Domain 4: Security and Compliance
Explore key security and compliance practices vital for AWS CloudOps Engineers. Understand how to manage IAM users and roles securely, enforce access controls with AWS KMS and S3 policies, and respond effectively to security incidents using native AWS services. Gain practical knowledge on eliminating shared credentials, enforcing multi-factor authentication, auditing administrative actions, and ensuring continuous monitoring and automated remediation in multi-account setups.
We'll cover the following...
Question 44
An operations team manages Amazon EC2 instances in development, test, and production environments. For emergency console access, the team currently shares one long-lived IAM user with a password and access keys stored in an internal vault. A security review requires eliminating shared credentials, enforcing strong authentication, and ensuring that elevated access is used only when necessary. The team also wants every administrative action to be attributable to a specific person in audit logs.
Which solution best meets these requirements while preserving least privilege and auditability?
A. Create an individual IAM user for each administrator, require MFA, grant baseline permissions only, and allow each user to assume a privileged IAM role through AWS STS when elevated access is required.
B. Keep the shared IAM user, rotate its access keys every 7 days, and require administrators to check out the credentials only during emergencies.
C. Create an individual IAM user for each administrator and attach the AdministratorAccess managed policy directly to every user permanently.
D. Attach an EC2 instance profile with administrative permissions to a bastion host and require administrators to use that instance profile for human console access.
Question 45
Several engineering teams independently created IAM roles, AWS KMS keys, and Amazon S3 buckets across a production account. The security team now needs to discover which of these resources are accessible from outside the account or shared unintentionally with other AWS accounts. They want an AWS-native service that continuously analyzes resource policies and generates findings for access outside the defined zone of trust.
Which service should the team use?
A. IAM Access Analyzer
B. AWS CloudTrail
C. AWS Trusted Advisor
D. IAM credential reports