Security Engineering on AWS Certification Security Engineering on AWS Certification Infrastructure Security & Automation

Question 1

Which AWS service provides automated security assessments of EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure?

Accepted Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 2

An engineer wants to enforce that all new EC2 instances must be launched with an approved AMI. Which AWS service can enforce this at provisioning time?

Accepted Answer

AWS Service Control Policies (SCPs)

Answer

AWS Config with auto-remediation

Answer

EC2 Image Builder

Answer

AWS Systems Manager Patch Manager

Question 3

What is the primary security benefit of using AWS CloudFormation StackSets for infrastructure deployment?

Accepted Answer

It enables consistent, auditable, and repeatable infrastructure deployment across multiple accounts and regions

Answer

It automatically patches operating systems

Answer

It provides real-time threat detection

Answer

It encrypts all deployed resources automatically

Question 4

A security engineer needs to patch all EC2 instances running Amazon Linux 2 across multiple accounts without logging into each instance. Which service should they use?

Accepted Answer

AWS Systems Manager Patch Manager

Answer

AWS CodeDeploy

Answer

EC2 User Data scripts

Answer

AWS OpsWorks

Question 5

Which AWS feature allows you to run commands on EC2 instances at scale without opening inbound SSH or RDP ports?

Accepted Answer

AWS Systems Manager Session Manager

Answer

EC2 Instance Connect

Answer

AWS Bastion Host

Answer

VPC Endpoint for EC2

Question 6

When using AWS CloudFormation to deploy infrastructure, which resource type should be used to create a stack that automatically enforces a specific IAM role on all EC2 instances in a region?

Accepted Answer

AWS::CloudFormation::StackSet deployed at the organization level

Answer

AWS::EC2::Instance with UserData

Answer

AWS::IAM::InstanceProfile associated via cfn-init

Answer

AWS::SSM::Association