon GuardDuty perform runtime vulnerability scans, API auditing, and threat detection respectively.

Anahtar Kavram

AWS Artifact is the primary portal for secure, on-demand compliance reports and agreements.
Tahmini Süre:45s
Soru 172Soru →

A digital healthcare startup plans to host a patient telemetry application on AWS. To meet regulatory requirements, the startup needs to obtain the AWS ISO 27001 certification, accept the HIPAA Business Associate Addendum (BAA), and ensure that database records are encrypted. Which of the following actions should the startup take to meet these compliance and governance requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Download the ISO 27001 certification and accept the HIPAA Business Associate Addendum (BAA) through AWS Artifact.; Enable encryption for data at rest and in transit within the application's database layer.

Cevap

To meet compliance requirements, the startup must download the ISO 27001 certification and accept the HIPAA BAA via AWS Artifact, and they must enable encryption for data at rest and in transit in their database layer.
The correct actions are downloading compliance documents using AWS Artifact and implementing database encryption. AWS Artifact is the central portal for on-demand access to AWS compliance reports and agreements, such as ISO certificates and the HIPAA Business Associate Addendum (BAA). Under the Shared Responsibility Model, AWS secures the underlying infrastructure, while the customer is responsible for encrypting their data at rest and in transit.

Adım Adım Çözüm

1
Identify the AWS service dedicated to retrieving compliance reports and signing agreements.
AWS Artifact is identified as the portal for downloading official certifications (like ISO 27001) and accepting legal agreements (like the HIPAA BAA).
AWS Artifact provides on-demand access to AWS security and compliance reports.
2
Determine customer security responsibilities under the Shared Responsibility Model.
Encrypting data at rest and in transit is identified as a customer responsibility ('security in the cloud').
AWS manages physical and hypervisor security, while customers must protect their own data and configure encryption keys.

Anahtar Kavram

Retrieving compliance documents through AWS Artifact and understanding customer responsibilities under the Shared Responsibility Model.
Soru 173Soru →

A media streaming company uses Amazon CloudFront to distribute video files to global users. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of AWS?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Maintaining the physical security of the edge locations; Patching the virtualization software and operating systems of the edge servers

Cevap

The correct answers are the options stating that AWS is responsible for maintaining the physical security of the edge locations, and patching the virtualization software and operating systems of the edge servers.
Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud. This includes protecting the global infrastructure (Regions, Availability Zones, and Edge locations) that runs all of the services offered in the AWS Cloud. Therefore, maintaining the physical security of edge locations and patching the virtualization software and operating systems of the edge servers are both AWS responsibilities.

Adım Adım Çözüm

1
Identify the service type and the specific resources being managed in the scenario.
The scenario involves Amazon CloudFront, which is a managed content delivery network (CDN) service deployed at AWS edge locations.
Understanding the service type helps determine where the boundary lies between customer configuration and AWS-managed infrastructure.
2
Distinguish between infrastructure-level security (security of the cloud) and configuration-level security (security in the cloud).
AWS is responsible for the physical security and infrastructure maintenance of edge locations. The customer is responsible for configuring access rules, geographic restrictions, and certificates.
This allows separation of the responsibilities to select the tasks handled by AWS.

Anahtar Kavram

AWS Shared Responsibility Model for managed Edge services
Soru 174Soru →

A gaming studio wants to automatically identify software vulnerabilities and unintended network exposure on its Amazon EC2 instances. Which AWS service should the studio use to perform these security assessments?

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector

Cevap

Amazon Inspector
Amazon Inspector is the correct service because it automatically and continually scans workloads, including Amazon EC2 instances, for software vulnerabilities and unintended network exposure. It identifies package-level issues (CVEs) and provides actionable remediation recommendations.

Adım Adım Çözüm

1
Analyze the requirement to scan EC2 instances for software vulnerabilities and network exposure.
Identify that the task requires a vulnerability assessment tool for host operating systems and software packages.
This narrows down the choice to AWS security services that perform package-level and configuration-level vulnerability scanning.
2
Evaluate the capabilities of the available AWS services.
Determine that Amazon Inspector is designed for scanning software vulnerabilities, whereas GuardDuty is for active threat detection, CloudTrail is for API logging, and Artifact is for compliance documents.
Correctly matching the service definition guarantees selecting the proper tool for vulnerability management.

Anahtar Kavram

Vulnerability scanning for EC2 instances and workloads using Amazon Inspector
Tahmini Süre:45s
Soru 175Soru →

A university is migrating its legacy student registration database to AWS. The database runs on Amazon EC2 instances within a private subnet of a Virtual Private Cloud (VPC). The security team has established two strict requirements:

1. Automatically deny all network traffic originating from a specific list of blacklisted external IP ranges at the subnet boundary.
2. Allow inbound database connections to the database instances on port 1521, while relying on the firewall's stateful behavior to automatically permit the returning outbound database traffic without requiring any explicit outbound rules.

Which of the following security configurations should the university implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Network Access Control List (Network ACL) at the subnet level with a rule to deny traffic from the blacklisted external IP ranges.; Configure a Security Group at the instance level to allow inbound connections on port 1521.

Cevap

To meet the requirements, the university should configure a Network Access Control List at the subnet level with a rule to deny traffic from the blacklisted external IP ranges, and configure a Security Group at the instance level to allow inbound connections on port 1521.
The requirement to deny blacklisted IP ranges at the subnet boundary is met by configuring a Network Access Control List with a deny rule, as Network ACLs operate at the subnet level and support explicit deny rules. The requirement to allow database connections statefully is met by configuring a Security Group, which operates at the instance level and automatically permits return traffic once inbound traffic is allowed.

Adım Adım Çözüm

1
Evaluate the requirement to block specific external IP ranges at the subnet boundary.
Network Access Control Lists operate at the subnet boundary and support explicit deny rules, which makes them suitable for blocking the blacklisted IP ranges before traffic enters the subnet. Security groups operate at the instance level and only support allow rules.
This establishes that a Network ACL must be used for the IP blacklisting requirement.
2
Evaluate the requirement to allow database traffic on port 1521 statefully without explicit outbound rules.
Security Groups are stateful firewalls that operate at the instance level. When you allow inbound traffic on a port, the return outbound traffic is automatically allowed. Network ACLs are stateless, so they do not automatically allow return traffic.
This establishes that a Security Group must be configured for the database instances' inbound rules.

Anahtar Kavram

Stateful vs. Stateless Network Firewalls in AWS
Soru 176Soru →

A financial services company is hosting a payment processing application on Amazon EC2 instances inside a private subnet. The instances must initiate outbound HTTPS connections (port 443) to an external payment gateway API and receive the responses. The security team requires that network access controls be configured at both the subnet boundary and the instance level. Which two configuration steps must the cloud practitioner take to allow this traffic while maintaining a secure architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add an outbound rule to the Security Group allowing TCP port 443 traffic to the destination IP range.; Add an outbound rule to the Network ACL allowing TCP port 443 traffic, and an inbound rule allowing TCP traffic on ephemeral ports 1024-65535 from the destination IP range.

Cevap

Configure the Security Group with an outbound rule allowing TCP port 443 to the destination IP range, and configure the Network ACL with both an outbound rule for TCP port 443 and an inbound rule allowing response traffic on ephemeral ports (1024-65535).
Security Groups operate at the instance level and are stateful. This means that if an outbound rule is created to allow traffic to a destination (such as TCP port 443 to the payment gateway), the return traffic is automatically allowed back in without requiring a corresponding inbound rule. Network Access Control Lists (Network ACLs) operate at the subnet boundary and are stateless. This means that rules must be explicitly created for both outbound and inbound traffic. For outbound connections initiated by the EC2 instances, the outbound rule must allow TCP port 443 to the destination, and the inbound rule must allow the response traffic coming back on ephemeral ports (typically 1024-65535) from the destination.

Adım Adım Çözüm

1
Analyze the security controls at the instance level (Security Group).
Since Security Groups are stateful, allowing outbound TCP port 443 traffic to the API gateway is sufficient to also allow the return traffic. No inbound rule is required.
To grant outbound-initiated communication at the instance level while leveraging Security Group's stateful tracking.
2
Analyze the security controls at the subnet boundary (Network ACL).
Since Network ACLs are stateless, traffic must be allowed explicitly in both directions. Outbound traffic needs a rule for TCP port 443, and inbound return traffic needs a rule for ephemeral ports (1024-65535) because client connections use a random source port in that range.
To ensure both request and response packets can cross the subnet boundary.

Anahtar Kavram

The difference between stateful Security Groups (instance-level) and stateless Network ACLs (subnet-level) in managing outbound traffic and its inbound responses.
Soru 177Soru →

A hospitality booking portal hosts its application on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (ECR). The security team wants to continuously monitor their AWS accounts for malicious activity and unauthorized behavior, while also automatically scanning the EC2 instances and container images for software vulnerabilities.

Which two AWS services should the company use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector to scan the Amazon EC2 instances and Amazon ECR container images for software vulnerabilities; Amazon GuardDuty to perform intelligent threat detection and continuous monitoring for malicious activity

Cevap

Amazon Inspector and Amazon GuardDuty
The service that scans Amazon EC2 instances and Amazon ECR container images for software vulnerabilities is Amazon Inspector. The service that provides intelligent threat detection and continuous monitoring for malicious activity is Amazon GuardDuty.

Adım Adım Çözüm

1
Identify the requirement for software vulnerability scanning on Amazon EC2 instances and ECR container images.
Amazon Inspector is identified as the appropriate AWS service designed for automated vulnerability management and scanning of EC2 instances and ECR images.
It identifies software vulnerabilities and unintended network exposure.
2
Identify the requirement for intelligent threat detection and continuous monitoring for malicious activity across AWS accounts.
Amazon GuardDuty is identified as the appropriate AWS service for intelligent threat detection.
It analyzes data sources like VPC Flow Logs, CloudTrail logs, and DNS logs using machine learning to detect unauthorized or malicious behavior.

Anahtar Kavram

Differentiating AWS threat detection and vulnerability management services under the Shared Responsibility Model.
Soru 178Soru →

A technology company wants to delegate administrative capabilities by allowing department leads to create and manage IAM roles for their developers. To maintain strict security, the central security team must ensure that these department leads cannot grant permissions that exceed a predefined set of allowed services, even if they create policies with administrator access. Which AWS Identity and Access Management (IAM) feature should the security team implement to enforce this maximum permission limit?

Cevabı ve açıklamayı göster

Cevap: Permissions boundaries

Cevap

Permissions boundaries
Permissions boundaries are specifically designed to set the maximum permissions that an identity-based policy can grant to an IAM entity. This allows senior administrators to delegate the creation of IAM roles to department leads, while ensuring that the leads cannot create roles with permissions that exceed the boundary.

Adım Adım Çözüm

1
Analyze the requirement to delegate IAM role management while preventing permission escalation.
Identify that the department leads need to create IAM roles, but must be restricted from granting administrative access to those roles.
This establishes the need for a mechanism that defines the maximum possible permissions that can be delegated.
2
Compare the capabilities of IAM features designed to limit maximum permissions.
Determine that permissions boundaries specifically set the maximum permissions that an identity-based policy can grant to an IAM entity (user or role) within an account.
This aligns with the security best practice of delegation with boundaries.

Anahtar Kavram

Permissions boundaries are used to restrict the maximum permissions that an identity-based policy can grant to an IAM user or role.
Tahmini Süre:2m 0s
Soru 179Soru →

A non-profit organization is setting up its donation portal on AWS and wants to continuously monitor its AWS accounts and workloads for malicious activity, such as unauthorized API calls or potential cryptocurrency mining. Which AWS service should the organization use to detect these threats?

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty

Cevap

Amazon GuardDuty
Amazon GuardDuty is correct because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts, workloads, and data.

Adım Adım Çözüm

1
Identify the need for continuous threat detection and monitoring of AWS accounts and workloads for malicious activities like cryptocurrency mining.
Determine that a service utilizing machine learning and threat intelligence to analyze log sources is required.
Generic logging or vulnerability scanning will not actively identify ongoing threat patterns.
2
Evaluate the correct AWS security service designed for intelligent threat detection.
Amazon GuardDuty is selected because it continuously monitors CloudTrail, VPC Flow Logs, and DNS logs to identify threat patterns.
Amazon GuardDuty is specifically built for active threat detection across AWS accounts.

Anahtar Kavram

Intelligent threat detection using Amazon GuardDuty
Soru 180Soru →

A global travel booking company is preparing for a security audit. The company needs to retrieve AWS compliance documentation, such as SOC reports, and also ensure that their stored customer databases are encrypted. Which of the following actions should the company perform to satisfy these compliance needs? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Retrieve the compliance reports directly using the AWS Artifact console; Enable and configure encryption for customer data stored in AWS databases

Cevap

Retrieve the compliance reports directly using the AWS Artifact console, and enable and configure encryption for customer data stored in AWS databases
To retrieve AWS compliance documents like SOC reports, users must access AWS Artifact. To secure customer database contents, the customer must enable and manage encryption themselves, as data protection is a customer responsibility under the Shared Responsibility Model.

Adım Adım Çözüm

1
Identify the AWS service dedicated to providing compliance reports.
AWS Artifact is identified as the portal to download SOC and ISO reports.
This satisfies the requirement to retrieve AWS compliance documentation.
2
Determine the party responsible for data encryption under the AWS Shared Responsibility Model.
Encrypting customer data is a customer responsibility ('security in the cloud').
This satisfies the requirement to ensure the customer databases are encrypted.

Anahtar Kavram

AWS Compliance and Shared Responsibility Model
ÖncekiSayfa 9 / 23Sonraki
Security and Compliance Alıştırma Soruları — AWS Certified Cloud Practitioner — Sayfa 9 | Examkin