Security Engineering on AWS Certification Security Engineering on AWS Certification Infrastructure Security & Automation 2 — Questions and Answers
Question 1: Which AWS service can automatically quarantine an EC2 instance by changing its security group when a GuardDuty finding is triggered?
- AWS Shield
- AWS Lambda triggered by EventBridge rule on GuardDuty finding (Correct answer)
- Amazon Inspector
- AWS Config auto-remediation
Correct answer: AWS Lambda triggered by EventBridge rule on GuardDuty finding
An EventBridge rule can match GuardDuty findings and invoke a Lambda function that calls the EC2 API to replace the instance's security group with an isolation group.
Question 2: What is the purpose of an AWS Service Control Policy (SCP) in the context of security engineering?
- To grant permissions to IAM users in member accounts
- To set permission guardrails that restrict actions available to all principals in an OU or account, even if IAM allows them (Correct answer)
- To enforce MFA on the root account
- To encrypt data in all S3 buckets
Correct answer: To set permission guardrails that restrict actions available to all principals in an OU or account, even if IAM allows them
SCPs act as organizational guardrails; they define the maximum permissions available in an account, overriding permissive IAM policies when they deny an action.
Question 3: A security engineer needs to ensure that no AWS resources in a given account are ever deployed outside of us-east-1 and us-west-2. What is the most scalable enforcement mechanism?
- Use IAM condition keys aws:RequestedRegion in all policies
- Apply an SCP that denies all actions when aws:RequestedRegion is not in the allowed list (Correct answer)
- Configure AWS Config rules per region
- Use CloudTrail to alert on out-of-region activity
Correct answer: Apply an SCP that denies all actions when aws:RequestedRegion is not in the allowed list
An SCP with a Deny statement on all actions with a condition on aws:RequestedRegion not matching allowed regions enforces region restriction across all principals.
Question 4: Which AWS Systems Manager capability allows security engineers to define and enforce configuration state on EC2 instances using desired-state documents?
- Session Manager
- Patch Manager
- State Manager (Correct answer)
- Parameter Store
Correct answer: State Manager
State Manager uses SSM Associations to apply configuration documents (SSM documents) to instances on a schedule, ensuring they maintain a defined state.
Question 5: An engineer wants to prevent developers from disabling CloudTrail in any account in the organization. What is the most effective control?
- Apply an IAM policy denying cloudtrail:StopLogging to all users
- Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail (Correct answer)
- Enable MFA Delete on the CloudTrail S3 bucket
- Use AWS Config to detect and re-enable CloudTrail
Correct answer: Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail
An SCP denying cloudtrail:StopLogging and cloudtrail:DeleteTrail applies to all principals in the organization, including account administrators, and cannot be overridden by account-level IAM policies.
Question 6: Which AWS service can be used to create golden AMIs with security baselines pre-baked, and automatically test and distribute them across regions?
- AWS Systems Manager Patch Manager
- EC2 Image Builder (Correct answer)
- AWS CodePipeline
- AWS Elastic Beanstalk
Correct answer: EC2 Image Builder
EC2 Image Builder automates the creation, testing, and distribution of hardened AMIs on a schedule, ensuring new instances launch with compliant baselines.
Security Engineering on AWS Certification Security Engineering on AWS Certification Infrastructure Security & Automation 2
Which AWS service can automatically quarantine an EC2 instance by changing its security group when a GuardDuty finding is triggered?