Security Engineering on AWS Certification Container & Serverless Security 1 — Questions and Answers
Question 1: Which AWS service provides runtime security monitoring and threat detection for containerized workloads running in Amazon ECS and EKS?
- AWS Inspector
- Amazon GuardDuty (Correct answer)
- AWS Security Hub
- Amazon Macie
Correct answer: Amazon GuardDuty
Amazon GuardDuty offers ECS/EKS Runtime Monitoring, which uses an eBPF-based security agent to detect threats like privilege escalation, cryptomining, and malicious file execution inside containers at runtime.
Question 2: When configuring a Lambda function's execution role following the principle of least privilege, what is the recommended approach?
- Attach the AdministratorAccess managed policy for simplicity
- Create a unique IAM role per function with only the permissions that function requires (Correct answer)
- Share a single IAM role across all Lambda functions in the account
- Use the AWSLambdaFullAccess managed policy as a starting baseline
Correct answer: Create a unique IAM role per function with only the permissions that function requires
Creating a dedicated IAM execution role per Lambda function scoped to exactly the permissions that function needs limits the blast radius if the function is compromised.
Question 3: What is the most secure method for passing database credentials to an AWS Lambda function?
- Set credentials as plaintext environment variables in the Lambda configuration
- Hard-code credentials directly in the function source code
- Store credentials in AWS Secrets Manager and retrieve them at runtime using the Lambda execution role (Correct answer)
- Pass credentials as query string parameters in the function invocation event
Correct answer: Store credentials in AWS Secrets Manager and retrieve them at runtime using the Lambda execution role
AWS Secrets Manager integrates with Lambda, supports automatic rotation, and the function retrieves secrets at runtime using IAM permissions—keeping credentials out of code and environment variables.
Question 4: Which Amazon ECR feature automatically scans container images for known OS package vulnerabilities when images are pushed to a repository?
- ECR lifecycle policies
- ECR image tag immutability
- ECR enhanced scanning with Amazon Inspector (Correct answer)
- ECR replication
Correct answer: ECR enhanced scanning with Amazon Inspector
ECR enhanced scanning integrates with Amazon Inspector to continuously scan images for OS and programming language package vulnerabilities, reporting findings in both the ECR console and Inspector.
Question 5: What is the primary security advantage of running containers on AWS Fargate instead of self-managed EC2 instances?
- Fargate containers share the host OS kernel for better performance
- Fargate eliminates the need for any IAM permissions
- Each Fargate task runs in its own isolated kernel, removing the risk of cross-container OS-level attacks (Correct answer)
- Fargate automatically disables all network access between tasks
Correct answer: Each Fargate task runs in its own isolated kernel, removing the risk of cross-container OS-level attacks
AWS Fargate provides task-level isolation by running each task on dedicated compute with its own kernel, so a container escape cannot affect other customers' workloads or other tasks.
Question 6: Which Kubernetes feature, supported natively in Amazon EKS, enables fine-grained IAM permissions for individual pods without sharing node-level credentials?
- Kubernetes RBAC ClusterRoles
- IAM Roles for Service Accounts (IRSA) (Correct answer)
- AWS Systems Manager Parameter Store
- EKS managed node groups
Correct answer: IAM Roles for Service Accounts (IRSA)
IRSA uses an OIDC identity provider to allow pods to assume IAM roles via Kubernetes service accounts, giving each pod its own scoped AWS permissions without needing node instance profiles.
Question 7: When configuring an Amazon ECS task definition, which setting prevents a container from running as the Linux root user inside the container?
- Setting the task CPU limit to 256 units
- Enabling the 'readonlyRootFilesystem' flag only
- Setting 'user' to a non-root UID or enabling 'privileged: false' (Correct answer)
- Configuring the task network mode to 'bridge'
Correct answer: Setting 'user' to a non-root UID or enabling 'privileged: false'
Specifying a non-root user in the container definition (e.g., 'user: 1000') or ensuring 'privileged' is false reduces the impact of a container compromise by preventing root-level OS access.
Security Engineering on AWS Certification Container & Serverless Security 1
Which AWS service provides runtime security monitoring and threat detection for containerized workloads running in Amazon ECS and EKS?