Security Engineering on AWS Certification Security Engineering on AWS Certification Infrastructure Security & Automation 2

Question 1

Which AWS service can automatically quarantine an EC2 instance by changing its security group when a GuardDuty finding is triggered?

Accepted Answer

AWS Lambda triggered by EventBridge rule on GuardDuty finding

Answer

An EventBridge rule can match GuardDuty findings and invoke a Lambda function that calls the EC2 API to replace the instance's security group with an isolation group.

Question 2

What is the purpose of an AWS Service Control Policy (SCP) in the context of security engineering?

Accepted Answer

To set permission guardrails that restrict actions available to all principals in an OU or account, even if IAM allows them

Answer

SCPs act as organizational guardrails; they define the maximum permissions available in an account, overriding permissive IAM policies when they deny an action.

Question 3

A security engineer needs to ensure that no AWS resources in a given account are ever deployed outside of us-east-1 and us-west-2. What is the most scalable enforcement mechanism?

Accepted Answer

Apply an SCP that denies all actions when aws:RequestedRegion is not in the allowed list

Answer

An SCP with a Deny statement on all actions with a condition on aws:RequestedRegion not matching allowed regions enforces region restriction across all principals.

Question 4

Which AWS Systems Manager capability allows security engineers to define and enforce configuration state on EC2 instances using desired-state documents?

Accepted Answer

State Manager

Answer

State Manager uses SSM Associations to apply configuration documents (SSM documents) to instances on a schedule, ensuring they maintain a defined state.

Question 5

An engineer wants to prevent developers from disabling CloudTrail in any account in the organization. What is the most effective control?

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail

Answer

An SCP denying cloudtrail:StopLogging and cloudtrail:DeleteTrail applies to all principals in the organization, including account administrators, and cannot be overridden by account-level IAM policies.

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Security Engineering on AWS Certification Infrastructure Security & Automation 2