Security Engineering on AWS Certification Security Engineering on AWS Certification Infrastructure Security & Automation 1 — Questions and Answers
Question 1: Which AWS service provides automated security assessments of EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure?
- Amazon GuardDuty
- AWS Security Hub
- Amazon Inspector (Correct answer)
- AWS Trusted Advisor
Correct answer: Amazon Inspector
Amazon Inspector automatically scans workloads for vulnerabilities (CVEs) and network reachability issues, integrating with ECR and Lambda as well as EC2.
Question 2: An engineer wants to enforce that all new EC2 instances must be launched with an approved AMI. Which AWS service can enforce this at provisioning time?
- AWS Config with auto-remediation
- AWS Service Control Policies (SCPs) (Correct answer)
- EC2 Image Builder
- AWS Systems Manager Patch Manager
Correct answer: AWS Service Control Policies (SCPs)
SCPs can deny ec2:RunInstances calls that do not specify an AMI ID from an approved list, preventing non-compliant instance launches organization-wide.
Question 3: What is the primary security benefit of using AWS CloudFormation StackSets for infrastructure deployment?
- It automatically patches operating systems
- It enables consistent, auditable, and repeatable infrastructure deployment across multiple accounts and regions (Correct answer)
- It provides real-time threat detection
- It encrypts all deployed resources automatically
Correct answer: It enables consistent, auditable, and repeatable infrastructure deployment across multiple accounts and regions
StackSets deploy identical CloudFormation stacks across multiple AWS accounts and regions, ensuring security baseline consistency at scale.
Question 4: A security engineer needs to patch all EC2 instances running Amazon Linux 2 across multiple accounts without logging into each instance. Which service should they use?
- AWS CodeDeploy
- AWS Systems Manager Patch Manager (Correct answer)
- EC2 User Data scripts
- AWS OpsWorks
Correct answer: AWS Systems Manager Patch Manager
AWS Systems Manager Patch Manager automates patching of managed instances using patch baselines and maintenance windows, with no direct SSH access required.
Question 5: Which AWS feature allows you to run commands on EC2 instances at scale without opening inbound SSH or RDP ports?
- EC2 Instance Connect
- AWS Systems Manager Session Manager (Correct answer)
- AWS Bastion Host
- VPC Endpoint for EC2
Correct answer: AWS Systems Manager Session Manager
Session Manager provides secure, browser-based shell access to EC2 instances via the SSM Agent, with no need for open inbound ports or SSH keys.
Question 6: When using AWS CloudFormation to deploy infrastructure, which resource type should be used to create a stack that automatically enforces a specific IAM role on all EC2 instances in a region?
- AWS::EC2::Instance with UserData
- AWS::IAM::InstanceProfile associated via cfn-init
- AWS::CloudFormation::StackSet deployed at the organization level (Correct answer)
- AWS::SSM::Association
Correct answer: AWS::CloudFormation::StackSet deployed at the organization level
StackSets can deploy IAM Instance Profiles consistently across all accounts and regions, ensuring every EC2 instance assumes the correct role.
Security Engineering on AWS Certification Security Engineering on AWS Certification Infrastructure Security & Automation 1
Which AWS service provides automated security assessments of EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure?