Security Engineering on AWS Certification Container & Serverless Security

Question 1

Which AWS service provides runtime security monitoring and threat detection for containerized workloads running in Amazon ECS and EKS?

Accepted Answer

Amazon GuardDuty

Answer

AWS Inspector

Answer

AWS Security Hub

Answer

Amazon Macie

Question 2

When configuring a Lambda function's execution role following the principle of least privilege, what is the recommended approach?

Accepted Answer

Create a unique IAM role per function with only the permissions that function requires

Answer

Attach the AdministratorAccess managed policy for simplicity

Answer

Share a single IAM role across all Lambda functions in the account

Answer

Use the AWSLambdaFullAccess managed policy as a starting baseline

Question 3

What is the most secure method for passing database credentials to an AWS Lambda function?

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime using the Lambda execution role

Answer

Set credentials as plaintext environment variables in the Lambda configuration

Answer

Hard-code credentials directly in the function source code

Answer

Pass credentials as query string parameters in the function invocation event

Question 4

Which Amazon ECR feature automatically scans container images for known OS package vulnerabilities when images are pushed to a repository?

Accepted Answer

ECR enhanced scanning with Amazon Inspector

Answer

ECR lifecycle policies

Answer

ECR image tag immutability

Answer

ECR replication

Question 5

What is the primary security advantage of running containers on AWS Fargate instead of self-managed EC2 instances?

Accepted Answer

Each Fargate task runs in its own isolated kernel, removing the risk of cross-container OS-level attacks

Answer

Fargate containers share the host OS kernel for better performance

Answer

Fargate eliminates the need for any IAM permissions

Answer

Fargate automatically disables all network access between tasks

Question 6

Which Kubernetes feature, supported natively in Amazon EKS, enables fine-grained IAM permissions for individual pods without sharing node-level credentials?

Accepted Answer

IAM Roles for Service Accounts (IRSA)

Answer

Kubernetes RBAC ClusterRoles

Answer

AWS Systems Manager Parameter Store

Answer

EKS managed node groups

Question 7

When configuring an Amazon ECS task definition, which setting prevents a container from running as the Linux root user inside the container?

Accepted Answer

Setting 'user' to a non-root UID or enabling 'privileged: false'

Answer

Setting the task CPU limit to 256 units

Answer

Enabling the 'readonlyRootFilesystem' flag only

Answer

Configuring the task network mode to 'bridge'