AWS DevOps Security Automation 2 — Questions and Answers
Question 1: A security team wants to automatically remediate S3 buckets that become publicly accessible. Which combination of AWS services achieves this with the least operational overhead?
- AWS Config rule with an SSM Automation remediation document (Correct answer)
- CloudTrail with a Lambda function triggered by SNS
- GuardDuty with a custom Lambda remediation function
- Security Hub with a manual approval workflow
Correct answer: AWS Config rule with an SSM Automation remediation document
AWS Config rules can be paired with SSM Automation documents to automatically remediate non-compliant resources without custom Lambda code.
Question 2: During a pipeline run, you need to scan container images for known CVEs before pushing to ECR. Which service is purpose-built for this task within an AWS-native pipeline?
- Amazon Inspector with ECR integration (Correct answer)
- AWS Security Hub with container findings
- Amazon Macie with image analysis
- AWS WAF with container rules
Correct answer: Amazon Inspector with ECR integration
Amazon Inspector integrates natively with ECR to scan container images for CVEs on push and continuously thereafter.
Question 3: Your CodePipeline must ensure that all CloudFormation stacks pass a security review before deployment. Which approach enforces preventive controls at the IaC layer?
- AWS CloudFormation Guard (cfn-guard) rules in a CodeBuild stage (Correct answer)
- AWS Config rules evaluated after stack creation
- CloudTrail log analysis post-deployment
- IAM policy conditions on the CloudFormation service role
Correct answer: AWS CloudFormation Guard (cfn-guard) rules in a CodeBuild stage
CloudFormation Guard evaluates IaC templates against policy rules as a pipeline gate before any resources are provisioned.
Question 4: A DevSecOps team needs secrets stored in AWS Secrets Manager to be automatically rotated every 30 days for an RDS database. What must be configured for this to work?
- A Lambda rotation function associated with the secret and a rotation schedule (Correct answer)
- An EventBridge rule that triggers a CodeBuild project to update credentials
- A Systems Manager Parameter Store advanced parameter with rotation enabled
- An IAM role with scheduled permission to update the secret value
Correct answer: A Lambda rotation function associated with the secret and a rotation schedule
Secrets Manager requires a Lambda rotation function (AWS provides templates) and a rotation schedule configured on the secret.
Question 5: Which AWS service can be used to detect when an IAM principal is making API calls from an unusual geographic location and automatically alert the security team?
- Amazon GuardDuty (Correct answer)
- AWS CloudTrail Insights
- AWS Security Hub
- Amazon Detective
Correct answer: Amazon GuardDuty
GuardDuty uses ML to detect anomalous API activity including calls from unusual locations and generates findings for alerting.
Question 6: A team wants to enforce that all new IAM roles created in their AWS account have a permission boundary attached. Which service and feature enforces this as a preventive control?
- AWS Organizations Service Control Policy (SCP) denying CreateRole without a PermissionsBoundary condition (Correct answer)
- AWS Config rule checking for permission boundaries after role creation
- IAM Access Analyzer blocking roles without boundaries
- CloudTrail rule triggering Lambda to delete non-compliant roles
Correct answer: AWS Organizations Service Control Policy (SCP) denying CreateRole without a PermissionsBoundary condition
An SCP with a Deny on iam:CreateRole unless a PermissionsBoundary condition key is present enforces this preventively across the organization.
Question 7: In a CI/CD pipeline, static application security testing (SAST) should be placed at which stage to provide the earliest feedback to developers?
- In the build stage, immediately after source code checkout (Correct answer)
- After integration tests pass in a staging environment
- Before the production deployment approval gate
- During the post-deployment smoke test stage
Correct answer: In the build stage, immediately after source code checkout
SAST tools analyze source code without execution and should run at build time to give developers the fastest feedback loop.
AWS DevOps Security Automation 2
A security team wants to automatically remediate S3 buckets that become publicly accessible.
Which combination of AWS services achieves this with the least operational overhead?