Security Engineering on AWS Certification Container & Serverless Security

Question 1

Which AWS service provides runtime security monitoring and threat detection for containerized workloads running in Amazon ECS and EKS?

Accepted Answer

Amazon GuardDuty

Answer

Amazon GuardDuty offers ECS/EKS Runtime Monitoring, which uses an eBPF-based security agent to detect threats like privilege escalation, cryptomining, and malicious file execution inside containers at runtime.

Question 2

When configuring a Lambda function's execution role following the principle of least privilege, what is the recommended approach?

Accepted Answer

Create a unique IAM role per function with only the permissions that function requires

Answer

Creating a dedicated IAM execution role per Lambda function scoped to exactly the permissions that function needs limits the blast radius if the function is compromised.

Question 3

What is the most secure method for passing database credentials to an AWS Lambda function?

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime using the Lambda execution role

Answer

AWS Secrets Manager integrates with Lambda, supports automatic rotation, and the function retrieves secrets at runtime using IAM permissions—keeping credentials out of code and environment variables.

Question 4

Which Amazon ECR feature automatically scans container images for known OS package vulnerabilities when images are pushed to a repository?

Accepted Answer

ECR enhanced scanning with Amazon Inspector

Answer

ECR enhanced scanning integrates with Amazon Inspector to continuously scan images for OS and programming language package vulnerabilities, reporting findings in both the ECR console and Inspector.

Question 5

What is the primary security advantage of running containers on AWS Fargate instead of self-managed EC2 instances?

Accepted Answer

Each Fargate task runs in its own isolated kernel, removing the risk of cross-container OS-level attacks

Answer

AWS Fargate provides task-level isolation by running each task on dedicated compute with its own kernel, so a container escape cannot affect other customers' workloads or other tasks.

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Practice Test

Security Engineering on AWS Certification Container & Serverless Security