Security Engineering on AWS Certification Container & Serverless Security 2

Question 1

In Amazon ECS, what is the security distinction between an ECS task execution role and an ECS task role?

Accepted Answer

The task execution role is used by the ECS agent to pull images and write logs; the task role is assumed by the application code inside the container

Answer

The execution role is used by the running application; the task role is used by the ECS agent to pull images and write logs

Answer

Both roles serve identical purposes and are interchangeable

Answer

The task role is only used with Fargate launch type; the execution role is only for EC2 launch type

Question 2

Which Lambda resource-based policy configuration restricts invocation of a function to only a specific AWS account and service?

Accepted Answer

A Lambda function resource policy with a Principal specifying the trusted account and service

Answer

An IAM identity-based policy attached to the caller

Answer

An S3 bucket policy on the function's deployment package

Answer

A VPC security group allowing inbound TCP 443

Question 3

Which AWS feature should you enable on an Amazon ECR repository to prevent mutable image tags from being overwritten, reducing supply chain attack risk?

Accepted Answer

ECR image tag immutability

Answer

ECR cross-region replication

Answer

ECR repository policy

Answer

ECR pull-through cache

Question 4

How does enabling VPC configuration for a Lambda function improve security?

Accepted Answer

It allows the function to access private resources in a VPC such as RDS databases or internal endpoints without exposing them publicly

Answer

It grants the function access to the public internet by default

Answer

It automatically encrypts all function environment variables

Answer

It prevents the function from being invoked from outside the VPC

Question 5

An ECS container needs to access AWS services. Which method is considered a security best practice for providing AWS credentials?

Accepted Answer

Use an ECS task role so temporary credentials are automatically provided via the container metadata endpoint

Answer

Embed access key ID and secret access key in the Dockerfile as environment variables

Answer

Store credentials in an S3 object and copy them into the container at startup

Answer

Hardcode credentials in the application source code and rebuild on rotation

Question 6

Which AWS service or feature provides a private network endpoint for pulling container images from Amazon ECR without routing traffic through the public internet?

Accepted Answer

ECR VPC interface endpoint (AWS PrivateLink)

Answer

AWS Direct Connect

Answer

ECR cross-region replication

Answer

AWS Transit Gateway

Question 7

When using Lambda Layers to share code across functions, which security concern must be explicitly managed?

Accepted Answer

A layer can be shared across accounts, so layer resource policies must restrict which accounts and principals can use the layer

Answer

Layers automatically grant public access to all functions in the account

Answer

Lambda Layers cannot be versioned, making security patching impossible

Answer

Layers are stored in EBS volumes which require separate encryption keys