DevOps Engineering on AWS Certification Security Automation and Compliance on AWS 1 — Questions and Answers
Question 1: Which AWS service continuously monitors AWS resource configurations and evaluates them against desired configurations?
- AWS CloudTrail
- Amazon Inspector
- AWS Config (Correct answer)
- AWS Security Hub
Correct answer: AWS Config
AWS Config continuously records resource configurations and evaluates them against config rules to detect non-compliant resources.
Question 2: What AWS IAM feature allows you to set permission boundaries that limit the maximum permissions an IAM entity can have?
- IAM roles
- Service control policies
- Permission boundaries (Correct answer)
- Resource-based policies
Correct answer: Permission boundaries
Permission boundaries define the maximum permissions that an IAM entity (user or role) can have, even if their identity-based policies grant more.
Question 3: Which AWS service manages encryption keys and provides hardware security module (HSM) backing for cryptographic operations?
- AWS Secrets Manager
- AWS Certificate Manager
- AWS KMS (Correct answer)
- AWS CloudHSM
Correct answer: AWS KMS
AWS KMS (Key Management Service) provides managed encryption key creation and control, backed by FIPS 140-2 validated HSMs.
Question 4: What AWS service automates security assessments of EC2 instances and container images for vulnerabilities and deviations from best practices?
- Amazon GuardDuty
- AWS Config
- Amazon Inspector (Correct answer)
- AWS Security Hub
Correct answer: Amazon Inspector
Amazon Inspector automatically assesses EC2 instances and container images for software vulnerabilities and unintended network exposure.
Question 5: Which AWS Organizations feature allows central governance by setting guardrails that restrict what actions can be performed in member accounts?
- IAM permission boundaries
- Service control policies (SCPs) (Correct answer)
- Resource-based policies
- AWS Config rules
Correct answer: Service control policies (SCPs)
Service Control Policies (SCPs) in AWS Organizations set maximum available permissions for all accounts in an organizational unit or the entire organization.
Question 6: What is the purpose of AWS Secrets Manager in a DevOps pipeline?
- Encrypting S3 objects at rest
- Storing, rotating, and retrieving secrets like database credentials and API keys (Correct answer)
- Managing IAM role permissions
- Auditing API calls in the account
Correct answer: Storing, rotating, and retrieving secrets like database credentials and API keys
AWS Secrets Manager securely stores and automatically rotates secrets such as database passwords and API keys, integrating with services like RDS.
DevOps Engineering on AWS Certification Security Automation and Compliance on AWS 1
Which AWS service continuously monitors AWS resource configurations and evaluates them against desired configurations?