DevOps Engineering on AWS Certification Security Automation and Compliance on AWS 2 — Questions and Answers
Question 1: Which AWS Config resource type is used to create custom compliance rules using Lambda functions?
- AWS::Config::ConfigRule with type MANAGED
- AWS::Config::ConfigRule with type CUSTOM_LAMBDA (Correct answer)
- AWS::Config::RemediationConfiguration
- AWS::Config::ConformancePack
Correct answer: AWS::Config::ConfigRule with type CUSTOM_LAMBDA
Custom Lambda config rules (type CUSTOM_LAMBDA) invoke a Lambda function to evaluate resource configurations against custom compliance logic.
Question 2: Which AWS KMS key type allows key material to be imported by the customer?
- AWS managed key
- Customer managed key with AWS-provided key material
- Customer managed key with imported key material (Correct answer)
- AWS owned key
Correct answer: Customer managed key with imported key material
Customer managed keys with imported key material allow you to supply your own key material to AWS KMS, giving you full control over the cryptographic material.
Question 3: What AWS service discovers, classifies, and protects sensitive data such as PII stored in Amazon S3?
- Amazon Inspector
- Amazon GuardDuty
- Amazon Macie (Correct answer)
- AWS Config
Correct answer: Amazon Macie
Amazon Macie uses machine learning to automatically discover and classify sensitive data like PII in S3 and alerts on data security risks.
Question 4: Which AWS service provides automated remediation of non-compliant AWS Config rules?
- AWS Systems Manager Automation
- AWS Lambda
- AWS Config Remediation Actions
- Both AWS Config Remediation Actions using SSM Automation (Correct answer)
Correct answer: Both AWS Config Remediation Actions using SSM Automation
AWS Config supports automatic remediation by triggering SSM Automation documents to fix non-compliant resources without manual intervention.
Question 5: What is the purpose of a VPC endpoint policy?
- To control inbound traffic to the VPC
- To restrict which AWS service APIs can be accessed through the VPC endpoint (Correct answer)
- To define NAT gateway routing rules
- To enforce encryption on VPC traffic
Correct answer: To restrict which AWS service APIs can be accessed through the VPC endpoint
A VPC endpoint policy controls which AWS principals can access which AWS service resources through the VPC endpoint.
Question 6: Which AWS service provides a managed WAF that protects web applications from common exploits like SQL injection and XSS?
- AWS Shield
- AWS Firewall Manager
- AWS WAF (Correct answer)
- Amazon GuardDuty
Correct answer: AWS WAF
AWS WAF is a web application firewall that protects against common web exploits by allowing you to create rules that filter malicious traffic.
DevOps Engineering on AWS Certification Security Automation and Compliance on AWS 2
Which AWS Config resource type is used to create custom compliance rules using Lambda functions?