Security and Compliance practice questions

AWS Config

Why wrong: AWS Config is a service that evaluates your AWS resource configurations against desired policies. It does not provide access to AWS compliance reports; it helps you audit your own resource configurations.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor provides recommendations to help you follow AWS best practices in areas such as cost optimization, performance, security, and fault tolerance. It does not provide compliance reports.

AWS Security Hub

Why wrong: AWS Security Hub aggregates security findings from multiple AWS services and third-party tools, enabling you to automate security checks. It does not provide direct access to AWS compliance reports.

AWS CloudTrail

Why wrong: AWS CloudTrail records API calls for auditing, but it does not evaluate the current configuration state of resources or enforce compliance rules.

Amazon GuardDuty

Why wrong: Amazon GuardDuty is a threat detection service that analyzes network traffic, DNS logs, and account activity for malicious behavior, not for configuration compliance.

AWS Security Hub

Why wrong: AWS Security Hub provides a comprehensive view of security alerts and compliance status from multiple AWS services, but it does not directly perform configuration evaluations; it relies on services like AWS Config for that data.

Add a condition to the KMS key policy that uses the 'kms:RequestTag/ConditionKey' to require the tag on the caller.

Why wrong: Incorrect. KMS key policies use condition keys such as 'kms:EncryptionContext' or 'kms:ViaService', but not 'kms:RequestTag/ConditionKey' for principal tags. Principal tags are checked using 'aws:PrincipalTag' in the key policy, but this is not the most straightforward approach and the key policy alone cannot enforce this if the IAM policy also grants permission. Moreover, the option uses an incorrect condition key name.

Add a condition to the IAM role's trust policy that denies the 'kms:Decrypt' action unless the role has the tag.

Why wrong: Incorrect. A role's trust policy controls which principals can assume the role, not what actions the role can perform. The trust policy cannot directly limit the decryption permissions of the role. The permissions are governed by the IAM policy attached to the role.

Add a condition to the S3 bucket policy that denies all access unless the IAM role has the required tag.

Why wrong: Incorrect. An S3 bucket policy controls access to S3 actions (like s3:GetObject), but it does not control the KMS decrypt action. Even if the bucket policy allows access, the application still needs explicit permission to use the KMS key. Additionally, S3 bucket policies can use 'aws:PrincipalTag' conditions, but that would only affect S3 API calls, not the decryption operation.

AWS Config

Why wrong: AWS Config evaluates and records resource configuration changes over time, but it does not capture API calls or caller identity. It is used for compliance auditing of resource configurations, not for logging API activity.

Amazon GuardDuty

Why wrong: Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior using machine learning and threat intelligence. It does not provide a continuous audit trail of all API calls.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor provides real-time guidance to help provision your resources following AWS best practices. It does not capture API call logs or provide an audit trail of user activity.

Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)

Why wrong: Incorrect. SSE-S3 uses encryption keys that are managed entirely by AWS. This violates the compliance policy that keys must never be stored or managed by the cloud provider.

Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS)

Why wrong: Incorrect. While SSE-KMS allows you to use a customer managed key, the key is still stored and managed by AWS KMS (a cloud service). The key material resides in AWS, which does not satisfy the requirement that keys must never be stored by the cloud provider.

Client-Side Encryption using an on-premises key management system

Why wrong: Incorrect. Client-side encryption encrypts data before it is sent to S3, which satisfies the key management requirement, but the question asks for an encryption option for Amazon S3. Client-side encryption is not an S3 server-side feature and would require additional application changes. Among the server-side options, only SSE-C ensures keys are not stored by AWS.

AWS Key Management Service (AWS KMS)

Why wrong: AWS KMS is for creating and managing encryption keys, not for storing or rotating database credentials. While it can encrypt secrets, it does not provide secret storage or rotation capabilities.

AWS Systems Manager Parameter Store

Why wrong: AWS Systems Manager Parameter Store can store secrets as SecureString parameters, but it does not natively support automatic rotation. Custom automation would be required, making it less suitable than Secrets Manager for this use case.

AWS Certificate Manager (ACM)

Why wrong: AWS Certificate Manager is used to provision, manage, and deploy public and private SSL/TLS certificates. It does not handle database credentials or secret rotation.

AWS Config

Why wrong: Incorrect. AWS Config evaluates your AWS resource configurations against desired rules and tracks configuration changes over time. While it can be used to detect non-compliant S3 bucket policies, it does not proactively analyze policies for unintended cross-account or public access in the same way as IAM Access Analyzer. Access Analyzer is more targeted for this specific requirement.

AWS Trusted Advisor

Why wrong: Incorrect. AWS Trusted Advisor provides a check for S3 buckets with open access permissions, but it is a point-in-time check that updates periodically, not a continuous, findings-based service. It also does not analyze access from specific external AWS accounts. IAM Access Analyzer offers more granular and continuous detection.

Amazon Macie

Why wrong: Incorrect. Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data within S3 buckets, such as personally identifiable information (PII). It does not analyze resource policies for unintended access permissions. The requirement is about policy analysis, not content inspection.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor provides recommendations based on AWS best practices, but it does not support custom rules to evaluate resource configurations against company-specific policies. It cannot check for specific tags or security group associations.

Amazon GuardDuty

Why wrong: Amazon GuardDuty is a threat detection service that uses machine learning to identify suspicious activity, such as unusual API calls or compromised credentials. It does not evaluate resource configurations for compliance with tagging or security group rules.

Amazon Inspector

Why wrong: Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It does not check resource metadata like tags or security group associations for compliance.

AWS Shield Standard

Why wrong: AWS Shield Standard provides always-on protection against common DDoS attacks at the network and transport layer, but it does not inspect application-layer content like SQL injection payloads. It cannot block or filter specific HTTP requests.

Network ACLs

Why wrong: Network ACLs are stateless firewalls that control traffic at the subnet level based on IP addresses, ports, and protocols. They cannot inspect the contents of HTTP requests or block application-layer attacks like SQL injection.

Amazon GuardDuty

Why wrong: Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning and threat intelligence. It can detect SQL injection attempts in logs, but it does not actively block the requests; it only generates alerts.

IAM policies

Why wrong: IAM policies define permissions for users and roles within a single account. However, an account administrator with full permissions can modify or bypass IAM policies. Since the requirement is for central enforcement across accounts regardless of individual permissions, IAM policies alone are insufficient.

AWS Config rules

Why wrong: AWS Config rules can evaluate resource configurations and trigger notifications or automation for non-compliant resources, but they are detective, not preventive. They cannot block an action from occurring; they only respond after the fact.

Amazon CloudWatch Events

Why wrong: Amazon CloudWatch Events (now part of Amazon EventBridge) can react to API calls (e.g., disabling CloudTrail) by invoking a Lambda function or sending a notification, but it does not prevent the action from happening. It is a reactive tool, not a preventive guardrail.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor includes a best practice check for IAM key rotation, but it is an advisory service that generates recommendations. It does not continuously enforce a specific rotation policy and does not automatically flag individual non-compliant keys for remediation or custom notifications in the same way AWS Config rules do.

Amazon Inspector

Why wrong: Amazon Inspector is a vulnerability management service that scans Amazon EC2 instances and container images for software vulnerabilities and unintended network exposure. It does not evaluate IAM access key age or rotation policies.

AWS IAM Access Analyzer

Why wrong: AWS IAM Access Analyzer helps identify resources in your account that are shared with an external entity by analyzing resource-based policies (e.g., S3 bucket policies, IAM role trust policies). It does not evaluate the age or rotation status of IAM user access keys.

AWS Config

Why wrong: AWS Config is a service that evaluates your AWS resource configurations against desired policies. It can help detect non-compliant resources but does not provide downloadable compliance reports such as SOC 2 reports.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor inspects your AWS environment and provides recommendations based on AWS best practices. It does not offer downloadable compliance reports from AWS auditors.

Amazon Inspector

Why wrong: Amazon Inspector is an automated security assessment service that scans workloads for vulnerabilities and deviations from security best practices. It does not provide AWS compliance reports like SOC or ISO certifications.

AWS KMS with automatic key rotation

Why wrong: AWS KMS uses shared, multi-tenant HSMs managed by AWS, not a dedicated HSM under the customer's sole control. Automatic key rotation does not address the requirement for a dedicated HSM.

AWS Certificate Manager (ACM)

Why wrong: ACM is used for provisioning, managing, and deploying SSL/TLS certificates for use with AWS services. It does not provide dedicated HSM storage for encryption keys used in S3 server-side encryption.

AWS Secrets Manager

Why wrong: Secrets Manager is designed for securely storing and managing secrets such as database credentials and API keys. It does not provide dedicated HSM hardware for encryption key storage used with S3.

AWS Systems Manager Parameter Store

Why wrong: Incorrect. AWS Systems Manager Parameter Store can store secure strings (e.g., passwords) but does not provide built-in automatic rotation. To rotate secrets, you would need to create a custom AWS Lambda function and manage the rotation logic yourself, which adds complexity and does not meet the requirement for a fully managed, automatic solution.

AWS Key Management Service (AWS KMS)

Why wrong: Incorrect. AWS KMS is a service for creating and managing encryption keys. It can encrypt data at rest, but it is not designed to store or rotate database passwords. KMS does not provide the ability to automatically rotate application credentials or update database user passwords.

AWS Identity and Access Management (IAM)

Why wrong: Incorrect. IAM is used to manage access to AWS resources by creating users, groups, roles, and policies. It does not store or rotate database passwords for applications. IAM can grant applications permission to retrieve secrets from Secrets Manager, but it is not the service that manages the secrets themselves.

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing 0.0.0.0/0 on port 3306.

Why wrong: This is incorrect because opening the database SG to the entire internet (0.0.0.0/0) on port 3306 exposes the database to potential attacks from any source, violating security best practices.

Web security group: inbound rule allowing the web security group as source on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.

Why wrong: This is incorrect because the web SG allows inbound traffic from itself (self-reference) on port 443, which does not allow internet traffic. Internet users cannot reach the web tier, so the application would be inaccessible.

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the internet-facing Application Load Balancer security group as source on port 3306.

Why wrong: This is incorrect because the scenario does not mention an Application Load Balancer (ALB). Even if an ALB were present, the requirement is for direct communication between the web tier EC2 instances and the database tier, not through a load balancer.

AWS Key Management Service (KMS)

Why wrong: Incorrect. KMS manages encryption keys (symmetric and asymmetric) used for encrypting data at rest or in transit, but it does not manage X.509 SSL/TLS certificates or integrate with ALB for HTTPS listeners.

AWS Secrets Manager

Why wrong: Incorrect. Secrets Manager is used to rotate and manage secrets such as database credentials and API keys. It is not designed to manage SSL/TLS certificates or provide automatic certificate renewal.

AWS Identity and Access Management (IAM)

Why wrong: Incorrect. IAM can be used to upload server certificates for use with Elastic Load Balancers, but this requires manual certificate upload and renewal. IAM does not automate certificate renewal, making it unsuitable for this requirement.

Amazon GuardDuty

Why wrong: Incorrect. Amazon GuardDuty is a threat detection service that uses machine learning to identify malicious activity or unauthorized behavior in your AWS environment, such as unusual API calls or compromised credentials. It does not evaluate resource configurations for compliance with encryption policies.

AWS CloudTrail

Why wrong: Incorrect. AWS CloudTrail records API activity in your AWS account, providing an audit trail of who did what and when. While it can be used to investigate past events, it does not continuously monitor resource configurations or enforce compliance rules.

Amazon Inspector

Why wrong: Incorrect. Amazon Inspector is a vulnerability management service that scans Amazon EC2 instances and container workloads for software vulnerabilities and unintended network exposure. It does not evaluate S3 bucket configurations for encryption compliance.

AWS Identity and Access Management (IAM) policies

Why wrong: IAM policies are attached to IAM users, groups, or roles within a single account. They cannot enforce restrictions across multiple accounts or prevent the root user from creating IAM users. They also do not apply automatically to new accounts added to the organization.

AWS Config managed rules with automatic remediation

Why wrong: AWS Config rules can detect when an IAM user is created (non-compliant) and trigger automatic remediation actions, but they cannot prevent the creation in the first place. This is a detective and reactive solution, not a preventive one, and it requires per-account configuration.

IAM Access Analyzer

Why wrong: IAM Access Analyzer is used to analyze resource-based policies (e.g., S3 bucket policies, IAM roles) to identify resources shared with external principals. It does not have the ability to enforce restrictions on the creation of IAM users.

AWS Config with the s3-bucket-public-read-prohibited managed rule

Why wrong: AWS Config is a detective service that evaluates resource configurations against rules. The s3-bucket-public-read-prohibited rule can detect buckets that allow public read access, but it does not prevent the bucket from being created or configured with public access. The scenario explicitly requires a preventive control, not a detective one.

AWS Identity and Access Management (IAM) policy with a condition that denies s3:PutBucketPolicy for any action that grants public access

Why wrong: While an IAM policy with a condition key like s3:PutBucketPublicAccessBlock or a specific condition can deny PutBucketPolicy for public grants, it only applies to IAM users and roles that have the policy attached. It does not prevent the account root user or other authorized principals from making buckets public. It also does not apply to existing buckets that were made public before the policy was created. Therefore, it is not a comprehensive preventive control across the entire account.

Amazon GuardDuty with a finding suppression rule for S3 public access events

Why wrong: Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior. It can generate findings when an S3 bucket is made public, but it does not prevent the action from occurring. GuardDuty is a detective and response service, not a preventive control.

Enable AWS CloudTrail in each account individually and configure the S3 bucket to allow cross-account access from the audit account.

Why wrong: This approach requires manual effort to set up CloudTrail in every account and does not automatically include newly created accounts. It is not the most efficient solution for a multi-account organization.

Use AWS Config to record API calls and deliver configuration history to an S3 bucket.

Why wrong: AWS Config records resource configuration changes and histories, not API calls. It is not designed to capture all API activity for auditing purposes.

Set up Amazon GuardDuty to monitor API activity and send findings to a centralized S3 bucket.

Why wrong: Amazon GuardDuty is a threat detection service that analyzes AWS logs and network traffic for malicious activity. It does not provide a complete record of all API calls for auditing.