Security Engineering on AWS Certification Container & Serverless Security 3

Question 1

Which Amazon EKS feature enables you to enforce mutual TLS (mTLS) and fine-grained authorization policies for service-to-service communication inside a Kubernetes cluster?

Accepted Answer

AWS App Mesh with Envoy sidecar proxies

Answer

EKS Managed Node Groups

Answer

Amazon CloudFront with WAF

Answer

EKS Pod Identity

Question 2

What is the recommended way to restrict a Lambda function so it can only be invoked from within a specific Amazon VPC?

Accepted Answer

Use a Lambda resource policy with an aws:SourceVpc condition key specifying the allowed VPC ID

Answer

Attach a security group to the Lambda function that denies external traffic

Answer

Enable VPC configuration on the function and set the subnet to private

Answer

Create a Network ACL on the Lambda's Elastic Network Interface

Question 3

In an Amazon EKS cluster, which Kubernetes object defines network-level rules that restrict traffic between pods to only permitted sources and destinations?

Accepted Answer

Kubernetes NetworkPolicy

Answer

Kubernetes ConfigMap

Answer

EKS IAM OIDC Provider

Answer

Kubernetes PodSecurityPolicy (deprecated)

Question 4

Which AWS control prevents ECS containers from escalating privileges to gain capabilities beyond what is defined in the task definition?

Accepted Answer

Setting 'privileged: false' and 'allowPrivilegeEscalation: false' in the container definition's linuxParameters

Answer

Setting the task memory reservation to a low value

Answer

Disabling CloudWatch Logs for the task

Answer

Using the bridge network mode instead of awsvpc

Question 5

What is the security purpose of enabling Amazon GuardDuty EKS Audit Log Monitoring?

Accepted Answer

It analyzes Kubernetes audit logs to detect potentially malicious or anomalous API activity within the cluster

Answer

It encrypts all Kubernetes API server responses

Answer

It automatically patches EKS node AMIs when vulnerabilities are found

Answer

It enforces Kubernetes RBAC policies on behalf of the cluster administrator

Question 6

Which approach best secures sensitive environment variables in a Lambda function at rest?

Accepted Answer

Encrypt environment variables using an AWS KMS customer managed key (CMK) so only authorized roles can decrypt them

Answer

Store them as plaintext in the function configuration and rely on IAM to restrict who can view the function

Answer

Base64-encode the values before storing them as environment variables

Answer

Store them in an S3 object with public-read access disabled

Question 7

When building a multi-account container workload strategy on AWS, which service provides centralized governance to share approved ECR images across organizational accounts without making them public?

Accepted Answer

AWS Resource Access Manager (RAM) combined with ECR repository policies

Answer

Amazon S3 Cross-Region Replication

Answer

Amazon ECR Public Gallery

Answer

AWS CodeArtifact