AWS Certified Security – Specialty — Practice Set 1

Question 1

A security engineer discovers that an IAM access key belonging to an EC2 instance role was exposed in a public GitHub repository three hours ago. AWS CloudTrail logs show the key was used to list Amazon S3 buckets and download several objects from a sensitive data bucket. The instance still needs to access the S3 bucket to continue normal operations. Which sequence of actions should the security engineer take FIRST to contain the incident with MINIMAL disruption to production?

Accepted Answer

Adding an inline deny policy (AWSRevokeOlderSessions or an explicit Deny with a condition on token issue time) to the IAM role immediately revokes all active sessions and stops ongoing unauthorized access without disrupting the EC2 instance itself, which retains its role attachment and will receive new credentials via IMDSv2 once the deny policy is removed or scoped. After containment, the security team can investigate the breach scope from CloudTrail. Option A deletes the role, which would break the instance and all dependent services. Option B rotates the static key but for an IAM role (not a user key), the right action is session revocation; also, disabling a key does not stop active sessions using temporary credentials already issued. Option D terminates the instance, causing production disruption and potentially destroying forensic evidence on the instance.

Question 2

A security engineer is responding to an Amazon GuardDuty finding of type UnauthorizedAccess:EC2/SSHBruteForce on a production EC2 instance. The instance is a web server in a public subnet with port 22 open to 0.0.0.0/0 in the security group. The attack is ongoing with 10,000 SSH attempts per minute. The engineer must stop the attack immediately and preserve the instance for forensic analysis. Which actions should the engineer take? (Choose TWO.)

Accepted Answer

Removing the 0.0.0.0/0 SSH rule or replacing the security group with one that has no inbound rules immediately stops the brute force attack at the network layer without terminating the instance — this contains the threat. Taking an EBS snapshot preserves the forensic state of the instance (OS logs, auth logs, any planted malware) before any additional changes are made, satisfying incident response best practices. Terminating the instance (option B) destroys forensic evidence and causes production disruption, which violates the 'preserve for forensic analysis' requirement. AWS Shield Advanced (option D) protects against volumetric DDoS attacks, not application-layer SSH brute force — it cannot block SSH connection attempts. Amazon Inspector (option E) scans for vulnerabilities but does not stop active attacks and should be performed after containment, not during.

Question 3

A security engineer receives a GuardDuty finding indicating that an EC2 instance has communicated with a known cryptocurrency mining pool command-and-control server (finding type: CryptoCurrency:EC2/BitcoinTool.B!DNS). The instance is part of a production auto-scaling group serving customer traffic. The engineer needs to isolate the compromised instance and restore clean capacity as quickly as possible. Which sequence of steps is MOST appropriate?

Accepted Answer

Placing the instance in standby status within the auto-scaling group triggers the ASG to launch a replacement instance immediately, restoring customer capacity without the operator needing to manually launch an instance. The standby state keeps the compromised instance running (not terminated) so a memory dump via SSM Run Command can capture in-memory malware artifacts. After forensic capture, the instance can be terminated. Immediately terminating (option A) destroys forensic evidence. Detaching from the ASG and manually launching a replacement (option B) is functionally correct for containment and forensics but requires more manual steps; standby mode (option D) is more operationally efficient. Suspending the entire ASG (option C) impacts all capacity, not just the compromised instance.

Question 4

A security operations team wants to automate incident response for specific Amazon GuardDuty findings to reduce mean time to respond. When GuardDuty generates an EC2-related finding of severity 7.0 or higher, the team wants to: (1) automatically isolate the EC2 instance by replacing its security group, (2) notify the on-call security engineer via PagerDuty, and (3) create a ticket in the ticketing system via a webhook. The solution must be serverless and require no infrastructure management. Which architecture MOST effectively implements this automated response?

Accepted Answer

Amazon EventBridge (formerly CloudWatch Events) is the native routing layer for GuardDuty findings, and Step Functions is the best choice for orchestrating multi-step automated response with error handling and retry logic. The state machine can execute EC2 isolation, PagerDuty notification, and ticketing webhook in parallel, reducing total response time. Step Functions provides visibility into each step's execution, retries on failure, and audit history — important for security workflows. EventBridge with a single Lambda function (option A) can work but a monolithic Lambda handling all three actions has no built-in step-level error handling or retry granularity. SNS with Lambda (option B) requires the Lambda to re-filter by severity since SNS cannot filter on nested JSON fields like severity scores (SNS filter policies have limited support for numeric comparisons on nested attributes). Security Hub custom actions (option C) require a human to manually trigger the action from the console — not automated.

Question 5

A security engineer needs to ensure that all AWS API calls across a multi-account AWS Organization are logged and cannot be disabled or deleted by any individual account administrator. The logs must be stored in a central security account for 3 years. Which configuration MOST effectively meets these requirements?

Accepted Answer

An AWS Organizations CloudTrail trail is the purpose-built mechanism for organization-wide CloudTrail coverage: it automatically covers all current and future member accounts without per-account configuration. Delivering to a central security account S3 bucket with a bucket policy that denies all non-CloudTrail writes ensures member account administrators cannot tamper with logs. S3 Object Lock in compliance mode prevents log deletion even by the security account's root user for the retention period. Per-account CloudTrail with Config alerts (option A) has a gap window between when CloudTrail is disabled and when Config detects it — and individual account administrators can disable both CloudTrail and Config. AWS Security Hub (option C) aggregates security findings, not raw API call logs — it is not a replacement for CloudTrail. AWS Config (option D) records resource configuration changes, not all API calls — many security-relevant API calls do not change resource configuration and would not be captured.

Question 6

A security engineer needs to detect and alert when any IAM user or role in the AWS account performs a console login without multi-factor authentication (MFA), or when root account activity is detected at any time. The solution must alert the security team within 2 minutes. Which implementation MOST efficiently meets these requirements?

Accepted Answer

CloudWatch Logs metric filters on CloudTrail log groups provide real-time event pattern matching with sub-minute detection: the filter for ConsoleLogin events with MFAUsed=false triggers a CloudWatch Alarm with an SNS notification to the security team in near real-time, well within the 2-minute requirement. A similar filter for Root userIdentity.type captures root account usage. This is the AWS-recommended approach documented in the CIS AWS Foundations Benchmark. Amazon GuardDuty (option A) detects IAMUser/Root finding types but does not have a dedicated non-MFA login detection finding — GuardDuty focuses on behavioral anomalies and threat intelligence, not policy compliance events. AWS Config iam-user-mfa-enabled (option C) evaluates MFA configuration on user accounts, not individual login events — it would alert that a user's MFA setting is disabled, not that a specific login occurred without MFA. Security Hub (option D) aggregates findings and runs periodic checks but is not a real-time event detection mechanism within 2 minutes.

Question 7

A security engineer is investigating a potential data exfiltration incident. AWS GuardDuty generated a finding of type Exfiltration:S3/AnomalousBehavior indicating unusual S3 data access from an EC2 instance. The engineer needs to determine exactly which S3 objects were accessed, when, and the size of data transferred over the past 30 days. CloudTrail is enabled and S3 data events are configured. Which approach MOST efficiently investigates the scope of access?

Accepted Answer

AWS CloudTrail S3 data events record individual GetObject, PutObject, DeleteObject, and ListBucket API calls with full request metadata including requester identity, source IP, object key, and response metadata. Querying via Amazon Athena provides SQL-based analysis across 30 days of events efficiently with filtering on the EC2 instance IP. This gives the engineer the exact list of objects accessed, timestamps, and bytes transferred per request. VPC Flow Logs (option A) provide network metadata (IP, bytes, ports) but cannot identify which specific S3 objects were accessed — they show connections to S3 endpoints but not object-level detail. S3 server access logs (option C) are similar in content to CloudTrail data events but are not enabled by default, may have delivery delays, and are less queryable at scale than Athena-on-CloudTrail. Amazon Macie (option D) classifies sensitive data content but does not provide historical access logs for the investigation.

Question 8

A company needs to implement a centralized security monitoring solution for 150 AWS accounts. The solution must aggregate all Amazon GuardDuty findings, AWS Security Hub findings, and AWS Config compliance results in a single pane of glass in a designated security account. New accounts joining the organization must be automatically enrolled. The security team requires that member account administrators cannot disable the security services. Which architecture MOST effectively meets all requirements?

Accepted Answer

Using AWS Organizations delegated administrator for both GuardDuty and Security Hub is the native AWS multi-account security architecture: the security account automatically receives all findings from all member accounts, and the auto-enable feature ensures new accounts are enrolled without manual action. Service Control Policies (SCPs) at the Organizations level prevent member account administrators from calling guardduty:DisableOrganizationAdminAccount or securityhub:DisableOrganizationAdminAccount — enforcing centralized visibility. AWS Config aggregator collects Config rule compliance results from all accounts. Lambda-based forwarding (option B) requires deploying and maintaining Lambda functions in 150 accounts — high operational overhead and not native. EventBridge cross-account bus forwarding (option C) requires event bus resource policies in all 150 accounts and does not have an auto-enable mechanism for new accounts. CloudTrail analysis via Athena (option D) requires deriving security findings from API logs — this is not a replacement for purpose-built security services.

Question 9

A security engineer needs to protect a public-facing web application from OWASP Top 10 vulnerabilities including SQL injection, XSS, and request forgery. The application is deployed behind an Amazon CloudFront distribution that serves traffic from an Application Load Balancer origin. The company needs managed rule updates without manual rule maintenance. Which configuration provides MOST comprehensive protection with LEAST operational overhead?

Accepted Answer

Associating AWS WAF with the CloudFront distribution (at the edge, closest to the attacker) with the AWS Managed Rules Common Rule Set provides pre-built, continuously updated protections for OWASP Top 10 threats including SQL injection, XSS, and HTTP protocol violations — with no manual rule maintenance required as AWS updates these rules automatically. Attaching WAF at the ALB origin means attacks must traverse CloudFront before being blocked at the ALB, providing less edge protection. Custom regex-based WAF rules (option A) require significant security expertise to write, test, and maintain — high operational overhead. GuardDuty (option C) detects threats after they've reached the application and performs behavioral analysis, not real-time web request inspection. AWS Shield Advanced (option D) includes enhanced DDoS protection and AWS WAF cost waiver, but does not automatically configure OWASP WAF rules — those must still be configured manually.

Question 10

A security engineer is designing the network security posture for a three-tier application in a VPC. The web tier is in a public subnet, the application tier is in a private subnet, and the database tier is in an isolated subnet with no route to the internet. A recent penetration test found that the security group on the database tier was incorrectly configured to allow inbound connections from 0.0.0.0/0 on port 3306 due to a developer error. The engineer wants to implement a defense-in-depth control that would block such a misconfiguration even if it occurs again, without impacting legitimate application-tier-to-database traffic. Which control MOST effectively prevents internet access to the database tier as a backstop?

Accepted Answer

Network ACLs are stateless, subnet-level controls that operate independently of security groups. Configuring the database subnet's NACL to deny all inbound traffic except from the application tier CIDR creates a defense-in-depth layer: even if a developer misconfigures the security group to allow 0.0.0.0/0, the NACL DENY rule at the subnet level blocks the traffic before it reaches the instance. NACLs also block traffic from the internet because the database subnet has no route to the internet gateway, so this is a belt-and-suspenders control. AWS Config auto-remediation (option A) has a detection-to-remediation lag during which the misconfiguration exists and traffic could flow. Amazon Inspector (option C) generates findings but does not block traffic — it is a detective control, not a preventive one. AWS Firewall Manager security group policies (option D) are valid centralized controls but enforce security group configurations rather than providing an independent network-layer backstop.

Question 11

A security engineer needs to ensure that EC2 instances in a production environment never have direct internet access, that all SSH access is performed through a controlled channel without maintaining long-lived bastion hosts, and that all session activity is audited and recorded. The instances are in private subnets with no internet gateway. Which solution MOST securely meets all requirements?

Accepted Answer

AWS Systems Manager Session Manager provides browser-based or CLI shell access to EC2 instances without requiring open inbound ports (no SSH port 22 needed), without SSH keys to manage, and with session activity (every command and response) logged to S3 and CloudWatch Logs. IAM policies control who can initiate sessions. The instances communicate with SSM via the SSM agent over HTTPS outbound, so private subnets with SSM VPC endpoints or NAT for the SSM endpoints work without internet gateways. A bastion host (option A) requires maintaining the bastion EC2 instance, managing SSH keys, and still requires port 22 open — a larger attack surface. Client VPN (option C) enables SSH access which requires managing SSH keys and open port 22; VPC Flow Logs capture IP metadata but not session content for auditing. Run Command (option D) is for running scripts non-interactively, not for interactive administrative shell sessions.

Question 12

A security engineer is evaluating the security posture of an Amazon EKS cluster running production microservices. A penetration test found that a compromised container was able to access the EC2 instance metadata service (IMDSv1) from within the container, retrieve the node's IAM role credentials, and use those credentials to access other AWS services. The cluster's node group uses EC2 instances with broad IAM permissions. Which combination of controls MOST effectively mitigates this attack path? (Choose TWO.)

Accepted Answer

IMDSv2 with hop limit of 1 (option A) prevents containers from accessing IMDS because IMDSv2 requires a PUT request to get a session token, and the TTL=1 in the PUT request means the packet cannot traverse the additional network hop (from the container network namespace through the host network namespace to IMDS) — the TTL expires before reaching 169.254.169.254 from within a container. IRSA/Pod Identity (option B) assigns fine-grained IAM roles directly to pods using OIDC federation, so even if a container obtained node role credentials, those credentials have minimal permissions, and each pod only has the specific permissions it needs. These two controls address the attack path at different layers. GuardDuty (option C) is detective — it detects after the attack occurs but does not prevent credential theft. Moving to Fargate (option D) eliminates the problem but is a major architectural change and may not be feasible for all workloads. NetworkPolicy (option E) requires a CNI plugin that supports NetworkPolicy (e.g., Calico, not the default VPC CNI for IMDS blocking) and can be bypassed by privileged containers.

Question 13

A security engineer needs to ensure that all Amazon EC2 instances launched in an AWS account have encrypted EBS volumes, specific required tags (CostCenter, Environment, Owner), and do not use the default VPC. The controls must be preventive — non-compliant instances must not be launchable. Which approach MOST effectively prevents launch of non-compliant instances?

Accepted Answer

Service Control Policies (SCPs) applied at the AWS Organizations level are preventive controls that evaluate before IAM permissions — they prevent the ec2:RunInstances API call from succeeding if the request lacks encryption specifications, required tags, or uses the default VPC subnet. This stops non-compliant instances from ever being launched. SCPs cannot be bypassed by account-level IAM policies. AWS Config auto-remediation (option A) is a detective-then-corrective approach with a gap window — the instance launches, runs for several minutes, and is then terminated; during that window it could be exploited or generate costs. CloudFormation StackSets (option C) enforces via approved templates but requires also restricting direct API access via IAM, which is more complex to maintain comprehensively. Amazon Inspector (option D) is a vulnerability scanner, not a compliance enforcement tool, and the 5-minute detection-to-termination gap still allows a non-compliant instance to run.

Question 14

A security engineer is reviewing IAM policies in an AWS account. An S3 bucket policy must grant read access to objects in the bucket to all IAM users in the same AWS account, but must explicitly deny access to a specific IAM user named 'restricted-analyst' regardless of any other permissions that user might have. Which bucket policy configuration CORRECTLY implements this?

Accepted Answer

An explicit Deny in IAM always overrides any Allow — attaching a Deny statement for the restricted-analyst IAM ARN in the bucket policy ensures that user cannot access the bucket regardless of any other Allow policies (including account-wide policies or the general Allow in the same bucket policy). The Allow for Principal '*' with aws:PrincipalAccount ensures only principals from the same account get access. Listing all permitted user ARNs explicitly (option B) is operationally impractical and breaks whenever new users are added. An IAM user-level Deny policy (option C) works but applies to all S3 resources, not specifically to this bucket — over-broad. IAM Identity Center permission sets (option D) manage SSO access, not native IAM user access, and 'exclusion from a group' is not a direct IAM concept.

Question 15

A security engineer is designing cross-account access for a centralized logging account. An application in Account A (production) needs to write CloudTrail logs to an S3 bucket in Account B (security/logging). The solution must follow least-privilege: only CloudTrail in Account A should be able to write to the bucket, no human user should have direct write access, and the security account team must be able to read the logs. Which IAM configuration CORRECTLY achieves this?

Accepted Answer

CloudTrail uses a service-linked role and calls the S3 API using the cloudtrail.amazonaws.com service principal. The S3 bucket policy in Account B grants s3:PutObject to the cloudtrail.amazonaws.com service principal with an aws:SourceArn condition scoped to Account A's specific CloudTrail ARN — this ensures only CloudTrail from Account A (not any other account or any human) can write to the bucket. Security team members in Account B receive read permissions via their IAM policies. An IAM role that Account A's administrators can assume (option A) grants human administrators write access, violating the no-human-write requirement. S3 Cross-Region Replication (option C) adds unnecessary complexity and still requires Account A's bucket to be properly secured. Creating an IAM user with access keys (option D) gives human-manageable credentials with write access — a security anti-pattern and violates least-privilege.

Question 16

A security engineer is implementing attribute-based access control (ABAC) for an organization with 500 developers across 15 teams. Each developer needs access to AWS resources (EC2, S3, RDS) tagged with their specific team name. Creating team-specific IAM roles would require 15 roles with near-identical policies. The engineer wants to use a single IAM role that scales to new teams without policy changes. Which IAM implementation MOST efficiently achieves this?

Accepted Answer

ABAC with principal tags and resource tags is the purpose-built IAM scaling mechanism: a single IAM policy with condition `aws:ResourceTag/Team StringEquals aws:PrincipalTag/Team` allows a developer to access only resources tagged with a Team value matching their own principal tag — when a new team is added, no policy change is needed, just a new tag value. This scales infinitely without policy proliferation. IAM groups with per-team policies (option A) require creating and maintaining 15+ policies and group memberships — it works but does not scale without policy changes per new team. Attaching all 15 policies to one role (option C) would grant every developer access to all team resources — a security failure. Per-team AWS accounts via SCPs (option D) is a valid isolation model but is a much heavier architectural change and does not use ABAC as described.

Question 17

A security engineer is reviewing IAM permissions for a Lambda function that processes customer orders. The function requires access to a specific Amazon SQS queue to receive orders and a specific Amazon DynamoDB table to write order records. During a security review, the engineer discovers the function's execution role has the managed policy AdministratorAccess attached. The engineer must remediate this to follow least privilege without breaking the function. Which remediation approach MOST effectively achieves least privilege?

Accepted Answer

IAM Access Analyzer policy generation uses CloudTrail activity to identify exactly which API calls the Lambda function has made historically and generates a least-privilege policy containing only those actions on those specific resources. This approach is accurate (based on actual usage, not guesses), comprehensive (catches any additional permissions the function uses that the engineer may not know about), and verifiable before deployment. A manually crafted custom policy (option B) is correct in principle but risks omitting permissions the function needs that aren't obvious from the description — CloudTrail-based generation is more reliable. AWSLambdaBasicExecutionRole with AmazonSQSReadOnlyAccess (option A) does not include DynamoDB write permissions or SQS message deletion, breaking the function. Adding an explicit Deny while keeping AdministratorAccess attached (option D) is not best practice — the Allow from AdministratorAccess remains in the policy, increasing the blast radius if the Deny is ever incorrectly modified.

Question 18

A security engineer needs to ensure that all objects uploaded to a specific Amazon S3 bucket are encrypted at rest using server-side encryption with AWS KMS Customer Managed Keys (SSE-KMS). The solution must prevent any unencrypted uploads and ensure only the designated CMK is used. Which configuration MOST effectively enforces this requirement?

Accepted Answer

Default bucket encryption applies the designated CMK automatically, but an application can still explicitly override it by specifying a different key or no key. Adding a bucket policy Deny statement that blocks s3:PutObject unless the request specifies the exact designated CMK ARN ensures that even if an application explicitly tries to use a different key or no encryption, the upload is rejected. The two controls together (default encryption for convenience + bucket policy Deny for enforcement) provide comprehensive protection. Default encryption alone (option A) applies the CMK when no encryption header is specified but does not block requests that explicitly override the key. Amazon Macie (option C) detects unencrypted objects after they are already stored — a corrective detective control, not a preventive one. IAM policy conditions (option D) apply only to IAM principals accessing the bucket from within the account, not to all principals or cross-account access, and do not cover service-role uploads.

Question 19

A security engineer at a healthcare company needs to discover and classify sensitive PHI (Protected Health Information) stored across hundreds of Amazon S3 buckets in a multi-account AWS environment. The company needs a risk report identifying which buckets contain PHI, the types of PHI found (names, SSNs, medical record numbers), and the buckets' exposure risk based on their access controls. Which AWS service combination MOST directly addresses these requirements?

Accepted Answer

Amazon Macie is purpose-built for S3 data classification and PHI discovery: its managed data identifiers include pre-built patterns for healthcare data (medical record numbers, health insurance IDs, SSNs, names in medical context) and it integrates with AWS Organizations for multi-account deployment. Macie also provides an S3 bucket inventory showing encryption, access control, and public exposure status, directly answering the exposure risk requirement. Amazon Inspector (option B) assesses software vulnerabilities and network exposure on EC2 instances and containers — it does not scan S3 object content for sensitive data classification. Custom Lambda with Comprehend Medical (option C) is technically possible but requires significant development, operational overhead, cost management for scanning hundreds of buckets, and no native PHI classification patterns. AWS Config rules (option D) identify misconfigured bucket policies but do not scan bucket contents for PHI.

Question 20

A security engineer is designing an encryption architecture for a multi-tenant SaaS application on AWS. Each tenant's data must be encrypted with a tenant-specific encryption key so that a compromise of one tenant's key does not expose other tenants' data. The application has 10,000 tenants and the number is growing. Key management must be operationally scalable with centralized audit logging of all key usage. Which encryption architecture MOST effectively meets these requirements?

Accepted Answer

Envelope encryption with GenerateDataKey and tenant-specific encryption contexts is the scalable, operationally practical architecture for 10,000+ tenants: one CMK is used for all tenants but each tenant gets a unique DEK (generated per-tenant or per-object), which encrypts their data. The encryption context (e.g., tenantId) is logged in CloudTrail for every KMS API call, providing per-tenant audit trails without separate CMKs. If one tenant's DEK is compromised, other tenants' data remains secure since each DEK is unique. Creating 10,000 CMKs (option A) is possible but AWS KMS has a default limit of 100,000 CMKs per Region, and managing 10,000 growing CMKs with individual key policies is operationally complex; also, the encryption context approach in option C achieves equivalent per-tenant isolation. A single CMK with no per-tenant DEK differentiation (option B) means a CMK compromise exposes all tenant data — no isolation. CloudHSM per-tenant clusters (option D) is extremely expensive and operationally heavy for 10,000 tenants.

Question 21

A security engineer needs to securely provide a database password, an API key, and an SSL certificate private key to an Amazon EC2 application. The credentials must be rotated automatically every 30 days, and the application must always use the current credential without code changes or redeployment. Access to the credentials must be logged for compliance. Which solution MOST effectively meets all requirements?

Accepted Answer

AWS Secrets Manager is purpose-built for credential management with native automatic rotation: it supports built-in Lambda rotation functions for common databases (RDS, Redshift, DocumentDB) and custom functions for APIs, automatically rotating on a schedule without application changes. The application retrieves the current secret value at runtime via the Secrets Manager API — after rotation, the next retrieval returns the new value automatically. AWS Certificate Manager manages SSL/TLS certificates including auto-renewal. Secrets Manager logs all GetSecretValue API calls to CloudTrail for compliance. Systems Manager Parameter Store with custom Lambda rotation (option C) is a valid approach but requires implementing rotation logic manually and lacks native database rotation support. EC2 user data (option A) is not designed for secrets — user data is not encrypted at the EC2 API level and is accessible to any process on the instance. Baking secrets into AMIs (option D) is a severe security anti-pattern — credentials are stored in AMI snapshots, which are hard to properly restrict.

Question 22

A security engineer at a company using AWS Organizations needs to ensure that no AWS account in the organization can ever disable Amazon GuardDuty or create public S3 buckets. These restrictions must apply even to account root users. Which control MOST effectively enforces these restrictions?

Accepted Answer

Service Control Policies are the only IAM mechanism that restricts even account root users — they are organization-level controls applied before any IAM evaluation. An SCP with explicit Deny statements for the relevant GuardDuty and S3 APIs prevents any principal, including root, from disabling GuardDuty or making S3 buckets public. IAM permission boundaries (option A) apply to IAM users and roles but do not restrict root users — root is explicitly excluded from IAM boundary enforcement. AWS Config auto-remediation (option C) is a reactive detective control with a time gap — GuardDuty could be disabled for several minutes before remediation. CloudFormation StackSets with drift detection (option D) detects configuration drift after the fact but cannot prevent the initial unauthorized action.

Question 23

A security engineer needs to continuously assess the security posture of 50 AWS accounts against the AWS CIS Foundations Benchmark and PCI DSS requirements. The solution must provide a compliance score, identify failed controls, and prioritize remediation by severity. New accounts must be automatically included in assessments. Which service MOST directly meets these requirements?

Accepted Answer

AWS Security Hub is the purpose-built service for multi-account security posture management: it maps findings to CIS Foundations Benchmark and PCI DSS controls, provides a normalized compliance score per standard and per account, prioritizes by severity, and integrates with AWS Organizations for automatic enrollment of new accounts. The delegated administrator model aggregates all findings in a single account. Amazon Inspector (option A) focuses on EC2/Lambda/ECR vulnerability assessments — it is not a CIS Benchmark or PCI DSS compliance assessment framework. AWS Config Conformance Packs (option C) provide granular rule-level compliance data and are a valid approach, but Security Hub aggregates at a higher level with severity scoring and compliance dashboard tailored to the stated requirements. AWS Trusted Advisor (option D) provides some security best practice checks but is not a comprehensive CIS or PCI DSS compliance assessment framework.

Question 24

A security engineer is implementing a patch management strategy for 2,000 Amazon EC2 instances across 10 AWS accounts. The organization requires that critical security patches be applied within 72 hours of release, that patches be tested in a non-production environment before production deployment, and that a compliance report showing patched and unpatched instances be available for audit. Which solution MOST effectively meets all requirements with LEAST operational overhead?

Accepted Answer

AWS Systems Manager Patch Manager with patch baselines, maintenance windows, and patch groups provides the complete native patching solution: patch baselines define severity classifications (critical, important) and approval rules; maintenance windows enforce the staged deployment (non-production first, production 48 hours later); patch groups tag instances for targeted patching; and SSM Compliance provides built-in reporting of patched/compliant and non-compliant instances across all accounts. The 72-hour requirement is met by configuring the non-production maintenance window within 24 hours of patch release. Third-party patching (option B) adds external dependencies, cost, and operational overhead beyond the native AWS solution. Lambda with yum/apt commands (option C) applies all updates indiscriminately without classification or staged deployment — not suitable for controlled critical patch management. AWS Config rules for detection with auto-remediation (option D) is a reactive approach that detects non-compliance after the 72-hour window has potentially been exceeded.

Question 25

A security engineer is designing a secure CI/CD pipeline for a financial services company on AWS. The pipeline must ensure that no infrastructure change can be deployed to production unless it has passed automated security scanning, received approval from two senior engineers, and that all deployment activity is immutably logged. The pipeline uses AWS CodePipeline and deploys infrastructure via AWS CloudFormation. Which security controls MOST comprehensively enforce these requirements?

Accepted Answer

AWS CodeGuru Security provides automated security scanning of IaC templates and code in the pipeline build stage — catching security issues before deployment. CodePipeline's native manual approval action supports multiple approver notifications and requires approval from configured approvers before proceeding; two separate manual approval actions (or configuring both approvers on one action) enforces the two-engineer requirement. AWS CloudTrail with S3 Object Lock (compliance mode) provides tamper-proof, immutable logging of all CodePipeline stage transitions, approvals, and CloudFormation stack operations. AWS Config (option B) evaluates resource configurations after deployment and provides only a single approver gate. Security Hub post-deployment checks (option C) detect issues after the change is already deployed to production — too late for the requirement to prevent non-compliant deployments. cfn-nag (option D) is a useful linter but single-approver and DynamoDB storage (not Object Lock) does not provide immutable logging.

SCS-C03 — AWS Certified Security – Specialty