Security Engineering on AWS Certification Security Engineering on AWS Certification Infrastructure Security & Automation

Question 1

Which AWS service provides automated security assessments of EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure?

Accepted Answer

Amazon Inspector

Answer

Amazon Inspector automatically scans workloads for vulnerabilities (CVEs) and network reachability issues, integrating with ECR and Lambda as well as EC2.

Question 2

An engineer wants to enforce that all new EC2 instances must be launched with an approved AMI. Which AWS service can enforce this at provisioning time?

Accepted Answer

AWS Service Control Policies (SCPs)

Answer

SCPs can deny ec2:RunInstances calls that do not specify an AMI ID from an approved list, preventing non-compliant instance launches organization-wide.

Question 3

What is the primary security benefit of using AWS CloudFormation StackSets for infrastructure deployment?

Accepted Answer

It enables consistent, auditable, and repeatable infrastructure deployment across multiple accounts and regions

Answer

StackSets deploy identical CloudFormation stacks across multiple AWS accounts and regions, ensuring security baseline consistency at scale.

Question 4

A security engineer needs to patch all EC2 instances running Amazon Linux 2 across multiple accounts without logging into each instance. Which service should they use?

Accepted Answer

AWS Systems Manager Patch Manager

Answer

AWS Systems Manager Patch Manager automates patching of managed instances using patch baselines and maintenance windows, with no direct SSH access required.

Question 5

Which AWS feature allows you to run commands on EC2 instances at scale without opening inbound SSH or RDP ports?

Accepted Answer

AWS Systems Manager Session Manager

Answer

Session Manager provides secure, browser-based shell access to EC2 instances via the SSM Agent, with no need for open inbound ports or SSH keys.

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Security Engineering on AWS Certification Infrastructure Security & Automation