Amazon Practice Questions, Discussions & Exam Topics by our Authors
A security engineer for a large company is managing a data processing application used by 1,500 subsidiary companies. The parent and subsidiary companies all use AWS. The application uses TCP port 443 and runs on Amazon C2 behind a Network Load Balancer (NLB). For compliance reasons, the application should only be accessible to the subsidiaries and should not be available on the public internet. To meet the compliance requirements for restricted access, t...
In this scenario, the security engineer needs to implement access restrictions that ensure the application is accessible only to the 1,500 subsidiary companies and is not exposed to the public internet. The solution should focus on leveraging AWS security mechanisms to control network access efficiently.
Let’s evaluate each option:
A) Create a NACL to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the NACL to both the NLB and EC2 instances.
Explanation:
Network ACLs (NACLs) can control traffic at the subnet level, so they can be used to restrict access to the EC2 instances and the Network Load Balancer (NLB). However, NACLs are stateless, meaning that responses to incoming requests must be explicitly allowed as well. Managing 1,500 CIDR block ranges for the subsidiaries would become challenging and error-prone because each NACL entry needs to be carefully defined for both incoming and outgoing traffic. Additionally, NACLs are applied at the subnet level, not to individual EC2 instances or the NLB, which may result in more granular access management issues.
Reason for rejection: Using NACLs introduces potential complexity and operational overhead in managing the many CIDR blocks and stateless traffic rules. It would be harder to maintain and more error-prone compared to other solutions like security groups.
Suitable Scenario: NACLs might be useful for simple, broad access control at the subnet level, but in this case, more precise and flexible access control is needed.
---
B) Create an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the security group to the NLB. Create a second security group for EC2 instances with access on TCP port 443 from the NLB security group.
Explanation:
This option uses security groups, which are stateful and allow more granular control over inbound and outbound traffic compared to NACLs. The idea is to associate the first security group with the NLB, allowing traffic only from the specified 1,500 subsidiary CIDR ranges. The second security group would be associated with the EC2 instances behind the NLB, ensuring that only traffic from the NLB can reach the EC2 instances on port 443. This approach is effective, as security groups can handle both the NLB and EC2 instance access control in a more manageable way than NACLs.
Reason for selection: This solution offers a scalable, stateful access control mechanism and allows precise control over the flow of traffic. Security groups are easy to manage, and using two groups (one for the NLB and one for EC2 instances) ensures that the right traffic is allowed at both layers. It's simple, easy to maintain, and scalable.
Suitable Scenario: This is the optimal approach for controlling access to both the load balancer and EC2 instances with minimal overhead and maximum flexibility.
---
C) Create an AWS PrivateLink endpoint service in the parent company account attached to the NLB. Create an AWS security group for the instances to allow access on TCP port 443 from the AWS Privat...
Author: Suresh · Last updated Jul 19, 2026
A company runs workloads on Amazon EC2 instances. The company needs to continually scan the EC2 instances for software vulnerabilities and unintended ...
In order to meet the company's requirements to continually scan EC2 instances for software vulnerabilities and unintended network exposure, let's evaluate each option based on its functionality and suitability:
Option A: Use Amazon Inspector. Set the scan mode to hybrid scanning.
- Amazon Inspector is a security assessment service that helps identify vulnerabilities in EC2 instances and applications. It scans EC2 instances for software vulnerabilities, and the "hybrid scanning" mode enables scanning of both the EC2 instances and the network infrastructure associated with them. This mode combines both host-level vulnerability scanning and network-level security assessments, making it a strong candidate for identifying software vulnerabilities and unintended network exposure.
- Why it's selected: It specifically addresses the need to scan EC2 instances for software vulnerabilities and unintended network exposure, as it includes both host and network scanning.
- Key consideration: Hybrid scanning is comprehensive for the use case of vulnerability scanning, covering both software issues and network security.
Option B: Use Amazon GuardDuty. Enable the Malware Protection feature.
- Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and anomalous behavior in an AWS environment. Enabling the Malware Protection feature adds malware detection capabilities to GuardDuty, but GuardDuty primarily focuses on detecting network anomalies, suspicious behavior, and security threats rather than performing detailed vulnerability scanning on EC2 instances.
- Why it's rejected: While it is valuable for detecting suspicious activity, GuardDuty does not specifically scan EC2 instances for software vulnerabilities or unintended network exposure in the way that Amazon Inspector does. GuardDuty focuses on security monitoring and threat detection rather than vulnerability sc...
Author: Carlos Garcia · Last updated Jul 19, 2026
A company has a requirement that no Amazon EC2 security group can allow SSH access from the CIDR block 0.0.0.0/0. The company wants to monitor compliance with this requirement at all times and wants to receive a near-real-time notification if any security group is noncompliant.
A security engineer has configured AWS Config and w...
To meet the company's requirements of continuously monitoring the compliance of security groups with the SSH access policy and sending near-real-time notifications if any security group is noncompliant, the solution needs to efficiently track compliance changes in AWS Config and notify the team immediately when an issue arises.
Let's evaluate each option based on the requirements:
Option A: Configure AWS Config to send its configuration snapshots to an Amazon S3 bucket. Create an AWS Lambda function to run on a PutEvent to the S3 bucket. Configure the Lambda function to parse the snapshot for a compliance change to the restricted-ssh managed rule. Configure the Lambda function to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if a change is discovered.
- Explanation: This option suggests using AWS Config to send snapshots to an S3 bucket and then using Lambda to process the snapshots for compliance changes. While this approach works, it introduces unnecessary complexity and delay. It involves manual parsing of snapshots, which isn't an efficient or real-time method. The Lambda function would need to be triggered by PutEvents, requiring extra steps and potentially slower processing, making it less ideal for near-real-time monitoring.
- Why it's rejected: This option is more complex and introduces a delay due to the snapshot process. It also requires manual Lambda handling and parsing, which isn't optimal for real-time compliance monitoring.
Option B: Configure an Amazon EventBridge event rule that is invoked by a compliance change event from AWS Config for the restricted-ssh managed rule. Configure the event rule to target an Amazon Simple Notification Service (Amazon SNS) topic that will provide a notification.
- Explanation: This is the most efficient option. AWS Config can generate a compliance change event when the restricted-ssh managed rule detects a change in compliance. This event can trigger an EventBridge rule, which immediately sends notifications via SNS. This approach is designed to be near real-time and doesn't involve complex processes or delays.
- Why it's selected: This option leverages native AWS integration to detect and respond to compliance changes in real-time. EventBridge allows for quick event handling and triggers notifi...
Author: IceDragon2023 · Last updated Jul 19, 2026
A security engineer discovers that a company's user passwords have no required minimum length. The company is using the following two identity providers (IdPs):
* AWS Identity and Access Management (IAM) federated with on-premises Active Directory
* Amazon Cognito user pools that contain the user database for an AWS Cloud application that the comp...
To implement a required minimum password length across both AWS Identity and Access Management (IAM) and Amazon Cognito user pools, we need to consider the settings and mechanisms available for each identity provider (IdP) involved.
Option A: Update the password length policy in the IAM configuration.
- Explanation: AWS IAM allows you to configure certain password policies directly within IAM. You can define password length, complexity requirements, and expiration settings for IAM users.
- Why it's selected: This option directly addresses the requirement for IAM users, where you can set a password length policy through the IAM management console or using AWS CLI commands.
- Key consideration: This option is specifically for IAM users and does not apply to Cognito, which requires a different configuration.
Option B: Update the password length policy in the Cognito configuration.
- Explanation: Amazon Cognito user pools allow you to configure password policies for users in your custom applications. You can define minimum length, complexity, and other requirements for user passwords.
- Why it's selected: This option applies directly to Cognito users, ensuring that the password policy in your application aligns with the required minimum length.
- Key consideration: This addresses the password policy for Cognito, but does not impact IAM or the on-premises Active Directory users.
Option C: Update the password length policy in the on-premises Active Directory configuration.
- Explanation: If users are federated from an on-premises Active Directory to AWS IAM, you can configure password policies within Active Directory to enforce a minimum password length.
- Why it's selected: This option ensures that the password policy for Active Directory users, who may be federated with AWS IAM, enforc...
Author: Ethan Smith · Last updated Jul 19, 2026
A company uses AWS Key Management Service (AWS KMS). During an attempt to attach an encrypted Amazon Elastic Block Store (Amazon EBS) volume to an Amazon EC2 instance, the attachment fails. The company discovers that a customer managed key has become unusable because the key material for the key was deleted. The company needs the data that is on the EBS volume.
A security engineer must recomme...
When dealing with the situation where a customer-managed key (CMK) has become unusable due to the deletion of the key material in AWS KMS, the goal is to decrypt the data on the Amazon Elastic Block Store (EBS) volume and successfully attach it to the EC2 instance. Let’s evaluate the options based on the given requirements:
Option A: Import new key material into the key. Attach the EBS volume.
- Explanation: AWS KMS allows you to import new key material into a CMK, but the key must already exist and be enabled. If the key material is deleted, the CMK itself is rendered unusable, meaning it cannot decrypt or encrypt data, even if you later import new key material. Importing new key material will make the CMK usable again, but it will not recover the ability to decrypt data that was encrypted with the original key material.
- Why it’s rejected: Importing new key material doesn’t solve the problem of decrypting data that was encrypted with the deleted key material. Once the key material is deleted, it is impossible to recover the encrypted data with that key, even if the key is re-enabled.
Option B: Restore the EBS volume from a snapshot that was taken before the deletion of the key material.
- Explanation: If an EBS snapshot was taken before the key material was deleted, the snapshot would be encrypted with the key material that was present at the time. As long as the CMK is still available and usable (i.e., the key material is intact), you can restore the volume from the snapshot and attach it to an EC2 instance.
- Why it’s selected: This option allows the restoration of the EBS...
Author: David · Last updated Jul 19, 2026
A company needs to analyze access logs for an Application Load Balancer (ALB). The ALB directs traffic to the company's online login portal. The company needs to use visualizations to identify login attempts...
To meet the company's requirements of analyzing access logs for an Application Load Balancer (ALB) and visualizing login attempts by bots from a list of known IP sources, let's evaluate each option and determine the best approach.
Option A: Configure the ALB to send logs directly to Amazon CloudWatch Logs. Analyze and visualize the logs by using CloudWatch Logs Insights.
- Explanation: CloudWatch Logs Insights allows you to analyze logs stored in CloudWatch Logs using a query language. While CloudWatch is good for real-time log analysis and searching, it is typically not as powerful as some other services for creating detailed, interactive visualizations.
- Why it's rejected: While CloudWatch Logs Insights can be used for analyzing the logs, it doesn’t provide rich visualization options like specialized dashboard tools (e.g., OpenSearch or QuickSight). Visualizations in CloudWatch are more basic compared to other options like OpenSearch or QuickSight, which provide more intuitive and interactive visual analytics.
- Key consideration: For complex visualizations and in-depth analysis, CloudWatch may not be the best fit.
Option B: Configure the ALB to send logs directly to Amazon Redshift. Analyze the logs by using SQL queries. Visualize the logs by using custom reports.
- Explanation: Amazon Redshift is a fully managed data warehouse service that excels at running complex SQL queries on large datasets. While it's possible to analyze logs by storing them in Redshift, it would require setting up an ETL (extract, transform, load) process to import the logs into Redshift and then running SQL queries to analyze them.
- Why it's rejected: This solution is overkill for log analysis as Redshift is typically used for large-scale data warehousing and more structured, analytical workloads. It would also require additional configuration for importing logs and managing data storage. Visualizations via custom reports would also require integrating Redshift with a separate visualization tool, which introduces complexity.
- Key consideration: This solution is more complex and involves more manual configuration than necessary for analyzing ALB logs.
Option C: Configure the ALB to send logs directly to Amazon OpenSearch Service. Analyze the logs by using OpenSearch dashboards. Visualize the logs by using custom OpenSearch dashboards.
- Explanati...
Author: Vivaan · Last updated Jul 19, 2026
A company runs a cron job on an Amazon EC2 instance on a predefined schedule. The cron job calls a bash script that encrypts a 2 KB file. A security engineer creates an AWS Key Management Service (AWS KMS) customer managed key with a key policy. The key policy and the EC2 insta...
Let's break down each option:
A) Use the `aws kms encrypt` command to encrypt the file by using the existing KMS key.
- Reasoning: The `aws kms encrypt` command encrypts the data directly with the KMS key. The data is encrypted using the key, and the result is the ciphertext.
- Rejection: While this approach is straightforward and does work, it's not ideal for encrypting larger files (this case is 2 KB, which isn't large, but still). The encrypted data would be returned by KMS, but it would need to be handled and written to a file in the script manually, which could introduce complexities in error handling, managing large files, and performance optimization.
B) Use the `aws kms create-grant` command to generate a grant for the existing KMS key.
- Reasoning: The `aws kms create-grant` command is used to create grants for controlling access to the KMS key. A grant is a way to delegate the ability to perform certain operations (like encryption) to a principal (e.g., an IAM role or a user).
- Rejection: This option doesn't directly solve the problem of file encryption. It's about managing permissions rather than performing encryption itself. The script does not need to create grants unless it's dealing with custom permissions that need to be granted on the KMS key. The necessary permissions for the EC2 instance role to encrypt with the key should already be set through the key policy or IAM policy.
C) Use the `aws kms encrypt` command to generate a data key. Use the plaintext data key to encrypt the file.
- Reasoning: The `aws kms encrypt` command is not typically used to generate a data key for encryption. It encrypts the data itself. T...
Author: ShadowWolf101 · Last updated Jul 19, 2026
A security engineer needs to analyze Apache web server access logs that are stored in an Amazon S3 bucket. Amazon EC2 instance web servers generated the logs. The EC2 instances have the Amazon CloudWatch agent installed and configured to report their access logs.
The security engineer needs to use a query in Amazon Athena to analyze the logs. The query must identify IP addresses that have attempted and failed to access r...
Let's break down each option to identify the correct query based on the given requirements:
Requirements:
- Logs: Stored in Amazon S3 bucket, generated by EC2 instances with CloudWatch agent installed.
- Goal: Analyze Apache web server access logs using Athena.
- Key Conditions:
- Identify IP addresses that attempted and failed to access restricted content at the `/admin` URL path.
- Failed attempts: Identified by the server status code, which typically indicates errors (e.g., `403` or `401`).
- Also, identify URLs that the IP addresses attempted to access.
Query Analysis:
A) `SELECT client_ip, client_request FROM logs WHERE client_request LIKE '%/admin%' AND server_status = '403'`
- Reasoning:
- client_ip: Extracts the IP address.
- client_request: Extracts the attempted URL.
- WHERE client_request LIKE '%/admin%': Filters for logs where the requested URL contains `/admin`.
- AND server_status = '403': Filters for failed access attempts (403 Forbidden errors, indicating restricted access).
- Why Selected: This query properly meets the requirement to find IP addresses attempting to access restricted content (i.e., URLs containing `/admin`) and identifies the failure status (`403`).
B) `SELECT client_ip FROM logs WHERE client_request CONTAINS '%/admin%' AND server_status = '401' GROUP BY client_ip`
- Reasoning:
- client_ip: Extracts the IP address.
- WHERE client_request CONTAINS '%/admin%': Filters logs where the URL contains `/admin` (Note: `CONTAINS` is not valid in SQL syntax; it should be `LIKE`).
- AND server_status = '401': Filters for failed access attempts (401 Unauthorized, which can also indicate restricted access).
- GROUP BY client_ip: Groups by IP address.
- Rejection: The use of `CONTAINS` is incorrect in SQL syntax for Athena. `LIKE` should be used instead. Als...
Author: StarryEagle42 · Last updated Jul 19, 2026
A company uses Amazon Cognito as an OAuth 2.0 identity platform for its web and mobile applications. The company needs to capture successful and unsuccessful login attempts. The company also needs to q...
Let's go through the options and analyze each one based on the requirements: capturing successful and unsuccessful login attempts and the ability to query the data.
Key Requirements:
- The company needs to capture both successful and unsuccessful login attempts.
- The company also needs to query the data about these login attempts.
Option Analysis:
A) Configure Cognito to send logs of user activity to Amazon CloudWatch. Configure Amazon EventBridge to invoke an AWS Lambda function to export the logs to an Amazon S3 bucket. Use Amazon Athena to query the logs for event names of SignUp with event sources of cognito-idp.amazonaws.com.
- Reasoning:
- CloudWatch Logs: The option starts by sending logs to CloudWatch. This is useful for capturing events.
- EventBridge and Lambda: EventBridge can forward events to Lambda, which then exports logs to S3. This can be useful for archiving logs, but it adds complexity and may not be the most straightforward approach.
- Querying with Athena: Athena can be used to query the logs in S3, but the query here is focused on `SignUp` events, which are not related to the login attempts requirement.
- Rejection: This option focuses on `SignUp` events and not on login attempts (e.g., `InitiateAuth`), which is what the company needs. This doesn't align with the login attempt tracking requirement.
B) Enable AWS CloudTrail to deliver logs to an Amazon S3 bucket. Use Amazon Athena to query the logs for event names of InitiateAuth with event sources of cognito-idp.amazonaws.com.
- Reasoning:
- CloudTrail Logs: CloudTrail logs provide detailed records of API calls made to AWS services, including Amazon Cognito. `InitiateAuth` is the API action for authenticating users, which directly relates to login attempts.
- Event Querying: Using Athena to query CloudTrail logs is efficient, and the query for `InitiateAuth` is directly related to the login attempts.
- Success and Failure: CloudTrail logs can capture both successful and failed authentication attempts, as failures will also be logged (e.g., failed `InitiateAuth`).
- Why Selected: This option directly aligns with the requirement of capturing both successful and unsuccessful login atte...
Author: Daniel · Last updated Jul 19, 2026
A security engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled.
While testing the solution, the s...
Let's break down each option and analyze why a particular one is the most likely cause of the issue:
Key Information:
- The CloudTrail trail is set up to log events across all regions.
- The logs are encrypted with SSE-KMS (AWS KMS-managed keys).
- Log integrity validation is enabled.
- The digest files are readable, but the log files are not.
Option Analysis:
A) The log files fail integrity validation and automatically are marked as unavailable.
- Reasoning: Integrity validation is enabled, which means the system checks the integrity of CloudTrail logs against the digest files. If the logs fail this validation, they might be marked as unavailable.
- Rejection: This could be a potential cause, but the problem described specifically involves the unreadability of the log files, not necessarily integrity failure. Failed integrity validation would typically trigger an alert or error, but the logs would not be accessible regardless. The logs themselves might still be encrypted and readable, though potentially inaccessible due to permission issues, making this less likely as the primary cause.
B) The KMS key policy does not grant the security engineer's IAM user or role permissions to decrypt with it.
- Reasoning: The logs are encrypted using SSE-KMS, meaning the security engineer's IAM user or role must have decrypt permissions on the KMS key. If the IAM user or role does not have these permissions, they will not be able to decrypt the log files, leading to the inability to read them.
- Why Selected: This is the most likely cause. Since the digest files are readable, the IAM user has at least some level of access, but missing decrypt permissions on the KMS key would prevent access to the actual log files. This fits perfectly with the scenario described, where the digest files are accessible, but the log files are not.
C) Th...
Author: Daniel · Last updated Jul 19, 2026
A company needs to securely deploy resources and workloads across AWS accounts. The accounts are in an organization in AWS Organizations.
The company needs to use AWS CloudFormation for infrastructure as code (IaC) management of approved architectural patterns. The company also must enforce tagging requi...
Let's break down each option and analyze how well it meets the company's requirements of securely deploying resources across AWS accounts, using AWS CloudFormation for infrastructure management, and enforcing tagging and configuration policies:
Key Requirements:
- Securely deploy resources and workloads across AWS accounts.
- Use AWS CloudFormation for managing infrastructure as code (IaC).
- Enforce tagging requirements and specific configuration guidelines for resources and workloads.
Option Analysis:
A) Use CloudFormation stack policies to prevent the creation of resources that do not meet the tagging or configuration requirements. Use Amazon EventBridge rules to detect API calls that attempt to create resources outside of CloudFormation.
- CloudFormation stack policies: These policies control which resources can be updated or deleted within a CloudFormation stack but do not directly enforce tagging or configuration requirements for new resource creation.
- EventBridge: While EventBridge can detect and react to API calls, it would add complexity and may not be efficient for enforcing tagging and configuration on a wide scale.
- Rejection: This option doesn't directly address the enforcement of consistent tagging or configuration standards across AWS accounts. CloudFormation stack policies focus on updating resources within a stack, but not on preventing misconfigured resources at a global level. EventBridge adds complexity and isn't the best tool for enforcing consistent configuration or tagging policies.
B) Use an AWS CodePipeline pipeline to test and deploy IaC defined workloads through CloudFormation into the accounts. Use AWS Config rules to enforce the tagging requirements. Apply an SCP to prevent the creation of misconfigured resources in all OUs.
- AWS CodePipeline: Using CodePipeline for continuous integration and continuous delivery (CI/CD) of CloudFormation-managed workloads is a great way to ensure that infrastructure changes are tested and deployed securely.
- AWS Config rules: Config rules can be used to enforce compliance with tagging requirements and other configuration standards across resources.
- Service Control Policies (SCPs): SCPs provide a way to control what actions are allowed or denied across accounts in an AWS Organization, which can help prevent misconfigured resources.
- Why Selected: This approach combines IaC deployment, tagging enforcement, and misconfiguration prevention across multiple AWS accounts using CloudFormation, AWS Config, and SCPs. It ensures resources are deployed securely and according to guidelines, and it enforces the necessary configurations and tagging policies across AWS accounts.
C) Create an IAM permissions boundary to prevent the creation of misconfigured resources through C...
Author: Zara · Last updated Jul 19, 2026
A company is migrating its Amazon EC2 based applications to use Instance Metadata Service Version 2 (IMDSv2). A security engineer needs to determine whether any of the EC2 instances are still using Instance Metadata Service Version 1 (IMDSv...
In this scenario, the goal is to confirm whether any EC2 instances are still using Instance Metadata Service Version 1 (IMDSv1) after migrating to Version 2 (IMDSv2). The security engineer needs to monitor and ensure that IMDSv1 is no longer being used.
Analyzing each option:
Option A: Configure logging on the Amazon CloudWatch agent for IMDSv1 as part of EC2 instance startup. Create a metric filter and a CloudWatch dashboard. Track the metric in the dashboard.
- This option involves setting up logging for IMDSv1 on the EC2 instance itself, which could create logs when IMDSv1 is accessed. However, the process of configuring logging on each instance would require significant management overhead, especially when scaling. This would not provide a simple, centralized way of tracking IMDSv1 usage across instances. Additionally, it might miss instances that do not generate logs correctly, or that are not properly configured.
- Rejected: This approach involves manual setup per instance and lacks a centralized monitoring solution.
Option B: Create an Amazon CloudWatch dashboard. Verify that the EC2:MetadataNoToken metric is zero across all EC2 instances. Monitor the dashboard.
- The `EC2:MetadataNoToken` metric in CloudWatch tracks requests to the instance metadata service that do not include a session token (which would occur if IMDSv1 is being used). This option is effective because it directly monitors for the usage of IMDSv1 (which does not require a session token), and the absence of this metric would indicate that IMDSv1 is not being used. By monitoring this across all instances, you can quickly verify if any instance is still relying on IMDSv1.
- Selected: This is an efficient way to track and confirm the use of IMDSv1 across multiple EC2 instances...
Author: RadiantPhoenixX · Last updated Jul 19, 2026
A company is planning to create an organization by using AWS Organizations. The company needs to integrate user management with the company's external identity provider (IdP). The company also needs to centrally manage access to all of its AWS accounts...
In this scenario, the company needs to integrate an external identity provider (IdP) with AWS, manage user access centrally through AWS Organizations, and ensure that access to all AWS accounts and applications is controlled from the organization's management account. Let's break down each option:
Option A: Configure AWS Directory Service with the external IdP. Create IAM policies and associate them with users from the external IdP.
- AWS Directory Service can integrate with an external IdP, such as Microsoft Active Directory, and it allows for management of user accounts in AWS. However, this solution is more suited for environments where a company needs to maintain an Active Directory environment, and is not specifically tailored for managing multiple AWS accounts in a centralized manner. Also, IAM policies would need to be manually created for each user, making the management of access across multiple AWS accounts cumbersome.
- Rejected: While this works for directory integration, it is not the best solution for centralizing access control across multiple AWS accounts managed through AWS Organizations.
Option B: Enable AWS IAM Identity Center and use the external IdP as the identity source. Create permission sets and account assignments by using IAM Identity Center.
- AWS IAM Identity Center (formerly AWS SSO) is designed for centralized access management across AWS Organizations. It integrates with an external IdP for user authentication and allows you to manage user permissions across multiple AWS accounts centrally. By using IAM Identity Center, you can assign users to specific accounts and create permission sets that define access policies for each user. This solution directly meets the company's requirement for central management of access to AWS accounts and applications.
- Selected: This is the best solution for centralizing user access management across multiple AWS accounts, integrating with an externa...
Author: Abigail · Last updated Jul 19, 2026
A company uses Amazon Elastic Container Registry (Amazon ECR) as the repository for its production applications. A security engineer must implement an automated solution to report any vulnerabilities that ECR enhanced scanning detects. The solution must provide notification of vulnerability findings in an...
In this scenario, the goal is to automate the process of reporting any vulnerabilities detected by Amazon ECR Enhanced Scanning, and to provide the notifications in a Slack channel. The solution must be operationally efficient and should automate this process as much as possible.
Let's break down each option:
Option A: Activate Amazon Inspector scans for the ECR repository. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure an AWS Chatbot client for Slack that consumes the SNS topic. Create an Amazon EventBridge rule for Amazon Inspector findings. Specify the SNS topic as the target for the rule.
- Explanation: Amazon Inspector is integrated with Amazon ECR to scan container images for vulnerabilities. By creating an SNS topic, you can configure an AWS Chatbot to send notifications directly to Slack when vulnerabilities are detected. The EventBridge rule can be used to automatically capture findings from Amazon Inspector and trigger the SNS notification. This solution is both efficient and automated, as it involves minimal manual intervention once set up, and the Slack notifications will be real-time.
- Selected: This solution is highly operationally efficient because it uses AWS managed services (SNS, EventBridge, AWS Chatbot) for seamless integration with Slack and minimizes custom scripting or infrastructure management.
Option B: Activate Amazon Inspector scans for the ECR repository. Write a script to use AWS CLI commands to retrieve image scan findings from Amazon Inspector. Configure the script to send the findings to a Slack endpoint. Launch an Amazon EC2 instance to run the script.
- Explanation: This option requires writing a custom script to retrieve findings from Amazon Inspector using the AWS CLI and then sending them to a Slack endpoint. Additionally, an EC2 instance needs to be set up to run this script. While this solution is functional, it is less efficient because it introduces the overhead of maintaining an EC2 instance and custom scripting. It also requires manual intervention to ensure the script runs correctly and continuously.
- Rejected: This approach adds unnecessary complexity and operational overhead with the need to manag...
Author: Kai99 · Last updated Jul 19, 2026
A company uses AWS Config rules to identify Amazon S3 buckets that are not compliant with the company's data protection policy. The S3 buckets are hosted in several AWS Regions and several AWS accounts. The accounts are in an organization in AWS Organizations.
The company needs a solution to remediate the organization's exi...
To address the company's requirement of remediating noncompliant S3 buckets both in the past and in the future across multiple accounts and regions, we need to evaluate the effectiveness of different solutions based on the goals of detecting, remediating, and preventing future noncompliance with the data protection policy.
Option A: Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
- Explanation: This solution leverages an AWS Config aggregator that aggregates compliance data across all accounts in the AWS organization. By using a Lambda function to automatically remediate noncompliant S3 buckets (either by deleting them or reconfiguring them), this option provides both remediation of existing noncompliant buckets and prevention of future noncompliance. The Lambda function can be set to trigger automatically whenever a noncompliance finding is detected by AWS Config, ensuring that the solution is dynamic and automatic.
- Selected: This option is the most efficient and flexible for both remediating existing noncompliant S3 buckets and preventing noncompliance for future S3 buckets. It takes advantage of AWS Config's powerful compliance monitoring and integrates well with automation (Lambda).
Option B: Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
- Explanation: While using an SCP (Service Control Policy) with a "Deny" statement to prevent the creation of noncompliant S3 buckets is a valid solution for preventing future noncompliance, it doesn't address the remediation of existing noncompliant S3 buckets. SCPs only prevent the creation of noncompliant resources in the future but don't automatically correct existing noncompliant resources.
- Rejected: This approach is not comprehensive enough because it ...
Author: Ming88 · Last updated Jul 19, 2026
A company's engineering team is developing a new application that creates AWS Key Management Service (AWS KMS) customer managed key grants for users. Immediately after a grant is created, users must be able to use the KMS key to encrypt a 512-byte payload. During load testing, AccessDeniedException errors occur occasionally when a user first att...
To solve the issue of AccessDeniedException errors when users first attempt to use a KMS key for encryption immediately after a grant is created, it's important to focus on how AWS Key Management Service (KMS) handles grants and permissions. The problem is likely caused by the fact that there might be a delay in the KMS system registering the grant, leading to temporary access issues. Let's analyze each option:
Option A: Instruct users to implement a retry mechanism every 2 minutes until the call succeeds.
- Explanation: This approach would instruct users to retry the encryption request every 2 minutes if the initial attempt fails. While this could eventually succeed, it is not an optimal solution because it doesn't address the root cause of the problem. Additionally, the delay could lead to inefficiencies, especially if the issue is intermittent and happens too frequently.
- Rejected: While it may eventually work, this is a workaround rather than a solution. It introduces unnecessary complexity and doesn't address the underlying problem in a more direct or efficient way.
Option B: Instruct the engineering team to consume a random grant token from users and to call the CreateGrant operation by passing the grant token to the operation. Instruct users to use that grant token in their call to encrypt.
- Explanation: This option suggests that the engineering team generates a random grant token for each user, consumes the token in the `CreateGrant` operation, and then users would pass the token when calling the `encrypt` operation. This would create an additional layer of complexity and is unnecessary. The grant token is typically a way to identify and manage the grant, not something that requires this level of dynamic handling.
- Rejected: This solution overcomplicates the process and introduces unnecessary complexity without directly addressing the issue. AWS KMS grants don't require this level of token management for proper functioning.
Option C: Instruct the engineering team to create a random name for the grant ...
Author: Emily · Last updated Jul 19, 2026
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent.
A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The security engineer must implement a rule statement as part of the web ACL to block the requests. The rule ...
To address the requirements of mitigating the ongoing DDoS attack from a specific IoT device brand with a unique user agent, and ensuring that future attacks from this device brand are blocked without affecting legitimate customer traffic, we need to consider the nature of the attack and the available rule statements.
Let's analyze each option:
A) Use an IP set match rule statement that includes the IP address for IoT devices from the user agent.
- This approach would only work if we could reliably identify the specific IP addresses associated with the IoT devices. However, DDoS attacks typically involve distributed sources and may use dynamic IP addresses, meaning the IP addresses of the attacking devices can change frequently. This makes it difficult to block the attack using an IP set match rule. Moreover, this rule would not effectively block all attacks from the IoT devices, as attackers could switch IP addresses to bypass this rule.
- Reason for rejection: DDoS attacks are often distributed, and the IP addresses of the attacking devices are not static. Blocking by IP may not be effective in this case.
B) Use a geographic match rule statement. Configure the statement to block countries that the IoT devices are located in.
- This method blocks traffic from specific countries based on the geographic location of the IP addresses. However, it would be a broad solution that may unintentionally block legitimate customers from those countries, even if the attack is isolated to a smaller group of IoT devices. Moreover, not all DDoS traffic necessarily originates from a specific country, as IoT devices may use proxy servers or botnets spread across different locations.
- Reason for rejection: Blocking by geographic region could block legitimate customers and is not a targeted solution for the specific IoT devic...
Author: Amira99 · Last updated Jul 19, 2026
A company has configured a gateway VPC endpoint in a VPC. Only Amazon EC2 instances that reside in a single subnet in the VPC can use the endpoint.
The company has modified the route table for this single subnet to route traffic to Amazon S3 through the gateway VPC endpoint. The VPC provides internet access through an internet gateway.
A security engineer attempts to use instance profile credentials from an EC2 instance to retrieve an object from the S3 bucket, but the attempt fails. The security engineer verifies that the EC2 instance has an IAM instance profile with the correct permissions to access the S3 bucket and to retrieve objects. The security engineer also verifies that t...
To diagnose why the request from the EC2 instance to Amazon S3 is failing, we need to carefully examine the networking configuration and security settings involved. Here's the analysis of each option:
A) Verify that the EC2 instance’s security group does not have an implicit inbound deny rule for Amazon S3.
- Reasoning: EC2 instance security groups are stateful and control only inbound and outbound traffic to/from the instance. However, security groups do not control access to the VPC endpoint or traffic to AWS services like S3. The security group’s inbound rules only determine whether traffic can reach the EC2 instance, not whether it can route traffic through the VPC endpoint to Amazon S3.
- Reason for rejection: The EC2 security group does not control traffic to Amazon S3 via the VPC endpoint. Therefore, this step is unlikely to resolve the issue.
B) Verify that the VPC endpoint’s security group does not have an explicit inbound deny rule for the EC2 instance.
- Reasoning: A VPC endpoint for S3 does not typically require a security group associated with it. If no security group is explicitly associated with the VPC endpoint, this would not be a problem. Additionally, VPC endpoints are designed to allow traffic between the VPC and AWS services (like S3) regardless of security group settings unless explicitly denied by the VPC endpoint policy.
- Reason for rejection: VPC endpoint security groups aren't commonly used with S3 gateway endpoints, so this wouldn't be the cause of the issue in this case.
C) Verify that the internet...
Author: Zara · Last updated Jul 19, 2026
A security administrator is restricting the capabilities of company root user accounts. The company uses AWS Organizations and has all features enabled.
The management account is used for billing and administrative purposes, but it is not used for operational AWS resource...
To restrict the usage of root user accounts across an AWS Organization, we need to focus on a solution that effectively applies organization-wide policies, without relying on specific configurations for individual accounts or services. Let's analyze each option in detail:
A) Disable the use of the root user account at the organizational root. Enable multi-factor authentication (MFA) of the root user account for each organization member account.
- Reasoning: While enabling MFA for root users is a best practice to enhance security, it does not restrict the usage of root user accounts; it only adds an extra layer of authentication. Disabling root user access at the organizational root isn't directly achievable in AWS Organizations. Additionally, this approach is more about securing root user accounts rather than restricting their usage.
- Reason for rejection: This option focuses on securing root accounts with MFA, but it does not address restricting the root user accounts' usage across the organization effectively.
B) Configure IAM user policies to restrict root account capabilities for each organization member account.
- Reasoning: IAM user policies apply to IAM users, not root users. IAM policies do not have the capability to directly restrict or block the root user. Root users are not subject to IAM user policies, so this approach would not restrict root account usage.
- Reason for rejection: IAM user policies cannot restrict root user accounts, as they apply to IAM users, not the root user.
C) Create an OU in Organizations, and attach an SCP that controls usage of the root user. Add all member accounts to the new OU.
- Reasoning: Service Contr...
Author: Aarav2020 · Last updated Jul 19, 2026
A company wants to start processing sensitive data on Amazon EC2 instances. The company will use Amazon CloudWatch Logs to monitor, store, and access log files from the EC2 instances.
The company's developers use CloudWatch Logs for troubleshooting. A security engineer must implement a solution that prevents the developers from viewing the sensitive data....
To meet the company's requirement of preventing developers from viewing sensitive data in CloudWatch Logs while still allowing them to troubleshoot logs (but without access to sensitive information), the solution needs to provide automatic application of controls to future log groups and enforce protection policies.
Let's break down each option:
A) Create a CloudWatch Logs account-wide data protection policy. Specify the appropriate data identifiers for the policy. Ensure that the developers do not have the `logs:Unmask` IAM permission.
- Reasoning: This option suggests using a CloudWatch Logs account-wide data protection policy and specifies that developers should not have the `logs:Unmask` permission. The `logs:Unmask` permission controls whether users can view the sensitive parts of the log data, such as redacted fields. The issue here is that an account-wide policy does not apply automatically to new log groups. The requirement specifies that this must apply to any new log groups created in the future, which this approach may not fully meet as it's not automatically enforced for new log groups.
- Reason for rejection: While the `logs:Unmask` permission is important for preventing access to sensitive data, this solution doesn't automatically apply to new log groups and is less flexible in terms of future log groups.
B) Export the CloudWatch Logs data to an Amazon S3 bucket. Set up automated discovery by using Amazon Macie on the S3 bucket. Create a custom data identifier for the sensitive data. Remove the developers' access to CloudWatch Logs. Grant permissions for the developers to view the exported log data in Amazon S3.
- Reasoning: This option involves exporting logs to Amazon S3 and using Amazon Macie to identify sensitive data. While Macie can be used for discovering sensitive data, the developers would still have access to logs stored in S3. The issue with this approach is that it requires extra complexity (exporting data to S3) and manual management of sensitive data discovery. Furthermore, this approach doesn't directly restrict CloudWatch Logs access, which was one of the core requirements.
- Reason for rejection: This is not a direct CloudWatch Logs-based solution and adds unnecessary complexity with exporting data. It doesn't automatically apply to all new log groups, and Macie is not a solution to restrict access but only to discover sensitive data.
C) Export the CloudWatch Logs data to ...
Author: Sophia · Last updated Jul 19, 2026
A security engineer needs to implement a solution to identify any sensitive data that is stored in an Amazon S3 bucket. The solution must report on sensitive data in the S3 bucket by using an existing Amazon Simple Notification Service (...
To meet the requirements of identifying sensitive data stored in an Amazon S3 bucket and sending notifications via an existing Amazon SNS topic, we need to choose a solution that is simple to implement and leverages AWS services efficiently.
Let's analyze each option:
A) Enable AWS Config. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.
- Reasoning: AWS Config is used for monitoring configuration changes to AWS resources, but it is not designed for identifying or scanning sensitive data within those resources. It primarily monitors compliance with resource configurations rather than content inside those resources. AWS Config wouldn't directly help identify sensitive data in an S3 bucket, as it's not designed for data discovery.
- Reason for rejection: This solution does not focus on scanning for sensitive data inside the S3 bucket, and AWS Config does not provide a way to identify sensitive content in stored objects.
B) Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern. Program the Lambda function to send notifications to the SNS topic.
- Reasoning: While AWS Lambda can be used to scan an S3 bucket for sensitive data, creating a Lambda function to manually scan files for sensitive data (e.g., by pattern matching or other custom logic) can be complex and error-prone. It requires developing and maintaining custom code, handling scalability issues, and creating custom logic for pattern matching. This adds significant implementation effort compared to other options.
- Reason for rejection: This solution involves more manual setup, custom code, and maintenance overhead. It's not the most efficient or least effort solution for identifying sensitive data in an S3 bucket.
C) Configure Amazon Macie to use managed data identifiers to identify and categorize sensitiv...
Author: Sophia · Last updated Jul 19, 2026
A company has an application on Amazon EC2 instances that store confidential customer data. The company must restrict access to customer data. A security engineer requires secure access to the instances that host the application. According to company policy, users must not open any inbound ports, maintain bastion hosts, or manage SSH keys for the EC2 instances.
T...
To evaluate the available solutions and determine the best one for meeting the company's requirements, let's break down the specific requirements:
Requirements:
1. Restrict access to customer data: The company needs a way to securely access EC2 instances without opening inbound ports, maintaining bastion hosts, or managing SSH keys.
2. Monitor, store, and access session activity logs: The security engineer must have detailed session activity logs.
3. Logs must be encrypted: The logs need to be encrypted to ensure confidentiality.
Option Breakdown:
A) Use AWS Control Tower to connect to the EC2 instances. Configure Amazon CloudWatch logging for the sessions. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.
- Reasoning: AWS Control Tower is designed for setting up and governing multi-account AWS environments. While it helps in managing environments, it doesn't provide direct access to EC2 instances for session management. AWS Control Tower itself doesn’t include features for session activity logging or encryption of logs for individual EC2 instance sessions. This solution does not align well with the requirement to directly manage EC2 sessions.
- Rejected: It doesn't support secure access to EC2 instances, logging, or session monitoring in the context needed here.
B) Use AWS Security Hub to connect to the EC2 instances. Configure Amazon CloudWatch logging for the sessions. Select the upload session logs option and allow only encrypted CloudWatch Logs log groups.
- Reasoning: AWS Security Hub is focused on providing a comprehensive view of security alerts and compliance status across AWS accounts, rather than directly managing access to EC2 instances or logging session activity. It doesn’t have built-in functionality to securely connect to EC2 instances for session management, which is a core requirement.
- Rejected: Security Hub does not provide direct access to EC2 instances for managing sessions, logging, or encryption as needed here.
C) Use AWS Systems Manager Session Manager to conne...
Author: Nia · Last updated Jul 19, 2026
A company uses an organization in AWS Organizations to help separate its Amazon EC2 instances and VPCs. The company has separate OUs for development workloads and production workloads.
A security engineer must ensure that only AWS accounts in the production OU can write VPC flow logs to an Amazon S3 bucket. The security engineer is configuring the S3 bucket policy with a Co...
To meet the requirement of ensuring that only AWS accounts in the production OU can write VPC flow logs to an Amazon S3 bucket, we need to configure a Condition element in the S3 bucket policy. Let's break down each option to determine which one fulfills the security engineer's requirements.
Key Requirements:
- Scope: The condition must restrict access to the S3 bucket for VPC flow log writes (s3:PutObject) to accounts in the production OU of the AWS Organization.
- Action: Only the production accounts should have the permission to write logs to the bucket.
Option Analysis:
A) Set the value of the aws:SourceOrgID condition key to be the organization ID.
- Reasoning: The `aws:SourceOrgID` condition key is used to match the organization ID of the source (i.e., the account making the request). However, this key does not filter by Organizational Unit (OU), so it would allow all accounts from the organization, including development accounts, to write to the S3 bucket.
- Rejected: This option doesn’t limit access to only accounts in the production OU, so it doesn’t fulfill the requirement of restricting access based on the specific OU.
B) Set the value of the aws:SourceOrgPaths condition key to be the Organizations entity path of the production OU.
- Reasoning: The `aws:SourceOrgPaths` condition key allows you to specify the entity path (i.e., the path to the Organizational Unit) for the AWS account requesting access. This path can be used to filter requests to ensure that only accounts from a specific OU (in this case, the production OU) are allowed. By specifying the path for the production OU, only accounts within that OU will be able to write VPC flow logs to the S3 bucket.
- Selected: This is the correct option, as it ...
Author: Emily · Last updated Jul 19, 2026
Amazon CloudWatch Logs agent is successfully delivering logs to the CloudWatch Logs service. However, logs stop being delivered after the associated log stream has been active for a specific number of ho...
To identify the cause of logs stopping delivery to Amazon CloudWatch Logs after a specific number of hours, the security engineer needs to investigate potential issues with the CloudWatch Logs agent and the environment. Let's evaluate the options and identify the most relevant steps to take:
Analysis of Options:
A) Ensure that file permissions for monitored files that allow the CloudWatch Logs agent to read the file have not been modified.
- Reasoning: If the file permissions of the monitored log files are changed, it could prevent the CloudWatch Logs agent from reading the log files, resulting in logs failing to be delivered. If logs stop after a period of time, it could be because the agent loses access to the files due to modified permissions.
- Selected: This is a valid step to take because ensuring proper file permissions is essential for continuous log delivery to CloudWatch Logs. It is important to verify that the agent can still read the log files at the point when the logs stop being delivered.
B) Verify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming.
- Reasoning: Log rotation is a common practice in operating systems to manage log file sizes and prevent them from growing indefinitely. If the CloudWatch Logs agent is not properly configured to handle log rotation, it may fail to continue streaming logs after a rotation occurs, especially if the log file is renamed or replaced during the rotation process. This can explain why logs stop after a specific number of hours.
- Selected: This is another key step. If the log rotation mechanism is incompatible with how the CloudWatch Logs agent handles log files, logs will not be delivered after the rotation. Ensuring compatibility between log rotation rules and agent configuration is crucial to avoid disruptions in log delivery.
C) Configure an Amazon Kinesis producer to first put the logs into Amazon Kinesis Streams.
- Reasoning: Using Amazon Kinesis Streams as a buffer between log delivery and CloudWatch Logs is a potential solution, bu...
Author: Amira99 · Last updated Jul 19, 2026
A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. The security engineer has provisioned each Availability Zone with one private subnet and one public subnet. The security engineer has created three route tables for use with the environment. One route table is for the public subnets, and two route tables are for the private subnets (one route table for the private subnet in each Availability Zone).
The security engineer discovers ...
To address the issue where all four subnets in the VPC are attempting to route traffic out through the internet gateway, the solution should ensure that public and private subnets have appropriate routing for their respective traffic flows. Let's break down the steps and reasoning for each option.
Scenario:
- The VPC includes two Availability Zones (AZs) with one private subnet and one public subnet in each AZ.
- There are three route tables: one for public subnets and two for private subnets (one for each AZ).
- The issue is that all subnets are routing traffic out through the internet gateway (IGW), which is not correct for private subnets (they should route traffic through a NAT gateway instead).
Steps to Remedy:
A) Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.
- Reasoning: A NAT gateway should be placed in a public subnet, allowing instances in private subnets to access the internet for things like software updates and external API calls. The NAT gateway should be used as the route target for private subnets when routing external traffic. If the NAT gateway is not provisioned, private subnets would not be able to route traffic correctly.
- Selected: This is a necessary step. The NAT gateway must be provisioned in each public subnet in both Availability Zones to facilitate traffic from the private subnets to the internet. Without this, the private subnets cannot reach the internet through a controlled gateway.
B) Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.
- Reasoning: A NAT gateway should never be placed in a private subnet, as it is designed to be accessible by the public subnet. Private subnets should route traffic to the NAT gateway located in a public subnet, not within a private subnet.
- Rejected: This option is incorrect because placing a NAT gateway in a private subnet would make it inaccessible from the public internet, which would defeat the purpose of using a NAT gateway for internet access.
C) Modify the route tables that are associated with each of the public subnets. Create a new route for local destinations to the VPC CIDR range...
Author: Madison · Last updated Jul 19, 2026
A company hired an external consultant who needs to use a laptop to access the company's VPCs. Specifically, the consultant needs access to two VPCs that are peered together in the same AWS Region. The company wants to provide the consultant with access to these VPCs with...
Analysis of Options:
The goal is to provide the consultant with access to two VPCs that are peered together in the same AWS Region. The access should be secure, controlled, and not include unnecessary access to other network resources.
Let’s break down each option:
A) Create an AWS Site-to-Site VPN endpoint in the same Region as the VPCs. Configure access through an appropriate subnet and authorization rule.
- Reasoning: The Site-to-Site VPN is typically used to securely connect an on-premises network (like an office or data center) to an AWS VPC over a public network. While it could provide access to the VPCs, it is primarily designed for network-level communication between an on-premises network and AWS VPCs. For an external consultant to use a laptop to access specific VPCs, this would be a less efficient and overcomplicated solution.
- Rejected: This is not the most appropriate option for the consultant's use case, as it's designed for connecting networks rather than providing individual user access to VPCs.
B) Create an AWS account. Use the VPC sharing feature through AWS Resource Access Manager to allow the consultant to access the VPCs.
- Reasoning: VPC sharing via AWS Resource Access Manager allows multiple AWS accounts to share a VPC within an organization, which could be useful for sharing resources between accounts. However, VPC sharing is generally used for allowing different AWS accounts within the same organization to share a VPC and is not suitable for providing access to a specific external consultant's laptop. It does not directly solve the problem of providing controlled access to specific VPCs for an individual user.
- Rejected: This solution is more complex and inappropriate for a single consultant who needs controlled access. It is not the right tool for providing individual user access to specific VPCs.
C) Create an AWS Client VPN endpoi...
Author: Scarlett · Last updated Jul 19, 2026
A company uses AWS Organizations to manage a small number of AWS accounts. However, the company plans to add 1,000 more accounts soon. The company allows only a centralized security team to create IAM roles for all AWS accounts and teams. Application teams submit requests for IAM roles to the security team. The security team has a backlog of IAM role requests and cannot review and provision the IAM roles quickly.
The security team must create a process that will allow application...
In this scenario, the key requirements are:
1. Allow application teams to provision their own IAM roles.
2. Limit the scope of IAM roles.
3. Prevent privilege escalation.
4. Ensure minimal operational overhead for the security team.
Now, let's evaluate each option based on these requirements:
Option A: Create an IAM group for each application team. Associate policies with each IAM group. Provision IAM users for each application team member. Add the new IAM users to the appropriate IAM group by using role-based access control (RBAC).
- Analysis:
- This option involves creating IAM users for each team member and associating them with specific IAM groups based on the role they need. While it would allow application teams to manage access, it doesn't specifically address the need for centralized control over the IAM roles and limits on permissions.
- The use of IAM groups and RBAC doesn’t effectively prevent privilege escalation, as users could still be assigned roles with excessive permissions if not properly managed. It also doesn’t directly solve the backlog issue because the security team is still responsible for creating users and managing their permissions.
- Conclusion: Not ideal due to complexity and potential for privilege escalation.
Option B: Delegate application team leads to provision IAM roles for each team. Conduct a quarterly review of the IAM roles the team leads have provisioned. Ensure that the application team leads have the appropriate training to review IAM roles.
- Analysis:
- This approach gives application team leads the responsibility to provision roles, but the security team still has to perform periodic reviews. This adds more operational overhead for the security team, especially with the growing number of accounts.
- Privilege escalation risks remain since team leads may not always apply the least privilege principle and could provision overly permissive roles.
- A quarterly review isn’t proactive enough, and the team leads may not always be well-trained on the best practices for role provisioning.
- Conclusion: This option creates mo...
Author: Aarav · Last updated Jul 19, 2026
A developer is receiving AccessDenied errors when the developer invokes API calls to AWS services from a workstation. The developer previously configured environment variables and configuration files on the workstation to use multiple roles with other AWS accounts.
A security engineer needs to help the developer configure authentication. The current credentials must be evaluated wi...
In this scenario, the goal is to configure authentication credentials without conflicting with previously configured credentials while maintaining the current credentials.
Let's analyze each option to determine the best approach:
Option A: In the local AWS CLI configuration file
- Analysis:
- The AWS CLI configuration file (`~/.aws/config`) stores configuration settings like default region, output format, and profile information, including credentials.
- You can specify multiple named profiles in this file, which makes it easier to switch between credentials when using different AWS accounts.
- This option is effective because it allows you to explicitly define credentials for a specific profile, thus isolating them from the default profile or any previously configured profiles. It doesn't conflict with other credentials already configured on the workstation.
- Conclusion: This is a valid option because it allows for isolated management of credentials without overriding or conflicting with existing configurations. The profiles are explicitly defined, making it easy to switch between them.
Option B: As environment variables on the local workstation
- Analysis:
- Environment variables (e.g., `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`) are used by the AWS CLI and SDKs to determine which credentials to use for authentication.
- If credentials are set as environment variables, they will take precedence over any credentials configured in configuration files. This can potentially lead to conflicts if other credentials are also set as environment variables.
- In a scenario where the developer is using multiple roles or AWS accounts, setting credentials in environment variables might override existing configurations and cause issues when switching between profiles.
- Conclu...
Author: Daniel · Last updated Jul 19, 2026
A medical company recently completed an acquisition and inherited an existing AWS environment. The company has an upcoming audit and is concerned about the compliance posture of its acquisition.
The company must identify personal health information inside Amazon S3 buckets and must identify S3 buckets that are publicly accessible. The company needs to prepare for the ...
To prepare for the audit and meet the requirements with the least operational overhead, the company needs to focus on identifying personal health information (PHI) inside Amazon S3 buckets and detecting publicly accessible S3 buckets. Here’s a breakdown of the steps:
Option A: Enable Amazon Macie. Run an on-demand sensitive data discovery job that uses the PERSONAL_INFORMATION managed data identifier.
- Analysis:
- Amazon Macie is a fully managed service designed for discovering and classifying sensitive data, such as personally identifiable information (PII) and personal health information (PHI). By enabling Macie and running an on-demand sensitive data discovery job, you can quickly identify any personal health information inside the S3 buckets.
- The PERSONAL_INFORMATION managed data identifier is designed specifically to detect sensitive personal data, which aligns with the company’s goal of identifying PHI.
- This option is ideal for automatically discovering and classifying sensitive data with minimal overhead and is particularly well-suited to the company's need to meet compliance and audit requirements.
- Conclusion: This is a highly suitable choice because it directly addresses the need to identify PHI in the S3 buckets with minimal manual effort.
Option B: Use AWS Glue with the Detect PII transform to identify sensitive data and to mask the sensitive data.
- Analysis:
- AWS Glue is a managed ETL (Extract, Transform, Load) service that is typically used for data processing and transformation, but it’s not designed specifically for identifying sensitive data like PHI in S3 buckets.
- The Detect PII transform is useful for identifying PII in structured data during ETL jobs, but it’s not as effective for unstructured data or identifying sensitive data within S3 buckets directly.
- This approach would require more setup and may not be as efficient for directly scanning S3 buckets for PHI or performing on-demand discovery.
- Conclusion: This option is not ideal as it involves more operational overhead for processing structured data and isn’t optimized for identifying sensitive data directly within S3 buckets.
Option C: Enable AWS Audit Manager. Create an assessment by using a supported framework.
- Analysis:
- AWS Audit Manager helps automate the process of collecting evidence for audits and compliance assessments. While it can help track controls related to compliance, it does not directly scan for sensitive data in S3 buckets or assess S3 bucket accessibility.
- This tool would help document and track compliance but does not directly address the specific need to identify PHI or publicly accessible S3 buckets.
- Conclusion: This opt...
Author: Grace · Last updated Jul 19, 2026
A company finds that one of its Amazon EC2 instances suddenly has a high CPU usage. The company does not know whether the EC2 instance is compromised or whether the operating system is performing background cleanup.
Which co...
In this scenario, the primary concern is to determine the cause of the high CPU usage on the EC2 instance (whether it's a result of the operating system performing background tasks or an indication of a potential compromise). The security engineer must take steps that provide valuable information and ensure data integrity for further investigation. Here’s an evaluation of each option:
Option A: Disable termination protection for the EC2 instance if termination protection has not been disabled.
- Analysis:
- Termination protection prevents accidental termination of an EC2 instance through the AWS Management Console. However, disabling termination protection right away in response to high CPU usage is premature and unnecessary, as there’s no immediate need to terminate the instance. Termination protection is useful only if you plan to avoid accidental termination, but it does not help with the current issue of diagnosing high CPU usage.
- Conclusion: Not immediately useful for this situation. The focus should be on understanding the cause of the high CPU usage and preserving data integrity first.
Option B: Enable termination protection for the EC2 instance if termination protection has not been enabled.
- Analysis:
- Enabling termination protection helps prevent accidental termination of the instance during investigation, which is important if the instance is critical and you want to ensure it remains running while you gather data for troubleshooting. This provides a safeguard, ensuring that the instance is not unintentionally terminated during the troubleshooting process.
- Conclusion: This is a good first step to protect the instance from accidental termination, which could disrupt the investigation.
Option C: Take snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
- Analysis:
- Taking snapshots of the attached EBS volumes ensures that you have a copy of the current state of the instance’s data, preserving it for further investigation in case the situation worsens (such as data loss or corruption). Snapshots are critical for forensic analysis, as they can be used later to investigate any potential compromise or abnormal behavior without affecting the current running state of the instance.
- Conclusion: This is an essential step in preserving data and ensuring that you have a reliable source of information for later investigation.
Option D: Remove all snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to ...
Author: Mia · Last updated Jul 19, 2026
A company is implementing a customized notification solution to detect repeated unauthorized authentication attempts to bastion hosts. The company's security engineer needs to implement a solution that will provide notification when 5 failed attempts occur within a 5-minute period. The solution must use native AWS services and mus...
To meet the requirement of notifying the designated system administrator when 5 failed login attempts occur within a 5-minute period on bastion hosts, using AWS native services, let's analyze each option:
Option A: Use the Amazon CloudWatch agent to collect operating system logs. Use Amazon EventBridge to configure an alarm based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Service (SNS) when the defined threshold for the alarm is exceeded. Use Amazon EC2 instance tags to determine which SNS topics receive notifications.
- Analysis:
- Amazon CloudWatch agent can collect operating system logs and send them to CloudWatch Logs, from which you can create metric filters.
- EventBridge could be used to set up rules and trigger actions based on events, but the solution doesn’t specify how the logs are evaluated for failed login attempts.
- SNS topics can be used for notifications, and EC2 instance tags can be leveraged to dynamically select the SNS topic, based on the instance’s tags.
- This solution is feasible but requires multiple components: CloudWatch agent, EventBridge, and EC2 tags to target the right administrator. It could work but introduces more complexity.
- Conclusion: While functional, it may add unnecessary complexity with EventBridge when you could achieve the same result with simpler configurations.
Option B: Use AWS Systems Manager Agent to collect operating system logs. Use the Systems Manager Run Command AWS-ConfigureCloudWatch document to configure an Amazon EventBridge event based on a metric filter for failed login attempts. Send an alert to Amazon SNS when the defined threshold for the alarm is exceeded. Use SNS messaging filters to control who receives notifications.
- Analysis:
- AWS Systems Manager Agent (SSM Agent) helps manage EC2 instances, but it’s primarily designed for management tasks like patching or configuration. It’s not the best tool for collecting operating system logs for login attempts.
- SNS messaging filters allow filtering messages to notify specific recipients, but combining SSM Agent for log collection and EventBridge for metrics and alarms could overcomplicate the solution. Systems Manager Run Command is also less suitable here than using CloudWatch directly.
- Conclusion: This option adds unnecessary complexity by using Systems Manager to collect logs and configure alarms. It is not the most e...
Author: Nia · Last updated Jul 19, 2026
An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connect to the website during the attack period. The ecommerce company's security team is worried about future potential attacks and wants to prepare for such events. The company needs to mi...
To minimize downtime during a future DDoS attack and prepare the ecommerce website for such events, the following steps are crucial:
Explanation of Options:
A) Enable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
- Rejected: While GuardDuty is useful for monitoring and detecting malicious activity, it doesn't directly mitigate DDoS attacks. It helps in identifying security threats like unauthorized access, but it doesn’t have direct capabilities to mitigate DDoS traffic. It is more suitable for detecting anomalies in AWS resources but doesn't provide an automatic blocking solution for DDoS events.
B) Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack.
- Selected: AWS Shield Advanced offers DDoS protection and automatic mitigation capabilities. It provides enhanced protection against larger and more sophisticated DDoS attacks. It also includes 24/7 support and provides real-time attack diagnostics, which are critical for minimizing downtime. This step will help ensure that the site is protected during an attack, and in case of a severe attack, the support team can assist in remediation. Shield Advanced is specifically designed to handle DDoS attacks and reduce impact, which is why this is one of the best options.
C) Use VPC Flow Logs to monitor network traffic and an AWS Lambda function to automatically block an attacker's IP using security groups.
- Rejected: VPC Flow Logs can help monitor network traffic and provide visibility into the traffic patterns, but they do not directly block DDoS traffic. Lambda can be set up to respond to specific traffic patterns, but this approach requires significant customization and m...
Author: Sophia Clark · Last updated Jul 19, 2026
An AWS account includes two S3 buckets: bucket1 and bucket2. The bucket2 does not have a policy defined, but bucket1 has the following bucket policy:
In addition, the same account has an IAM User na...
To determine which S3 buckets the IAM user "alice" can access, we need to analyze both the bucket policy for bucket1 and the IAM policy associated with alice.
Key Factors:
1. Bucket Policy for bucket1:
- Bucket policies are defined for S3 buckets and control access to the objects within them. In this case, bucket1 has a policy that likely grants access to alice, but the exact policy details are missing here.
- However, if the bucket policy allows alice access to bucket1, she will be able to access it.
2. Bucket Policy for bucket2:
- bucket2 does not have any policy defined, which means no explicit permissions are granted to access bucket2. By default, unless there is an explicit permission or an IAM policy allowing access to bucket2, alice will not have access to it.
3. IAM Policy for alice:
- IAM policies define permissions granted to specific IAM users or groups. For alice to access a bucket, her IAM ...
Author: Zara · Last updated Jul 19, 2026
A company has used AWS Lambda functions to build an application on AWS. The company's security engineer implemented Amazon Inspector and activated Lambda standard scanning and Lambda code scanning.
The security engineer reviews the Amazon Inspector console and learns that Amazon Inspector is not scanning some of the Lambda functions. The ...
To investigate why Amazon Inspector is not scanning some Lambda functions and the reason stated is that "the scan eligibility expired," the most relevant factor to investigate is whether the Lambda functions have been invoked recently. Amazon Inspector scans Lambda functions that have been invoked within the past 90 days. If the Lambda functions haven't been invoked in this time frame, their scan eligibility would expire, and Amazon Inspector would not scan them.
Analyzing Each Option:
A) Validate that the AmazonInspector2ServiceRolePolicy AWS managed policy grants permissions to access Lambda.
- Rejected: While it's important for the IAM role used by Amazon Inspector to have the correct permissions, the issue described here is related to the scan eligibility expiration due to lack of recent invocations. The IAM policy would only be relevant if there were issues with permission to scan the Lambda functions, but since the issue is about expired scan eligibility, this is not the cause.
B) Increase the timeout value of the Lambda functions to complete the scans successfully while the code is running.
- Rejected: The timeout value for the Lambda function determines how long the function can run before timing out. This does not affect scan eligibility or the fact that scans are not happening because the Lambda function has not been i...
Author: Ethan · Last updated Jul 19, 2026
A company is testing incident response procedures for destination containment. The company needs to contain a critical Amazon EC2 instance as quickly as possible while keeping the EC2 instance running. The EC2 instance is the only resource in a public subn...
To immediately contain the EC2 instance while keeping it running, we need a solution that effectively prevents any further traffic to or from the EC2 instance without disrupting its operation.
Let's analyze each option in detail:
A) Create a new security group that has no inbound rules or outbound rules. Attach the new security group to the EC2 instance.
- Analysis: A security group controls traffic at the instance level and allows for immediate changes. Creating a new security group with no inbound or outbound rules and attaching it to the EC2 instance will effectively block any new inbound and outbound traffic to and from the EC2 instance.
- Pros: This action can be performed quickly, and it immediately blocks all traffic without stopping the EC2 instance. It is also non-disruptive to the instance's internal processes.
- Cons: The EC2 instance might still maintain connections to existing resources, but no new connections can be made, and no outbound traffic can occur.
B) Configure the existing security group for the EC2 instance. Remove all existing inbound rules and outbound rules from the security group.
- Analysis: This option modifies the existing security group by removing all inbound and outbound rules, which would have the same effect as option A. The EC2 instance would immediately stop accepting any new inbound connections or making outbound connections.
- Pros: It's effective and fast in blocking all traffic.
- Cons: Since the change is made to the existing security group, it might affect other instances if they are using the same security group.
C) Create a new network ACL that has a single Deny rule for in...
Author: Ethan · Last updated Jul 19, 2026
A company needs to use HTTPS when connecting to its web applications to meet compliance requirements. These web applications run in Amazon VPC on Amazon EC2 instances behind an Application Load Balancer (ALB). A security engineer wants to ensure that the load balancer will only accept connections over port 443, even if the...
In this scenario, the goal is to ensure that the Application Load Balancer (ALB) only accepts connections over port 443 (HTTPS), even if it is mistakenly configured with an HTTP listener (port 80). Let's evaluate each of the options provided:
A) Create a security group with a rule that denies inbound connections from 0.0.0.0/0 on port 80. Attach this security group to the ALB to overwrite more permissive rules from the ALB's default security group.
- Analysis: Security groups in AWS are stateful, meaning that if a rule denies traffic on port 80, it will prevent inbound HTTP connections. However, security groups don't have an explicit deny rule by default, so adding a deny rule for port 80 could conflict with the more permissive rules, potentially causing issues.
- Pros: A security group is applied directly to the ALB and will stop unwanted HTTP traffic.
- Cons: Security groups are stateful, meaning they don't block all types of inbound traffic as strictly as necessary in this case. Instead, they allow traffic unless specifically denied, and applying a deny rule might not be effective in all situations, especially if the default security group is misconfigured. Additionally, this approach might not work if other more permissive security groups are applied elsewhere.
B) Create a network ACL that denies inbound connections from 0.0.0.0/0 on port 80. Associate the network ACL with the VPC's internet gateway.
- Analysis: Network ACLs work at the subnet level and provide a stateless way to allow or deny traffic. Associating a network ACL with the VPC's internet gateway could potentially block traffic at the subnet level. However, this approach would affect all traffic across the subnet, not just the ALB, which could impact other services or resources within the VPC.
- Pros: Network ACLs can enforce network-level restrictions.
- Cons: Sin...
Author: Aditya · Last updated Jul 19, 2026
A consultant agency needs to perform a security audit for a company's production AWS account. Several consultants need access to the account. The consultant agency already has its own AWS account.
The company requires multi-factor authentication (MFA) for all access to its production account. The company also f...
In this scenario, the goal is to provide the consultant agency with access to the company's production AWS account while meeting the following requirements:
1. Multi-factor authentication (MFA): MFA must be enabled for all access to the production account.
2. No long-term credentials: Long-term credentials (e.g., IAM users with static access keys) are forbidden.
Let's analyze each option:
A) Create an IAM group. Create an IAM user for each consultant. Add each user to the group. Turn on MFA for each consultant.
- Analysis: This option involves creating individual IAM users for each consultant, which violates the requirement to avoid long-term credentials. IAM users typically have long-term access keys, which are not permitted by the company.
- Pros: It can meet the MFA requirement if MFA is configured for each user.
- Cons: This approach violates the company's policy against long-term credentials, as IAM users with static access keys would be required.
B) Configure Amazon Cognito on the company’s production account to authenticate against the consultant agency's identity provider (IdP). Add MFA to a Cognito user pool.
- Analysis: Amazon Cognito is primarily used for federating user access, often for web or mobile applications. While Cognito can integrate with an identity provider (IdP) and enforce MFA, this is not the typical approach for giving consultants access to an AWS account. Moreover, it may introduce unnecessary complexity and doesn't align directly with standard AWS access management best practices.
- Pros: MFA can be implemented with Cognito.
- Cons: It is a more complex solution and not a standard approach for granting AWS account access. Additionally, it may not fully integrate with the AWS permissions model.
C) Create an IAM role in the consultant agency’s AWS account. Define a trust policy that requires MFA. In the trust policy, specify the c...
Author: Mia · Last updated Jul 19, 2026
A company uses AWS Lambda functions to implement application logic. The company uses an organization in AWS Organizations to manage hundreds of AWS accounts.
The company needs to implement a solution to continuously monitor the Lambda functions for vulnerabilities in all accounts. The solution must publish detected issues to a dashboard. Lambda functio...
To continuously monitor Lambda functions for vulnerabilities across multiple AWS accounts and publish detected issues to a dashboard, while ensuring that Lambda functions in testing or development are excluded from the dashboard, we need a combination of security services and filtering options.
Let's analyze each option:
A) Designate a delegated Amazon GuardDuty administrator account in the organization's management account. Use the GuardDuty Summary dashboard to obtain an overview of Lambda functions that have vulnerabilities.
- Analysis: GuardDuty is a security service that detects suspicious activity and potential vulnerabilities in your AWS environment. It provides insights into findings related to Lambda functions, but it does not provide specific vulnerability scanning for Lambda functions, which is not its primary focus. GuardDuty would show security-related findings, but not detailed vulnerabilities in Lambda functions, which makes it unsuitable for this requirement.
- Pros: GuardDuty is useful for security activity monitoring.
- Cons: It does not specifically focus on vulnerabilities in Lambda functions.
B) Designate a delegated Amazon Inspector administrator account in the organization's management account. Use the Amazon Inspector dashboard to obtain an overview of Lambda functions that have vulnerabilities.
- Analysis: Amazon Inspector is designed to assess vulnerabilities in AWS resources, including Lambda functions. By designating an administrator account and using the Amazon Inspector dashboard, you can scan Lambda functions across multiple accounts for vulnerabilities. This meets the requirement of monitoring Lambda functions for vulnerabilities.
- Pros: Amazon Inspector is specifically designed for vulnerability assessment, including Lambda functions. This directly addresses the requirement of continuously monitoring Lambda functions for vulnerabilities.
- Cons: There is no mention of how to exclude Lambda functions in testing or development from appearing on the dashboard.
C) Apply tags of “test” or “development” to all Lambda functions that are in testing or development. Use a suppression filter that suppresses findings that contain these tags.
- Analysis: This option ensures that Lambda functions in testing or development are tagged with specific identifiers (e.g., "test" or "development"). Using a suppression filter based on these tags will ensure that vulnerabilities detected in these Lambda functions do not appear on the dashboard. This so...
Author: Liam · Last updated Jul 19, 2026
A company has an organization in AWS Organizations that includes dedicated accounts for each of its business units. The company is collecting all AWS CloudTrail logs from the accounts in a single Amazon S3 bucket in the top-level account. The company's IT governance team has access to the top-level account. A security engineer needs to allow each business unit to access its own CloudTrail logs.
The security engineer creates an IAM role in the top-level account for each of the other accounts. For each role, the security engineer creates an IAM p...
The security engineer's goal is to allow IAM users in the business unit accounts to access their respective CloudTrail logs stored in the top-level account's S3 bucket. The security engineer has already created an IAM role in the top-level account for each business unit, with a policy granting read-only permissions to the S3 objects corresponding to each business unit's logs. Now, the next step is to configure the business unit accounts to allow their IAM users to assume the role in the top-level account.
Let's evaluate each option:
A) Attach a policy to the IAM user to allow the user to assume the role that was created in the top-level account. Specify the role's ARN in the policy.
- Analysis: This option is correct. The IAM users in the business unit accounts need permission to assume the role in the top-level account. By attaching a policy to the IAM user in the business unit account that allows the user to assume the role in the top-level account (using the role's ARN), the IAM user can assume the role and access the CloudTrail logs stored in the top-level account's S3 bucket.
- Pros: This is a best practice for cross-account access and is explicitly designed for the scenario described. It adheres to AWS security practices for cross-account roles.
- Cons: No significant cons for this scenario.
B) Create an SCP that grants permissions to the top-level account.
- Analysis: Service Control Policies (SCPs) are used to manage permissions across accounts within AWS Organizations. SCPs control what actions can be performed across the organization or specific accounts, but they do not directly grant permissions for IAM users to assume roles. SCPs are not the correct tool for granting IAM users in the business unit accounts permission to assume roles in the top-level acc...
Author: Rohan · Last updated Jul 19, 2026
A company has configured an organization in AWS Organizations for its AWS accounts. AWS CloudTrail is enabled in all AWS Regions.
A security engineer must implement a solution to prev...
To prevent CloudTrail from being disabled, we need a solution that ensures CloudTrail logging cannot be turned off by users or services in the AWS account, even by administrative users. Let's analyze each option in detail:
Option A: Enable CloudTrail log file integrity validation from the organization’s management account.
- Analysis: Enabling log file integrity validation helps ensure the integrity of CloudTrail logs by detecting any tampering, but it does not prevent the ability to disable CloudTrail or stop logging. While it is a good security practice for auditing purposes, it doesn't specifically prevent disabling CloudTrail.
- Rejection Reason: This option doesn't directly prevent CloudTrail from being disabled; it only secures the logs after they've been created.
Option B: Enable server-side encryption with AWS KMS keys (SSE-KMS) for CloudTrail logs. Create a KMS key. Attach a policy to the key to prevent decryption of the logs.
- Analysis: Enabling SSE-KMS encryption ensures that CloudTrail logs are encrypted, but it doesn't prevent CloudTrail from being disabled. The focus here is on securing the logs after they are created, not preventing actions like disabling CloudTrail or stopping logging.
- Rejection Reason: While important for securing logs, it doesn't directly prevent CloudTrail from being disabled or tampered with by users.
Option C: Create an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail action. Attach the SCP to the root OU.
- Analysis: Service Control Policies (SCPs) are part of AWS Organizations and are used to manage permissions across AWS accounts in the organization. By explicitly de...
Author: Mia · Last updated Jul 19, 2026
A company runs its microservices architecture in Kubernetes containers on AWS by using Amazon Elastic Kubernetes Service (Amazon EKS) and Amazon Aurora The company has an organization in AWS Organizations to manage hundreds of AWS accounts that host different microservices.
The company needs to implement a monitoring solution for logs from all AWS resources across all acc...
To determine the most suitable solution for monitoring logs from all AWS resources across multiple accounts and detecting security-related issues with the least operational effort, let’s analyze each option based on key factors like ease of implementation, operational overhead, automation, and security-focused features.
Option A: Designate an Amazon GuardDuty administrator account in the organization’s management account. Enable GuardDuty for all accounts. Enable EKS Protection and RDS Protection in the GuardDuty administrator account.
- Analysis: Amazon GuardDuty is a managed threat detection service that provides continuous monitoring of AWS accounts for malicious or unauthorized behavior. It works seamlessly with various AWS services like EKS (Elastic Kubernetes Service) and RDS (Relational Database Service). By enabling GuardDuty across all accounts, security-related findings are automatically aggregated in the designated administrator account.
- Selection Reasoning: This option involves the least operational overhead because GuardDuty automatically detects security issues without requiring custom log management, and it integrates natively with AWS services like EKS and RDS. It requires minimal setup once GuardDuty is enabled and provides automatic threat detection across multiple AWS accounts.
- Rejection Reason: This solution doesn't focus on general log collection for all AWS resources, but it is tailored specifically for security-related event detection, which aligns well with the company’s need for automatic detection of security issues.
Option B: Designate a monitoring account. Share Amazon CloudWatch logs from all accounts with the monitoring account. Configure Aurora to publish all logs to CloudWatch. Use Amazon Inspector in the monitoring account to evaluate the CloudWatch logs.
- Analysis: This option involves setting up centralized log collection in CloudWatch and using Amazon Inspector for security evaluations. However, this would require setting up CloudWatch log groups for each service and integrating Aurora with CloudWatch logs, which adds complexity. While Amazon Inspector can help with security assessments, the setup and management effort would be significant.
- Rejection Reason: This option requires more configuration and ongoing management to set up CloudWatch logging across all services and accounts. It also introduces complexity due to the manual log collection and security evaluation processes, making it less efficient compared to other solutions.
Option C: Create a central Amazon S3 bucket in the organizat...
Author: Kunal · Last updated Jul 19, 2026
A security engineer has been asked to troubleshoot inbound connectivity to a web server. This single web server is not receiving inbound connections from the internet, whereas all other web servers are functioning properly.
The architecture includes network ACLs, security groups, and a virtual security appliance. In addition, the development team has implemented Application Load Balancers (ALBs) to distribute the load across all web servers. It is a requirement that traffic between the web servers and the internet flow through the virtual security appliance.
The security engineer has verified the f...
To troubleshoot why the web server is not receiving inbound connections while others are functioning properly, we need to analyze the networking and routing configuration between the web server, the Application Load Balancer (ALB), and the virtual security appliance. Given the information, we have already ruled out security group, network ACL, and virtual appliance rule set issues.
Let’s go through each option and assess its relevance:
Option A: Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to a NAT gateway.
- Analysis: The web server needs to receive inbound traffic from the internet, and the NAT gateway is typically used for outbound traffic from private subnets to the internet. If the web server is in a private subnet, the NAT gateway might be used for outbound traffic, but it’s not relevant for inbound traffic. The route for inbound traffic should point to the virtual security appliance or ALB, not the NAT gateway.
- Rejection Reason: NAT gateways are used for outbound traffic from private subnets and do not affect inbound traffic. Thus, this is not the root cause of the issue.
Option B: Verify which security group is applied to the particular web server’s elastic network interface (ENI).
- Analysis: Each web server has an ENI, and the correct security group should be applied to it to allow inbound traffic. Even though the security group rule set was verified, it’s possible that a different security group is associated with the ENI of this specific web server, causing connectivity issues.
- Selection Reasoning: This is a valid troubleshooting step. If the incorrect security group is applied to the ENI of the particular web server, it could explain why that specific server is not receiving traffic despite other servers working fine. Verifying this configuration ensures there are no misconfigurations at the ENI level.
Option C: Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to the virtual security appliance.
- Analysis: Since the requirement specifies that traffic between the web servers and the internet must flow through the virtual security appliance, the route table for the web server subnet must direct outbound traffic to the virtual ...
Author: Sophia Clark · Last updated Jul 19, 2026
A company has a strict policy against using root credentials. The company's security team wants to be alerted as soon as possible when root credentials are used to sign in to th...
The security team needs to be alerted when root credentials are used to sign in to the AWS Management Console. Let’s analyze each option to determine the most effective solution:
Option A: Use AWS Lambda to periodically query AWS CloudTrail for console login events and send alerts using Amazon Simple Notification Service (Amazon SNS).
- Analysis: While AWS Lambda can be used to query CloudTrail logs periodically, this approach introduces complexity because it requires periodic querying, which could be inefficient for real-time alerting. Furthermore, CloudTrail logs are typically delivered with some delay, making this method less immediate. This option is more resource-intensive and would involve custom Lambda functions and scheduled jobs to check for root logins.
- Rejection Reason: This approach introduces unnecessary complexity and might not be as real-time as other solutions. It is not as efficient or simple as directly leveraging AWS services built for event-driven monitoring.
Option B: Use Amazon EventBridge to monitor console logins and direct them to Amazon Simple Notification Service (Amazon SNS).
- Analysis: Amazon EventBridge is a serverless event bus service that can monitor AWS CloudTrail events in near real-time, including sign-ins to the AWS Management Console. EventBridge can be easily configured to trigger alerts when specific events occur, such as the use of root credentials. This method allows the security team to receive instant alerts when root credentials are used to sign in, without the need for complex custom code or periodic queries.
- Selection Reasoning: This is the most efficient and straightforward solution. EventBridge integrates well with CloudTrail and can send immediate alerts based on specific conditions, like root sign-ins, to SNS. It's fully managed and highly scalable, making it the best option...
Author: Amira · Last updated Jul 19, 2026
A security engineer is designing security controls for a fleet of Amazon EC2 instances that run sensitive workloads in a VPC. The security engineer needs to implement a solution to detect and mitigate soft...
To determine which solution will best meet the requirement of detecting and mitigating software vulnerabilities on EC2 instances running sensitive workloads, let’s evaluate each option based on key factors like vulnerability detection, patch management, and automation.
Option A: Scan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager.
- Vulnerability Detection: Amazon Inspector is a security assessment service that helps detect vulnerabilities and exposures in EC2 instances. It can identify vulnerabilities such as missing patches, insecure configurations, and known software flaws.
- Patch Management: AWS Systems Manager Patch Manager automates the process of applying security patches to EC2 instances, ensuring that the instances are up to date with the latest security patches.
- Automation: Both tools offer strong integration with AWS services, making automation and continuous monitoring possible.
- Reason for Selection: This solution directly addresses the need for both vulnerability scanning and patch management. Amazon Inspector and AWS Systems Manager Patch Manager are purpose-built for the task.
Option B: Install host-based firewall and antivirus software on each EC2 instance. Use AWS Systems Manager Run Command to update the firewall and antivirus software.
- Vulnerability Detection: Antivirus and firewall software provide a basic level of defense but are not specifically designed for comprehensive vulnerability detection on EC2 instances. They are more suited to protecting against malware and unauthorized access rather than identifying security vulnerabilities in the software stack.
- Patch Management: While AWS Systems Manager can help automate software updates and patches for the firewall and antivirus, it does not directly address patching the OS or other critical software components.
- Reason for Rejection: This option does not directly address vulnerability scanning at the software level, ma...
Author: Kunal · Last updated Jul 19, 2026
A company stores sensitive data in AWS Secrets Manager. A security engineer needs to design a solution to generate a notification email when anomalous GetSecretValue API calls occur. The security engineer has configured an Amazon EventBridge rule f...
To determine which solution meets the requirement of generating a notification email when anomalous `GetSecretValue` API calls occur in AWS Secrets Manager, we need to assess the options based on their ability to:
1. Detect anomalous API calls (specifically `GetSecretValue` calls).
2. Trigger notifications based on the detected anomaly.
3. Make use of the EventBridge rule that has already been configured to capture all Secrets Manager events delivered by AWS CloudTrail.
Option A: Configure CloudTrail as the target of the EventBridge rule. Set up an attribute filter on the IncomingBytes attribute and enable anomaly detection. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure a CloudTrail alarm that uses the SNS topic to send the notification.
- CloudTrail as Target: CloudTrail records API calls for AWS services, but configuring it as the target of an EventBridge rule is not optimal for anomaly detection or notifications. EventBridge rules typically route events to AWS services like Lambda, SNS, or SQS, rather than CloudTrail directly.
- Anomaly Detection: While CloudTrail can log `GetSecretValue` API calls, anomaly detection is typically handled by services like CloudWatch or through EventBridge rules, not directly via CloudTrail alarms.
- Reason for Rejection: This option involves misusing CloudTrail as the target and doesn’t directly address anomaly detection or the correct way to trigger notifications for anomalous API calls.
Option B: Configure CloudTrail as the target of the EventBridge rule. Set up an attribute filter on the IncomingBytes attribute and enable anomaly detection. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure a CloudTrail alarm that uses the SQS queue to send the notification.
- CloudTrail as Target: Similar to Option A, using CloudTrail as a target of the EventBridge rule isn’t the ideal approach. EventBridge can send events to SQS, SNS, or Lambda, but CloudTrail itself should not be the direct target.
- Anomaly Detection: Anomaly detection is better handled with CloudWatch or other AWS services, not directly through CloudTrail.
- Reason for Rejection: The use of CloudTrail as the target is incorrect, and SQS is not the best fit for handling anomaly-based notifications. SNS is more commonly used for notifications.
...
Author: MysticJaguar44 · Last updated Jul 19, 2026
A company is using AWS Organizations with the default SCP. The company needs to restrict AWS usage for all AWS accounts that are in a specific OU.
Except for some desired global services, the AWS usage must occur only in the eu-west-1 Region for all accounts in the OU. A security engineer must create ...
To meet the requirement of restricting AWS usage for all accounts in a specific Organizational Unit (OU) to only the `eu-west-1` region, except for some global services, the security engineer needs to design an Service Control Policy (SCP) that applies this restriction. Let's analyze the options based on the following requirements:
Key Requirements:
1. Region Restriction: AWS usage should only be allowed in the `eu-west-1` region for all accounts in the specific OU.
2. Global Services: Some global services (like IAM, AWS SSO, etc.) must remain available across all regions.
3. Applies to Existing and New Accounts: The SCP must apply to both existing and any new accounts in the OU.
Option Analysis:
We need to structure the SCP to:
- Deny access to all regions except `eu-west-1`.
- Allow the usage of global services (those that are not region-specific).
Let's look at the possible structures for this SCP.
SCP Example (General Structure):
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "",
"Resource": "",
"Condition": {
"StringNotEqualsIfExists": {
"aws:RequestedRegion": "eu-west-1"
}
}
},
{
"Effect": "Allow",
"Action": "",
"Resource": "",
"Condition": {
"StringEqualsIfExists": {
"aws:RequestedRegion": "global"
}
}
}
]
}
```
Key Factors:
1. Allow Global Services: The `"S...
Author: Zara · Last updated Jul 19, 2026
A company is planning to migrate its applications to AWS in a single AWS Region. The company's applications will use a combination of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, and Amazon S3 buckets. The company wants to complete the migration as quickly as possible. All the applications must meet the following requirements:
* Data must be encrypted at rest.
* Data must be encrypted in transit.
* E...
To meet the company's requirements with the least effort, the security engineer needs to ensure that data is encrypted both at rest and in transit, and that endpoints are monitored for anomalous network traffic. Let's break down the options and assess how they contribute to meeting these goals.
Key Requirements:
1. Data Encryption at Rest: This ensures that data stored in services like Amazon EC2 and Amazon S3 is encrypted.
2. Data Encryption in Transit: This ensures that data moving between clients, load balancers, and EC2 instances is encrypted.
3. Endpoint Monitoring for Anomalous Network Traffic: This helps detect any unusual or potentially harmful activity on the endpoints.
Option Analysis:
A) Install the Amazon Inspector agent on EC2 instances by using AWS Systems Manager Automation.
- Data Encryption: This option does not address encryption for data in transit or at rest.
- Anomalous Traffic Monitoring: Amazon Inspector can provide security assessments, but it doesn't directly monitor for anomalous network traffic on EC2 instances.
- Reason for Rejection: While Amazon Inspector is useful for security assessments, this option does not directly address the primary requirements of encryption or monitoring anomalous traffic, and it requires additional configuration and setup for each EC2 instance.
B) Enable Amazon GuardDuty in all AWS accounts.
- Anomalous Traffic Monitoring: GuardDuty is a threat detection service that continuously monitors for anomalous activity, including unusual network traffic patterns and malicious behavior.
- Encryption: GuardDuty does not directly handle encryption but supports monitoring security-related activities (which is useful for endpoint monitoring).
- Reason for Selection: This option is essential for monitoring anomalous network traffic, and it's a relatively easy and effective solution to detect suspicious activity without requiring complex manual setup.
C) Create VPC endpoints for Amazon EC2 and Amazon S3. Update VPC route tables to use only the secure VPC endpoints.
- Data Encryption in Transit: VPC endpoints ensure that traffic between EC2 instances and S3 remains private and encrypted over the AWS network, which is highly secure.
- Encryption at Rest: VPC endpoints do not directly affect encryption at rest for S3 or EC2.
- Reason for Rejection: While VPC endpoints provide secure and encrypted traffic in transit, they do not directly address e...
Author: Ryan · Last updated Jul 19, 2026
A security engineer is working with a development team to design a supply chain application that stores sensitive inventory data in an Amazon S3 bucket. The application will use an AWS Key Management Service (AWS KMS) customer managed key to encrypt the data in Amazon S3.
The inventory data in Amazon S3 will be shared with hundreds of vendors. All vendors will use AWS principals from their own AWS accounts to access the data in Amazon S3. The vendor list might change...
To meet the requirement of securely managing cross-account access for a customer-managed key in AWS KMS and enabling the sharing of sensitive inventory data in Amazon S3, the solution should be both secure and operationally efficient. The application involves multiple vendors with potentially changing access every week, which requires a flexible and scalable access control mechanism.
Let’s evaluate each option in detail:
Option A: Use KMS grants to manage key access. Programmatically create and revoke grants to manage vendor access.
- KMS Grants: KMS grants provide fine-grained access control by granting permissions to specific principals for a limited time or with certain conditions. Grants can be created and revoked programmatically.
- Operational Efficiency: While grants allow fine-grained control over key access, they are less intuitive and harder to manage at scale when dealing with hundreds of vendors. Managing grants programmatically for every vendor change could become cumbersome, especially if the vendor list changes frequently.
- Reason for Rejection: This approach could require significant custom automation for every vendor change, making it less efficient in a scenario where the vendor list changes weekly.
Option B: Use an IAM role to manage key access. Programmatically update the IAM role policies to manage vendor access.
- IAM Roles: IAM roles can be used to grant access to resources across AWS accounts. However, for managing KMS key access specifically, IAM roles would require the role policies to include specific permissions for KMS actions, which would need to be updated programmatically as vendor access changes.
- Operational Efficiency: This solution involves managing IAM policies for every vendor in every account, which could become operationally challenging at scale, especially when there are frequent changes to the vendor list.
- Reason for Rejection: While it’s possible to use IAM roles, it would require manually updating IAM role policies or creating new roles each time vendors change. This adds unnecessary complexity and operational overhead.
Option C: Use KMS key policies to manage key access. Programmatically update the KMS key policies to manage vendor access.
- KMS Key Policies: A KMS key policy de...
Author: Ethan Smith · Last updated Jul 19, 2026
A company runs an application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). A security engineer needs to provide secure access to the application without requiring the use of a VPN. Users should be able to access the application only when they...
To meet the security requirements of providing secure access to the application without requiring a VPN and ensuring that users can access the application only when they meet specific security conditions, including a defined device posture, let's evaluate each option:
Option A: Create an AWS WAF web ACL. Configure a custom response to block traffic that does not align with the defined device posture.
- Analysis: AWS WAF (Web Application Firewall) can block or allow traffic based on a set of conditions, such as IP addresses, geographic locations, HTTP headers, and request body content. However, it is not natively designed to enforce device posture checks. While you can implement some level of security with WAF (e.g., blocking certain traffic types), it does not have built-in support for evaluating specific device posture or enforcing device security checks like device health, installed software, or security settings.
- Reason for Rejection: AWS WAF is not designed to handle detailed device posture evaluation, which is a key requirement in this scenario. It cannot enforce security conditions related to device posture on its own.
Option B: Configure AWS Verified Access. Add the application by creating an endpoint for the ALB.
- Analysis: AWS Verified Access is a service that allows you to control access to your applications based on identity, device posture, and other security conditions. It integrates well with services like Amazon EC2 and ALB and can enforce device posture checks, such as ensuring that users meet specific security conditions like device health, compliance, and security software status. It works seamlessly with ALB to control user access based on these conditions.
- Reason for Selection: AWS Verified Access is specifically designed for scenario...
Author: Aria · Last updated Jul 19, 2026
A company needs to retain data that is stored in Amazon CloudWatch Logs log groups. The company must retain this data for 90 days. The company must receive notification in AWS Security Hub when log group retention is no...
Option A: Create a Security Hub custom action to assess the log group retention period.
- Analysis: A Security Hub custom action allows users to create custom workflows for security findings, such as marking findings as reviewed or assigning them to a specific user. However, custom actions do not automatically assess compliance or check configurations like log group retention periods. Instead, they are typically triggered manually based on security findings or alerts.
- Reason for Rejection: While Security Hub custom actions are useful for workflow automation based on findings, they do not provide automated monitoring or assessment of CloudWatch Logs retention policies. Therefore, this option is not suitable for continuously monitoring log retention compliance.
Option B: Create a data protection policy in CloudWatch Logs to assess the log group retention period.
- Analysis: CloudWatch Logs data protection policies can be used to monitor log data and ensure compliance with certain security and data protection policies. However, CloudWatch Logs does not directly support a built-in feature for assessing the retention period of log groups through such policies.
- Reason for Rejection: CloudWatch Logs does not have a native "data protection policy" feature to assess the retention period for log groups. This makes it an ineffective solution for the requirement.
Option C: Create a Security Hub automation rule. Configure the automation rule to assess the log group retention period.
- Analysis: Security Hub automation rules can be used to automatically take actions based on security findings, such as triggering workflows or remediati...
