AWS DevOps Security Automation 5

Question 1

A development team uses AWS CDK to define infrastructure. How can they integrate automated security policy checks into their development workflow before code is committed?

Accepted Answer

Use cdk-nag as a pre-commit hook or CDK aspect to validate stacks against security best practice rules

Answer

cdk-nag is an open-source CDK aspect that applies security and compliance rule packs (AWS Solutions, NIST, PCI) at synthesis time, giving developers immediate feedback.

Question 2

Amazon Macie is enabled in an AWS account. Which type of data does Macie primarily help protect?

Accepted Answer

Sensitive data such as PII and financial information stored in Amazon S3

Answer

Macie uses ML to discover and protect sensitive data (PII, financial records, credentials) stored in S3 buckets.

Question 3

A pipeline must verify that third-party Docker base images have not been tampered with before use. Which mechanism provides cryptographic verification of image integrity?

Accepted Answer

Docker Content Trust (DCT) with image signing verified via Notary, enforced through the DOCKER_CONTENT_TRUST=1 environment variable

Answer

Docker Content Trust uses Notary to cryptographically sign and verify images, ensuring that only signed images from trusted publishers are pulled.

Question 4

AWS IAM Access Analyzer is configured in an AWS account. What is its primary function in a security automation context?

Accepted Answer

Identify resources that are shared with external principals outside the zone of trust using policy analysis

Answer

IAM Access Analyzer uses formal verification to identify resource policies (S3, KMS, IAM roles, etc.) that grant access to external principals.

Question 5

A security team needs to automatically block IP addresses identified by GuardDuty as malicious across all accounts in an AWS Organization. Which service enables centralized enforcement of this control?

Accepted Answer

AWS Network Firewall managed rule groups updated by Lambda from GuardDuty findings, deployed via Firewall Manager

Answer

AWS Firewall Manager centrally deploys and manages Network Firewall policies across accounts, and Lambda can dynamically update threat intelligence rule groups from GuardDuty findings.

AWS Practice Test

AWS Practice Test

AWS DevOps Security Automation 5