AWS DevOps Security Automation 5 — Questions and Answers
Question 1: A development team uses AWS CDK to define infrastructure. How can they integrate automated security policy checks into their development workflow before code is committed?
- Use cdk-nag as a pre-commit hook or CDK aspect to validate stacks against security best practice rules (Correct answer)
- Run aws cloudformation validate-template on the synthesized template in a CI stage
- Manually review CDK code in pull requests using a checklist
- Deploy to a sandbox account and run Inspector after each commit
Correct answer: Use cdk-nag as a pre-commit hook or CDK aspect to validate stacks against security best practice rules
cdk-nag is an open-source CDK aspect that applies security and compliance rule packs (AWS Solutions, NIST, PCI) at synthesis time, giving developers immediate feedback.
Question 2: Amazon Macie is enabled in an AWS account. Which type of data does Macie primarily help protect?
- Sensitive data such as PII and financial information stored in Amazon S3 (Correct answer)
- Credentials and secrets stored in EC2 instance environment variables
- Encryption keys stored in AWS KMS
- Database records containing personal information in Amazon RDS
Correct answer: Sensitive data such as PII and financial information stored in Amazon S3
Macie uses ML to discover and protect sensitive data (PII, financial records, credentials) stored in S3 buckets.
Question 3: A pipeline must verify that third-party Docker base images have not been tampered with before use. Which mechanism provides cryptographic verification of image integrity?
- Docker Content Trust (DCT) with image signing verified via Notary, enforced through the DOCKER_CONTENT_TRUST=1 environment variable (Correct answer)
- Scanning the image with Amazon Inspector before pulling
- Using only ECR-hosted images with immutable tags enabled
- Verifying the image SHA256 digest manually in the buildspec.yml
Correct answer: Docker Content Trust (DCT) with image signing verified via Notary, enforced through the DOCKER_CONTENT_TRUST=1 environment variable
Docker Content Trust uses Notary to cryptographically sign and verify images, ensuring that only signed images from trusted publishers are pulled.
Question 4: AWS IAM Access Analyzer is configured in an AWS account. What is its primary function in a security automation context?
- Identify resources that are shared with external principals outside the zone of trust using policy analysis (Correct answer)
- Detect anomalous API call patterns that may indicate credential compromise
- Automatically rotate IAM access keys that have not been used in 90 days
- Enforce MFA requirements on all IAM users through continuous monitoring
Correct answer: Identify resources that are shared with external principals outside the zone of trust using policy analysis
IAM Access Analyzer uses formal verification to identify resource policies (S3, KMS, IAM roles, etc.) that grant access to external principals.
Question 5: A security team needs to automatically block IP addresses identified by GuardDuty as malicious across all accounts in an AWS Organization. Which service enables centralized enforcement of this control?
- AWS Network Firewall managed rule groups updated by Lambda from GuardDuty findings, deployed via Firewall Manager (Correct answer)
- A WAF IP set manually updated based on GuardDuty finding notifications
- VPC Network ACLs updated by a Lambda function in each account independently
- Security groups updated account-by-account using an SSM Automation runbook
Correct answer: AWS Network Firewall managed rule groups updated by Lambda from GuardDuty findings, deployed via Firewall Manager
AWS Firewall Manager centrally deploys and manages Network Firewall policies across accounts, and Lambda can dynamically update threat intelligence rule groups from GuardDuty findings.
Question 6: In a CI/CD pipeline, dependency scanning (software composition analysis) is used to detect what type of security risk?
- Known vulnerabilities in third-party open-source libraries and packages used by the application (Correct answer)
- Hardcoded secrets and API keys in the application source code
- Misconfigured IAM roles and overly permissive policies in the deployment
- Insecure coding patterns and logic flaws in the application's own code
Correct answer: Known vulnerabilities in third-party open-source libraries and packages used by the application
Software composition analysis (SCA) identifies open-source dependencies with known CVEs, license violations, or other supply-chain risks.
Question 7: A company wants to ensure that Lambda functions deployed through their pipeline do not have overly permissive execution roles. Which approach enforces this at pipeline time?
- IAM Access Analyzer policy validation integrated as a CodeBuild step that fails the build if policies exceed a defined permission scope (Correct answer)
- Manually reviewing Lambda function policies during the code review process
- AWS Config lambda-function-public-access-prohibited rule evaluated post-deployment
- CloudTrail monitoring of Lambda invocations to detect unauthorized data access
Correct answer: IAM Access Analyzer policy validation integrated as a CodeBuild step that fails the build if policies exceed a defined permission scope
IAM Access Analyzer's policy validation API can be called in CodeBuild to programmatically check for overly permissive policies and fail the pipeline before deployment.
AWS DevOps Security Automation 5
A development team uses AWS CDK to define infrastructure.
How can they integrate automated security policy checks into their development workflow before code is committed?