AWS DevOps Security Automation 4 — Questions and Answers
Question 1: A team needs to automatically quarantine an EC2 instance when GuardDuty detects a cryptocurrency mining finding. Which architecture achieves this with the least custom code?
- EventBridge rule matching the GuardDuty finding type triggers an SSM Automation runbook that isolates the instance (Correct answer)
- A Lambda function polling the GuardDuty API every minute to check for findings
- CloudTrail alarm in CloudWatch that triggers an SNS topic to notify the security team
- AWS Config rule that detects the instance and sends a remediation notification
Correct answer: EventBridge rule matching the GuardDuty finding type triggers an SSM Automation runbook that isolates the instance
EventBridge natively receives GuardDuty findings as events, and SSM Automation runbooks can isolate instances without custom Lambda code.
Question 2: When implementing infrastructure-as-code security scanning in a pipeline, what is the primary difference between Checkov and AWS CloudFormation Guard?
- Checkov supports multiple IaC frameworks (Terraform, CloudFormation, Kubernetes) while cfn-guard is CloudFormation-specific with a custom policy language (Correct answer)
- Checkov only runs on Linux while cfn-guard is cross-platform
- cfn-guard requires an AWS account to run while Checkov is fully offline
- Checkov is a commercial tool while cfn-guard is open source
Correct answer: Checkov supports multiple IaC frameworks (Terraform, CloudFormation, Kubernetes) while cfn-guard is CloudFormation-specific with a custom policy language
Checkov is a multi-framework open-source scanner while cfn-guard uses a domain-specific rule language designed specifically for CloudFormation and CDK templates.
Question 3: A company wants to ensure that all API calls made in their AWS accounts are logged and immutable audit trails are stored for 7 years. Which architecture satisfies this requirement?
- CloudTrail organization trail with log file validation enabled, logs shipped to S3 with Object Lock (Compliance mode) and Glacier lifecycle policy (Correct answer)
- CloudTrail per-account trails stored in standard S3 buckets with versioning enabled
- VPC Flow Logs stored in CloudWatch Logs with a 7-year retention policy
- AWS Config configuration history stored in S3 with MFA delete enabled
Correct answer: CloudTrail organization trail with log file validation enabled, logs shipped to S3 with Object Lock (Compliance mode) and Glacier lifecycle policy
An organization trail with log file validation plus S3 Object Lock in Compliance mode creates tamper-proof, immutable audit logs that cannot be deleted even by root.
Question 4: In a multi-account AWS environment, which approach best prevents any account from disabling CloudTrail logging?
- An SCP that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail for all principals (Correct answer)
- An IAM permission boundary on all IAM users prohibiting CloudTrail modifications
- An AWS Config rule that re-enables CloudTrail if it is found to be disabled
- CloudWatch alarms on CloudTrail API calls with SNS alerts to the security team
Correct answer: An SCP that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail for all principals
SCPs at the Organizations level are preventive controls that override all IAM permissions and prevent even account root from disabling CloudTrail.
Question 5: A security automation pipeline needs to dynamically retrieve a TLS certificate for a new service. Which AWS service automates certificate issuance and renewal with the least operational overhead?
- AWS Certificate Manager (ACM) with automatic renewal for certificates used with AWS services (Correct answer)
- AWS Private CA with a Lambda function triggered monthly to renew certificates
- IAM Server Certificates with a cron job running on EC2 to handle renewals
- Let's Encrypt certificates managed via a Systems Manager State Manager association
Correct answer: AWS Certificate Manager (ACM) with automatic renewal for certificates used with AWS services
ACM automatically renews certificates before expiration when used with integrated AWS services like ALB, CloudFront, and API Gateway.
Question 6: Which AWS service enables you to define and audit that all EBS volumes attached to EC2 instances are encrypted, and automatically enforce encryption for new volumes?
- Enable EBS encryption by default at the account level plus an AWS Config rule to detect unencrypted existing volumes (Correct answer)
- AWS Macie scanning EBS snapshots for unencrypted data
- Amazon Inspector checking EBS volume encryption settings
- An SCP denying ec2:CreateVolume without the encrypted flag
Correct answer: Enable EBS encryption by default at the account level plus an AWS Config rule to detect unencrypted existing volumes
The account-level EBS encryption default ensures all new volumes are encrypted, while Config's encrypted-volumes rule detects existing non-compliant volumes.
Question 7: A CodePipeline deployment to production requires that a human security approver reviews the change before proceeding. Which stage type implements this control?
- A Manual Approval action in CodePipeline that sends an SNS notification to approvers (Correct answer)
- A CodeBuild stage that pauses and waits for an SSH command to continue
- A Lambda function that polls an external ticketing system for approval status
- An EventBridge rule that halts pipeline execution until an SNS message is received
Correct answer: A Manual Approval action in CodePipeline that sends an SNS notification to approvers
CodePipeline's built-in Manual Approval action pauses the pipeline and sends SNS notifications to approvers who can approve or reject via console, CLI, or API.
AWS DevOps Security Automation 4
A team needs to automatically quarantine an EC2 instance when GuardDuty detects a cryptocurrency mining finding.
Which architecture achieves this with the least custom code?