Security Engineering on AWS Certification Container & Serverless Security 3

Question 1

Which Amazon EKS feature enables you to enforce mutual TLS (mTLS) and fine-grained authorization policies for service-to-service communication inside a Kubernetes cluster?

Accepted Answer

AWS App Mesh with Envoy sidecar proxies

Answer

AWS App Mesh deploys Envoy proxies as sidecars in each pod, enforcing mTLS encryption and authorization policies between microservices without requiring application code changes.

Question 2

What is the recommended way to restrict a Lambda function so it can only be invoked from within a specific Amazon VPC?

Accepted Answer

Use a Lambda resource policy with an aws:SourceVpc condition key specifying the allowed VPC ID

Answer

A Lambda resource policy with the aws:SourceVpc condition restricts invocations so only calls originating from the specified VPC—typically via a VPC endpoint—are allowed.

Question 3

In an Amazon EKS cluster, which Kubernetes object defines network-level rules that restrict traffic between pods to only permitted sources and destinations?

Accepted Answer

Kubernetes NetworkPolicy

Answer

Kubernetes NetworkPolicy objects define ingress and egress rules for pods; a CNI plugin (such as Amazon VPC CNI with Calico) enforces these policies at the network level within the cluster.

Question 4

Which AWS control prevents ECS containers from escalating privileges to gain capabilities beyond what is defined in the task definition?

Accepted Answer

Setting 'privileged: false' and 'allowPrivilegeEscalation: false' in the container definition's linuxParameters

Answer

Setting 'privileged: false' blocks root-level host access, and 'allowPrivilegeEscalation: false' in linuxParameters prevents a process inside the container from gaining more privileges than its parent process.

Question 5

What is the security purpose of enabling Amazon GuardDuty EKS Audit Log Monitoring?

Accepted Answer

It analyzes Kubernetes audit logs to detect potentially malicious or anomalous API activity within the cluster

Answer

GuardDuty EKS Audit Log Monitoring consumes Kubernetes control plane audit logs and uses threat intelligence and ML to identify suspicious activity like anonymous API calls or unusual admin actions.

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Container & Serverless Security 3