AWS DevOps Security Automation 3 — Questions and Answers
Question 1: A company uses AWS CodeArtifact to host internal packages. How can they ensure that only packages without known vulnerabilities are consumed by development teams?
- Integrate Amazon Inspector with CodeArtifact and block packages with critical CVEs via a Lambda upstream proxy (Correct answer)
- Enable AWS Shield Advanced on the CodeArtifact domain
- Use AWS WAF rules to filter package download requests
- Configure CodeArtifact to require MFA for all package downloads
Correct answer: Integrate Amazon Inspector with CodeArtifact and block packages with critical CVEs via a Lambda upstream proxy
Inspector can scan packages in CodeArtifact and a Lambda-backed upstream proxy can block or flag packages with critical vulnerabilities.
Question 2: Which AWS feature allows you to define and enforce tagging policies across all resources in an AWS Organization to support cost allocation and security auditing?
- AWS Organizations Tag Policies (Correct answer)
- AWS Config required-tags managed rule
- AWS Resource Groups tagging API with SCPs
- CloudFormation StackSets with mandatory tag parameters
Correct answer: AWS Organizations Tag Policies
Tag Policies in AWS Organizations define standardized tag keys and allowed values and can enforce compliance across the entire organization.
Question 3: A security engineer needs to ensure that no EC2 instance in the account uses a security group that allows unrestricted inbound SSH (port 22). Which solution provides continuous automated detection?
- AWS Config managed rule restricted-ssh with automatic notification
- A CloudTrail event rule that triggers on AuthorizeSecurityGroupIngress API calls
- Amazon Inspector network reachability assessment on a schedule
- AWS Firewall Manager with a Security Group policy (Correct answer)
Correct answer: AWS Firewall Manager with a Security Group policy
AWS Firewall Manager Security Group policies continuously audit and can automatically remediate non-compliant security groups across accounts.
Question 4: When using AWS KMS customer-managed keys (CMKs) in a CI/CD pipeline, what is the recommended practice for granting CodeBuild access to decrypt artifacts?
- Attach an IAM role to the CodeBuild project with kms:Decrypt permission and reference the role in the CMK key policy (Correct answer)
- Embed the CMK ARN and access key in the buildspec.yml environment variables
- Grant CodeBuild the AWS managed key policy via a resource-based policy
- Use an SCP to allow CodeBuild to access all KMS keys in the account
Correct answer: Attach an IAM role to the CodeBuild project with kms:Decrypt permission and reference the role in the CMK key policy
The CodeBuild service role must have kms:Decrypt in its IAM policy and that role must be listed in the CMK key policy for cross-service access.
Question 5: A DevOps team stores database credentials as environment variables in CodeBuild. The security team flags this as a risk. What is the correct remediation?
- Reference secrets using the SSM Parameter Store or Secrets Manager integration in the CodeBuild environment variables configuration (Correct answer)
- Base64-encode the credentials before storing them as environment variables
- Store credentials in a private S3 bucket and download them in the buildspec.yml
- Create a dedicated IAM user with limited permissions whose credentials are stored as variables
Correct answer: Reference secrets using the SSM Parameter Store or Secrets Manager integration in the CodeBuild environment variables configuration
CodeBuild natively supports referencing SSM Parameter Store and Secrets Manager secrets in environment variable definitions, keeping plaintext credentials out of the build configuration.
Question 6: Which AWS service provides a managed, centralized dashboard that aggregates security findings from GuardDuty, Inspector, Macie, and other services across multiple accounts?
- AWS Security Hub (Correct answer)
- Amazon Detective
- AWS Trusted Advisor
- AWS Config Aggregator
Correct answer: AWS Security Hub
AWS Security Hub aggregates, normalizes, and prioritizes findings from integrated AWS security services and third-party tools.
Question 7: A pipeline deploys infrastructure using CloudFormation. To enforce least privilege, the CloudFormation service role should have which characteristic?
- Only the permissions required to create, update, and delete the specific resources defined in the stack template (Correct answer)
- AdministratorAccess to ensure all resource types can be provisioned without errors
- ReadOnlyAccess plus iam:PassRole to handle all IAM operations
- PowerUserAccess with an SCP restricting destructive actions
Correct answer: Only the permissions required to create, update, and delete the specific resources defined in the stack template
The CloudFormation service role should follow least privilege and only include permissions for the exact resource types used in that specific stack.
AWS DevOps Security Automation 3
A company uses AWS CodeArtifact to host internal packages.
How can they ensure that only packages without known vulnerabilities are consumed by development teams?