AWS DevOps Safety Systems & Standards 3 — Questions and Answers
Question 1: Which AWS service provides automated security assessments that check for deviations from security best practices in EC2 instances and container workloads?
- AWS Security Hub
- Amazon Inspector (Correct answer)
- AWS Config
- Amazon GuardDuty
Correct answer: Amazon Inspector
Amazon Inspector performs automated vulnerability assessments on EC2 instances and container images, checking for software vulnerabilities and unintended network exposure.
Question 2: A DevOps team needs to enforce that all S3 buckets must have server-side encryption enabled. Which AWS tool automatically remediates non-compliant resources?
- AWS Trusted Advisor
- AWS Config with auto-remediation (Correct answer)
- AWS Security Hub
- Amazon Macie
Correct answer: AWS Config with auto-remediation
AWS Config rules can trigger automatic remediation actions via AWS Systems Manager Automation documents when resources are found non-compliant.
Question 3: In a CI/CD pipeline, which practice ensures that infrastructure code meets security standards before deployment?
- Blue/green deployment
- Static code analysis with tools like Checkov or cfn-nag (Correct answer)
- Canary releases
- A/B testing
Correct answer: Static code analysis with tools like Checkov or cfn-nag
Static analysis tools like Checkov and cfn-nag scan IaC templates (CloudFormation, Terraform) for security misconfigurations before deployment.
Question 4: Which AWS CodePipeline feature can pause a pipeline execution and require a human to review and approve changes before proceeding to production?
- Manual approval action (Correct answer)
- Gate check stage
- Deployment blocker
- Pipeline freeze
Correct answer: Manual approval action
CodePipeline's manual approval action halts the pipeline and sends an SNS notification, requiring an authorized reviewer to approve or reject before continuing.
Question 5: A team wants to detect when IAM policies are modified in their AWS account. Which service should they configure to alert on these changes?
- Amazon Inspector
- AWS CloudTrail with Amazon EventBridge rules (Correct answer)
- AWS Shield
- Amazon Macie
Correct answer: AWS CloudTrail with Amazon EventBridge rules
CloudTrail logs all IAM API calls, and EventBridge rules can trigger alerts or automated responses when specific IAM modification events are detected.
Question 6: Which AWS feature allows you to define guardrails that prevent AWS accounts in an Organization from performing specific high-risk actions regardless of IAM permissions?
- IAM permission boundaries
- Service Control Policies (SCPs) (Correct answer)
- AWS Config rules
- Resource-based policies
Correct answer: Service Control Policies (SCPs)
SCPs in AWS Organizations act as maximum permission boundaries, blocking actions even if an IAM policy explicitly grants them.
Question 7: During a rolling deployment, an application's error rate spikes above the defined threshold. Which AWS service automatically triggers a rollback based on CloudWatch alarms?
- AWS CodeDeploy with automatic rollback (Correct answer)
- AWS Elastic Beanstalk health checks
- AWS CloudFormation drift detection
- AWS X-Ray tracing
Correct answer: AWS CodeDeploy with automatic rollback
AWS CodeDeploy can be configured to automatically roll back a deployment when a CloudWatch alarm threshold is breached during or after deployment.
AWS DevOps Safety Systems & Standards 3
Which AWS service provides automated security assessments that check for deviations from security best practices in EC2 instances and container workloads?