AWS DevOps Safety Systems & Standards 4 — Questions and Answers
Question 1: Which AWS Systems Manager capability helps enforce patch compliance standards across a fleet of EC2 instances on a scheduled basis?
- Systems Manager Run Command
- Systems Manager Patch Manager (Correct answer)
- Systems Manager Parameter Store
- Systems Manager Inventory
Correct answer: Systems Manager Patch Manager
Patch Manager automates patching of EC2 instances using patch baselines and maintenance windows to ensure compliance with OS and application patch standards.
Question 2: A company must ensure no secrets are committed to their CodeCommit repository. Which approach integrates secret detection into the pipeline?
- Enable CodeCommit encryption at rest
- Use a CodeBuild pre-build phase with tools like git-secrets or truffleHog (Correct answer)
- Enable AWS Macie on the repository
- Use IAM policies to restrict commits
Correct answer: Use a CodeBuild pre-build phase with tools like git-secrets or truffleHog
Running secret-scanning tools such as git-secrets or truffleHog in a CodeBuild pre-build phase catches hardcoded credentials before they reach the repository.
Question 3: What is the purpose of using AWS Secrets Manager rotation in a DevOps pipeline compared to storing credentials in environment variables?
- It reduces latency for database queries
- It automatically rotates credentials and eliminates long-lived static secrets (Correct answer)
- It provides faster secret retrieval than Parameter Store
- It encrypts secrets with a stronger algorithm
Correct answer: It automatically rotates credentials and eliminates long-lived static secrets
Secrets Manager automatically rotates credentials on a schedule, reducing the risk of compromised long-lived static secrets stored in environment variables.
Question 4: Which AWS service enables you to set up continuous compliance monitoring and automatically generate audit-ready reports for standards like PCI DSS and HIPAA?
- AWS Security Hub
- AWS Audit Manager (Correct answer)
- AWS Config
- AWS Trusted Advisor
Correct answer: AWS Audit Manager
AWS Audit Manager continuously collects evidence and maps it to compliance frameworks like PCI DSS, HIPAA, and SOC 2 to simplify audit preparation.
Question 5: A DevOps engineer needs to ensure that only signed container images are deployed to Amazon ECS. Which AWS feature enforces this requirement?
- Amazon ECR image scanning
- AWS Signer with ECS task definition policy (Correct answer)
- Amazon Inspector container scanning
- IAM roles for task execution
Correct answer: AWS Signer with ECS task definition policy
AWS Signer can sign container images, and ECS can be configured to enforce signature verification policies that reject unsigned or improperly signed images.
Question 6: Which CloudFormation feature detects when deployed stack resources have been manually changed outside of CloudFormation, which can indicate a compliance violation?
- Stack policy enforcement
- Drift detection (Correct answer)
- Change set preview
- Stack termination protection
Correct answer: Drift detection
CloudFormation drift detection compares the actual configuration of stack resources against the expected template configuration, identifying unauthorized manual changes.
Question 7: In AWS DevOps workflows, what is the primary security benefit of using IAM roles for CodeBuild projects instead of IAM users with access keys?
- Roles provide higher API rate limits
- Roles issue temporary credentials that automatically expire, eliminating long-lived key exposure (Correct answer)
- Roles allow cross-account deployments
- Roles bypass MFA requirements
Correct answer: Roles issue temporary credentials that automatically expire, eliminating long-lived key exposure
IAM roles provide temporary, automatically-rotated credentials via STS, eliminating the risk of long-lived access keys being leaked or compromised.
AWS DevOps Safety Systems & Standards 4
Which AWS Systems Manager capability helps enforce patch compliance standards across a fleet of EC2 instances on a scheduled basis?