Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company is using AWS WAF to protect a customized public API service that is based on Amazon EC instances. The API uses an Application Load Balancer.
The AWS WAF web ACL is configured with an AWS Managed Rules rule group. After a software upgrade to the API and the client application, some types of requests are no longer working and are causing application stability issues. A security engineer discovers that AWS WAF logging is not turned on for the web ACL.
The security engineer needs to immediately return the application to service, resolve the issue, and ensure t...
Let's break down the situation and the options:
Scenario Overview:
- The company uses AWS WAF to protect an API service based on EC2 instances.
- After a software upgrade, certain requests are no longer working, causing stability issues.
- The AWS WAF logging was not enabled for the web ACL, so the engineer enabled logging to Amazon CloudWatch Logs.
- The security engineer needs to immediately return the application to service and ensure logging remains enabled in the future.
The key requirements are:
1. Immediate action to return the application to service.
2. Logging needs to stay enabled for monitoring future issues.
3. Determining which rule is blocking the requests.
Step-by-step Evaluation of Options:
A) Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.
- Why this is selected (partially):
- Using Count actions will allow the engineer to count requests that match a specific rule without actually blocking them. This is useful for identifying which rules are affecting traffic without causing further issues.
- IAM policy modification is an important step to prevent future removal of logging configurations.
- Why the rest is rejected:
- The IAM policy ensures that administrators cannot remove logging, which addresses the concern of turning off logging unintentionally, but it doesn't fully address the other requirements.
B) Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs.
- Why this is selected (partially):
- The Count actions approach helps in identifying which rule is blocking requests without disrupting t...
Author: ShadowWolf101 · Last updated Jul 19, 2026
A security engineer is creating an AWS Lambda function. The Lambda function needs to use a role that is named LambdaAuditRole to assume a role that is named AcmeAuditFactoryRole in a different AWS account.
When the code is processed, the following error message appears: "An error occurred (AccessDenied) when ...
The error message indicates that the Lambda function is trying to assume a role across AWS accounts but lacks the necessary permissions. To resolve this, the security engineer needs to ensure that both roles (LambdaAuditRole and AcmeAuditFactoryRole) are configured correctly for cross-account role assumption.
Let's evaluate each option:
A) Ensure that LambdaAuditRole has the sts:AssumeRole permission for AcmeAuditFactoryRole.
- Explanation: LambdaAuditRole needs the `sts:AssumeRole` permission to be able to assume the AcmeAuditFactoryRole. This permission should be part of the policy attached to LambdaAuditRole. If it's missing, the Lambda function will not be able to assume the role.
- Why this option is selected: This is crucial for the Lambda function to assume a role in a different account. Without this permission, the assume role operation will fail.
- Why other options are rejected: This option is not rejected because it directly addresses the error. This permission needs to be present for LambdaAuditRole.
B) Ensure that LambdaAuditRole has the AWSLambdaBasicExecutionRole managed policy attached.
- Explanation: The AWSLambdaBasicExecutionRole policy allows Lambda functions to interact with AWS services, but it doesn't directly address the issue of assuming roles in another account.
- Why this option is rejected: While it's a good practice to attach this policy for logging and execution permissions, it is not directly related to the issue of cross-account role assumption. The issue at hand is with the `sts:AssumeRole` permission, not Lambda execution rights.
C) Ensure that the trust policy for AcmeAuditFactoryRole allows the sts:AssumeRole action from LambdaAuditRole.
- Explanation: The trust policy of AcmeAuditFactoryRole must explicitly allow the LambdaAuditRole to assume the role by allowing `sts:AssumeRole` from that specific role or ...
Author: Aria · Last updated Jul 19, 2026
A company has AWS accounts in an organization in AWS Organizations. The organization includes a dedicated security account.
All AWS account activity across all member accounts must be logged and reported to the dedicated security account. The company must retain all the activity logs in a secure storage location within the dedicated security account for 2 years. ...
To meet the company's requirements of logging all AWS account activity and ensuring the logs are stored securely in a dedicated security account with the least operational overhead, let's evaluate each option:
A) In the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock in compliance mode and a retention period of 2 years on the S3 bucket. Set the bucket policy to allow the organization's management account to write to the S3 bucket.
- Explanation: S3 Object Lock in compliance mode prevents object modification or deletion for the specified retention period, ensuring the logs cannot be altered or deleted. Setting the bucket policy to allow the organization's management account to write to the bucket makes sense for this scenario, but it doesn't ensure all member accounts can write to it.
- Why this option is rejected: This option restricts access to the S3 bucket only to the management account. Since the requirement is for all member accounts to log activity, the policy should allow member accounts to write logs to the bucket, not just the management account.
B) In the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock in compliance mode and a retention period of 2 years on the S3 bucket. Set the bucket policy to allow the organization's member accounts to write to the S3 bucket.
- Explanation: S3 Object Lock in compliance mode with a 2-year retention period ensures that logs cannot be deleted or altered during that period, fulfilling the security requirement. The policy allowing all member accounts to write to the S3 bucket ensures that logs from all accounts are delivered to this centralized storage location.
- Why this option is selected: This setup satisfies the requirement for centralized logging with secure, unalterable storage and ensures that all member accounts can contribute logs. It’s efficient and meets all the security requirements with minimal overhead.
C) In the dedicated security account, create an Amazon S3 bucket that has an S3 Lifecycle configuration that expires objects after 2 years. Set the bucket policy to allow the organization's member accounts to write to the S3 bucket.
- Explanation: S3 Lifecycle configuration allows you to define policies for automatically deleting or transitioning objects. However, t...
Author: Oliver · Last updated Jul 19, 2026
A company is testing its incident response plan for compromised credentials. The company runs a database on an Amazon EC2 instance and stores the sensitive database credentials as a secret in AWS Secrets Manager. The secret has rotation configured with an AWS Lambda function that uses the generic rotation function template. The EC2 instance and the Lambda function are deployed in the same private subnet. The VPC has a Secrets Manager VPC endpoint.
A security engineer discovers that the secret cannot rotate...
The error message "setSecret: Unable to log into database" in the CloudWatch logs suggests that the Lambda function responsible for rotating the secret is unable to connect to the database. Since the VPC endpoint for Secrets Manager is working, the issue seems to be with the Lambda function's ability to connect to the EC2 instance hosting the database.
Let's evaluate each option to identify the best solution:
A) Use the AWS Management Console to edit the JSON structure of the secret in Secrets Manager so that the secret automatically conforms with the structure that the database requires.
- Explanation: The structure of the secret in Secrets Manager should match the format expected by the database. However, the error message indicates that the problem is not with the format of the secret, but rather with the Lambda function's ability to interact with the database.
- Why this option is rejected: While ensuring the secret format matches the database's expected structure is important, the error message points to a connection issue rather than an issue with the secret's structure. The solution likely lies in resolving network connectivity issues.
B) Ensure that the security group that is attached to the Lambda function allows outbound connections to the EC2 instance. Ensure that the security group that is attached to the EC2 instance allows inbound connections from the security group that is attached to the Lambda function.
- Explanation: The Lambda function must have network access to the EC2 instance where the database is hosted in order to update the database credentials. For this, the Lambda function's security group must allow outbound connections to the EC2 instance, and the EC2 instance's security group must allow inbound connections from the Lambda function's security group.
- Why this option is selected: This option addresses the core problem: ensuring that the Lambda function can reach the EC2 instance to update the database credentials. Properly configured security groups are essential for network connectivity between these resources in the same VPC.
- Why other options are rejected: This solution directly address...
Author: Mia · Last updated Jul 19, 2026
A company deploys a set of standard IAM roles in AWS accounts. The IAM roles are based on job functions within the company. To balance operational efficiency and security, a security engineer implemented AWS Organizations SCPs to restrict access to critical security services in all company accounts.
All of the company's accounts and OUs within AWS Organizations have a default FullAWSAccess SCP that is attached. The security engineer needs to ensure that no one can disable Amazon GuardDuty and AWS Security Hub. The securi...
To meet the requirement of preventing anyone from disabling Amazon GuardDuty and AWS Security Hub while ensuring that no other IAM policies are overridden, the security engineer needs to create and attach an SCP (Service Control Policy) that explicitly denies actions related to disabling GuardDuty and Security Hub, but does not interfere with other permissions granted by IAM policies.
Let's evaluate each option and consider key factors in the reasoning:
Key Factors:
- Service Control Policies (SCPs) govern what actions can be performed within AWS Organizations. SCPs are used to set permission guardrails for IAM roles and policies, but they do not override permissions that are granted by IAM policies within the accounts.
- The goal is to deny disabling GuardDuty and Security Hub but allow all other IAM policy permissions.
- The SCP must be applied to the root of the organization so that it affects all accounts and organizational units (OUs).
Explanation of the Correct SCP
The correct SCP should explicitly deny any actions that are capable of disabling GuardDuty or AWS Security Hub, while ensuring that other permissions are not overridden. Here’s a sample SCP that could achieve this:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": [
"guardduty:DisableGuardDuty",
"securityhub:DisableSecurityHub",
"securityhub:BatchDisableStandards",
"securityhub:UpdateSecurityHubConfiguration"
],
"Resource": ""
}
]
}
```
This SCP:
- Deny specific actions such a...
Author: Sam · Last updated Jul 19, 2026
A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials.
The company already uses AWS Key ...
To meet the company's requirements of securely deploying resources from an AWS CloudFormation template while handling sensitive database credentials, we need to leverage AWS services that ensure security best practices. Let's evaluate each option:
Key Factors:
- AWS Secrets Manager: A service designed specifically for managing sensitive information like database credentials, API keys, and other secrets.
- AWS Key Management Service (KMS): A service to manage encryption keys and control access to encrypted data.
- CloudFormation: A service for deploying AWS resources in a secure, automated, and consistent manner.
Option Analysis:
A) Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.
- Explanation: AWS CloudFormation supports dynamic references to securely reference values stored in services such as Secrets Manager. When using dynamic references in the template, CloudFormation automatically retrieves the secret values from Secrets Manager at stack creation time. This approach is a recommended security best practice because the database credentials are never exposed directly in the template, and the retrieval process is secure and encrypted.
- Why this option is selected: This solution uses Secrets Manager, which is purpose-built for managing sensitive information. The dynamic reference allows secure retrieval of the credentials without hardcoding them in the template, meeting both security and best practice requirements.
B) Use a parameter in the CloudFormation template to reference the database credentials. Encrypt the CloudFormation template by using AWS KMS.
- Explanation: This option suggests referencing the database credentials as a parameter in the CloudFormation template. While you can encrypt the template with AWS KMS, parameters passed into CloudFormation can be viewed in plaintext by users with access to CloudFormation, which is a security risk. Encrypting the entire template with KMS doesn’t provide proper protection for sensitive data like credentials that are handled by the template itself.
- Why this option is rejected: While encrypting the CloudFormation template adds some level of security, the credentials are still passed as parameters and could be exposed to users with sufficient CloudFo...
Author: Layla · Last updated Jul 19, 2026
An international company wants to combine AWS Security Hub findings across all the company's AWS Regions and from multiple accounts. In addition, the company wants to create a centralized custom dashboard to correlate these findings with operational data for deeper analysis and insights. The company needs an an...
Reasoning and Explanation:
1. Step A: Designate an AWS account as a delegated administrator for Security Hub. Publish events to Amazon CloudWatch from the delegated administrator account, all member accounts, and required Regions that are enabled for Security Hub findings.
- Why Rejected: While CloudWatch can be used for monitoring and alerting purposes, it is not the most suitable for aggregating and visualizing large amounts of Security Hub findings across multiple accounts and regions. The company needs to centralize and analyze findings from all accounts and regions, which would be more efficiently done using EventBridge and a data pipeline to a centralized data store (like S3). CloudWatch events can be used for operational metrics but don’t offer the same ease of analysis and cross-account data handling as EventBridge.
2. Step B: Designate an AWS account in an organization in AWS Organizations as a delegated administrator for Security Hub. Publish events to Amazon EventBridge from the delegated administrator account, all member accounts, and required Regions that are enabled for Security Hub findings.
- Why Selected: This is the most suitable option as it uses Amazon EventBridge to aggregate events from all accounts and regions into a centralized event bus. EventBridge is specifically designed to handle event-driven architectures across multiple AWS accounts and regions, which is exactly what the company needs. This centralized collection of findings will allow for easy correlation and deeper analysis of Security Hub data.
3. Step C: In each Region, create an Amazon EventBridge rule to deliver findings to an Amazon Kinesis data stream. Configure the Kinesis data streams to output the logs to a single Amazon S3 bucket.
- Why Rejected: While Kinesis is a great tool for streaming data in real-time, this solution does not provide the same level of ease for querying and visualizing the data. Storing findings in S3 and using Athena or QuickSight for querying would be a better approach. Kinesis also adds unnecessary complexity compared to using EventBridge directly to publish findings to S3 or other analytics services.
4. Step D: In each Region, create an Amazon EventBridge rule to deliver findings to an Amazon Kinesis Data Firehose delivery stream. Configure the Kine...
Author: Zara1234 · Last updated Jul 19, 2026
An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication:
After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands...
Reasoning and Explanation:
1. Option A: Change the value of aws:MultiFactorAuthPresent to true.
- Why Rejected: This option only modifies the policy’s condition, but it doesn't solve the issue where users are unable to perform EC2 commands. The core issue is that users need to authenticate using multi-factor authentication (MFA), but this approach doesn't address how users should authenticate via CLI or API after MFA enforcement. It assumes the policy is incorrect without considering how to implement MFA with the CLI.
2. Option B: Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.
- Why Selected: This is the most effective option. The `aws sts get-session-token` command is used to obtain temporary security credentials that include the MFA authentication. This allows users to authenticate with MFA while still being able to run AWS CLI commands. The users will authenticate using the MFA device and then use the temporary credentials (access key ID, secret access key, and session token) provided by the `get-session-token` command to authenticate their requests to AWS services, such as EC2. It resolves the problem by ensuring MFA is enforced while enabling the users to perform EC2 commands.
3. Option C: Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
- Why Rejected: While SAML-based fede...
Author: Zara · Last updated Jul 19, 2026
A company is developing a mechanism that will help data scientists use Amazon SageMaker to read, process, and output data to an Amazon S3 bucket. Data scientists will have access to a dedicated S3 prefix for each of their projects. The company will implement bucket policies that use the dedicated S3 prefixes to restrict access to the S3 objects. The projects can last up to 60 days.
The company's securi...
Reasoning and Explanation:
1. Option A: Create an AWS Lambda function to identify and delete objects in the S3 bucket that have not been accessed for 60 days. Create an Amazon EventBridge scheduled rule that runs every day to invoke the Lambda function.
- Why Rejected: While this option would technically meet the requirement of deleting objects after 60 days, it is more complex than necessary. It involves the setup of an AWS Lambda function that runs on a scheduled basis, adding operational overhead, maintenance, and additional costs for the Lambda execution and EventBridge rules. Additionally, Lambda would need to query the objects to determine if they haven't been accessed, which may not be the most efficient approach in terms of both time and cost.
2. Option B: Create a new S3 bucket. Configure the new S3 bucket to use S3 Intelligent-Tiering. Copy the objects to the new S3 bucket.
- Why Rejected: S3 Intelligent-Tiering is a storage class designed to move objects between two access tiers (frequent and infrequent access) based on access patterns. However, this is not directly related to the requirement of expiring objects after 60 days. The additional costs and complexity of configuring a new bucket and moving data to the Intelligent-Tiering storage class do not align with the goal of simply ensuring data is deleted after the project ends. Intelligent-Tiering is useful for cost optimization based on access patterns but doesn't automatically delete objects after a specified period, which is a key requirement here.
3. Option C: Create an S3 Lifecycle configuration for each S3 bucket prefix for each project. Set the S3 ...
Author: IronLion88 · Last updated Jul 19, 2026
A company has AWS accounts that are in an organization in AWS Organizations. An Amazon S3 bucket in one of the accounts is publicly accessible.
A security engineer must change the configuration so that the S3 bucket is no longer publicly accessible. The security engineer also must ...
Reasoning and Explanation:
1. Option A: Configure the S3 bucket to use an AWS Key Management Service (AWS KMS) key. Encrypt all objects in the S3 bucket by creating a bucket policy that enforces encryption. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account.
- Why Rejected: While using AWS KMS encryption can enhance data security, it does not directly address the requirement of preventing public access to the S3 bucket. Also, denying the `s3:GetObject` action via an SCP does not directly prevent the bucket from being made publicly accessible. The goal is to restrict public access to the bucket and ensure it cannot be made public again in the future, which this solution does not fully address.
2. Option B: Enable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account.
- Why Rejected: Enabling the PublicAccessBlock configuration is the correct step to block public access, but denying the `s3:GetObject` action via an SCP is unnecessary and might disrupt legitimate access. The `s3:GetObject` action is essential for reading objects from the S3 bucket, and denying this action could create access issues for legitimate users or applications, which doesn't align with the requirement.
3. Option C: Enable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account.
- W...
Author: Evelyn · Last updated Jul 19, 2026
A company is designing a new application stack. The design includes web servers and backend servers that are hosted on Amazon EC2 instances. The design also includes an Amazon Aurora MySQL DB cluster.
The EC2 instances are in an Auto Scaling group that uses launch templates. The EC2 instances for the web layer and the backend layer are backed by Amazon Elastic Block Store (Amazon EBS) vol...
Reasoning and Explanation:
1. Option A: Modify EBS default encryption settings in the target AWS Region to enable encryption. Use an Auto Scaling group instance refresh.
- Why Selected: By modifying the EBS default encryption settings, all newly created EBS volumes will be automatically encrypted at rest using AWS Key Management Service (KMS). This ensures that the web and backend EC2 instances will have encrypted EBS volumes as they are launched by the Auto Scaling group. Using the instance refresh ensures that existing EC2 instances are replaced with new instances that use the updated launch template and the new EBS encryption settings. This approach is an efficient and cost-effective way to ensure encryption at rest for the EC2 instances’ EBS volumes.
2. Option B: Modify the launch templates for the web layer and the backend layer to add AWS Certificate Manager (ACM) encryption for the attached EBS volumes. Use an Auto Scaling group instance refresh.
- Why Rejected: AWS Certificate Manager (ACM) is primarily used to manage SSL/TLS certificates for securing communication over HTTPS, not for encrypting EBS volumes. EBS volume encryption is handled using AWS Key Management Service (KMS), not ACM. Therefore, this option is incorrect because it incorrectly refers to ACM for encryption of EBS volumes.
3. Option C: Create a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster.
- Why Selected: To meet the encryption-at-rest requirement for the Amazon Aurora MySQL DB cluster...
Author: Matthew · Last updated Jul 19, 2026
A company uses SAML federation with AWS Identity and Access Management (IAM) to provide internal users with SSO for their AWS accounts. The company's identity provider certificate was rotated as part of its normal lifecycle Shortly after users started receiving the following error when attempting to log in:
'Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken)'
A s...
In this scenario, the security engineer needs to address an issue caused by a certificate rotation on the identity provider used for SAML federation. Users are encountering the "Response Signature Invalid" error because the IAM identity provider's configuration is not aligned with the new certificate.
Let's go through the options systematically:
A) Download a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.
- Why Rejected: This option involves creating a new IAM identity provider, which is unnecessary for addressing the issue. It's likely that the original IAM identity provider configuration is still valid, and merely updating the certificate or metadata should resolve the issue. Creating a new IAM entity unnecessarily introduces complexity and doesn't align with best practices for certificate rotations.
B) During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
- Why Selected: This option is ideal because it takes a proactive approach. By adding a secondary certificate, you can avoid disruption during the current certificate's rotation, allowing for a smooth transition. Additionally, uploading the updated metadata and performing certificate rotations as needed ensures that the process remains aligned with best practices. It also prevents similar errors from recurring in the future by maintaining updated metadata.
C) Download a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the S...
Author: Krishna · Last updated Jul 19, 2026
A company is implementing a new application in a new AWS account. A VPC and subnets have been created for the application. The application has been peered to an existing VPC in another account in the same AWS Region for database access Amazon EC2 instances will regularly be created and terminated in the application VPC, but only some of them will need access to the databases in the peered VPC over TCP port 1521. A secu...
To address the requirement where only certain EC2 instances in the application VPC need access to the database in the peered VPC over TCP port 1521, the security engineer should use a solution that restricts access based on security group rules, as they provide a more dynamic and manageable approach than network ACLs.
Option Analysis:
A) Create a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to allow TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access.
- Why Rejected: While security groups can control inbound traffic to database instances, adding a network ACL rule is unnecessary and adds complexity. Network ACLs are stateless, and using them in combination with security groups introduces redundant layers of security. Security groups are generally more flexible for controlling traffic within a VPC, and using them to allow access to specific instances is the preferred method.
B) Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access.
- Why Rejected: This approach involves using IP address ranges in the security group rules, which may not be as precise or dynamic as using specific security groups. It's also harder to manage when EC2 instances are dynamically created or terminated. Additionally, if multiple EC2 instances from the application VPC need to access the database, it's more efficient to use security groups ra...
Author: Liam123 · Last updated Jul 19, 2026
A company needs a forensic-logging solution for hundreds of applications running in Docker on Amazon EC2. The solution must perform real-time analytics on the logs, must support the replay of messages, and must per...
To meet the requirements of forensic logging, real-time analytics, log persistence, and replay of messages, the solution needs services that support log collection, analysis, storage, and easy retrieval. Let's evaluate the available options:
Option Analysis:
A) Amazon Athena
- Why Rejected: Amazon Athena is a serverless query service that allows you to analyze data directly from Amazon S3 using standard SQL. While it is great for querying logs that are already stored in S3, it does not support real-time log ingestion or replay of messages directly. Athena is more suited for batch analytics over logs stored in S3 rather than for real-time log streaming or persistent log ingestion. It's not the best choice for real-time logging and replay scenarios.
B) Amazon Kinesis
- Why Selected: Amazon Kinesis is a real-time streaming data platform, ideal for handling log data in real-time. It allows for the ingestion of log data (using Kinesis Data Streams) and provides the capability to process this data in real-time with Kinesis Data Analytics. Additionally, Kinesis supports data replay, making it a great fit for both real-time processing and log persistence requirements. It can easily integrate with other AWS services for log storage and analytics.
C) Amazon SQS
- Why Rejected: Amazon SQS is a simple queue service designed for decoupling applications and microservices. While it supports message persistence and retrieval, it is not optimized for real...
Author: RadiantJaguar56 · Last updated Jul 19, 2026
A company has many member accounts in an organization in AWS Organizations. The company is concerned about the potential for misuse of the AWS account root user credentials for member accounts in the organization. To address this potential misuse, the company wants to ensure that even if th...
To protect the AWS account root user credentials in member accounts within an AWS Organization, the company must implement a solution that mitigates the risk of root user misuse while ensuring the root user account can still be managed securely. Let's evaluate the available options:
Option Analysis:
A) Block service access by using SCPs for the root user
- Why Rejected: Service Control Policies (SCPs) can be used to restrict permissions for accounts in an organization, but SCPs do not directly restrict the root user's ability to perform actions. SCPs apply to IAM users and roles, but they do not prevent the root user from accessing services unless the organization applies additional constraints, which is not a direct protection mechanism for the root user credentials. Therefore, SCPs are not an ideal solution for this scenario.
B) Remove the password for the root user
- Why Selected: Removing the password for the root user is an effective measure to mitigate the risk of unauthorized access. If the root user does not have a password, an attacker cannot access the account using the web console, even if they obtain the root user's credentials. This action significantly reduces the attack surface for the root user, ensuring that its access is limited to programmatic access only (such as through access keys). This step can be paired with the use of MFA to further secure root account ac...
Author: Mia · Last updated Jul 19, 2026
An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installs the Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2 instances launch with an IAM role that has an IAM policy attached. The policy provides access to publish custom metrics to CloudWatch. The EC2 instances run in a private subnet inside a VPC The VPC provides access to the internet for private subnets through a NAT gateway.
A security engineer notices that no logs are being published to CloudWatch Logs for the EC2 instances that the Auto Scaling group launches. The security engineer validates that the CloudWatch Logs...
In this scenario, the EC2 instances launched by the Auto Scaling group are unable to publish logs to CloudWatch Logs despite proper configuration of the CloudWatch Logs agent. The security engineer has already validated that network communication is functioning and the agent is running, indicating that the issue might lie in network access or IAM permissions. Let's analyze the options:
Option Analysis:
A) Configure the IAM policy in use by the IAM role to have access to the required cloudwatch: API actions that will publish logs.
- Why Rejected: The IAM policy attached to the instance’s IAM role already provides access to publish custom metrics to CloudWatch, so it’s likely that the permissions required to publish logs (such as `logs:PutLogEvents`, `logs:CreateLogStream`, etc.) are not included in the policy. However, the IAM policy already has CloudWatch-related permissions. This option might not be the most direct solution because it doesn't directly address network access, which seems to be the root cause, given that the issue persists even after network and agent configuration are validated.
B) Adjust the Amazon EC2 Auto Scaling service-linked role to have permissions to write to CloudWatch Logs.
- Why Rejected: The EC2 Auto Scaling service-linked role manages Auto Scaling group operations, but it is not responsible for managing EC2 instance access to CloudWatch Logs. The issue here is that the EC2 instances themselves lack the correct permissions to publish logs, and this would not be reso...
Author: Krishna · Last updated Jul 19, 2026
A company uses Amazon Elastic Container Service (Amazon ECS) containers that have the Fargate launch type. The containers run web and mobile applications that are written in Java and Node.js. To meet network segmentation requirements, each of the company's business units deploys applications in its own dedicated AWS account. Each business unit stores container images in an Amazon Elastic Container Registry (Amazon ECR) private registry in its own account.
A security engineer must recommend a solution to scan ECS containers and ECR registries for vulnerabilities i...
To determine the best solution, we need to evaluate each option based on the specific requirements mentioned:
Key Requirements:
1. Scan ECS Containers and ECR Registries for Vulnerabilities: The solution should scan both ECS containers and ECR registries for vulnerabilities in operating systems and programming language libraries.
2. Network Segmentation: The business units deploy applications in their own dedicated AWS accounts, so the solution must be able to scan across multiple accounts.
3. Audit Team Access: The audit team should be able to identify vulnerabilities in all accounts and have access to the vulnerability findings from all accounts.
Option A: Amazon Inspector + AWS Security Hub
- Amazon Inspector is a vulnerability assessment service that can scan for security vulnerabilities in Amazon EC2 instances, Lambda functions, and container images stored in Amazon ECR.
- AWS Security Hub is a service that aggregates and centralizes security findings across multiple AWS accounts. The vulnerability findings from Inspector can be forwarded to Security Hub.
- Why it fits: Amazon Inspector provides comprehensive vulnerability scanning for ECS containers and ECR images. By forwarding findings to AWS Security Hub, the audit team can review the vulnerabilities in a central location across all accounts.
- Why it's not rejected: This option aligns well with the requirements of scanning vulnerabilities, forwarding findings to a central account, and providing audit team access to Security Hub.
Option B: AWS Config + Conformance Packs
- AWS Config monitors and records configuration changes across AWS...
Author: Maya · Last updated Jul 19, 2026
A company uses Amazon EC2 Linux instances in the AWS Cloud. A member of the company's security team recently received a report about common vulnerability identifiers on the instances.
A security engineer needs to verify patching and perform remediation if the instances do not have the correct patches installed. The security engineer must determine which EC2 instances are at risk ...
Let's evaluate the options based on the requirements of the security engineer:
Key Requirements:
1. Identify which EC2 instances are at risk: The security engineer needs to determine which EC2 instances have missing patches.
2. Automate patching for remediation: The solution must allow for the automation of patching on EC2 instances that are not fully patched.
Option A: AWS Systems Manager Patch Manager
- AWS Systems Manager Patch Manager is designed specifically to automate the process of patching EC2 instances by applying missing patches for the operating system. It also allows you to view which instances are missing patches.
- Why it fits: Patch Manager allows for both vulnerability identification (via patch status) and automated patching of EC2 instances, making it ideal for the task at hand.
- Why it's not rejected: This solution directly addresses both the need to identify instances with missing patches and the need to automate the patching process. It’s a specialized tool for patching EC2 instances and works seamlessly in the AWS environment.
Option B: AWS Shield Advanced + AWS Systems Manager Patch Manager
- AWS Shield Advanced is a managed DDoS protection service and does not provide patching or vulnerability scanning capabilities for EC2 instances.
- Why it's rejected: While AWS Shield Advanced is great for protecting against DDoS attacks, it has no relation to vulnerability identification or patching, making it unnecessary and irrelevant for this use case.
Option C: Amazon ...
Author: Amira99 · Last updated Jul 19, 2026
A company hosts an application on Amazon EC2 that is subject to specific rules for regulatory compliance. One rule states that traffic to and from the workload must be inspected for network-level attacks. This involves inspecting the whole packet.
To comply with this regulatory rule, a security engineer must install intrusion detection software on a c5n.4xlarge EC2 ...
Let's break down the options based on the requirements and the reasoning behind each:
Key Requirements:
1. Inspect traffic for network-level attacks: This requires the ability to inspect the entire packet to identify attacks.
2. Traffic monitoring: The engineer needs to monitor traffic going to and from the application instances.
3. Use of a c5n.4xlarge EC2 instance: The security engineer will install intrusion detection software on this instance for monitoring traffic.
Option A: Place the network interface in promiscuous mode to capture the traffic
- Promiscuous mode allows a network interface to capture all traffic on the network, not just traffic meant for that specific instance. This is useful for packet capture.
- Why it fits: Promiscuous mode allows the EC2 instance to capture all traffic, which is useful for packet inspection.
- Why it's not rejected: While promiscuous mode can capture traffic, it is not sufficient by itself for setting up a comprehensive solution that sends traffic from other instances to the monitoring EC2 instance. It is typically used in combination with tools like traffic mirroring or packet capture agents.
Option B: Configure VPC Flow Logs to send traffic to the monitoring EC2 instance using a Network Load Balancer
- VPC Flow Logs capture metadata about IP traffic (e.g., source and destination IP addresses, ports, protocols), but they do not capture the full packet data. Flow logs are useful for traffic monitoring, but they are not sufficient for inspecting the whole packet.
- Why it's rejected: VPC Flow Logs provide metadata, not the full packet content. Since the requirement is to inspect the whole packet, VPC Flow Logs would not be appropriate here.
Option C: Configure VPC traffic mirrorin...
Author: Ishaan · Last updated Jul 19, 2026
A company deploys a distributed web application on a fleet of Amazon EC2 instances. The fleet is behind an Application Load Balancer (ALB) that will be configured to terminate the TLS connection. All TLS traffic to the ALB must stay secure, e...
Let's evaluate the options based on the requirement that all TLS traffic to the Application Load Balancer (ALB) must stay secure, even if the certificate private key is compromised. This requirement focuses on ensuring that traffic remains secure and that forward secrecy is maintained.
Key Requirements:
- TLS traffic must stay secure: Even if the certificate's private key is compromised, the communication must remain secure.
- Perfect Forward Secrecy (PFS): PFS ensures that if the private key of the server's TLS certificate is compromised, past communications are still secure, because session keys are not derived from the private key.
Option A: Create an HTTPS listener that uses a certificate that is managed by AWS Certificate Manager (ACM)
- ACM can be used to manage SSL/TLS certificates for ALBs, and it simplifies certificate management and renewal. However, just using an ACM-managed certificate by itself does not guarantee forward secrecy.
- Why it's rejected: While ACM helps with the management and renewal of certificates, it doesn't necessarily ensure that the certificate uses secure cipher suites with perfect forward secrecy. This is not sufficient to meet the requirement for security in case of private key compromise.
Option B: Create an HTTPS listener that uses a security policy that uses a cipher suite with perfect forward secrecy (PFS)
- Perfect Forward Secrecy (PFS) is the key here. By configuring the ALB to use a security policy with cipher suites that support PFS, the TLS traffic will remain secure even if the private key is compromised.
- Why it fits: This option ensures that the cipher suites used for TLS connections support perfect forward secrecy, which means the session keys used to encrypt traffic are not derived from the private key, making the traffic se...
Author: Liam123 · Last updated Jul 19, 2026
A company recently adopted new compliance standards that require all user actions in AWS to be logged. The user actions must be logged for all accounts that belong to an organization in AWS Organizations. The company needs to set alarms that respond when specified actions occur. The alarms must forward alerts to ...
Let's evaluate each option based on the requirements:
Key Requirements:
1. Logging user actions for all accounts in an AWS Organization: The solution must log user actions across all accounts within the organization.
2. Real-time alarms: The company needs to be notified in near real-time when specified actions occur.
3. Alert forwarding: Alerts must be forwarded to an email distribution list.
4. AWS compliance standards: The solution should comply with the need to log and react to user actions efficiently.
Option A: Implement an AWS CloudTrail trail as an organizational trail. Configure the trail with Amazon CloudWatch Logs forwarding. In CloudWatch Logs, set a metric filter for any user action events that the company specifies. Create an Amazon CloudWatch alarm to provide alerts for occurrences within a reported period and to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic.
- Why it fits:
- CloudTrail can log actions from all accounts in the organization when set as an organizational trail.
- CloudWatch Logs forwarding allows logs to be sent in near real-time, and setting metric filters enables the detection of specific user actions.
- CloudWatch alarms can be triggered based on the metric filter, and SNS can be used to send notifications to the email distribution list.
- This solution is highly efficient for near-real-time logging, alerting, and forwarding.
- Why it's not rejected:
- This solution uses AWS native services effectively, ensuring compliance and providing near real-time alerts via SNS.
- It meets all the requirements: organizational coverage, near real-time alerts, and email forwarding via SNS.
Option B: Implement an AWS CloudTrail trail. Configure the trail with Amazon CloudWatch Logs forwarding. In CloudWatch Logs, set a metric filter for any user action events that the company specifies. Create an Amazon CloudWatch alarm to provide alerts for occurrences within a reported period and to send messages to an Amazon Simple Queue Service (Amazon SQS) queue.
- Why it's rejected:
- While this option uses CloudTrail, CloudWatch Logs, and metric filters to monitor user actions, using SQS to send alerts is not the best solution for this case. SQS is a message queue that is used for queu...
Author: Alexander · Last updated Jul 19, 2026
A company wants to create a log analytics solution for logs generated from its on-premises devices. The logs are collected from the devices onto a server on premises. The company wants to use AWS services to perform near real-time log analysis. The company also wants to store these logs for 365 days for pattern...
Solution Breakdown:
Key Factors:
- Near real-time log analysis: The system should be capable of processing and analyzing the logs quickly after they are received.
- Long-term storage: The logs need to be stored for 365 days to facilitate pattern matching and substring search.
- Minimal development overhead: The solution should require minimal setup and management while providing scalable capabilities for log processing and storage.
Let's analyze each option:
---
Option A: Install Amazon Kinesis Agent on the on-premises server to send the logs to Amazon DynamoDB. Configure an AWS Lambda trigger on DynamoDB streams to perform near real-time log analysis. Export the DynamoDB data to Amazon S3 periodically. Run Amazon Athena queries for pattern matching and substring search. Set up S3 Lifecycle policies to delete the log data after 365 days.
- Pros:
- DynamoDB is highly scalable and managed, which reduces development effort for handling data storage.
- AWS Lambda allows for near real-time processing of logs.
- Athena can be used for querying logs stored in S3, which is well-suited for pattern matching and substring searches.
- S3 lifecycle policies are effective for automatically deleting logs after the retention period.
- Cons:
- DynamoDB is typically not ideal for high-volume log storage due to potential cost issues with frequent writes.
- Exporting data to S3 periodically adds complexity to the solution and introduces potential delays.
- The use of Lambda for processing DynamoDB streams can be tricky to manage at scale and may not be efficient enough for large amounts of log data.
- Conclusion: While feasible, this solution is a bit cumbersome and introduces complexity due to the manual export process to S3 and the use of DynamoDB, which isn't ideal for logs.
---
Option B: Install Amazon Managed Streaming for Apache Kafka (Amazon MSK) on the on-premises server. Create an MSK cluster to collect the streaming data and analyze the data in real time. Set the data retention period to 365 days to store the logs persistently for pattern matching and substring search.
- Pros:
- Kafka (via MSK) is excellent for high-throughput, real-time log streaming and processing.
- It’s capable of retaining log data for a configurable time period (365 days).
- Cons:
- Setting up MSK involves a substantial amount of management overhead compared to other AWS services.
- Kafka clusters can require careful scaling and tuning to handle high data volumes, leading to higher operational complexity.
- It doesn't directly provide a solution for performing log analysis (like pattern matching) unless you add another service like Elasticsearch or Athena.
- Operational overhead for managing MSK clusters and ensuring scaling is handled properly adds more complexity.
- Conclusion: MSK is a powerful tool for high-throughput streaming, but it requires a lot of manual setup and management. It doesn’t offer a seamless solution for log analysis or querying without additional to...
Author: Amira99 · Last updated Jul 19, 2026
A company has a large fleet of Linux Amazon EC2 instances and Windows EC2 instances that run in private subnets. The company wants all remote administration to be performed as securel...
In the given scenario, the goal is to ensure that all remote administration of Linux and Windows EC2 instances in private subnets is performed as securely as possible in the AWS Cloud. We will analyze each option based on key factors such as security, compliance, ease of use, and suitability for instances in private subnets.
Option A: Do not use SSH-RSA private keys during the launch of new instances. Implement AWS Systems Manager Session Manager.
- Pros:
- AWS Systems Manager Session Manager allows secure shell access to instances without the need for an SSH key, making it a more secure and centralized management option.
- No need for SSH key management: Since SSH keys are not used, there is no need to manage or rotate keys, reducing the administrative overhead.
- Works in private subnets: AWS Systems Manager does not require direct internet access to instances, so it is ideal for instances in private subnets.
- Logging: Session Manager provides audit logs, which improve the traceability of admin activities.
- Role-based access control: It integrates well with AWS IAM policies for defining who can access instances and for what purposes.
- Cons:
- Requires configuring and maintaining the AWS Systems Manager agent on all EC2 instances.
Option B: Generate new SSH-RSA private keys for existing instances. Implement AWS Systems Manager Session Manager.
- Pros:
- AWS Systems Manager Session Manager is still the key feature for securely managing instances.
- SSH keys would be used for access, but this would add complexity by requiring SSH keys for instances already launched.
- Cons:
- Key management complexity: Even though Session Manager is used, SSH key management still introduces the possibility of human error or misuse.
- Not ideal: The presence of SSH keys might conflict with the goal of reducing key management overhead and focusing entirely on centraliz...
Author: Emily · Last updated Jul 19, 2026
A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually.
The company often needs to query the logs to produce results about application sessions and user issues. The company does not want its new automatically scali...
To address the requirements of securely storing log files, avoiding data loss when instances are scaled in, and ensuring efficient log query capabilities, let's analyze each option based on security, cost, ease of implementation, and scalability.
Option A: Configure a cron job on the instances to forward the log files to Amazon S3 periodically.
- Pros:
- Durability: Storing logs in Amazon S3 ensures they are safe from instance termination or scaling in, as S3 is a persistent and highly durable storage solution.
- Cost-effective: S3 storage is generally inexpensive and offers low costs for storage, especially for log files which often don’t need frequent access.
- Simple to set up: A cron job can be set up quickly to periodically upload log files to S3, making this a straightforward solution.
- Cons:
- Manual management: You must manage the cron job on each instance, which could become cumbersome as the number of instances grows.
- Periodic uploads: If instances are terminated before the cron job runs, some logs might be lost unless you implement a more complex logging mechanism.
Option B: Configure AWS Glue and Amazon Athena to query the log files.
- Pros:
- Powerful querying: AWS Glue and Athena are excellent tools for querying large sets of log data stored in Amazon S3, making this a powerful solution for analyzing log data.
- Cons:
- Does not address log storage: This option assumes you already have the logs stored somewhere like Amazon S3, so it doesn't solve the log storage issue.
- More complex and costly: AWS Glue and Athena can be more expensive and complex to set up, making it less cost-effective for simple log storage.
Option C: Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs.
- Pros:
- Centralized management: CloudWatch Logs is a managed service that allows centralized log collection and storage, and ensures that logs are not lost even when instances are terminated or scaled in.
- Integration with other AWS services: CloudWatch integrates well with other AWS services, including CloudWatch Logs Insights for querying and monitoring.
- Automatic handling: Once configured, CloudWatch Logs automatically handles the forwarding of logs, with minim...
Author: Ahmed97 · Last updated Jul 19, 2026
A company uses an external identity provider to allow federation into different AWS accounts. A security engineer for the company needs to identify the federated user that terminated a production Amazon EC2 instance a ...
In this scenario, the goal is to quickly identify the federated user responsible for terminating a production EC2 instance a week ago. Let's break down each option and determine the fastest and most efficient way to accomplish this.
Option A: Review the AWS CloudTrail event history logs in an Amazon S3 bucket and look for the TerminateInstances event to identify the federated user from the role session name.
- Pros:
- Simple: This approach involves directly reviewing the CloudTrail event logs and locating the termination event.
- Direct: If the federated user’s role session name is included in the event, this can provide immediate identification.
- Cons:
- Requires manual filtering: You would need to manually sift through the logs, which may be time-consuming if the log data is large.
- Role session name ambiguity: The session name may not always clearly indicate the user’s identity, especially in complex federated setups with multiple roles.
Option B: Filter the AWS CloudTrail event history for the TerminateInstances event and identify the assumed IAM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username.
- Pros:
- Specific to federated users: By reviewing the `AssumeRoleWithSAML` event, you can directly identify the federated user who assumed the role.
- Accurate identification: This provides a clear link between the termination event and the federated user.
- Cons:
- Multiple steps: This approach requires finding both the `TerminateInstances` event and the corresponding `AssumeRoleWithSAML` event, which might take extra time to search and correlate.
- Complexity: If there are many federated users or SAML assertions, this could become more complicated and take longer than necessary.
Option C: Search the AWS CloudTrail logs for the TerminateInstances event and note the event time. Review the IAM Access Advisor tab for all federated roles. The last accessed time should match the time when the instance was terminated.
- Pros:
- Uses IAM Access Advisor: This provides a way to check when federated roles were last accessed, which can be helpful if you're looking for the activity timestamp.
- Cons:
- Not direct: The IAM Access Advisor tab is not...
Author: Aria · Last updated Jul 19, 2026
Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rul...
To troubleshoot the issue of two Amazon EC2 instances in different subnets not being able to communicate with each other, let's review the most relevant troubleshooting steps based on network behavior, security rules, and AWS service functionalities.
Option A: Check inbound and outbound security groups, looking for DENY rules.
- Why it's not the best choice:
- Security groups are stateful: Security groups do not have explicit "DENY" rules. If a security group is not permitting traffic, the absence of an appropriate "ALLOW" rule will result in the traffic being implicitly denied, not an explicit "DENY" rule.
- Limited scope: Since security groups are stateful and the communication between instances in different subnets should be allowed if the security groups have valid "ALLOW" rules, this step would likely not uncover the problem if the issue lies elsewhere in the network configuration.
Option B: Check inbound and outbound Network ACL rules, looking for DENY rules.
- Why this is a valid choice:
- Network ACLs are stateless: Unlike security groups, network ACLs are stateless, meaning they have both "ALLOW" and "DENY" rules. If there are restrictive ACL rules in place, traffic could be blocked at the subnet level even if the security group rules are correct.
- Subnet-specific traffic control: Network ACLs control traffic at the subnet level, so issues with ACLs could prevent communication between instances in different subnets.
- Effective troubleshooting step: Checking the Network ACLs would be a logical next step because they are designed to control inbound and outbound traffic at the subnet level, which might be causing the issue if configured incorrectly.
Option C: Review the rejected packet reason codes in the VPC Flow Logs.
- Why this is a valid choice:
- Flow logs provide detailed insights: VPC Flow Lo...
Author: Elijah · Last updated Jul 19, 2026
A company has an application that needs to get objects from an Amazon S3 bucket. The application runs on Amazon EC2 instances.
All the objects in the S3 bucket are encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The resources in the VPC do not have access to the internet and use a gateway VPC endpoint to access Amazon ...
Let's break down each option and reason through the scenario:
A) The IAM instance profile that is attached to the EC2 instances does not allow the s3:ListBucket action for the S3 bucket.
- Analysis: This action (`s3:ListBucket`) is required when listing objects inside a bucket, but it is not necessary for retrieving (getting) objects. The application may need permission for `s3:GetObject`, which allows access to the objects themselves. While missing `s3:ListBucket` could cause issues when listing contents, it won't prevent the application from getting objects from the bucket.
- Conclusion: This is not a primary reason for the issue, since `s3:ListBucket` is not directly related to accessing objects.
B) The IAM instance profile that is attached to the EC2 instances does not allow the s3:ListParts action for the S3 bucket.
- Analysis: The `s3:ListParts` action is related to managing multipart uploads (listing the parts of a multipart upload). This is not relevant to the scenario where the application is trying to get objects from the S3 bucket. It wouldn't impact the ability to retrieve a full object.
- Conclusion: This is not the cause of the issue.
C) The KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:ListKeys action to the EC2 instance profile ARN.
- Analysis: The `kms:ListKeys` action allows the listing of keys, but it's not necessary for the decryption of objects. What is required is the ability to perform the `kms:Decrypt` action on the KMS key used to encrypt the S3 objects. Missing `kms:ListKeys` would only affect the ability to list KMS keys and would not prevent decryption of the objects.
- Conclusion: This is...
Author: Andrew · Last updated Jul 19, 2026
A company runs workloads in the us-east-1 Region. The company has never deployed resources to other AWS Regions and does not have any multi-Region resources. The company needs to replicate its workloads and infrastructure to the us-west-1 Region.
A security engineer must implement a solution that uses AWS Secrets Manager to store secrets in both Regions. The solution must use AWS Key Management Service (AWS KMS) to encrypt the secrets. The solution must minimize latency and...
Let's break down each option and assess the best solution:
A) Encrypt the secrets in us-east-1 by using an AWS managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using a new AWS managed KMS key in us-west-1.
- Analysis: Using AWS managed KMS keys across Regions is not recommended. AWS-managed keys are region-specific, meaning that each region gets a separate key for encryption. This creates a problem if the company needs the secrets to be accessible in both regions with the same encryption configuration.
- Issue: Replicating the secrets and encrypting them with a new AWS-managed KMS key in the us-west-1 Region introduces complexity, as managing multiple KMS keys can lead to difficulties in compliance, especially if both regions need to access the same key for decryption. AWS-managed KMS keys also do not allow cross-region access, which is a limitation for this use case.
- Conclusion: This is not a suitable solution.
B) Encrypt the secrets in us-east-1 by using an AWS managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
- Analysis: While it is possible for resources in one region to access resources in another region using endpoints, this does not align with the requirement of minimizing latency. Calling the Secrets Manager endpoint in us-east-1 from us-west-1 will introduce cross-region latency, which goes against the requirement to minimize latency.
- Issue: This approach would work technically, but it doesn't meet the low-latency requirement, as it would require cross-region calls for every secret retrieval.
- Conclusion: This is not a suitable solution due to the latency concern.
C) Encrypt the secrets in us-east-1 by ...
Author: Leah · Last updated Jul 19, 2026
A company is using an AWS Key Management Service (AWS KMS) AWS owned key in its application to encrypt files in an AWS account. The company's security team wants the ability to change to new key material for new files whenever a potential key breach occurs. A security engineer must implement a solution that g...
Let's evaluate each option and determine the most appropriate solution for the company's requirements:
A) Create a new customer managed key. Add a key rotation schedule to the key. Invoke the key rotation schedule every time the security team requests a key change.
- Analysis: AWS KMS allows you to enable automatic key rotation for customer managed keys (CMKs), but this automatic rotation happens annually, not on-demand. You cannot manually invoke the key rotation schedule every time the security team wants a key change. Additionally, key rotation typically applies to the same key, not creating a new key each time.
- Issue: The requirement to manually trigger key changes is not met with this approach because automatic rotation occurs only once per year, not on-demand.
- Conclusion: This is not a suitable solution.
B) Create a new AWS managed key. Add a key rotation schedule to the key. Invoke the key rotation schedule every time the security team requests a key change.
- Analysis: AWS managed keys are pre-created by AWS and are not customer-controlled. AWS automatically rotates keys for its managed keys on a regular schedule (typically every three years), and the rotation cannot be manually triggered by the security team.
- Issue: You cannot control the rotation of AWS managed keys, and they do not allow for manual rotation or key changes on-demand. This is not a good fit for the company's requirement to change keys when a potential key breach occurs.
- Conclusion: This is not a suitable solution.
C) Create a key alias. Create a new customer managed key every time the security team requests a key change. Associate the alias with the new key.
- Analysis: This approach allows the security team to create a new custo...
Author: Noah Williams · Last updated Jul 19, 2026
A security engineer needs to set up an Amazon CloudFront distribution for an Amazon S3 bucket that hosts a static website. The security engineer must allow only specified IP addresses to access the website. The security engineer also must prevent ...
Let's analyze each option based on the requirements:
A) Generate an S3 bucket policy. Specify cloudfront.amazonaws.com as the principal. Use the aws:SourceIp condition key to allow access only if the request comes from the specified IP addresses.
- Analysis: This solution involves configuring an S3 bucket policy to allow CloudFront access and restricting access based on the source IP using the `aws:SourceIp` condition. This setup allows access to the S3 bucket only from CloudFront, and the IP addresses can be restricted via the `aws:SourceIp` condition. However, this approach doesn't directly prevent users from accessing the website using the S3 URLs, as the S3 bucket can still be accessed directly via its URL if no other measures are taken.
- Issue: This solution doesn't prevent direct access via S3 URLs, which is a key requirement.
- Conclusion: This is not the best solution, as it doesn't fully meet the "prevent direct access by using S3 URLs" requirement.
B) Create a CloudFront origin access control (OAC). Create the S3 bucket policy so that only the OAC has access. Create an AWS WAF web ACL, and add an IP set rule. Associate the web ACL with the CloudFront distribution.
- Analysis: This option uses CloudFront Origin Access Control (OAC), which ensures that only CloudFront can access the S3 bucket. By restricting S3 access to the OAC, direct access to the S3 URLs is prevented. The AWS WAF web ACL is used to apply IP address filtering, ensuring only specified IP addresses can access the content through CloudFront.
- Advantages: This solution addresses both requirements:
1. Prevents direct access to S3 URLs: The OAC ensures that only CloudFront can access the S3 bucket.
2. Restricts access by IP: The AWS WAF IP rule enforces access control based on IP address.
- Conclusion: This is a suitable solution because it effectively prevents direct...
Author: Ella · Last updated Jul 19, 2026
A company uses user data scripts that contain sensitive information to bootstrap Amazon EC2 instances. A security engineer discovers that this sensitive information is viewable by people who should not have access to it.
...
Let’s evaluate each option based on the goal of securely protecting sensitive information used to bootstrap EC2 instances:
A) Store the scripts in the AMI and encrypt the sensitive data using AWS KMS. Use the instance role profile to control access to the KMS keys needed to decrypt the data.
- Analysis: Storing the scripts in the AMI means that the sensitive data will be part of the instance's filesystem. While encrypting the sensitive data with AWS KMS and controlling access through IAM roles would help restrict access, it doesn't fully address the concern about keeping the sensitive data secure during instance bootstrapping. The sensitive data would still be exposed in the instance filesystem and possibly in logs or temp files during the bootstrapping process.
- Issue: This solution does not prevent sensitive information from being temporarily exposed during the bootstrapping process, and it might still be accessible to users or applications with access to the instance.
- Conclusion: This is not the most secure option because sensitive data might be exposed in logs or during instance setup.
B) Store the sensitive data in AWS Systems Manager Parameter Store using the encrypted string parameter and assign the GetParameters permission to the EC2 instance role.
- Analysis: AWS Systems Manager Parameter Store allows storing sensitive data such as passwords and keys in an encrypted form. The EC2 instance role can be granted permission to retrieve the parameter, ensuring that only the instance can access the sensitive data. By using the encrypted parameter store, the sensitive data is kept secure and does not reside directly on the instance.
- Advantages: Sensitive data is securely stored and can be accessed only by the instance with the correct IAM permissions. The data remains encrypted at rest, and access control is easily managed through IAM roles and policies.
- Conclusion: This is the most secure option, as it minimizes the exposure of sensitive data and keeps it encrypted. The use of Systems Manager also allows secure re...
Author: Zara1234 · Last updated Jul 19, 2026
A company has a VPC that has no internet access and has the private DNS hostnames option enabled. An Amazon Aurora database is running inside the VPC. A security engineer wants to use AWS Secrets Manager to automatically rotate the credentials for the Aurora database. The security engineer configures the Secrets Manager default AWS Lambda rotation function to run inside the same VPC that the Aurora database uses. However, the security engineer determines that the password cannot be rotated properly because t...
To enable the Lambda function inside the VPC to communicate with the Secrets Manager endpoint securely, we need to evaluate the options based on several key factors:
Key Factors:
1. Security: The solution should maintain the principle of least privilege and avoid unnecessary exposure to the public internet.
2. VPC Configuration: The VPC has no internet access, and private DNS hostnames are enabled.
3. Service Access: The Lambda function must be able to access AWS Secrets Manager, which resides outside the VPC, but the solution must be secure and private.
Option Analysis:
A) Add a NAT gateway to the VPC to allow access to the Secrets Manager endpoint:
- Pros: A NAT gateway allows instances in private subnets to reach the internet securely.
- Cons: The NAT gateway involves routing traffic through a public IP, which exposes outbound traffic to the internet. This solution goes against the goal of maintaining no internet access, as the NAT gateway requires internet traffic to route through a public subnet.
- Security: This option is not ideal because it introduces an indirect route to the internet, which is unnecessary and may expose sensitive traffic.
B) Add a gateway VPC endpoint to the VPC to allow access to the Secrets Manager endpoint:
- Pros: Gateway VPC endpoints are used to allow traffic to AWS services like S3 and DynamoDB within the VPC securely without requiring internet access. However, Secrets Manager is not currently supported by gateway VPC endpoints.
- Cons: Secrets Manager is not supported by gateway VPC end...
Author: Scarlett · Last updated Jul 19, 2026
A company has two AWS accounts: Account A and Account B. Each account has a VPC. An application that runs in the VPC in Account A needs to write to an Amazon S3 bucket in Account B. The application in Account A already has permission to write to the S3 bucket in Account B.
The application and the S3 bucket are i...
To meet the requirements of the application in Account A writing to an Amazon S3 bucket in Account B, we need to consider solutions that enable secure communication without sending network traffic over the public internet. The application has the necessary permission to write to the S3 bucket, so the key challenge is ensuring secure connectivity between the two accounts' VPCs without exposing data to the public internet.
Key Factors:
1. No internet traffic: The solution must avoid using the public internet for communication.
2. Inter-Account Communication: The solution must allow Account A to communicate with Account B's S3 bucket.
3. AWS-native solutions: The solution should leverage AWS-native tools to ensure security, scalability, and ease of management.
4. Same AWS Region: The application and the S3 bucket are located in the same AWS region.
Option Analysis:
A) In both accounts, create a transit gateway and VPC attachments in a subnet in each Availability Zone. Update the VPC route tables.
- Pros: Transit Gateway allows inter-VPC communication across multiple AWS accounts and regions. It is a powerful tool for connecting multiple VPCs in a hub-and-spoke architecture.
- Cons: This solution would be more complex than necessary for simple communication between a VPC in Account A and an S3 bucket in Account B. Additionally, transit gateways are more suitable for scenarios with multiple VPCs in multiple regions or larger-scale networking setups.
- Security: While secure, this option introduces unnecessary complexity and cost for the use case where only one VPC needs to interact with S3 in another account.
- When to use: This solution is typically used in complex environments with multiple VPCs and requires managing multiple network connections.
B) Deploy a software VPN appliance in Account A. Create a VPN connection between the software VPN appliance and a virtual private gateway in Account B.
- Pros: A VPN connection can securely connect the two VPCs over the internet.
- Cons: This option violates the requirement of avoiding internet traffic. A VPN connection typically uses public internet infrastructure, even if it is encrypted. This is not suitable for the scenario, as the company explicitly wants to avoid public internet access.
- Security: This is less ideal as it involves routing traffic over the internet, potentially creating a security concern.
- When to use: This option might be used in cases where internet access is required or when usin...
Author: Elijah · Last updated Jul 19, 2026
A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making connections to known malicious addresses.
The instance is in a development account within a VPC that is in the us-east-1 Region. The VPC contains an internet gateway and has a subnet in us-east-1a and us-east-1b. Each subnet is associate with a route table that uses the internet gateway as a default route. Each subnet also uses the default network ACL. The suspicious EC2 instance runs within...
Key Factors in the Situation:
1. Suspicious Activity: The instance is making connections to known malicious addresses.
2. Immediate Mitigation: The goal is to mitigate the attack immediately while enabling investigation.
3. Subnets and Network Configurations: The instance is in a VPC with an internet gateway and subnets, and security groups and network ACLs can be used to control traffic.
4. Investigation: The engineer needs to investigate the root cause while mitigating the threat.
Option Analysis:
A) Log in to the suspicious instance and use the netstat command to identify remote connections. Use the IP addresses from these remote connections to create deny rules in the security group of the instance. Install diagnostic tools on the instance for investigation. Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule during the investigation of the instance.
- Pros: This option suggests using the netstat command to identify malicious remote connections, which can be a useful tool for investigating traffic. Updating the network ACL to deny all outbound traffic is an effective immediate action to stop further malicious communications.
- Cons: Logging into the instance to identify remote connections may not be the fastest way to stop the attack. Additionally, this method doesn't ensure that the instance's communication is fully stopped (especially if the malicious activity is automated or uses multiple ports). Installing diagnostic tools on the instance could leave the instance exposed to further attacks.
- Security: The outbound ACL rule is a good measure to block further outbound connections but does not stop inbound or internal communications. It's reactive and could potentially leave the instance vulnerable if there are other attack vectors.
B) Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule. Replace the security group with a new security group that allows connections only from a diagnostics security group. Update the outbound network ACL for the us-east-1b subnet to remove the deny all rule. Launch a new EC2 instance that has diagnostic tools. Assign the new security group to the new EC2 instance. Use the new EC2 instance to investigate the suspicious instance.
- Pros: This option introduces a more thorough security approach by using outbound ACL rules and isolating the suspicious instance using a security group that allows only specific diagnostic connections. Creating a separate EC2 instance for investigation is a good practice to ensure the compromised instance does not affect the diagnostic process.
- Cons: The process of creating a new EC2 instance and reconfiguring network ACLs adds a...
Author: Zara1234 · Last updated Jul 19, 2026
An online media company has an application that customers use to watch events around the world. The application is hosted on a fleet of Amazon EC2 instances that run Amazon Linux 2. The company uses AWS Systems Manager to manage the EC2 instances. The company applies patches and application updates by using the AWS-AmazonLinux2DefaultPatchBaseline patching baseline in Systems Manager Patch Manager.
The company is concerned about potential attacks on the application during the week of an upcoming event. The company needs a solution that can immediately deploy patches ...
Key Factors in the Situation:
- Security Incident Response: The solution must allow for immediate patch deployment in response to a security incident or vulnerability.
- Centralized Evidence: The solution must provide centralized evidence that patches were successfully applied.
- Amazon EC2 Instances: The patches must be deployed on Amazon Linux 2 EC2 instances.
- AWS Systems Manager: The company is using Systems Manager to manage patching and needs a method to apply patches effectively.
Option Analysis:
A) Create a new patching baseline in Patch Manager. Specify Amazon Linux 2 as the product. Specify Security as the classification. Set the automatic approval for patches to 0 days. Ensure that the new patching baseline is the designated default for Amazon Linux 2.
- Pros: This solution allows the creation of a baseline with automatic approval of security patches. Setting the automatic approval to 0 days ensures patches are immediately approved and applied. This is critical for urgent security incidents.
- Cons: While this ensures patches are applied as soon as they are released, it does not address centralized evidence for the patches being applied or provide a manual intervention method in case of an issue.
- Security: This is a good solution for automatic patch deployment, but lacks the ability to verify successful patching centrally and may not offer control for auditing the success of the patch application process.
B) Use the Patch Now option with the scan and install operation in the Patch Manager console to apply patches against the baseline to all nodes. Specify an Amazon S3 bucket as the patching log storage option.
- Pros: The Patch Now option allows for immediate patch deployment. This option can apply patches to all EC2 instances immediately, which is suitable for an urgent response. Additionally, specifying an S3 bucket for log storage ensures centralized evidence of the patches that were applied.
- Cons: The patch deployment is immediate but still depends on the manual execution of the Patch Now option. It may not be fully automated in the context of future events unless paired with a scheduled or automatic solution.
- Security: This option meets the immediate patch deployment requirement and provides centralized logs, making it suitable for the situation.
C) Use the Clone function of Patch Manager to create a copy of the AWS-AmazonLinux2DefaultPatchBaseline built-in baseline. Set the automatic approval for patches to 1 day.
- Pros: Cloning the existing patch baseline can provide flexibility to adjust the approval time for patches. Setting it to 1 day would allow some time for review before patch approval, which is useful for non-urgent s...
Author: Manish · Last updated Jul 19, 2026
A developer operations team uses AWS Identity and Access Management (IAM) to manage user permissions. The team created an Amazon EC2 instance profile role that uses an AWS managed ReadOnlyAccess policy. When an application that is running on Amazon EC2 tries to read a file from an encrypted Amazon S3 bucket, the application receives an AccessDenied error.
The team administrator has verified that the S3 bucket p...
Key Factors:
1. IAM Role Permissions: The EC2 instance is using an IAM role with the ReadOnlyAccess AWS managed policy.
2. Encrypted S3 Bucket: The file in the S3 bucket is encrypted, so the application needs specific permissions to decrypt the file.
3. Access Denied Error: The application is encountering an AccessDenied error when trying to read the file, which suggests the role does not have sufficient permissions to decrypt the file in the S3 bucket.
Option Analysis:
A) Edit the ReadOnlyAccess policy to add kms:Decrypt actions
- Pros: This option suggests modifying the existing ReadOnlyAccess policy to include the `kms:Decrypt` action. This is a valid approach, as the error likely occurs because the role doesn't have the required permission to decrypt the file using the KMS key.
- Cons: The ReadOnlyAccess managed policy is predefined and managed by AWS. Editing AWS-managed policies is not recommended, as it could result in unexpected behavior or loss of manageability over time.
- Security: While adding the `kms:Decrypt` permission would resolve the issue, modifying a managed policy is not best practice. It is better to create a separate, more specific policy and attach it to the IAM role.
B) Add the EC2 IAM role as the authorized Principal to the S3 bucket policy
- Pros: This would allow the EC2 instance's IAM role to be explicitly granted permission to access the S3 bucket.
- Cons: The issue is likely related to the decryption permissions on the file, not the access to the bucket itself. Since the S3 bucket policy already allows access to everyone in the account, this step doesn't address the root cause of the issue. The problem is likely with the lack of decryption permissions, not the acc...
Author: Liam · Last updated Jul 19, 2026
A company uses AWS Organizations and has Amazon Elastic Kubernetes Service (Amazon EKS) clusters in many AWS accounts. A security engineer integrates Amazon EKS with AWS CloudTrail. The CloudTrail trails are stored in an Amazon S3 bucket in each account to monitor API calls. The security engineer observes that CloudTrail logs ar...
In this case, the security engineer wants to view Kubernetes pod creation events in Amazon CloudWatch. Let's evaluate each option in detail to determine the most appropriate solution:
A) Configure the EKS clusters to use private S3 VPC endpoints. Configure the S3 buckets for logging.
- Analysis: This option focuses on configuring VPC endpoints for S3, which is useful for managing S3 traffic within a private network. While this may improve the security and network configuration for accessing CloudTrail logs stored in S3, it doesn't directly address logging Kubernetes pod creation events or send those events to CloudWatch. Therefore, this is not the correct choice for monitoring pod creation events.
- Rejection Reason: It does not relate to viewing Kubernetes events or CloudWatch logging.
B) Enable Kubernetes API server component logs for each cluster.
- Analysis: This option is the most relevant. The API server component in an Amazon EKS cluster logs API activity, including Kubernetes pod creation events. Enabling these logs would ensure that events like pod creation, deletion, and other Kubernetes activities are captured. These logs can be sent to Amazon CloudWatch Logs, where they can be analyzed. This solution specifically targets the need to capture Kubernetes pod creation events and display them in CloudWatch.
- Rejection Reas...
Author: Lucas · Last updated Jul 19, 2026
A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off.
...
Let's evaluate each option for efficiently turning AWS CloudTrail back on if it gets turned off in multiple AWS regions:
A) Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.
- Analysis: AWS Config is a powerful tool that can monitor the configuration of AWS resources. There are managed rules available, like `cloudtrail-enabled`, that can detect if CloudTrail logging is disabled in any region. If CloudTrail is disabled, AWS Config can trigger a remediation action (such as enabling CloudTrail). This is an efficient, automated approach to ensure CloudTrail logging is re-enabled if it is turned off.
- Rejection Reason: None, this is a valid and highly efficient solution to ensure CloudTrail stays enabled.
B) Create an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging API.
- Analysis: This option would set up an EventBridge rule to listen for CloudTrail "StartLogging" events. However, "StartLogging" events typically occur when CloudTrail is being turned on, not when it's turned off. While it’s useful to monitor CloudTrail's state, this option doesn't directly address the need to react when CloudTrail is turned off. It also introduces additional complexity with EventBridge and Lambda, which may not be necessary for this requirement.
- Rejection Reason: Overcomplicated for the goal, ...
Author: FrozenWolf2022 · Last updated Jul 19, 2026
An ecommerce company is developing new architecture for an application release. The company needs to implement TLS for incoming traffic to the application. Traffic for the application will originate from the internet. TLS does not have to be implemented in an end-to-end configuration because the company is concerned about impacts on performance The...
Let's analyze each option and its suitability for meeting the requirements of implementing TLS while considering performance:
A) Create a public Application Load Balancer. Create two listeners: one listener on port 80 and one listener on port 443. Create one target group. Create a rule to forward traffic from port 80 to the listener on port 443. Provision a public TLS certificate in AWS Certificate Manager (ACM). Attach the certificate to the listener on port 443.
- Analysis: This option sets up a public Application Load Balancer (ALB), which is designed to handle HTTP and HTTPS traffic. It listens on ports 80 (HTTP) and 443 (HTTPS), with a rule forwarding HTTP traffic to HTTPS. A TLS certificate is attached to the HTTPS listener. This ensures TLS is only applied for HTTPS traffic while the HTTP traffic is redirected to HTTPS, thus meeting the requirement of implementing TLS without end-to-end encryption.
- Selected Option: This approach is efficient because it offloads the TLS termination to the ALB, which reduces the performance impact on the application and keeps the TLS configuration limited to the entry point (port 443).
B) Create a public Application Load Balancer. Create two listeners: one listener on port 80 and one listener on port 443. Create one target group. Create a rule to forward traffic from port 80 to the listener on port 443. Provision a public TLS certificate in AWS Certificate Manager (ACM). Attach the certificate to the listener on port 80.
- Analysis: This option would attempt to apply the TLS certificate to the listener on port 80 (HTTP). However, port 80 should not be used for TLS because it's typically associated with unencrypted HTTP traffic. TLS is expected to terminate on port 443 (HTTPS). Attaching the TLS certificate to port 80 would result in an improper configuration and would not meet the TLS encryption requirement for HTTPS traffic.
- Rejection Reason: Misconfiguration of TLS by applying the certificate to port 80 is incorrect because TLS should be used for encrypted traffic (port 443).
C) Create a public Network Load Balancer. Create two listeners: one listener on port 80 and one listener on port 443. Create one target...
Author: ElectricLionX · Last updated Jul 19, 2026
A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets.
The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users w...
Let's evaluate the options to determine the best solution for meeting the requirements of protecting critical data from being permanently deleted, replicating S3 objects across regions, and preventing users with administrator access from permanently deleting data in the secondary region.
A) Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
- Analysis: AWS Backup allows for creating backups of data stored in S3. By enabling AWS Backup Vault Lock in governance mode, you can prevent data from being deleted or altered for a set retention period. However, this option doesn't directly address the requirement of replicating S3 objects across regions in real-time or ensuring that the objects are protected from permanent deletion in the secondary region.
- Rejection Reason: While backup and Vault Lock provide protection, they don't provide an active replication solution for disaster recovery, and Vault Lock is more suited for long-term data retention and backup, not for real-time S3 replication.
B) Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
- Analysis: S3 Object Lock in compliance mode ensures that objects cannot be deleted or overwritten for the retention period, even by users with administrative permissions. By implementing this on the primary region's S3 bucket and configuring cross-Region replication, the objects are replicated to the secondary region, and S3 Object Lock in compliance mode would protect the replicated objects there as well. This solution would meet both requirements: replication and preventing permanent deletion.
- Selected Option: This is the best choice because it ensures that objects are replicated and are protected from deletion in both the primary and secondary regions, eve...
Author: Leah · Last updated Jul 19, 2026
A company in France uses Amazon Cognito with the Cognito Hosted UI as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application's users will come from France.
When the company launches the application, the company's security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France.
The security team needs a solution to perfor...
Let's analyze the steps and options that meet the requirement of performing custom validation at sign-up based on the geographic location of users, specifically targeting fraudulent sign-ups from outside France.
A) Create a pre-sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool.
- Analysis: The pre-sign-up AWS Lambda trigger allows you to run custom logic before a user is created in the Amazon Cognito user pool. This is the ideal place to perform geographic validation. You can retrieve the IP address of the user, determine their location (based on the IP), and decide whether to accept or deny the sign-up based on that location (in this case, users from outside France). This method gives you full control over the sign-up process, including the ability to enforce geographic restrictions.
- Selected: This option directly enables custom validation and allows you to accept or deny sign-ups based on location.
B) Use a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.
- Analysis: AWS WAF can be used to filter traffic based on geographic location. You could configure AWS WAF to block requests from countries outside France. However, this solution operates at the HTTP level, not the Cognito sign-up process. While AWS WAF can block malicious traffic, it doesn’t directly handle the sign-up logic within Amazon Cognito or provide custom validation during the sign-up phase itself.
- Rejection Reason: AWS WAF can prevent access to the hosted UI from outside France, but it doesn’t provide the ability to accept or deny sign-ups after users have reached the Cognito sign-up page. It doesn't integrate directly into the Cognito sign-up flow.
C) Configure an app client for the application's Amazon Cognito user pool. Use the app client ID to validate the requests in the hosted UI.
- Analysis: The app client ID is part of the configuration for identifying an application that uses Amazon Cognito for authentication. However, it doesn’t provide any functionality for custom validation during sign-up. The app client ID is just an identifier used to configure the app, and while it’s required for Cognito...
Author: Rohan · Last updated Jul 19, 2026
A security engineer is configuring AWS Config for an AWS account that uses a new IAM entity. When the security engineer tries to configure AWS Config rules and automatic remediation options, errors occur. In the AWS CloudTrail logs, the security engineer sees the following error message: 'Insufficient delivery policy to s3 bucket: DOC-EXAMPLE-BUCKET, unable t...
To address the issue described in the AWS CloudTrail logs, let's go through each option and analyze the factors involved.
A) Check the Amazon S3 bucket policy. Verify that the policy allows the config.amazonaws.com service to write to the target bucket.
- Reasoning: This option is relevant because AWS Config needs permissions to write logs to the S3 bucket. If the S3 bucket policy doesn't explicitly allow the `config.amazonaws.com` service to write, AWS Config will not be able to deliver logs to the bucket. This could explain the error in the CloudTrail logs regarding insufficient permissions.
- Conclusion: This is a valid step because it directly addresses the need for proper access from AWS Config to the target S3 bucket.
B) Verify that the IAM entity has the permissions necessary to perform the s3:GetBucketAcl and s3:PutObject operations to write to the target bucket.
- Reasoning: This option is important because AWS Config needs permissions to interact with the S3 bucket. The IAM entity performing AWS Config setup must have permissions to interact with the S3 bucket, such as checking the ACL (`s3:GetBucketAcl`) and writing objects (`s3:PutObject`). If these permissions are missing, AWS Config cannot write to the bucket.
- Conclusion: This is a valid step because it addresses IAM permissions, ensuring that the IAM entity can write to the S3 bucket, which is essential for AWS Config functionality.
C) Verify that the Amazon S3 bucket policy has the permissions necessary to perform the s3:GetBucketAcl and s3:PutObject operations to write to the target bucket.
- Reasoning: While this option is similar to A, it specifies more granular permissions (GetBucketAcl and PutObject) for the S3 bucket. This step ensures that the S3 bucket itself allows these actions, which are required for AWS Config to deliver logs.
- Conclusion: ...
Author: Sophia Clark · Last updated Jul 19, 2026
A company is undergoing a layer 3 and layer 4 DDoS attack on its web servers running on AWS.
Which combination of AWS services and featur...
In this scenario, the company is undergoing a Layer 3 and Layer 4 DDoS attack on its web servers. To address this, you would need services that can provide protection specifically against network and transport layer attacks, as well as mitigate large-scale DDoS threats. Let's evaluate each of the options:
A) Amazon Route 53
- Reasoning: Amazon Route 53 is a scalable DNS service. While it helps with DNS resolution and routing, it is not specifically designed to protect against DDoS attacks at the Layer 3 or Layer 4 level. However, it can help with high availability and failover strategies, but it does not directly mitigate DDoS attacks.
- Conclusion: This option is not directly relevant to mitigating DDoS attacks at Layers 3 and 4, though it can be part of a broader strategy by providing reliable DNS.
B) AWS Certificate Manager (ACM)
- Reasoning: AWS Certificate Manager (ACM) is used to manage SSL/TLS certificates, which help secure HTTPS traffic. While important for data encryption and securing traffic, it does not provide direct protection against DDoS attacks at Layer 3 or Layer 4.
- Conclusion: ACM does not address the DDoS attack scenario at the required layers and is not applicable for mitigation.
C) Amazon S3
- Reasoning: Amazon S3 is a scalable storage service, typically used for static content storage. It doesn't offer specific features for mitigating DDoS attacks, especially Layer 3 and Layer 4 attacks.
- Conclusion: This option is not relevant to protecting against DDoS attacks on web servers.
D) AWS Shield
- Reasoning: AWS Shield is a managed DDoS protection service that protects against both Layer 3 and Layer 4 attacks. AWS Shield provides automatic detection and mitigation of DDoS attacks.
- AWS Shield Standard is automatically available to all AWS customers and offers protection against most ...
Author: RadiantPhoenixX · Last updated Jul 19, 2026
A company wants to implement host-based security for Amazon EC2 instances and containers in Amazon Elastic Container Registry (Amazon ECR). The company has deployed AWS Systems Manager Agent (SSM Agent) on the EC2 instances. All the company's AWS accounts are in one organization in AWS Organizations. The company will analyze the workloads for software vulnerabilities and unintended network exposure. The company will push any findings to AWS Security Hub, which the company has configured for the organization....
To meet the company's requirements of automatically scanning EC2 instances and ECR containers for software vulnerabilities and unintended network exposure, pushing findings to AWS Security Hub, and deploying the solution across all AWS accounts in the organization (including new accounts), we need to carefully consider each option.
A) Use SCPs to configure scanning of EC2 instances and ECR containers for all accounts in the organization.
- Reasoning: Service Control Policies (SCPs) in AWS Organizations are used to control the permissions that accounts have, including what actions are allowed or denied. However, SCPs do not directly enable or configure scanning of EC2 instances or ECR containers for security purposes. SCPs are useful for setting permission boundaries but are not the right tool for implementing automatic scanning or vulnerability analysis.
- Conclusion: This option is not appropriate for configuring vulnerability scanning, as SCPs cannot perform the necessary security scanning functions.
B) Configure a delegated administrator for Amazon GuardDuty for the organization. Create an Amazon EventBridge rule to initiate analysis of ECR containers.
- Reasoning: Amazon GuardDuty is a service for detecting suspicious activity, but it does not perform vulnerability scanning of EC2 instances or ECR containers. GuardDuty focuses on threat detection (e.g., monitoring for compromised instances, unusual API calls), not vulnerability management. Additionally, Amazon EventBridge is used for event-driven workflows, but it would not be sufficient to initiate comprehensive scanning of EC2 instances or ECR containers for software vulnerabilities.
- Conclusion: While GuardDuty is important for threat detection, this option does not meet the requirement for scanning EC2 instances and ECR containers for vulnerabilities, so it is not the right solution.
C) Configure a delegated administrator for Amazon Inspector fo...
Author: Carlos Garcia · Last updated Jul 19, 2026
A company uses AWS Organizations to manage several AWS accounts. The company processes a large volume of sensitive data. The company uses a serverless approach to microservices. The company stores all the data in either Amazon S3 or Amazon DynamoDB. The company reads the data by using either AWS Lambda functions or container-based services that the company hosts on Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate.
The company must implement a solution to encrypt all t...
To meet the company's requirements of encrypting all data at rest and enforcing least privilege data access controls, let’s go through each of the options and analyze them carefully.
A) Create a key policy that allows the kms:Decrypt action only for Amazon S3 and DynamoDB. Create an SCP that denies the creation of S3 buckets and DynamoDB tables that are not encrypted with the key.
- Reasoning: This option focuses only on Amazon S3 and DynamoDB, which are the data storage services. However, it does not address Lambda or EKS, which are also part of the company’s architecture. The key policy restricts decryption to only S3 and DynamoDB, but it should also consider Lambda and EKS to ensure data access is controlled across the entire environment. The option includes creating an SCP to enforce encryption, which is useful but doesn't account for all services involved (like Lambda or EKS).
- Conclusion: This is not comprehensive because it does not include Lambda and EKS in the key policy and doesn’t provide a solution for those services.
B) Create an IAM policy that denies the kms:Decrypt action for the key. Create a Lambda function that runs on a schedule to attach the policy to any new roles. Create an AWS Config rule to send alerts for resources that are not encrypted with the key.
- Reasoning: This option involves creating an IAM policy to deny the `kms:Decrypt` action and a Lambda function to attach the policy to new roles. However, this approach is not ideal because:
- It introduces unnecessary complexity with a Lambda function running on a schedule to apply the policy.
- It doesn’t directly enforce encryption on S3, DynamoDB, Lambda, or EKS resources. It only creates alerts through AWS Config, which is not sufficient for actively enforcing encryption.
- The IAM policy also does not directly control the permissions for the KMS key.
- Conclusion: While this option involves some useful components (like AWS Config alerts), it is inefficient for enforcing encryption and least privil...
Author: Sofia · Last updated Jul 19, 2026
An AWS Lambda function was misused to alter data, and a security engineer must identify who invoked the function and what output was produced. The engineer cannot find any logs created by the Lambda function in...
To determine why there are no logs in Amazon CloudWatch Logs for a Lambda function, let's analyze each option in detail:
A) The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.
- Reasoning: When a Lambda function is executed, it needs permission to write logs to CloudWatch Logs. This permission is granted through the Lambda function's execution role, specifically the `logs:CreateLogStream` and `logs:PutLogEvents` permissions. If the Lambda function’s execution role does not have these permissions, logs will not be written to CloudWatch Logs.
- Conclusion: This is a valid and highly likely explanation. Without proper permissions to write logs, CloudWatch Logs will not receive any data from the Lambda function. This is a common misconfiguration.
B) The Lambda function was invoked by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs.
- Reasoning: While Amazon API Gateway can invoke Lambda functions, it does not prevent Lambda functions from logging data to CloudWatch Logs. In fact, API Gateway typically does store logs in CloudWatch for requests and responses, but this does not impact the Lambda function’s ability to log to CloudWatch Logs. Lambda logging to CloudWatch Logs is independent of API Gateway logs.
- Conclusion: This is not correct. The invocation source (API Gateway or otherwise) does not stop logs from being created in CloudWa...
Author: Kai99 · Last updated Jul 19, 2026
A company is worried about potential DDoS attacks. The company has a web application that runs on Amazon EC2 instances. The application uses Amazon S3 to serve static content such as images and videos.
A security engineer must create a resilient archi...
To determine the most cost-effective solution for protecting against DDoS attacks while considering the existing infrastructure (EC2, S3, etc.), we should weigh factors such as scalability, ease of implementation, resilience, and cost.
Option A: Create an Amazon CloudWatch alarm that invokes an AWS Lambda function when an EC2 instance’s CPU utilization reaches 90% and updates security groups to deny inbound ports 80 and 443.
- Reason for rejection: This solution doesn't directly address DDoS attacks in a scalable manner. While CloudWatch alarms could trigger Lambda functions, updating security groups based on CPU utilization would be ineffective for large-scale DDoS attacks. DDoS attacks often involve a large number of requests, not necessarily high CPU usage. The solution lacks proactive defense mechanisms against DDoS and might cause issues with service availability.
Option B: Put EC2 instances into an Auto Scaling group behind an Elastic Load Balancer (ELB) and use Amazon CloudFront with Amazon S3 as an origin.
- Reason for consideration: This solution is highly scalable and offers a resilient architecture. Elastic Load Balancing automatically distributes incoming traffic across multiple EC2 instances, and Auto Scaling can quickly add more instances in response to traffic spikes, including potential DDoS attacks. Additionally, using Amazon CloudFront as a CDN to cache static content from S3 helps reduce the load on EC2 instances, as CloudFront can absorb much of the traffic, including requests for static content (images, videos). CloudFront and ELB can also mitigate some DDoS threats by leveraging AWS's native protections and infrastructure.
Key advantages:
- Scalability: Auto Scaling ensures the system can handle increased traffic automatically.
- Cost-effective: CloudFront reduces the load on EC2 instances, improving overall cost-effectiveness.
- Improved availability: ELB improves the fault tolerance and ...
Author: Nia · Last updated Jul 19, 2026
A company uses an organization in AWS Organizations to manage hundreds of AWS accounts. Some of the accounts provide access to external AWS principals through cross-account IAM roles and Amazon S3 bucket policies.
The company needs to identify...
To determine which external AWS principals have access to which accounts through IAM roles and Amazon S3 bucket policies, the solution should focus on identifying permissions and access across accounts efficiently. Here’s an analysis of the provided options:
Option A: Enable AWS Identity and Access Management (IAM) Access Analyzer for the organization. Configure the organization as a zone of trust. Filter findings by AWS account ID.
- Selected option: This is the best solution for the use case. IAM Access Analyzer helps you identify which external principals (AWS accounts, IAM users, federated users, etc.) have access to your resources, such as S3 buckets and IAM roles. By configuring the organization as a zone of trust, it analyzes cross-account access from external principals across all accounts in the AWS Organization. You can filter the findings by account ID to see which external entities have access to specific resources in each account. This solution is tailored to track cross-account access permissions and effectively provides visibility into external access.
Option B: Create a custom AWS Config rule to monitor IAM roles in each account. Deploy an AWS Config aggregator to a central account. Filter findings by AWS account ID.
- Reason for rejection: AWS Config can track configuration changes and resources like IAM roles, but it does not directly track cross-account access granted to external principals. This would be more useful for monitoring changes to IAM role configurations rather than identifying which external entities have access to specific accounts. While AWS Config with an aggregator can give insight into configurations, it doesn't provide the level of access visibility needed here for cross-account IAM...
Author: Matthew · Last updated Jul 19, 2026
A company has AWS accounts in an organization in AWS Organizations. The company needs to install a corporate software package on all Amazon EC2 instances for all the accounts in the organization.
A central account provides base AMIs for the EC2 instances. The company uses AWS Systems Manager for software inventory and patching operations.
A security engineer must implement a solution that detects EC2 instanc...
To meet the requirement of detecting and automatically installing the required software on EC2 instances across multiple accounts, we must focus on a solution that is centralized, scalable, and capable of detecting missing software and performing installation actions without manual intervention.
Option A: Provide new AMIs that have the required software pre-installed. Apply a tag to the AMIs to indicate that the AMIs have the required software. Configure an SCP that allows new EC2 instances to be launched only if the instances have the tagged AMIs. Tag all existing EC2 instances.
- Reason for rejection: This solution involves creating new AMIs with the required software and enforcing usage through tags and Service Control Policies (SCPs). While this approach can ensure that new instances are properly configured, it doesn't address the current EC2 instances that might be missing the software. Additionally, managing tags for existing EC2 instances could be complex and error-prone, especially if instances are frequently spun up or terminated. This method doesn't scale well for ongoing software management.
Option B: Configure a custom patch baseline in Systems Manager Patch Manager. Add the package name for the required software to the approved packages list. Associate the new patch baseline with all EC2 instances. Set up a maintenance window for software deployment.
- Reason for rejection: Systems Manager Patch Manager is designed to manage OS-level patches, not specific third-party software packages. It focuses on patching OS-level vulnerabilities rather than managing software installations like corporate packages. While you could use it to deploy security updates or patches for the OS, it isn't the right tool for installing custom software that isn't part of the OS's patching process.
Option C: Centrally enable AWS Config. Set up the `ec2-managedinstance-applications-required` AWS Config rule for all accounts. Create an Amazon EventBridge rule that reacts to AWS Config events. Configure the EventBridge rule to invoke an AWS Lambda function that uses Systems Mana...
Author: Henry · Last updated Jul 19, 2026
A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and download the toolset's code.
The company discovers that the code contains an IAM access key and secret key that provide access to internal resources in the company's AWS environment
A security engineer must implement a solution to identify whether unauthorized ...
To meet the requirements of identifying whether unauthorized usage of exposed credentials has occurred and preventing further usage, the solution needs to effectively detect any past usage and disable the credentials to prevent further risk.
Explanation of Selected Options:
Option B: Deactivate the exposed IAM access key from the user's IAM account.
- Selected option: This is essential to prevent any further unauthorized usage of the exposed credentials. Deactivating the IAM access key ensures that the key can no longer be used to access AWS resources, preventing further potential security breaches.
Why it’s selected: This step is a fundamental action for stopping the exposed credentials from being used to access internal resources, directly addressing the requirement to prevent additional usage.
Option E: Generate an IAM credential report. Check the report to determine when the user that owns the access key last logged in.
- Selected option: This is a useful step to determine whether the credentials have been used. The IAM credential report provides details about all IAM users' credentials, including the status of access keys and the last time they were used. By examining this report, the security engineer can identify if the exposed access key was used before being deactivated and assess the risk level of the exposure.
Why it’s selected: It helps to identify unauthorized usage of the credentials by showing when they were last used. This will allow the security engineer to understand the scope of the potential compromise.
Explanation of Rejected Options:
Option A: Use AWS Identity and Access Management Access Analyzer to determine which resources the exposed credentials accessed and who used them.
- Re...
