Amazon Practice Questions, Discussions & Exam Topics by our Authors
Company A has an AWS account that is named Account A. Company A recently acquired Company B, which has an AWS account that is named Account B. Company B stores its files in an Amazon S3 bucket. The administrators need to give a user from Account A full access to the S3 bucket in Account B.
After the administrators adjust the IAM permissions for the u...
To grant a user from Account A full access to an S3 bucket in Account B, a proper access control mechanism must be put in place. After adjusting the IAM permissions in Account A, the user still cannot access the bucket, which indicates that the permissions in Account B have not been correctly configured to allow access.
Key Factors:
1. IAM Permissions in Account A: These permissions allow the user from Account A to interact with resources, but cross-account permissions must also be configured in Account B to allow the access.
2. Access Control Mechanism: There are different mechanisms for granting access to S3 buckets—ACLs, bucket policies, and user policies. The correct mechanism must be chosen based on the use case of cross-account access.
3. Cross-Account Access: The solution must allow users from Account A to access resources in Account B securely without introducing unnecessary complexity or security risks.
Evaluation of Each Option:
- A) In Account B, create a bucket ACL to allow the user from Account A to access the S3 bucket in Account B.
- Pros: ACLs can be used to grant cross-account access to specific objects or buckets.
- Cons: While ACLs can work for granting access, they are generally considered legacy and less flexible compared to bucket policies. Additionally, ACLs require explicit permission on each object, which can make management cumbersome, especially for large buckets. This approach is less secure and harder to manage than using a bucket policy.
- Conclusion: ACLs are a valid but outdated mechanism for controlling access to S3 resources. It's better to use a more scalable and manageable solution such as a bucket policy.
- B) In Account B, create an object ACL to allow the user from Account A to access all the objects in the S3 bucket in Account B.
- Pros: Object ACLs can be used to grant access at the object level.
- Cons: Managing permissions for each object via ACLs can be error-prone and cumbersome, especially when dealing with large numbers of objects. Additionally, this approach might not grant th...
Author: Max · Last updated Jul 19, 2026
A company wants to receive an email notification about critical findings in AWS Security Hub. The company does not have an existing architecture that supp...
Option A: Create an AWS Lambda function to identify critical Security Hub findings. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target of the Lambda function. Subscribe an email endpoint to the SNS topic to receive published messages.
- Explanation: While Lambda can be used to process findings, it requires manual intervention to filter and identify critical findings, adding complexity to the setup. AWS Lambda functions generally require custom code to identify and send notifications for critical findings. However, this introduces extra maintenance overhead and complexity compared to other options.
- Why rejected: This approach is more complex than necessary. It requires managing Lambda functions, writing code to filter critical findings, and potentially introducing latency. Additionally, this approach doesn’t scale as easily as EventBridge, which is designed for handling events natively.
- Scenarios where this might be used: If a more advanced, custom logic is required for processing Security Hub findings beyond simple filtering.
Option B: Create an Amazon Kinesis Data Firehose delivery stream. Integrate the delivery stream with Amazon EventBridge. Create an EventBridge rule that has a filter to detect critical Security Hub findings. Configure the delivery stream to send the findings to an email address.
- Explanation: Kinesis Data Firehose is generally used for streaming and transforming large amounts of data, such as logs or real-time data feeds. While it can be used in combination with EventBridge, this setup is unnecessarily complex for sending email notifications about critical findings.
- Why rejected: Kinesis Data Firehose is overkill for this requirement. It is designed for high-throughput data processing, not for simple email notifications. The integration with EventBridge adds an additional layer of complexity that is not needed in this scenario.
- Scenarios where this might be used: For complex use cases involving real-time data streaming and transformation, such as ...
Author: James · Last updated Jul 19, 2026
An international company has established a new business entity in South Korea. The company also has established a new AWS account to contain the workload for the South Korean region. The company has set up the workload in the new account in the ap-northeast-2 Region. The workload consists of three Auto Scaling groups of Amazon EC2 instances. All workloads that operate in this Region must keep system logs and application logs for 7 years.
A security engineer must implement a solution to ensure that no logging data is lost f...
Option A: Ensure that the Amazon CloudWatch agent is installed on all the EC2 instances that the Auto Scaling groups launch. Generate a CloudWatch agent configuration file to forward the required logs to Amazon CloudWatch Logs.
- Explanation: Installing the CloudWatch agent on EC2 instances allows for the collection of both system and application logs, which can be forwarded to CloudWatch Logs. This ensures that logs are continuously collected and retained, even during Auto Scaling activities, since logs will be managed centrally in CloudWatch.
- Why selected: This option guarantees that log data will be preserved across EC2 instance scaling activities because the logs will be sent directly to CloudWatch Logs, preventing loss of log data when instances are terminated or replaced in the Auto Scaling process.
- Scenarios where this is ideal: Ideal when logs need to be aggregated centrally and the requirement is for long-term retention (7 years in this case), with the ability to access logs efficiently for analysis and compliance.
Option B: Set the log retention for desired log groups to 7 years.
- Explanation: Amazon CloudWatch Logs allows setting a retention policy on log groups. By setting the retention to 7 years, the company can automatically manage the logs' lifecycle, ensuring compliance with the requirement to keep logs for 7 years and that no logs are deleted prematurely.
- Why selected: This is a critical step in meeting the requirement to retain logs for 7 years. Once the logs are forwarded to CloudWatch Logs, setting the retention policy ensures that CloudWatch will automatically manage log expiration after 7 years, without manual intervention.
- Scenarios where this is ideal: Suitable for ensuring that the logs are automatically retained and deleted according to compliance needs, without requiring additional effort.
Option C: Attach an IAM role to the launch configuration or launch template that the Auto Scaling groups use. Configure the role to provide the necessary permissions to forward logs to Amazon CloudWatch Logs.
- Explanation: EC2 instances need appropriate permissions to send logs to CloudWatch Logs. Attaching an IAM role with the necessary permissions ensures that the EC2 instances launched by the Auto Scaling groups can forward logs to CloudWatch Logs. This avoids the need to manually configure individual instances.
- Why selected: This step is essential to provide the EC2 instances with the correct permissions to forward logs to CloudWatch. Without this role, the instances won’t be able to send logs to CloudWatch, preventing log aggregation.
- Scenarios where this is ideal: This is a standard requirement when you need to automate log forwarding for EC2 instances and ensure that the scaling EC2 instances have the necessary permissions to perform this action.
Option ...
Author: Ava · Last updated Jul 19, 2026
A security engineer is designing an IAM policy to protect AWS API operations. The policy must enforce multi-factor authentication (MFA) for IAM users to access certain services in the AWS production account. Each session must remain valid for only 2 hours. The current version of the IAM policy is as fol...
Option A: "Bool": {"aws:MultiFactorAuthPresent": "true"}
- Explanation: This condition ensures that multi-factor authentication (MFA) is enabled for the IAM user when accessing the resources. The "aws:MultiFactorAuthPresent" condition checks whether MFA has been provided during the session. Setting it to `"true"` enforces that MFA must be used for the session.
- Why selected: To meet the requirement that MFA must be enforced, this condition is necessary because it ensures users can only perform actions if they have authenticated with MFA.
- Scenarios where this is ideal: This option is essential when enforcing MFA as a prerequisite for accessing sensitive or production resources.
Option B: "Bool": {"aws:MultiFactorAuthPresent": "false"}
- Explanation: This condition would allow actions only when MFA is not enabled. This is the opposite of the required functionality.
- Why rejected: This condition is not suitable because the security requirement is to enforce MFA, not to disable it. This would violate the policy requirement of enforcing MFA for access.
- Scenarios where this might be used: It would be used in situations where you want to block actions if MFA is not used, but that’s not the case in this scenario.
Option C: "NumericLessThan": {"aws:MultiFactorAuthAge": "7200"}
- Explanation: The `aws:MultiFactorAuthAge` condition is used to control the age of the MFA session, i.e., how long ago the MFA authentication occurred. If `aws:MultiFactorAuthAge` is less than 7200 seconds (2 hours), it ensures that the MFA session is still valid. This directly meets the requirement that the session should remain valid for only 2 hours.
- Why selected: This condition is crucial for enforcing the session duration. By setting it to 7...
Author: Ahmed97 · Last updated Jul 19, 2026
A company uses AWS Organizations and has production workloads across multiple AWS accounts. A security engineer needs to design a solution that will proactively monitor for suspicious behavior across all the accounts that contain production workloads.
The solution must automate remediation of incidents across the production accounts. The solution also must publish a notification to an Amazon Simple Notification Service (Amazon SN...
Option A: Activate Amazon GuardDuty in each production account. In a dedicated logging account, aggregate all GuardDuty logs from each production account. Remediate incidents by configuring GuardDuty to directly invoke an AWS Lambda function. Configure the Lambda function to also publish notifications to the SNS topic.
- Explanation: GuardDuty can monitor for suspicious behavior in AWS accounts, and using it in each production account helps identify potential threats. GuardDuty’s findings can be aggregated in a central logging account to maintain security visibility. Additionally, configuring GuardDuty to trigger a Lambda function allows for automatic remediation, and the Lambda function can be set up to notify via SNS.
- Why rejected: While this approach works for GuardDuty findings, it doesn't fully meet the requirement for a comprehensive security monitoring solution, as it focuses only on GuardDuty findings. For more holistic security management across multiple AWS accounts, AWS Security Hub is often a better choice because it integrates findings from multiple AWS security services.
- Scenarios where this might be used: This option could work well when GuardDuty is the primary service to monitor suspicious behavior, but it may not capture other security findings from AWS services.
Option B: Activate AWS Security Hub in each production account. In a dedicated logging account, aggregate all Security Hub findings from each production account. Remediate incidents by using AWS Config and AWS Systems Manager. Configure Systems Manager to also publish notifications to the SNS topic.
- Explanation: Security Hub aggregates findings from multiple AWS security services, making it a comprehensive security monitoring solution. Using it in each production account and aggregating findings in a dedicated logging account meets the need for centralized visibility. AWS Config and AWS Systems Manager can automate remediation of incidents, and Systems Manager can trigger SNS notifications.
- Why rejected: While this approach is valid, the solution relies on AWS Config and Systems Manager for remediation. While effective, this can introduce unnecessary complexity when using EventBridge and Lambda, which are more commonly used for security automation and incident response workflows.
- Scenarios where this might be used: Ideal when integrating AWS Config and Systems Manager into the security automation workflow is a priority or when using AWS Config for compliance and configuration management.
Option C: Activate Amazon GuardDuty in each production account. In a dedicated logging account, aggregate all GuardDuty logs from e...
Author: Ella · Last updated Jul 19, 2026
A company is designing a multi-account structure for its development teams. The company is using AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On). The company must implement a solution so that the development teams can use only specific AWS Regions and so that each AWS account...
Option A: Use IAM Identity Center to set up service-linked roles with IAM policy statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
- Explanation: This approach involves using AWS IAM Identity Center (formerly AWS SSO) with service-linked roles, which simplifies centralized management of permissions for IAM users and groups. While it’s possible to restrict access to specific services and Regions using IAM policies, this option introduces more complexity with service-linked roles and does not align as well with the need to control access across multiple accounts.
- Why rejected: This solution is somewhat over-complicated for the requirements. Using service-linked roles with IAM Identity Center adds unnecessary complexity, and IAM Identity Center itself does not provide an efficient way to restrict services and Regions compared to other AWS tools like Service Control Policies (SCPs).
- Scenarios where this might be used: Suitable when you need fine-grained control and are already using service-linked roles extensively, but this approach is not the best fit for this scenario.
Option B: Deactivate AWS Security Token Service (AWS STS) in Regions that the developers are not allowed to use.
- Explanation: Disabling AWS Security Token Service (STS) in specific regions would prevent developers from assuming roles or getting temporary credentials in those regions. However, this solution doesn’t directly address the requirement to restrict access to specific AWS services.
- Why rejected: This approach focuses on controlling access to temporary credentials, not directly controlling access to services or regions within AWS. It’s a narrow solution and doesn't solve the overall requirement of limiting access to specific AWS services and regions. Additionally, it doesn’t provide fine-grained control over which services the users can access.
- Scenarios where this might be used: This might be useful in specific cases where controlling access to temporary credentials is the main goal, but it is not comprehensive enough for this broader use case.
Option C: Create SCPs that include the Condition, Resource, and NotAction elements to allow access to onl...
Author: Leah · Last updated Jul 19, 2026
A company is developing an ecommerce application. The application uses Amazon EC2 instances and an Amazon RDS MySQL database. For compliance reasons, data must be secured in transit and at rest. The company needs a solution ...
Let's evaluate each option based on the requirements: securing data in transit and at rest, minimizing operational overhead, and minimizing cost.
A) Use TLS certificates from AWS Certificate Manager (ACM) with an Application Load Balancer. Deploy self-signed certificates on the EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Enable encryption of the RDS DB instance. Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that support the EC2 instances.
- Securing Data in Transit: Using TLS certificates from AWS Certificate Manager (ACM) ensures secure communication between clients and the Application Load Balancer (ALB). The communication between EC2 instances and Amazon RDS is secured using TLS.
- Securing Data at Rest: Enabling encryption for Amazon RDS and EBS volumes ensures data is encrypted at rest.
- Operational Overhead: ACM provides managed TLS certificates, reducing operational overhead as it handles certificate renewals automatically. However, deploying self-signed certificates on the EC2 instances adds some complexity and does not fully reduce operational overhead.
- Cost: ACM is free for managing certificates, but there are costs associated with using the ALB, RDS, and EBS encryption. Overall, the cost is reasonable for the security provided.
B) Use TLS certificates from a third-party vendor with an Application Load Balancer. Install the same certificates on the EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Use AWS Secrets Manager for client-side encryption of application data.
- Securing Data in Transit: Using third-party TLS certificates will also secure communication between the client and the ALB, and between EC2 instances and RDS.
- Securing Data at Rest: While this option mentions using Secrets Manager for client-side encryption, it doesn't directly address encryption at rest for the database or EC2 instance volumes.
- Operational Overhead: Using third-party certificates introduces more operational complexity because you need to manage, renew, and install certificates manually, unlike AWS-managed ACM certificates. Additionally, using Secrets Manager for encryption adds another layer of complexity for managing encryption keys.
- Cost: There are additional costs for third-party certificates, Secrets Manager, and the operational overhead to manage certificates, making this solution more expensive and less efficient.
C) Use AWS CloudHSM to generate TLS certificates for the EC2 instances. Install the TLS certificates on...
Author: Scarlett · Last updated Jul 19, 2026
A security engineer is working with a company to design an ecommerce application. The application will run on Amazon EC2 instances that run in an Auto Scaling group behind an Application Load Balancer (ALB). The application will use an Amazon RDS DB instance for its database.
The only required connectivity from the internet is for HTTP and HTTPS traffic to the application. The application must communicate with an external payment provider that allows traffic only from a preconfigured allow list of IP addresses. The company...
Let's break down each option and evaluate the requirements for the ecommerce application and communication with the external payment provider.
Requirements:
- HTTP/HTTPS traffic: The only allowed connectivity from the internet is HTTP and HTTPS to the application.
- Communication with external payment provider: The communication must be uninterrupted, and traffic should originate from preconfigured IP addresses.
- Scaling: The solution should ensure that communication with the external payment provider is not disrupted as the environment scales.
A) Deploy a NAT gateway in each private subnet for every Availability Zone that is in use.
- Why this option is selected: Since the EC2 instances need to communicate with an external payment provider and they are likely in private subnets, a NAT gateway allows outbound internet traffic from the private subnets (where EC2 instances reside) to external services like the payment provider. It is essential to scale the application without interrupting these communications.
- Why other options are rejected:
- This is the correct solution because it ensures uninterrupted outbound traffic from private subnets to the payment provider.
- It's important to deploy NAT gateways in every Availability Zone to maintain high availability and scalability of the environment.
- Key factor: Ensures that outbound communication with external services is routed without disrupting scaling.
B) Place the DB instance in a public subnet.
- Why this option is rejected:
- Placing the database in a public subnet exposes it to the internet, which is not recommended from a security perspective. RDS instances should not be directly accessible from the internet unless absolutely necessary.
- Key factor: Databases should be placed in a private subnet for security reasons to minimize exposure to the public internet.
C) Place the DB instance in a private subnet.
- Why this option is selected:
- Placing the DB instance in a private subnet ensures that it is not directly accessible from the internet,...
Author: Ming88 · Last updated Jul 19, 2026
A company uses several AWS CloudFormation stacks to handle the deployment of a suite of applications. The leader of the company's application development team notices that the stack deployments fail with permission errors when some team members try to deploy the stacks. However, other team members can deploy the stacks successfully.
The team members access the account by assuming a role that has a specific set of permissions that are necessary for the job responsibili...
To solve the issue of stack deployment failures due to permission errors, we need to ensure that the team members have the correct permissions and that the AWS CloudFormation stacks can be deployed with the necessary roles. Here's an evaluation of the options:
A) Create a service role that has a composite principal that contains each service that needs the necessary permissions. Configure the role to allow the sts:AssumeRole action.
- Why this option is rejected:
- The approach of creating a composite principal to include each service is generally unnecessary. In most scenarios, the service principal `cloudformation.amazonaws.com` is sufficient to allow CloudFormation to assume the role. Additionally, a composite principal would introduce complexity and is not a common or recommended pattern for granting permissions to CloudFormation itself.
- Key factor: Not aligned with AWS best practices and unnecessarily complex.
B) Create a service role that has cloudformation.amazonaws.com as the service principal. Configure the role to allow the sts:AssumeRole action.
- Why this option is selected:
- This is the correct approach. The `cloudformation.amazonaws.com` service principal grants AWS CloudFormation the permissions it needs to assume the role during stack operations.
- This role can then be assigned to the CloudFormation service for deployment tasks. It ensures that CloudFormation can assume the role and perform the necessary operations on behalf of the team members.
- Key factor: Follows AWS best practices and ensures that CloudFormation can correctly assume the role with the required permissions.
C) For each required set of permissions, add a separate policy to the role to allow those permissions. Add the ARN of each CloudFormation stack in the resource field of each policy.
- Why this option is rejected:
- Adding policies to the service role with specific stack ARNs is too granular and unnecessary. CloudFormation should be granted permissions based on the actions it needs to perform (e.g., `cloudformation:CreateStack`, `cloudformation:UpdateStack`), rather than restricting access to individual stacks using ARNs.
- Key factor: Granular control like this can lead to maintenance overhead and is not needed for CloudFormation’s role management.
D) For each required set of permissions, add a separate policy to ...
Author: Joseph · Last updated Jul 19, 2026
A company used a lift-and-shift approach to migrate from its on-premises data centers to the AWS Cloud. The company migrated on-premises VMs to Amazon EC2 instances. Now the company wants to replace some of components that are running on the EC2 instances with managed AWS services that provide similar functionality.
Initially, the company will transition from load balancer software that runs on EC2 instances to AWS Elastic Load Balancers. A security engineer must ensure that after this transition, ...
To meet the requirements of centralizing and searching load balancer logs while also generating metrics related to ciphers in use, let's evaluate each option in detail:
Requirements:
- Centralize and search logs: The logs should be centralized and searchable for auditing.
- Generate metrics for ciphers: The solution should generate metrics showing which ciphers are in use.
A) Create an Amazon CloudWatch Logs log group. Configure the load balancers to send logs to the log group. Use the CloudWatch Logs console to search the logs. Create CloudWatch Logs filters on the logs for the required metrics.
- Why this option is rejected:
- While this solution can centralize logs and allow for searching through CloudWatch Logs, it doesn't fully address generating metrics related to ciphers in use.
- CloudWatch Logs doesn't natively support detailed metrics extraction from log data like cipher information. You would have to manually parse and extract this data, which can be complex and error-prone.
- Key factor: CloudWatch Logs is more suited for log searching but lacks automatic, structured metric generation like cipher data.
B) Create an Amazon S3 bucket. Configure the load balancers to send logs to the S3 bucket. Use Amazon Athena to search the logs that are in the S3 bucket. Create Amazon CloudWatch filters on the S3 log files for the required metrics.
- Why this option is rejected:
- While using an S3 bucket and Athena for log searching is a valid option for centralizing and querying logs, it doesn't directly generate metrics such as the ciphers being used. Athena can be used for searching, but CloudWatch filters alone won't extract specific metrics from the logs.
- Additionally, using CloudWatch filters on S3 log files is not a straightforward or supported approach. Athena is more appropriate for searching and analyzing logs stored in S3.
- Key factor: While this option does handle centralized searching, it does not handle the generation of the required metrics like ciphers in use in an efficient manner.
C) Create an Amazon S3 bucket. Configur...
Author: Amelia · Last updated Jul 19, 2026
A company uses AWS Organizations to manage a multi-account AWS environment in a single AWS Region. The organization's management account is named management-01. The company has turned on AWS Config in all accounts in the organization. The company has designated an account named security-01 as the delegated administrator for AWS Config.
All accounts report the compliance status of each account's rules to the AWS Config delegated administrator account by using an AWS Config aggregator. Each account administrator can configure and manage the account's own AWS Config rules to handle each account's unique compliance requirements.
A security engineer needs t...
Let's evaluate each option and how they relate to the requirements of deploying AWS Config rules across all existing and future AWS accounts in the organization:
Requirements:
- Automatically deploy AWS Config rules: A set of 10 AWS Config rules must be deployed to all existing and future AWS accounts in the organization.
- Ensure AWS Config is automatically turned on during account creation: AWS Config needs to be activated across all accounts, even for future accounts.
- Delegated administrator: The delegated administrator for AWS Config is the `security-01` account.
A) Create an AWS CloudFormation template that contains the 10 required AWS Config rules. Deploy the template by using CloudFormation StackSets in the security-01 account.
- Why this option is rejected:
- While this option will deploy the CloudFormation template containing the 10 required AWS Config rules across multiple accounts using StackSets, it does not ensure AWS Config is automatically turned on in new accounts during their creation. The solution focuses on deploying rules but does not guarantee that AWS Config is activated in each account automatically.
- Key factor: StackSets will not handle AWS Config activation automatically in new accounts.
B) Create a conformance pack that contains the 10 required AWS Config rules. Deploy the conformance pack from the security-01 account.
- Why this option is selected:
- Conformance packs allow the bundling of AWS Config rules and compliance checks. When deployed, a conformance pack will ensure that a set of rules is applied across all accounts in an organization, and AWS Config will be automatically enabled in the accounts where the conformance pack is deployed. This solution meets both the need to deploy the rules and automatically activate AWS Config during account creation.
- Key factor: Conformance packs allow for the deployment of rules across multiple accounts and the automatic activation of AWS Config.
C) Create a conformance pack that contains the 10 required AWS Config rules. Deploy the conformance pack from the management-01 account.
- Why this opt...
Author: Emily · Last updated Jul 19, 2026
A company has a legacy application that runs on a single Amazon EC2 instance. A security audit shows that the application has been using an IAM access key within its code to access an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET1 in the same AWS account. This access key pair has the s3:GetObject permission to all objects in only this S3 bucket. The company takes the application offline because the application is not compliant with the company's security policies for accessing other AWS resources from Amazon EC2.
A security engineer validates that AWS CloudTrail is turned on in all AWS Regions. CloudTrail is sending logs to an S3 bucket that is named DOC-EXAMPLE-BUCKET2. This S3 bucket is in the same AWS account as DOC-EXAMPLE-BUCKET1. However, CloudTrail has not been configured to send logs to Amazon CloudWatch Logs.
The company wants to know...
To gather the information about whether any objects in DOC-EXAMPLE-BUCKET1 were accessed by the IAM access key, and whether they contained PII, the security engineer can follow a combination of steps that best address the problem. Let's analyze each option:
A) Use Amazon CloudWatch Logs Insights to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII and that were available to the access key.
- Why rejected: CloudWatch Logs Insights is a tool to query logs stored in CloudWatch Logs. However, the CloudTrail logs are stored in an S3 bucket (DOC-EXAMPLE-BUCKET2) and not in CloudWatch Logs, as per the information in the scenario. Therefore, CloudWatch Logs Insights would not be useful for querying CloudTrail logs in S3 and identifying access with the IAM key.
B) Use Amazon OpenSearch Service to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for API calls that used the access key to access an object that contained PII.
- Why rejected: Amazon OpenSearch Service is a powerful search and analytics tool, but it requires logs to be ingested into OpenSearch before you can query them. CloudTrail logs are not automatically sent to OpenSearch; this would require additional configuration that isn't part of the given scenario. Also, CloudTrail logs do not contain the actual content of the objects (e.g., whether they contain PII), so OpenSearch would not directly help identify PII within the objects.
C) Use Amazon Athena to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for any API calls that used the access key to access an object that contained PII.
- Why selected: Athena is a serverless query service that allows you to run SQL queries on data stored in S3. ...
Author: SolarFalcon11 · Last updated Jul 19, 2026
A security engineer creates an Amazon S3 bucket policy that denies access to all users. A few days later, the security engineer adds an additional statement to the bucket policy to allow read-only access to one other employee. Even after updating the ...
Explanation of each option:
A) The ACL in the bucket needs to be updated.
- Why rejected: The scenario explicitly states that the security engineer modified the S3 bucket policy and not the Access Control List (ACL). ACLs are used to grant permissions at the object level and are typically independent of the bucket policy. Since the issue is related to the bucket policy, updating the ACL would not be relevant here. Thus, this option does not apply to the situation described.
B) The IAM policy does not allow the user to access the bucket.
- Why rejected: The question specifies that a bucket policy was applied to grant read-only access to the employee, not an IAM policy. IAM policies are separate from bucket policies, and while they do control access, the main focus in this scenario is on the S3 bucket policy. Additionally, if the IAM policy were the issue, the employee would not have even been able to access the bucket initially, not just after the bucket policy change.
C) It takes a few minutes for a bucket policy to take...
Author: Liam · Last updated Jul 19, 2026
A company is using Amazon Macie, AWS Firewall Manager, Amazon Inspector, and AWS Shield Advanced in its AWS account. The company wants to receive alerts if a DDoS attac...
Explanation of each option:
A) Use Macie to detect an active DDoS event. Create Amazon CloudWatch alarms that respond to Macie findings.
- Why rejected: Amazon Macie is primarily used for discovering and classifying sensitive data (such as personally identifiable information or PII) within your Amazon S3 buckets. Macie is not designed to detect or respond to DDoS (Distributed Denial of Service) attacks. Therefore, this option is not suitable for monitoring DDoS events and will not help in meeting the requirement.
B) Use Amazon Inspector to review resources and to invoke Amazon CloudWatch alarms for any resources that are vulnerable to DDoS attacks.
- Why rejected: Amazon Inspector is a security assessment service that helps identify vulnerabilities in applications and infrastructure. It is useful for identifying security weaknesses and compliance issues but is not designed to detect or alert on active DDoS attacks. Therefore, this solution is not directly related to the detection of DDoS events and cannot effectively meet the requirement.
C) Create an Amazon CloudWatch alarm that monitors Firewall Manager metrics for an active DDoS ev...
Author: Maya · Last updated Jul 19, 2026
A company hosts a web application on an Apache web server. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The company configured the EC2 instances to send the Apache web server logs to an Amazon CloudWatch Logs group that the company has configured to expire after 1 year.
Recently, the company discovered in the Apache web server logs that a specific IP address is sending suspicious requests to the web application. A security engineer wants to analyze the past week of Apac...
Explanation of each option:
A) Export the CloudWatch Logs group data to Amazon S3. Use Amazon Macie to query the logs for the specific IP address and the requested URL.
- Why rejected: Amazon Macie is a data security service that is primarily used for discovering and classifying sensitive data (such as PII) in S3 buckets. It is not designed to query logs or to analyze specific events like web server requests based on IP addresses or URLs. Therefore, Macie is not suitable for this scenario, and this solution would be inefficient and not ideal for the task.
B) Configure a CloudWatch Logs subscription to stream the log group to an Amazon OpenSearch Service cluster. Use OpenSearch Service to analyze the logs for the specific IP address and the requested URLs.
- Why rejected: While Amazon OpenSearch Service (formerly Elasticsearch Service) is great for storing and analyzing large volumes of log data, setting up an OpenSearch Service cluster involves more configuration work (streaming the logs and creating the necessary infrastructure). This may be an overcomplicated solution for the task, which can be handled more easily with a simpler approach such as using CloudWatch Logs Insights. Thus, while OpenSearch can help, it adds unnecessary complexity for the current requirements.
C) Use CloudWatch Logs Insights...
Author: Michael · Last updated Jul 19, 2026
While securing the connection between a company's VPC and its on-premises data center, a security engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). The ping command did not return a re...
Explanation of each option:
A) In the security group of the EC2 instance, allow inbound ICMP traffic.
- Why selected: In AWS, security groups are stateful firewalls that control inbound and outbound traffic to EC2 instances. For a ping command (ICMP Echo Request) to work, the security group attached to the EC2 instance must allow inbound ICMP traffic. Since the flow log shows traffic originating from the on-premises host (203.0.113.12) and directed to the EC2 instance (172.31.16.139), the security group on the EC2 instance needs to allow inbound ICMP traffic in order to respond to the ping request. This is the correct action to resolve the issue, as it directly addresses the missing permission for the ICMP Echo Request.
B) In the security group of the EC2 instance, allow outbound ICMP traffic.
- Why rejected: The outbound ICMP traffic rule in the security group is relevant for responses from the EC2 instance (i.e., ICMP Echo Replies). However, the issue at hand is about allowing the inbound ICMP traffic (the ping request from the on-premises host), not the outbound traffic. The outbound rule is generally not r...
Author: David · Last updated Jul 19, 2026
A company developed an application by using AWS Lambda, Amazon S3, Amazon Simple Notification Service (Amazon SNS), and Amazon DynamoDB. An external application puts objects into the company's S3 bucket and tags the objects with date and time. A Lambda function periodically pulls data from the company's S3 bucket based on date and time tags and inserts specific values into a DynamoDB table for further processing.
The data includes personally identifiable ...
To evaluate which solution meets the company's requirement of removing data older than 30 days from both the S3 bucket and the DynamoDB table with the most operational efficiency, let's analyze the options step by step:
Option A:
- Action for S3: Adding a TTL (Time to Live) S3 flag to objects and creating an S3 Lifecycle policy to expire objects based on the TTL flag.
- Action for DynamoDB: No explicit mention of handling DynamoDB.
Analysis:
S3 TTL flags can automatically expire objects after a set time, making the solution efficient for managing S3 objects. However, there is no mention of how DynamoDB will handle data expiration, so this option does not fully meet the requirement for both systems (S3 and DynamoDB). Thus, it does not offer complete operational efficiency.
Option B:
- Action for S3: Create an S3 Lifecycle policy to expire objects that are older than 30 days.
- Action for DynamoDB: Update the Lambda function to add the TTL attribute in the DynamoDB table and enable TTL for automatic expiration.
Analysis:
This option provides a solid solution for both systems:
- The S3 Lifecycle policy will automatically remove objects older than 30 days, which is efficient.
- DynamoDB TTL is also set up, which allows automatic deletion of items older than 30 days based on the TTL attribute, thus ensuring data expiration is handled automatically without additional manual intervention in the Lambda function.
This is a highly efficient solution because it leverages built-in TTL features for both S3 and DynamoDB, minimizing operational overhea...
Author: Sofia2021 · Last updated Jul 19, 2026
What are the MOST secure ways to protect the AWS account root user of a recently opened AWS account?...
To secure the AWS account root user of a recently opened AWS account, the focus should be on minimizing the use of the root user and enforcing strong authentication mechanisms. Let's evaluate the options based on these criteria:
Option A:
- Use the AWS account root user access keys instead of the AWS Management Console.
Analysis:
This option is not recommended because the AWS account root user should be used sparingly. Root user access keys pose a significant security risk since they provide full access to the account. Using the root user for everyday activities can increase the potential for accidental or malicious actions. Instead, the best practice is to avoid using the root user for day-to-day tasks and to create specific IAM users with appropriate permissions. This option goes against the principle of least privilege and doesn't improve security.
Option B:
- Enable multi-factor authentication for the AWS IAM users with the AdministratorAccess managed policy attached to them.
Analysis:
While enabling multi-factor authentication (MFA) for IAM users with AdministratorAccess is an important step to enhance security, this does not directly protect the AWS account root user. The root user itself requires its own protection, and IAM users are separate entities. However, this option adds an additional layer of security for users who have high-level privileges. While important for overall account security, it doesn't directly secure the root user.
Option C:
- Use AWS KMS to encrypt all AWS account root user and AWS IAM access keys and set automatic rotation to 30 days.
Analysis:
AWS KMS (Key Management Service) is used to manage encryption keys, but it cannot be used to encrypt root user access keys directly. Moreover, access keys for the root user ...
Author: ElectricLionX · Last updated Jul 19, 2026
A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store's application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account. The company uses AWS Organizations and has an OU that is used only for these accounts.
The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company's deployment plan for AWS resources. The security engineer also must limit ...
In this scenario, the security engineer needs to ensure that each team follows the company's deployment plan for AWS resources, while also limiting access to the deployment plan to only the developers who need access. The solution should focus on a secure, centralized way of managing access to the CloudFormation template and ensuring that only authorized users can deploy the resources.
Option A: Create an AWS Service Catalog portfolio in the organization's management account. Upload the CloudFormation template. Add the template to the portfolio's product list. Share the portfolio with the OU.
- Analysis: This option makes use of AWS Service Catalog to centrally manage the CloudFormation template. Service Catalog allows the company to create a catalog of approved resources and share it with specific accounts or organizational units (OUs). By sharing the portfolio with the OU, the security engineer can ensure that only authorized developers in that OU have access to the deployment plan. This is a secure and scalable solution because it allows the company to define and enforce which resources can be deployed, ensuring compliance with the company's deployment plan.
- Why this is good: AWS Service Catalog allows granular access control, and the deployment templates can be shared securely without direct access to the underlying CloudFormation templates. It is the most secure and scalable approach.
Option B: Use the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. In the OU, create an SCP that allows access to the extension.
- Analysis: This option involves creating a private extension in the CloudFormation registry. While this might be an option for controlling access to reusable components or modules, it is generally more complex and doesn't directly address the need to share a CloudFormation template securely across multiple accounts. Additionally, Service Control Policies (SCPs) are primarily used for controlling actions across accounts rather than directly managing access to specific CloudFormation resources.
- Why this is less optimal: This option introduces unnecessary complexity by using private extensions and SCPs, making it harder to manage. It is not the most straightforward or secure way to meet the requirement.
Option C: Create an AWS Service Catalog portfolio in the organization's management account....
Author: Olivia · Last updated Jul 19, 2026
A team is using AWS Secrets Manager to store an application database password. Only a limited number of IAM principals within the account can have access to the secret. The principals who require access to the secret change frequently. A security engineer m...
The goal is to manage access to a secret in AWS Secrets Manager for a limited number of IAM principals whose membership changes frequently, while maximizing flexibility and scalability. The solution should be secure, scalable, and easy to update as the access requirements change.
Option A: Use a role-based approach by creating an IAM role with an inline permissions policy that allows access to the secret. Update the IAM principals in the role trust policy as required.
- Analysis: This option involves using an IAM role with an inline permissions policy that grants access to the secret, and updating the role’s trust policy when adding or removing IAM principals. While this can work, it requires manual changes to the trust policy each time a principal's access needs to be adjusted. The role-based approach is less flexible compared to other options, especially in cases where the set of principals changes frequently.
- Why this is less optimal: The need to constantly update the trust policy for changing principals introduces manual overhead and complexity. It doesn't scale as well as solutions that automatically handle dynamic membership changes.
Option B: Deploy a VPC endpoint for Secrets Manager. Create and attach an endpoint policy that specifies the IAM principals that are allowed to access the secret. Update the list of IAM principals as required.
- Analysis: Using a VPC endpoint for Secrets Manager allows for more secure access to secrets within a VPC. However, while endpoint policies can restrict access to the secret, they still require the manual updating of the list of allowed IAM principals. This approach introduces a static and manual process, which doesn’t fully meet the scalability requirement of handling frequent changes to the list of IAM principals.
- Why this is less optimal: Endpoint policies don't provide a dynamic, scalable way to manage access for frequently changing principals. The manual process of updating the policy makes it less flexible than other approaches.
Option C: Use a tag-based approach by attaching a resource policy to the secret. Apply tags to the secret and the IAM principals. Use the `aws:PrincipalTag` and `aws:ResourceTag` IAM condition keys to control access.
- Analysis: This approach utilizes tags to control access to the secret. By tagging both the secret and IAM principals and ...
Author: Ming88 · Last updated Jul 19, 2026
A company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application has become the target of a DoS attack. Application logging shows that requests are coming from a small number of client IP addresses, but the addresses change regularly.
The company needs to ...
To address the DoS attack on the web application hosted behind an Application Load Balancer (ALB), the company needs a solution that can block the malicious traffic without requiring extensive manual effort. The attack involves a small number of client IP addresses that change regularly, so the solution should handle dynamic IPs effectively.
Option A: Create an AWS WAF rate-based rule, and attach it to the ALB.
- Analysis: AWS WAF (Web Application Firewall) is specifically designed to protect web applications from malicious traffic, including DoS attacks. Rate-based rules can be configured to block requests from IP addresses that exceed a certain threshold of requests within a defined time period. This is ideal for blocking the small number of IP addresses that are sending malicious traffic, especially if those IPs change frequently. AWS WAF integrates easily with the ALB and automatically applies the rate-based rule to incoming traffic. This solution is scalable, flexible, and requires minimal ongoing effort because the rate-based rule dynamically adjusts to block the malicious IP addresses as they change.
- Why this is selected: It provides the least amount of ongoing effort since AWS WAF automatically handles IP blocking based on request rates, and you don't need to manually update rules for changing IPs.
Option B: Update the security group that is attached to the ALB to block the attacking IP addresses.
- Analysis: Security groups are stateful firewalls used to control inbound and outbound traffic for EC2 instances and load balancers. While you could block specific IP addresses, this approach requires manual intervention and updating whenever the attacker's IP addresses change. If the attacking IPs change frequently, you would need to continuously update the security group, which increases operational overhead and does not provide a dynamic solution.
- Why this is less optimal: Manual effort is required to update the security group, and it doesn't scale well for attacks where the source IP addresses are constantly changing. It also doesn't provide the granularity or flexibility that AWS WAF offers for handling web traffic.
...
Author: Liam · Last updated Jul 19, 2026
A company has hundreds of AWS accounts in an organization in AWS Organizations. The company operates out of a single AWS Region. The company has a dedicated security tooling AWS account in the organization. The security tooling account is configured as the organization's delegated administrator for Amazon GuardDuty and AWS Security Hub. The company has configured the environment to automatically enable GuardDuty and Security Hub for existing AWS accounts and new AWS accounts.
The company is performing control tests on specific GuardDuty findings to make sure that the company's security team can detect and respond to security events. The security team launched an Amazon EC2 ins...
Let's evaluate each option to understand why the finding wasn't created in the Security Hub delegated administrator account.
Option A: VPC flow logs were not turned on for the VPC where the EC2 instance was launched.
- Reasoning: GuardDuty uses VPC flow logs to monitor network traffic and detect anomalies. However, DNS findings, such as those triggered by unusual DNS requests (like those made by the EC2 instance in this case), do not require VPC flow logs to be enabled. GuardDuty can detect such DNS-based activities through other data sources (e.g., DNS logs), and VPC flow logs are typically used for traffic analysis, not DNS activity specifically.
- Why Rejected: VPC flow logs not being turned on wouldn't prevent GuardDuty from detecting DNS activity and generating a finding related to it.
Option B: The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver.
- Reasoning: While GuardDuty may be able to detect unusual or suspicious DNS requests, a custom OpenDNS resolver is unlikely to cause an issue with GuardDuty's ability to generate DNS-related findings. GuardDuty can detect suspicious activity in the DNS logs even if a custom DNS resolver is used.
- Why Rejected: Custom DNS resolvers (e.g., OpenDNS) typically would not prevent GuardDuty from generating DNS-related findings, as GuardDuty analyzes DNS request patterns.
Option C: The GuardDuty integration with Security Hub was never activated in the AWS account where the finding was generated.
- Reasoning: In order for GuardDuty findings to appear in AWS S...
Author: Noah · Last updated Jul 19, 2026
An ecommerce company has a web application architecture that runs primarily on containers. The application containers are deployed on Amazon Elastic Container Service (Amazon ECS). The container images for the application are stored in Amazon Elastic Container Registry (Amazon ECR).
The company's security team is performing an audit of components of the application architecture. The security team identifies issues with some container images that are stored in the container repositories.
The security team wants to address these issues by implementing continual scanning and on-push scanning of the container images. The security team needs to implement a solution that makes any findings from these scans visible in a central...
Let's evaluate each option based on the given requirements:
Key Requirements:
1. Continual scanning and on-push scanning of container images: The security team needs to scan container images for vulnerabilities both at the time of push and on a continuous basis.
2. Centralized dashboard for security findings: The security team wants a centralized location to view findings from different sources, which could include future security findings beyond container scans.
3. Exclude specific repositories from the scanning process: The security team needs to be able to exclude certain repositories from the scan.
Option A: Use Amazon Inspector. Create inclusion rules in Amazon ECR to match repositories that need to be scanned. Push Amazon Inspector findings to AWS Security Hub.
- Reasoning: Amazon Inspector can perform container image scans for vulnerabilities, which addresses the continual and on-push scanning requirements. It integrates with Amazon Security Hub, where findings can be viewed in a centralized dashboard.
- Why Selected: Amazon Inspector can scan container images stored in ECR and provide findings in a centralized dashboard (AWS Security Hub). The "inclusion rules" to match repositories can be configured in Amazon Inspector. The solution also allows exclusion of specific repositories from scanning by controlling the scan scope in Inspector.
Option B: Use ECR basic scanning of container images. Create inclusion rules in Amazon ECR to match repositories that need to be scanned. Push findings to AWS Security Hub.
- Reasoning: ECR's basic scanning performs vulnerability scanning on container images and can push findings to AWS Security Hub. This meets the requirements of continuous and on-push scanning.
- Why Rejected: ECR basic scanning provides limited vulnerability scanning features compared to Amazon Inspector. It ca...
Author: Olivia Johnson · Last updated Jul 19, 2026
A company has a single AWS account and uses an Amazon EC2 instance to test application code. The company recently discovered that the instance was compromised. The instance was serving up malware. The analysis of the instance showed that the instance was compromised 35 days ago.
A security engineer must implement a continuous monitoring solution that automatically notifies the company's security team about compromised instances through an email distribution list fo...
To meet the requirements for continuous monitoring of compromised instances, and automatically notifying the security team about high-severity findings, let's evaluate the options one by one:
Key Requirements:
1. Continuous monitoring solution: The company needs a solution that will constantly monitor the AWS account for compromised instances.
2. Automatic notifications: The security team must receive notifications through an email distribution list whenever a high-severity finding occurs.
3. High-severity findings: The solution should focus on detecting and notifying about high-severity findings (such as compromised instances).
4. Quick implementation: The solution should be quick to implement.
Option A: Enable AWS Security Hub in the AWS account.
- Reasoning: AWS Security Hub aggregates security findings from various AWS services such as Amazon GuardDuty, AWS Inspector, and others. However, Security Hub alone does not directly monitor or detect compromised EC2 instances unless integrated with services like GuardDuty. While Security Hub provides visibility into findings, it needs other tools to perform the actual monitoring and detection.
- Why Rejected: AWS Security Hub on its own will not immediately meet the requirement for monitoring compromised instances. It's more useful for aggregating findings from multiple services.
Option B: Enable Amazon GuardDuty in the AWS account.
- Reasoning: Amazon GuardDuty is a security monitoring service that continuously analyzes AWS CloudTrail logs, VPC flow logs, and DNS logs for suspicious activity. GuardDuty is excellent at detecting compromised EC2 instances, unusual network activity, and other high-severity threats, making it the perfect solution for detecting the compromised instance.
- Why Selected: GuardDuty will actively monitor the AWS environment, detect compromised instances, and generate findings for suspicious or malicious activity. This is key for detecting compromised EC2 instances like the one described in the scenario.
Option C: Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team's email distribution list to the topic.
- Reasoning: SNS is a flexible service that can send notifications via email, SMS, or other channels. It integrates well with EventBridge and Guard...
Author: Amira99 · Last updated Jul 19, 2026
A company uses identity federation to authenticate users into an identity account (987654321987) where the users assume an IAM role named IdentityRole. The users then assume an IAM role named JobFunctionRole in the target AWS account (123456789123) to perform their job functions.
A user is unable to assume the IAM role in the target account. The p...
To enable a user to assume an IAM role in the target AWS account (123456789123), let's analyze each option to understand what needs to be done:
Key Requirements:
1. Identity Federation: The user is authenticating through identity federation into the identity account (987654321987).
2. Role Assumption in Target Account: The user assumes the `IdentityRole` in the identity account, and then attempts to assume the `JobFunctionRole` in the target account (123456789123).
3. Role Trust Policy: The key issue usually lies in the trust relationship between the roles. To allow role assumption, the trust policy in the target account (where the role is assumed) needs to allow the identity account (987654321987) or the federated user to assume the role.
Option A: Update the IAM policy attached to the role in the identity account to be:
- Reasoning: The IAM policy on the role in the identity account governs what the user can do within the identity account, but it doesn't control what roles can be assumed in the target account. Changing this policy wouldn't directly solve the problem with assuming a role in the target account.
- Why Rejected: The issue lies in the target account's role's trust policy, not the IAM policy in the identity account.
Option B: Update the trust policy on the role in the target account to be:
- Reasoning: The trust policy of a role in the target account controls which entities are allowed to assume the role. The trust policy must explicitly allow the identity account (987654321987) or the federated user (assuming the role in the identity account) to assume the `JobFunctionRole`.
- Why Selected: This is the most appro...
Author: David · Last updated Jul 19, 2026
A company is using AWS Organizations to manage multiple AWS accounts for its human resources, finance, software development, and production departments. All the company's developers are part of the software development AWS account.
The company discovers that developers have launched Amazon EC2 instances that were preconfigured with software that the company has not approved for use. The company wants to implement a solution to...
Let's evaluate each option based on the company's requirements of ensuring that developers can only launch EC2 instances with approved software, and that these instances are only launched in the software development AWS account.
Key Requirements:
1. Only approved software: The EC2 instances should have only software that has been approved by the company.
2. Software development AWS account: Developers should only be able to launch EC2 instances within the software development AWS account.
3. Centralized control: The solution needs to ensure that only the approved software is used and developers are restricted to the correct environment.
Option A: In the software development account, create AMIs of preconfigured instances that include only approved software. Include the AMI IDs in the condition section of an AWS CloudFormation template to launch the appropriate AMI based on the AWS Region. Provide the developers with the CloudFormation template to launch EC2 instances in the software development account.
- Reasoning: This option creates pre-configured AMIs with approved software and allows developers to launch EC2 instances using CloudFormation templates. The CloudFormation template could enforce the use of specific AMIs by including the AMI IDs in the template’s conditions.
- Why Rejected: While this option ensures that only approved software is used, it requires manual management of AMI IDs in CloudFormation templates. This can become difficult to scale and manage across multiple environments, especially as the list of approved software changes. It also does not prevent developers from bypassing the CloudFormation template and launching instances directly with other, non-approved AMIs.
Option B: Create an Amazon EventBridge rule that runs when any EC2 RunInstances API event occurs in the software development account. Specify AWS Systems Manager Run Command as a target of the rule. Configure Run Command to run a script that will install all approved software onto the instances that the developers launch.
- Reasoning: This solution uses EventBridge to detect when an EC2 instance is launched and then automatically runs a script using Systems Manager Run Command to install approved software onto the instances.
- Why Rejected: This solution does not prevent developers from launching EC2 instances with unapproved...
Author: Julian · Last updated Jul 19, 2026
A company has enabled Amazon GuardDuty in all AWS Regions as part of its security monitoring strategy. In one of its VPCs, the company hosts an Amazon EC2 instance that works as an FTP server. A high number of clients from multiple locations contact the FTP server. GuardDuty identifies this activity as a brute force attack because of the high number of connections that happen every hour.
The company has flagged the finding as a false positive, but GuardDuty continues ...
The scenario involves a high number of connections to an Amazon EC2 instance acting as an FTP server, which GuardDuty is flagging as a brute force attack due to the volume of traffic. The company has already flagged the findings as false positives, but GuardDuty continues to raise the issue. The goal is to improve the signal-to-noise ratio without compromising visibility of legitimate threats.
Analyzing the Options:
A) Disable the FTP rule in GuardDuty in the Region where the FTP server is deployed.
- Explanation: Disabling the FTP rule in GuardDuty would stop detecting any FTP-related activity as suspicious, including potential future threats to the FTP server or any other FTP servers in the same region. While this might reduce false positives in the short term, it could also cause legitimate threats to go undetected, which compromises the security visibility of the environment.
- Rejection Reason: This approach could lead to a loss of important security insights for FTP-related incidents. Disabling rules is too broad and doesn't specifically address the issue of false positives without compromising other potential threats.
B) Add the FTP server to a trusted IP list. Deploy the list to GuardDuty to stop receiving the notifications.
- Explanation: Adding the FTP server to a trusted IP list would ensure that GuardDuty does not flag the connections to the FTP server as potential brute-force attacks, since the IP list would be marked as trusted. However, this could lead to security concerns if new, legitimate sources or changes in traffic patterns are not monitored properly.
- Rejection Reason: The problem is not necessarily that the source IP addresses are untrusted, but that the volume of connections is high, which can be a valid security concern. Trusting an IP list could suppress the detection of abnormal traffic patterns and prevent GuardDuty from alerting on legitimate attacks that may arise from trusted sources. Additionally, it doesn't improve the signal-to-noise ratio in a meaningful way.
C) Create a suppression rule in GuardDuty to filter findings by a...
Author: Ming88 · Last updated Jul 19, 2026
A company is running internal microservices on Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type. The company is using Amazon Elastic Container Registry (Amazon ECR) private repositories.
A security engineer needs to encrypt the private repositories by using AWS Key Management Service (AWS KMS). The security eng...
The security engineer needs to fulfill two requirements:
1. Encrypt the private repositories using AWS KMS.
2. Analyze container images for common vulnerabilities and exposures (CVEs).
Let's break down the options:
A) Enable KMS encryption on the existing ECR repositories. Install Amazon Inspector Agent from the ECS container instances' user data. Run an assessment with the CVE rules.
- Explanation:
- Enabling KMS encryption on existing ECR repositories is valid, as KMS can be used to encrypt the container images stored in Amazon ECR.
- Installing the Amazon Inspector Agent on ECS instances is unnecessary here, as Amazon Inspector is typically used for scanning EC2 instances, not specifically container images. Amazon Inspector would also require additional setup on the ECS instances, but it's not the best tool for analyzing the CVEs in container images directly.
- Rejection Reason: Although KMS encryption works, Amazon Inspector is not the best tool for scanning ECR repositories or images for CVEs. There are more efficient solutions for this task.
B) Recreate the ECR repositories with KMS encryption and ECR scanning enabled. Analyze the scan report after the next push of images.
- Explanation:
- Recreating ECR repositories and enabling KMS encryption ensures that container images are encrypted as they are pushed into the repository.
- Enabling ECR image scanning is the optimal solution for analyzing container images for CVEs. Amazon ECR integrates directly with Amazon Elastic Container Registry Image Scanning to detect known vulnerabilities in the container images based on CVE rules.
- The solution includes scanning images after they are pushed, making it the ideal approach to identify CVEs in container images.
- Selected Reason: This solution effectively meets both the requirements. It uses built-in functionality to scan container images for vulnerabilities while encrypting the reposit...
Author: Ravi Patel · Last updated Jul 19, 2026
A company's security engineer has been tasked with restricting a contractor's IAM account access to the company's Amazon EC2 console without providing access to any other AWS services. The contractor's IAM account must not be able to gain access to any other AWS service, even if the IAM account is...
Requirements:
- The contractor should only have access to Amazon EC2 in the AWS Management Console.
- The contractor's IAM account should not gain access to any other AWS services, even if assigned additional permissions through IAM group membership.
Option Analysis:
A) Create an inline IAM user policy that allows for Amazon EC2 access for the contractor's IAM user.
- Explanation: An inline policy directly attached to the IAM user can grant permissions for Amazon EC2 access. However, the issue here is that while the user would have access to EC2, it does not prevent future permissions from being added to the IAM user or group. This means that even if the contractor's IAM account is part of a group with additional permissions in the future, the user would gain access to other services.
- Rejection Reason: The inline IAM user policy doesn't meet the requirement to strictly prevent access to all other services, even if additional permissions are added through group memberships. This is not the most restrictive solution.
B) Create an IAM permissions boundary policy that allows Amazon EC2 access. Associate the contractor's IAM account with the IAM permissions boundary policy.
- Explanation: An IAM permissions boundary is a policy that defines the maximum permissions a user or role can have, regardless of any permissions granted by their policies or group memberships. By associating a permissions boundary that allows access only to Amazon EC2, this will ensure that the contractor's IAM account cannot gain access to any other AWS services, even if additional permissions are added through IAM group membership.
- Selected Reason: This is the best solution. The permissions boundary ensures that the contractor's IAM account can only have the defined EC2 access and nothing more, preventing any unintended permissions, even from group policies.
...
Author: Sofia · Last updated Jul 19, 2026
A company manages multiple AWS accounts using AWS Organizations. The company's security team notices that some member accounts are not sending AWS CloudTrail logs to a centralized Amazon S3 logging bucket. The security team wants to ensure there is at least one trail configured for all existing accoun...
To ensure that all existing and future AWS accounts have CloudTrail logs sent to a centralized Amazon S3 logging bucket, the security team needs to implement a solution that automatically manages CloudTrail configuration across all accounts in the organization, including new accounts that are created.
Option Analysis:
A) Create a new trail and configure it to send CloudTrail logs to Amazon S3. Use Amazon EventBridge to send a notification if a trail is deleted or stopped.
- Explanation:
- Creating a new trail and configuring it to send logs to a centralized S3 bucket is a valid step. However, using Amazon EventBridge to monitor trail deletion or stoppage can only notify the security team after an issue occurs.
- This approach does not proactively ensure that all accounts, including new accounts, always have a trail configured. It only provides notification after a trail is deleted or stopped, which still requires manual intervention to resolve the issue.
- Rejection Reason: While EventBridge helps with notifications, this solution doesn't ensure a trail is always configured in the first place, nor does it automatically apply to new accounts. It focuses on detecting issues after they happen.
B) Deploy an AWS Lambda function in every account to check if there is an existing trail and create a new trail if needed.
- Explanation:
- Deploying a Lambda function in every account is a solution that would check for existing CloudTrail configuration and create a trail if necessary. However, this requires ongoing maintenance and monitoring to ensure that the Lambda function is properly deployed and working in every account.
- Additionally, this approach does not scale as effectively as managing the trail configuration directly through AWS Organizations, and it introduces the complexity of managing Lambda functions across all accounts.
- Rejection Reason: While functional, this approach requires more manual effort and monitoring compared to using AWS Organizations' built-in management capabilities. Lambda-based solutions are not as automated or scalable for managing CloudTrail configurat...
Author: Ahmed · Last updated Jul 19, 2026
A company recently had a security audit in which the auditors identified multiple potential threats. These potential threats can cause usage pattern changes such as DNS access peak, abnormal instance traffic, abnormal network interface traffic, and unusual Amazon S3 API calls. The threats can come from different sources and can occur at any time. The company needs to i...
Requirements:
The company needs a solution to continuously monitor its system and identify threats in near-real time for various potential threats such as abnormal instance traffic, DNS access peaks, unusual Amazon S3 API calls, and abnormal network interface traffic. The solution should be capable of handling diverse threat sources and varying threat occurrence times.
Option Analysis:
A) Enable AWS CloudTrail logs, VPC flow logs, and DNS logs. Use Amazon CloudWatch Logs to manage these logs from a centralized account.
- Explanation:
- CloudTrail logs provide detailed logs of API calls made on the account.
- VPC flow logs offer visibility into network traffic.
- DNS logs provide information on DNS queries made in the environment.
- Amazon CloudWatch Logs can centralize the management of these logs and offer visibility into logs, but it lacks direct anomaly detection capabilities. You would need to manually configure custom metrics, alarms, and dashboards to monitor for specific patterns or threats.
- Rejection Reason: While this solution allows central log management, it lacks the built-in threat detection and automated analysis capabilities of specialized security services. This would require manual intervention for detecting and responding to potential threats.
B) Enable AWS CloudTrail logs, VPC flow logs, and DNS logs. Use Amazon Macie to monitor these logs from a centralized account.
- Explanation:
- Amazon Macie is a security service focused primarily on data security and privacy. It excels at discovering, classifying, and protecting sensitive data within Amazon S3, specifically for detecting PII (Personally Identifiable Information) data leaks.
- While Macie is useful for monitoring data privacy threats, it is not designed for monitoring or detecting the network-level traffic anomalies (e.g., abnormal VPC flow logs, DNS queries, or instance traffic) described in the use case.
- Rejection Reason: This option would not be ideal for identifying network or instance traffic anomalies, as Macie is focused more on data privacy rather than network-level or application security monitoring.
C) Enable Amazon GuardDuty from a centralized account. Use Guard...
Author: Akash · Last updated Jul 19, 2026
A company that uses AWS Organizations is using AWS IAM Identity Center (AWS Single Sign-On) to administer access to AWS accounts. A security engineer is creating a custom permission set in IAM Identity Center. The company will use the permission set across multiple accounts. An AWS managed policy and a customer managed policy are attached to the permission set. The security engineer has full administrative permissions and is operating in the management account.
When the se...
To address the failure in assigning the permission set to the IAM Identity Center user, we need to evaluate each option carefully, keeping in mind the structure and behavior of AWS IAM Identity Center, the role of managed policies, and how permission sets are applied across multiple AWS accounts.
Option A: Create the customer managed policy in every account where the permission set is assigned. Give the customer managed policy the same name and same permissions in each account.
- Reasoning: This option suggests replicating the customer managed policy in every account where the permission set is applied, with the same name and permissions. While this might work, it introduces unnecessary complexity. IAM Identity Center uses global permission sets that can be applied to multiple accounts in an organization. There's no need to duplicate policies in each account. Managing the same policy across multiple accounts can lead to inconsistent behavior and administrative overhead.
- Rejected: Duplicating the policy across multiple accounts is inefficient and does not resolve the core issue of why the permission set assignment failed in the first place. IAM Identity Center permission sets are designed to be applied across accounts, without needing separate policy copies in each account.
Option B: Remove either the AWS managed policy or the customer managed policy from the permission set. Create a second permission set that includes the removed policy. Apply the permission sets separately to the user.
- Reasoning: This option suggests breaking the policies into separate permission sets and applying them separately. This could be an alternative approach but does not directly address the underlying issue with the permission set assignment failing. In most cases, IAM Identity Center is designed to handle multiple policies attached to a single permission set without the need to split them across multiple permission sets.
- Rejected: Splitting policies into separate permission sets introduces complexity without directly addressing the problem. It is not the most efficient or scalable solution and doesn’t handle potential conflicts between the policies in a clean way.
Option C: Evaluate...
Author: Isabella · Last updated Jul 19, 2026
A company has thousands of AWS Lambda functions. While reviewing the Lambda functions, a security engineer discovers that sensitive information is being stored in environment variables and is viewable as plaintext in the Lambda console. The values of the sensitiv...
To address the security issue of sensitive information being stored as plaintext in AWS Lambda environment variables, the most important factor is to ensure that the sensitive information is stored securely, encrypted, and only accessible to the Lambda functions that need access to it. Let's evaluate each option:
Option A: Set up IAM policies from the Lambda console to hide access to the environment variables.
- Reasoning: IAM policies in the Lambda console cannot be used to hide environment variables. IAM can control which resources a user or service can access, but it cannot control the visibility of environment variables in the Lambda console itself. The visibility of environment variables in the Lambda console is a UI issue that IAM policies do not address. Moreover, hiding environment variables does not solve the core problem of storing sensitive data securely.
- Rejected: This option does not solve the issue of storing sensitive information securely and is not a feasible solution. It only addresses access control from the UI perspective, not the actual security of the data.
Option B: Use AWS Step Functions to store the environment variables. Access the environment variables at runtime. Use IAM permissions to restrict access to the environment variables to only the Lambda functions that require access.
- Reasoning: While AWS Step Functions can be used to coordinate multiple AWS services, it is not designed for securely storing environment variables. Step Functions is primarily a workflow orchestration service, not a storage solution for sensitive data. Using Step Functions in this manner would add unnecessary complexity and might not offer the best security posture for storing sensitive information.
- Rejected: Step Functions is not designed for storing sensitive data like environment variables. This approach introduces unnecessary complexity and is not cost-effective for this specific use case.
Option C: Store the environment variables in AWS Secrets Manager, and access them at runtime. Use IAM permissions to restrict access to the secrets to only the Lambda functions that require access.
- Reasoning: AWS Secrets Manager is designed to ...
Author: Vikram · Last updated Jul 19, 2026
A security engineer is using AWS Organizations and wants to optimize SCPs. The security engineer needs to ensure that the SCPs conform to best practices.
Which...
To ensure that the Service Control Policies (SCPs) conform to best practices in AWS Organizations, it's essential to focus on the tools and processes that are specifically designed for analyzing and validating IAM and policy configurations within AWS Organizations. Let's evaluate each option:
Option A: Use AWS IAM Access Analyzer to analyze the policies. View the findings from policy validation checks.
- Reasoning: AWS IAM Access Analyzer is a tool designed to help you review and analyze IAM policies, including SCPs, for potential security issues. It can provide findings related to access analysis, ensuring that policies are following best practices, such as identifying overly permissive policies. This tool is directly relevant to validating the configuration of SCPs within AWS Organizations.
- Selected Option: This is the most appropriate solution because IAM Access Analyzer is specifically designed to help you evaluate and refine IAM policies, including SCPs. It checks for security risks, ensures that policies follow best practices, and provides insights into access behavior, making it the best option for ensuring SCPs conform to best practices.
Option B: Review AWS Trusted Advisor checks for all accounts in the organization.
- Reasoning: AWS Trusted Advisor provides a set of best practice checks across various AWS resources and services, including cost optimization, performance, and security. However, Trusted Advisor is primarily focused on general AWS infrastructure optimization and does not specifically analyze IAM policies or SCPs. While it can help with general security best practices (e.g., ensuring that MFA is enabled), it does not directly validate SCP configurations or ensure their adherence to best practices.
- Rejected: While Trusted Advisor is a valuable tool for general AWS account and resource best practices, it does not specifical...
Author: Maya · Last updated Jul 19, 2026
A company uses Amazon RDS for MySQL as a database engine for its applications. A recent security audit revealed an RDS instance that is not compliant with company policy for encrypting data at rest. A security engineer at the company needs to ensure that all existing RDS databases are encrypted using server-side encryption and that an...
To ensure that all existing Amazon RDS instances are encrypted using server-side encryption and that future deviations from the encryption policy are detected, the security engineer needs to take a combination of proactive steps to detect and remediate unencrypted RDS databases, as well as continuously monitor for compliance. Let's evaluate each option:
Option A: Create an AWS Config rule to detect the creation of unencrypted RDS databases. Create an Amazon EventBridge rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.
- Reasoning: AWS Config is a service that tracks configuration changes to AWS resources. By creating an AWS Config rule to detect unencrypted RDS databases, the security engineer can ensure that any non-compliant databases are immediately detected. Amazon EventBridge can be used to monitor the state of the AWS Config rule, and Amazon SNS can notify the security team if any unencrypted RDS databases are created. This approach provides continuous monitoring and alerting, which helps detect non-compliance in a timely manner.
- Selected Option: This is a good proactive monitoring solution, as it will notify the security team whenever a non-compliant (unencrypted) database is created, allowing quick remediation and ensuring policy compliance in real-time.
Option B: Use AWS Systems Manager State Manager to detect RDS database encryption configuration drift. Create an Amazon EventBridge rule to track state changes and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.
- Reasoning: AWS Systems Manager State Manager can be used to ensure that configuration settings for managed resources remain consistent over time, but it is typically more useful for managing configuration drift of EC2 instances or other systems under management. While it could track changes in configuration, State Manager is not ideal for tracking the encryption status of RDS instances, which are not managed in the same way as EC2 instances.
- Rejected: This is not the best fit for this specific use case, as AWS Systems Manager is better suited for configuration management of EC2 instances or other services, not for detecting encryption status changes in RDS databases.
Option C: Create a read replica for the existing unencrypted RDS database and enable replica encryption in the process. Once the replica becomes active, promote it into a standalone database instance and terminate the unen...
Author: Vivaan · Last updated Jul 19, 2026
A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots. The company uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt all Amazon Elastic Block Store (Amazon EBS) snapshots.
The company performs a gap analysis of its disaster recovery procedures and backup strategies. A security engineer needs to implement...
To address the scenario where the company needs to recover EC2 instances in case the AWS account is compromised and the EBS snapshots are deleted, the security engineer must ensure that backup data (EBS snapshots) is protected, and that the backup remains intact even if the account's access is compromised. Let's evaluate each option:
Option A: Create a new Amazon S3 bucket. Use EBS lifecycle policies to move EBS snapshots to the new S3 bucket. Use lifecycle policies to move snapshots to the S3 Glacier Instant Retrieval storage class. Use S3 Object Lock to prevent deletion of the snapshots.
- Reasoning: EBS snapshots cannot be directly moved to an S3 bucket using lifecycle policies. EBS snapshots are managed within Amazon EBS and not stored as S3 objects, meaning they cannot be transferred to an S3 bucket directly. Additionally, S3 Object Lock is designed to prevent the deletion of objects in S3, but it does not apply to EBS snapshots themselves.
- Rejected: This approach is not valid because EBS snapshots cannot be moved to an S3 bucket using lifecycle policies, and the protection mechanisms do not apply directly to EBS snapshots.
Option B: Use AWS Systems Manager to distribute a configuration that backs up all attached disks to Amazon S3.
- Reasoning: While AWS Systems Manager is a useful tool for managing configurations across EC2 instances, it is not designed for regular backup of EC2 instance data or EBS volumes to S3. This option is more appropriate for automation and configuration management rather than backup and disaster recovery of EBS snapshots.
- Rejected: This option does not provide a comprehensive solution for protecting EBS snapshots or addressing the need for recovering EC2 instances if the account is compromised.
Option C: Create a new AWS account that has limited privileges. Allow the new account to access the KMS key that encrypts the EBS snapshots. Copy the encrypted snapshots to the new account on a recurring basis.
- Reasoning: This a...
Author: Aarav · Last updated Jul 19, 2026
A company's security engineer is designing an isolation procedure for Amazon EC2 instances as part of an incident response plan. The security engineer needs to isolate a target instance to block any traffic to and from the target instance, except for traffic from the company's forensics team. Each of the company's EC2 instances has its own dedicated security group. The EC2 instances are deployed in subnets of a VPC. A subnet can contain multiple instances.
The security engineer is testing the procedure for EC2 isolation and opens an SSH session to the target instance. The procedure starts to simulate access to the target instance by an attacker. The security engineer removes the existing security group rules and adds security group rules to give the forensics team acces...
To isolate the target EC2 instance effectively and prevent any traffic to and from it, except for traffic from the forensics team, the security engineer needs a strategy that fully isolates the instance while allowing the required forensic access. Let's evaluate each option.
Option A: Add an inbound rule to the security group to allow traffic from 0.0.0.0/0 for all ports. Add an outbound rule to the security group to allow traffic to 0.0.0.0/0 for all ports. Then immediately delete these rules.
- Reasoning: This option temporarily opens the instance to all traffic (both inbound and outbound) from anywhere on the internet, which would contradict the isolation objective. Even though the rules are deleted afterward, the period during which these rules are in place introduces a security risk. This is not a proper isolation solution and could expose the instance to unnecessary traffic before the rules are removed.
- Rejected because it opens the instance to unnecessary traffic and doesn't ensure the required isolation during the process.
Option B: Remove the port 22 security group rule. Attach an instance role policy that allows AWS Systems Manager Session Manager connections so that the forensics team can access the target instance.
- Reasoning: While removing port 22 security group rules would block SSH traffic, it doesn't fully isolate the instance in terms of network communication. It only addresses SSH access but doesn't address other potential network traffic (like web traffic or other ports). Additionally, this option relies on AWS Systems Manager (SSM) to give the forensics team access, which is a good practice but doesn’t necessarily block all other traffic, making it a partial solution.
- Rejected because it doesn't isolate the instance completely and relies on specific config...
Author: Rahul · Last updated Jul 19, 2026
A startup company is using a single AWS account that has resources in a single AWS Region. A security engineer configures an AWS CloudTrail trail in the same Region to deliver log files to an Amazon S3 bucket by using the AWS CLI.
Because of expansion, the company adds resources in multiple Regions. The security engineer notices that the logs from...
In this scenario, the security engineer is dealing with a CloudTrail configuration issue where logs from multiple Regions are not reaching the S3 bucket. The goal is to fix the issue with the least amount of operational overhead, ensuring that all logs from all Regions are properly delivered to the designated S3 bucket.
Option A: Create a new CloudTrail trail. Select the new Regions where the company added resources.
- Reasoning: This option requires creating a new CloudTrail trail and manually selecting the Regions where resources were added. However, the issue here is that the current CloudTrail trail should already be able to capture logs from multiple Regions. This approach adds unnecessary complexity by creating additional trails for different Regions, which increases operational overhead by requiring management of multiple trails.
- Rejected because it introduces more complexity and overhead by creating multiple trails.
Option B: Change the S3 bucket to receive notifications to track all actions from all Regions.
- Reasoning: This option pertains to configuring notifications for the S3 bucket, which would help in tracking actions on the S3 bucket itself. However, it does not address the core issue with CloudTrail logs not being delivered to the S3 bucket from the new Regions. The issue is that the existing CloudTrail trail is not covering multiple Regions, so simply changing the S3 bucket behavior wil...
Author: Leah Davis · Last updated Jul 19, 2026
A company's public Application Load Balancer (ALB) recently experienced a DDoS attack. To mitigate this issue, the company deployed Amazon CloudFront in front of the ALB so that users would not directly access the Amazon EC2 instances behind the ALB.
The company discovers that some traffic is still coming directly into the ALB and is still being handled by the ...
To ensure that the EC2 instances behind the Application Load Balancer (ALB) receive traffic only from Amazon CloudFront and not directly from the internet, the company needs to configure the infrastructure to properly validate that incoming requests to the ALB come through CloudFront. This can be done by using a custom HTTP header and enforcing it on the ALB. Let's review each option.
Option A: Configure CloudFront to add a cache key policy to allow a custom HTTP header that CloudFront sends to the ALB.
- Reasoning: This option suggests modifying the cache key policy to allow a custom HTTP header to be added by CloudFront. While this could theoretically work, the cache key policy primarily affects how CloudFront caches content and does not ensure that CloudFront traffic is differentiated from other traffic at the ALB level. It doesn’t directly address restricting the traffic to only come from CloudFront, making it less relevant to this use case.
- Rejected because this option is more about caching and doesn't help with traffic validation to ensure requests come through CloudFront.
Option B: Configure CloudFront to add a custom HTTP header to requests that CloudFront sends to the ALB.
- Reasoning: This option makes sense because it specifies that CloudFront will add a custom HTTP header to all requests that it forwards to the ALB. This header can act as a marker indicating that the request is coming from CloudFront, allowing the ALB to identify and filter traffic from CloudFront and deny direct traffic. This is a good approach to ensure the traffic is indeed coming from CloudFront.
- Selected because adding a custom HTTP header to requests ensures that only requests from CloudFront can be accepted by the ALB, facilitating the required security.
Option C: Configure the ALB to forward only requests that contain the custom HTTP header.
- Reasoning: This option works well in conjunction with Option B. After configuring CloudFront to add a custom ...
Author: Kai · Last updated Jul 19, 2026
A company discovers a billing anomaly in its AWS account. A security consultant investigates the anomaly and discovers that an employee who left the company 30 days ago still has access to the account. The company has not monitored account activity in the past.
The security consultant needs to determine whi...
To determine which resources have been deployed or reconfigured by the employee, the security consultant needs to find a way to quickly identify all the actions that were performed in the AWS account within the past 30 days. Here's an analysis of the available options:
Option A: In AWS Cost Explorer, filter chart data to display results from the past 30 days. Export the results to a data table. Group the data table by resource.
- Reasoning: AWS Cost Explorer helps track billing information and cost anomalies, but it does not track detailed activities like resource creation or configuration changes. It would only show cost-related data, not exactly what the employee did with the resources (e.g., creating or modifying them).
- Rejected because this option does not track resource activity; it’s focused on costs and billing information, which won’t provide insight into what actions the employee performed in the account.
Option B: Use AWS Cost Anomaly Detection to create a cost monitor. Access the detection history. Set the time frame to Last 30 days. In the search area, choose the service category.
- Reasoning: AWS Cost Anomaly Detection focuses on detecting unexpected changes in costs and usage patterns. However, it does not track specific actions taken on resources. It’s more about identifying cost spikes rather than providing detailed activity logs or configurations made by users.
- Rejected because it does not track user actions or resource-level changes, but only identifies unusual cost behaviors.
Option C: In AWS CloudTrail, filter the event history to display results from the past 30 days. Create an Amazon Athena table that cont...
Author: Emma · Last updated Jul 19, 2026
A security engineer is checking an AWS CloudFormation template for vulnerabilities. The security engineer finds a parameter that has a default value that exposes an application's API key in plaintext. The parameter is referenced several times throughout the template. The security engineer must replace the parameter w...
To address the vulnerability of exposing an API key in plaintext in an AWS CloudFormation template, the security engineer needs to securely reference the API key throughout the template while maintaining security best practices. Let’s analyze each option:
Option A: Store the API key value as a SecureString parameter in AWS Systems Manager Parameter Store. In the template, replace all references to the value with `{{resolve:ssm:MySSMParameterName:1}}`.
- Reasoning: Storing sensitive data such as API keys as a `SecureString` parameter in AWS Systems Manager Parameter Store is a secure option. The value is encrypted, and access is controlled via IAM policies. The `{{resolve:ssm:MySSMParameterName:1}}` syntax in CloudFormation templates allows the value of the parameter to be securely retrieved during stack creation or updates. This solution is widely used and complies with best practices for managing secrets in AWS.
- Selected because it provides secure storage and retrieval of sensitive data (API key) while allowing references throughout the CloudFormation template. Systems Manager Parameter Store provides built-in encryption and access control, making it a secure choice.
Option B: Store the API key value in AWS Secrets Manager. In the template, replace all references to the value with `{{resolve:secretsmanager:MySecretId:SecretString}}`.
- Reasoning: AWS Secrets Manager is designed to securely store and manage secrets, such as API keys, and supports automatic rotation and fine-grained access control. This option is also secure, and using the `{{resolve:secretsmanager:MySecretId:SecretString}}` syntax in CloudFormation templates is a secure way to reference secrets. However, Secrets Manager is typically used for storing secrets that require rotation, which might not be necessary for all use cases (such as a static API key).
- Rejected because while this is a secure option, it may offer more features than necessary (automatic rotation, etc.), adding extra comp...
Author: Sara · Last updated Jul 19, 2026
A company's AWS CloudTrail logs are all centrally stored in an Amazon S3 bucket. The security team controls the company's AWS account. The security team must prevent unauthorized access and tampering of the C...
To secure the AWS CloudTrail logs stored in an S3 bucket and prevent unauthorized access or tampering, the security team should take the following steps:
A) Configure server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
- Why Selected: Server-side encryption with KMS-managed keys (SSE-KMS) ensures that the CloudTrail logs are encrypted both in transit and at rest. By using KMS, the security team gains full control over the encryption keys, providing an added layer of protection against unauthorized access. If a malicious actor gains access to the S3 bucket, they won't be able to read the logs without access to the KMS key, which is tightly controlled.
- Why Not Rejected: Encryption with SSE-KMS is critical to protect sensitive log data, and it's a best practice for securing log files in AWS. This cannot be overlooked, as plaintext logs are a security vulnerability.
C) Create an Amazon EventBridge rule to notify the security team of any modifications on CloudTrail log files.
- Why Selected: An EventBridge rule that detects changes (e.g., PUT, DELETE, or POST operations) on CloudTrail log files in the S3 bucket helps the security team respond quickly to potential tampering or unauthorized access. The EventBridge rule sends a notification when any modifications occur, allowing the team to act swiftly if any unauthorized actions are detected.
- Why Not Rejected: Monitoring for any changes is crucial in the context of security, particularly for logs that may serve as evidence in case of a breach. Without this alerting mechanism, modifications could go unnoticed.
D) Implement least privilege access to the S3 bucket by configuring a bucket policy.
- Why Selected: Least privilege access is essential for reducing the attack surface. By configuring a bucket policy to ensure that only authorized users or ser...
Author: Ishaan · Last updated Jul 19, 2026
A company has several petabytes of data. The company must preserve this data for 7 years to comply with regulatory requirements. The company's compliance team asks a security officer to develop a strategy that will prevent anyone f...
To meet the requirement of preserving several petabytes of data for 7 years while preventing anyone from changing or deleting the data, the most cost-effective and reliable solution needs to ensure that the data is both immutable and cost-efficient for long-term storage. Here is an analysis of each option:
A) Create an Amazon S3 bucket. Configure the bucket to use S3 Object Lock in compliance mode. Upload the data to the bucket. Create a resource-based bucket policy that meets all the regulatory requirements.
- Why Selected: S3 Object Lock in compliance mode ensures that once data is uploaded to the S3 bucket, it cannot be modified or deleted until the retention period expires. Compliance mode is specifically designed for use cases like this, where the data must be preserved for regulatory reasons and protected from any changes or deletions, including by administrators.
- Cost-Effectiveness: This solution provides direct control over the data in S3 and ensures its immutability without the need for external services. S3 is also designed for high durability and availability, which suits long-term retention.
- Why Not Rejected: This option meets the compliance and immutability requirements effectively, and it is appropriate for long-term storage, especially since it avoids unnecessary transitions between storage classes, which could incur additional costs.
B) Create an Amazon S3 bucket. Configure the bucket to use S3 Object Lock in governance mode. Upload the data to the bucket. Create a user-based IAM policy that meets all the regulatory requirements.
- Why Rejected: S3 Object Lock in governance mode only prevents users (except those with special permissions) from deleting or modifying data but does not offer the same level of protection as compliance mode. In governance mode, authorized users with the right permissions can override the lock, which doesn't fully meet the regulatory requirement of immutability and protection from changes or deletions.
- Cost Factor: While governance mode may be cheaper in certain use cases, it doesn't provide the level of security needed to meet strict regulat...
Author: Sofia2021 · Last updated Jul 19, 2026
A-company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certificate, users saw the following message when trying to log in:
Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken)
...
To address the error "Response Signature Invalid" caused by the expired signing certificate of the third-party identity provider after it was renewed, the security engineer needs to fix the issue where the AWS Identity and Access Management (IAM) service is not using the updated public key from the identity provider. Here's the analysis of the options:
A) Upload the third-party signing certificate’s new private key to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS Management Console.
- Why Rejected: The private key should never be shared or uploaded to AWS. The public key (not the private key) is used to validate the SAML response signature. Thus, uploading the private key is both insecure and unnecessary. AWS only requires the public key for signature verification, so this solution is inappropriate for the issue at hand.
B) Sign the identity provider's metadata file with the new public key. Upload the signature to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
- Why Rejected: This solution would be used in cases where the identity provider's metadata file itself needs to be signed to prove its authenticity. However, the core issue here is related to the renewal of the signing certificate, and uploading the signature does not directly resolve the issue of AWS not having the new public key for signature validation. Therefore, this solution introduces unnecessary complexity without directly solving the problem.
C) Download the updated SAML metadata file from the id...
Author: Grace · Last updated Jul 19, 2026
A company has several workloads running on AWS. Employees are required to authenticate using on-premises ADFS and SSO to access the AWS Management Console. Developers migrated an existing legacy web application to an Amazon EC2 instance. Employees need to access this application from anywhere on the internet, but currently, there is no authenticati...
To secure employee-only access to the migrated legacy web application without modifying the application itself, the solution needs to integrate with the existing ADFS-based authentication system while minimizing changes to the architecture. Below is an analysis of the options:
A) Place the application behind an Application Load Balancer (ALB). Use Amazon Cognito as authentication for the ALB. Define a SAML-based Amazon Cognito user pool and connect it to ADFS.
- Why Selected: This solution allows you to authenticate users with ADFS using Amazon Cognito without modifying the application. By placing the application behind an ALB and configuring Amazon Cognito for authentication, the ALB can be set up to authenticate users via SAML with ADFS. This effectively controls access to the application and ensures that only employees can access it, leveraging the existing ADFS infrastructure.
- Benefits: Cognito can handle SSO via SAML, and using ALB allows for a scalable and easy-to-manage approach without needing to change the application itself. This is a clean and secure solution for integrating authentication into a web application hosted on EC2, with minimal changes required to the application or infrastructure.
B) Implement AWS IAM Identity Center (AWS Single Sign-On) in the management account and link it to ADFS as an identity provider. Define the EC2 instance as a managed resource, then apply an IAM policy on the resource.
- Why Rejected: AWS IAM Identity Center (AWS SSO) is primarily used for managing access to AWS resources like the AWS Management Console, AWS CLI, and AWS applications, rather than for web applications hosted on EC2. While AWS SSO can integrate with ADFS for AWS-based access, it doesn't natively support managing access for a legacy web application running on EC2. This solution does no...
Author: Chloe · Last updated Jul 19, 2026
A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are deployed in a private subnet of a VPC that does not have internet access. The EC2 instances and the S3 buckets are in the same AWS account.
The EC2 instances access the S3 buckets through an S3 gateway endpoint that has the default access policy. Each EC2 instance is associated with an instance profile role that has a policy that explicitly allows the s3:GetObject action and the s3:PutObject action for only the required S3 buckets.
The company learns that one or more of the EC2 ins...
To address the issue of exfiltration of data by compromised EC2 instances and ensure that the EC2 processing job remains functional, the security engineer must focus on restricting the ability of the compromised EC2 instances to access S3 buckets outside the company's organization while maintaining the necessary functionality for the internal EC2 instances to access their required S3 buckets.
Analysis of the options:
A) Update the policy on the S3 gateway endpoint to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company's values.
- Why Selected: The S3 gateway endpoint acts as the entry and exit point for traffic between the EC2 instances and S3. By updating the policy on the S3 gateway endpoint with conditions using the `aws:ResourceOrgID` and `aws:PrincipalOrgID` condition keys, the security engineer can ensure that S3 actions (such as `s3:GetObject` and `s3:PutObject`) are allowed only if the S3 resource and the principal (the EC2 instance) belong to the same AWS Organization (i.e., the company's organization). This prevents the compromised EC2 instances from exfiltrating data to external S3 buckets outside the company’s organization while preserving access to the internal S3 buckets for the processing job.
- Key Factor: The use of condition keys on the S3 gateway endpoint policy is the most effective way to control access based on organization membership without requiring changes to the instance profiles or disrupting the existing EC2 instance behavior.
B) Update the policy on the instance profile role to allow the S3 actions only if the value of the aws:ResourceOrgID condition key matches the company's value.
- Why Rejected: While updating the policy on the instance profile role can restrict the S3 actions based on organization, it does not prevent the exfiltration of data via the compromised EC2 instances when the traffic is routed through the S3 gateway endpoint. The EC2 instance can still use th...
Author: Mia · Last updated Jul 19, 2026
A company that operates in a hybrid cloud environment must meet strict compliance requirements. The company wants to create a report that includes evidence from on-premises workloads alongside evidence from AWS resources. A security engineer must implement a solution to collect, re...
To meet the strict compliance requirements and include evidence from both on-premises workloads and AWS resources, the best solution is to collect, review, and manage evidence across both environments in a centralized manner. Let’s analyze each option:
A) Create an assessment in AWS Audit Manager from a prebuilt framework or a custom framework. Upload manual evidence from the on-premises workloads. Add the evidence to the assessment. Generate an assessment report after Audit Manager collects the necessary evidence from the AWS resources.
- Explanation: AWS Audit Manager is specifically designed for collecting, reviewing, and managing evidence in a structured way to demonstrate compliance with various regulations and standards. It allows the integration of evidence from both AWS and non-AWS (on-premises) workloads. You can upload manual evidence from on-premises and let Audit Manager gather evidence from AWS resources automatically. It provides a comprehensive and automated reporting solution, making it ideal for hybrid cloud environments.
- Reasoning: This solution fits the requirement of managing compliance in a hybrid environment. AWS Audit Manager is tailored to handle this scenario, making it the most appropriate choice.
B) Install the Amazon CloudWatch agent on the on-premises workloads. Use AWS Config to deploy a conformance pack from a sample conformance pack template or a custom YAML template. Generate an assessment report after AWS Config identifies noncompliant workloads and resources.
- Explanation: AWS Config is useful for tracking configuration compliance, but it's focused more on identifying non-compliant AWS resources rather than a full compliance assessment involving both on-premises and cloud resources. While CloudWatch agents and AWS Config can monitor and manage AWS resources and some on-premises workloads, this approach lacks an effective means to upload and manage manual evidence from on-premises resources and doesn't provide a unified reporting system for compliance.
- Reasoning: This option is primarily focused on AWS environments and might be less suitable for comprehensive hybrid cloud compliance reporting.
C) Set up the appropriate sec...
Author: Olivia Johnson · Last updated Jul 19, 2026
To meet regulatory requirements, a security engineer needs to implement an IAM policy that restricts the use of AWS services to the us-...
To restrict the use of AWS services to the us-east-1 Region, the IAM policy must prevent the use of AWS resources in any other regions. Let's evaluate how different policy options can achieve this:
1. AWS IAM Policy with Region Restriction:
To restrict service usage to the us-east-1 region, the IAM policy can specify a condition that limits actions to only this region. This can be done using the `Condition` element, specifically with the `aws:RequestedRegion` condition key.
Here’s an example of such a policy:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "",
"Resource": "",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": "us-east-1"
}
}
}
]
}
```
Explanation:
- Condition: The `StringNotEquals` condition checks the region of the requested action against the `us-east-1` region.
- Action: The `Deny` effect is applied to all actions (`Action: `), so if any resource is requested outside the `us-east-1` region, the action is denied.
- Resource: This condition applies to all resources (`Resource: `).
This IAM policy is ideal for restricting actions based on the region because it explicitly checks the `aws:RequestedRegion` and denies any actions that are not in the `us-east-1` region.
2. IAM Policy Restricting Specific Actions:
Another option is to restrict specific actions rather than all actions. For example, you could deny acti...
Author: Deepak · Last updated Jul 19, 2026
A company has a web server in the AWS Cloud. The company will store the content for the web server in an Amazon S3 bucket. A security engineer must use an Amazon CloudFront distribution to speed up delivery of the content. None of the file...
To meet the requirements of using Amazon CloudFront to speed up content delivery while ensuring that none of the files are publicly accessible from the S3 bucket directly, we need to ensure that CloudFront can access the files, but the S3 bucket itself does not allow direct public access. Let's break down each option to see which solution is most appropriate:
A) Configure the permissions on the individual files in the S3 bucket so that only the CloudFront distribution has access to them.
- Explanation: Configuring permissions on individual files would require manually specifying which files CloudFront can access and ensuring that others are denied. While this might seem like an approach to control access, managing permissions at the individual file level can become complex and error-prone, especially if there are many files.
- Reasoning: This method is cumbersome and inefficient for large-scale use because you’d have to manage access for each file individually. This doesn't provide a scalable or maintainable solution compared to other methods.
B) Create an origin access control (OAC). Associate the OAC with the CloudFront distribution. Configure the S3 bucket permissions so that only the OAC can access the files in the S3 bucket.
- Explanation: An origin access control (OAC) is the recommended way to securely allow CloudFront to access content in S3 while ensuring the S3 bucket itself is not publicly accessible. This mechanism ensures that only CloudFront, not users directly accessing S3, can retrieve the content. You configure the S3 bucket to trust the OAC, which CloudFront uses to pull the content.
- Reasoning: This is the most appropriate solution because it is secure, scalable, and integrates with CloudFront's best practices for restricting access. The use of OAC prevents direct access to the files in the S3 bucket while allowing CloudFront to serve them to users.
- Use Case: This is the ideal solution for this scenario, as it directly meets the requirements of restricting access t...
Author: Daniel · Last updated Jul 19, 2026
A security engineer logs in to the AWS Lambda console with administrator permissions. The security engineer is trying to view logs in Amazon CloudWatch for a Lambda function that is named myFunction. When the security engineer chooses the option in the Lambda console to view logs in CloudWatch, an "error loading Log Streams" message ...
In this scenario, the security engineer is experiencing an issue when trying to view logs for a Lambda function in CloudWatch, which results in an "error loading Log Streams" message. This suggests that the Lambda function's execution role does not have sufficient permissions to interact with CloudWatch logs, specifically to access or retrieve log streams.
Let’s break down the options to understand how to correct the error.
IAM Permissions for Lambda Execution Role:
To view logs in CloudWatch, the Lambda function's execution role must have the necessary permissions to access CloudWatch Logs. These include:
- `logs:DescribeLogGroups`: Allows the Lambda function to describe log groups in CloudWatch.
- `logs:DescribeLogStreams`: Allows the Lambda function to list the log streams within a log group.
- `logs:GetLogEvents`: Allows the Lambda function to retrieve log events from a specific log stream.
- `logs:CreateLogGroup` and `logs:CreateLogStream`: Allow the creation of new log groups and log streams, respectively.
Now, let's evaluate the options based on the error encountered and what is likely missing from the IAM policy.
A) Move the logs:CreateLogGroup action to the second Allow statement.
- Explanation: The `logs:CreateLogGroup` permission allows the creation of log groups, but this action is not required to view logs in CloudWatch. The error likely stems from missing permissions to view existing logs or describe log streams. Moving this action to another Allow statement would not resolve the issue of viewing logs.
- Reasoning: The `logs:CreateLogGroup` permission isn't necessary for viewing existing logs, so this solution is not the right fix.
B) Add the logs:PutDestination action to the second Allow statement.
- Explanation: The `logs:PutDest...
