AWS DevOps Security Automation 3

Question 1

A company uses AWS CodeArtifact to host internal packages. How can they ensure that only packages without known vulnerabilities are consumed by development teams?

Accepted Answer

Integrate Amazon Inspector with CodeArtifact and block packages with critical CVEs via a Lambda upstream proxy

Answer

Inspector can scan packages in CodeArtifact and a Lambda-backed upstream proxy can block or flag packages with critical vulnerabilities.

Question 2

Which AWS feature allows you to define and enforce tagging policies across all resources in an AWS Organization to support cost allocation and security auditing?

Accepted Answer

AWS Organizations Tag Policies

Answer

Tag Policies in AWS Organizations define standardized tag keys and allowed values and can enforce compliance across the entire organization.

Question 3

A security engineer needs to ensure that no EC2 instance in the account uses a security group that allows unrestricted inbound SSH (port 22). Which solution provides continuous automated detection?

Accepted Answer

AWS Firewall Manager with a Security Group policy

Answer

AWS Firewall Manager Security Group policies continuously audit and can automatically remediate non-compliant security groups across accounts.

Question 4

When using AWS KMS customer-managed keys (CMKs) in a CI/CD pipeline, what is the recommended practice for granting CodeBuild access to decrypt artifacts?

Accepted Answer

Attach an IAM role to the CodeBuild project with kms:Decrypt permission and reference the role in the CMK key policy

Answer

The CodeBuild service role must have kms:Decrypt in its IAM policy and that role must be listed in the CMK key policy for cross-service access.

Question 5

A DevOps team stores database credentials as environment variables in CodeBuild. The security team flags this as a risk. What is the correct remediation?

Accepted Answer

Reference secrets using the SSM Parameter Store or Secrets Manager integration in the CodeBuild environment variables configuration

Answer

CodeBuild natively supports referencing SSM Parameter Store and Secrets Manager secrets in environment variable definitions, keeping plaintext credentials out of the build configuration.

AWS Practice Test

AWS Practice Test

AWS DevOps Security Automation 3