CCNA Security and Compliance Questions

The most likely cause is that the application is caching the secret and not refreshing it after rotation. By default, the AWS SDK for Secrets Manager caches secrets in memory for a configurable TTL (default 1 hour). Even though the secret is rotated in Secrets Manager, the application will continue to use the cached old secret until the cache expires or is explicitly refreshed.

Option A is incorrect because the IAM role has the required permission (secretsmanager:GetSecretValue) and listing secrets is not necessary for retrieval. Option B is unlikely because the application would fail immediately if using the wrong secret ID, not only after rotation. Option C is about the rotation Lambda function, but the application's failure to connect after rotation does not indicate the Lambda function itself is failing; rotation may have succeeded but the application is not fetching the new version.

AWS Organizations with IAM Identity Center (AWS SSO) enables centralized user management and single sign-on across multiple AWS accounts, eliminating the need to manage individual IAM users in each account. Option B is incorrect because creating the same IAM users in each account leads to duplication and inconsistent permissions. Option C is incorrect because cross-account roles still require local IAM users or federated identities to assume those roles, and do not provide centralized user management.

Option D is incorrect because IAM federation with an external IdP centralizes authentication but does not inherently manage users across accounts unless combined with AWS Organizations and IAM Identity Center.

The most secure because adding a Deny statement for ec2:TerminateInstances with a condition for the user's ARN explicitly blocks the termination action, regardless of any other policies that might allow it. Option A is wrong because an SCP affects the entire account, not just the user, and may be too broad. Option B is wrong because simply modifying the policy to include ec2:StopInstances and remove ec2:TerminateInstances does not prevent termination if the user has other policies that grant ec2:TerminateInstances.

Option D is wrong because attaching a separate Deny policy is effective but less direct and more complex than adding a Deny in the same policy.

(launch RDS in a private subnet) and Option D (enable encryption at rest using AWS KMS) are correct best practices for securing an Amazon RDS database. Launching in a private subnet ensures the database is not directly accessible from the internet, enhancing security. Encryption at rest protects data stored on disk.

Option A is incorrect because enabling public accessibility increases exposure to attacks. Option B is incorrect because using a single Availability Zone does not enhance security and may reduce availability. Option E is incorrect because direct IAM user access to the database is not a standard practice; RDS uses database authentication, though IAM database authentication can be used, it's not a direct IAM user access and is not a best practice for all scenarios.

A Service Control Policy (SCP) can deny the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions across all accounts in the organization, effectively preventing member accounts from disabling CloudTrail or deleting logs. Option A is incorrect because requiring all accounts to use the same trail does not prevent them from disabling or deleting that trail; they could still perform those actions. Option C is incorrect because IAM policies within each account are managed by the account administrator and can be overridden, so they are not a reliable control.

Option D is incorrect because while logging to a centralized bucket helps protect logs, it does not prevent member accounts from disabling CloudTrail or deleting the trail itself in their own account; member accounts may still have permissions to modify or delete the trail.

Using a customer-managed KMS key to encrypt the Lambda function's environment variables satisfies the encryption at rest requirement. Option C is correct because configuring the Lambda function to be VPC-enabled and setting up a VPC endpoint for Lambda restricts invocation to within the specific VPC. Option B is incorrect because encrypting CloudWatch Logs does not encrypt the Lambda environment variables.

Option D is incorrect because assigning an IAM execution role with KMS permissions is necessary but not sufficient; the encryption is enabled by configuring KMS on the function. Option E is incorrect because resource-based policies cannot restrict invocation to VPC origin alone; VPC configuration and endpoints are required.

It combines a bucket policy in Account A granting access to Account B's root or specific ARN, and an IAM policy in Account B allowing users to access that bucket. Option A is wrong because a bucket policy alone is insufficient; Account B users also need IAM permissions. Option B is wrong because KMS is for encryption, not access control.

Option D is wrong because creating an IAM role in Account A with a trust policy allowing Account B to assume it is a valid pattern, but the question specifies users in Account B; they would need to assume the role, which is less direct than Option C for S3 access.

Enabling multi-factor authentication (MFA) adds an extra layer of security beyond a password, which is especially important for privileged users. Option E is correct because IAM roles provide temporary credentials for applications, eliminating the need to store long-term access keys and reducing security risks. Option A is incorrect because access keys should not be shared; each user should have their own keys and they should be rotated regularly.

Option B is incorrect because storing IAM user passwords in a shared document violates security best practices and increases the risk of unauthorized access. Option D is incorrect because using the root user for daily administrative tasks is dangerous; the root user should be used only for limited, high-privilege tasks, and otherwise should be protected with MFA and not used for routine operations.

Options A and B are correct. AWS Systems Manager Parameter Store can store database credentials as SecureString parameters, and you can implement automatic rotation using a custom AWS Lambda function. AWS Secrets Manager provides built-in automatic rotation for supported databases (e.g., Amazon RDS, Amazon Redshift) without requiring custom code.

Option C (AWS CloudFormation) is an infrastructure-as-code service and does not manage or rotate credentials. Option D (AWS KMS) is a key management service that encrypts data but does not handle credential rotation. Option E (AWS IAM) manages access permissions and roles, not database credentials.

The most likely cause is that the security group rule is using an outdated list of CloudFront IP ranges. CloudFront's IP ranges are dynamic and change over time; AWS publishes these ranges but they are not static. When a new range is added that is not in the security group rule, requests from those IPs are blocked, leading to 'Origin Connect Error' and intermittent 503 errors.

The correct approach is to use a custom header (e.g., X-Origin-Verify) from CloudFront and validate it at the ALB, rather than relying on IP-based security groups. Option A (WAF blocking) would typically result in 403 Forbidden, not 503. Option C (SSL certificate) would cause handshake failures with a different error.

Option D (idle timeout) would cause consistent timeout errors, not intermittent ones.

The most secure way to grant a Lambda function access to a secret in AWS Secrets Manager is to attach an IAM role to the Lambda function with permissions to read the secret and retrieve it at runtime (Option B). This follows the principle of least privilege and avoids hardcoding or embedding secrets in the function code. Option A is incorrect because AWS KMS is used for encryption, not for storing or retrieving secrets; Secrets Manager handles secret storage, and KMS can be used to encrypt secrets at rest.

Option C is insecure because storing credentials directly in environment variables exposes them in plain text. Option D is also insecure because even with encryption enabled, environment variables can be exposed in logs or through the AWS Management Console, and they are not designed for secret management.

The IAM policy includes a condition that allows s3:GetObject only if the request originates from an IP address within the 10.0.0.0/8 range. The user's IP 10.1.2.3 falls within this range, so the condition is satisfied and the action is allowed. Option A is wrong because a Deny statement is not required; an explicit Allow with a condition is sufficient.

Option B is wrong because the policy does explicitly allow the action when the condition is met. Option C is wrong because the bucket policy is not specified and the IAM policy already grants permission; the result does not depend on the bucket policy unless it explicitly denies, but no such policy is shown.

AWS Secrets Manager (Option A) is the correct service for securely storing database credentials. It provides automatic rotation, fine-grained access control, and native integration with Amazon ECS via task roles, allowing containers to retrieve secrets at runtime. Option B (Amazon S3 with SSE) is wrong because S3 is a general-purpose object store; storing credentials in S3 requires manual encryption and access management, and it lacks native rotation.

Option C (AWS Systems Manager) is a broad management service that includes features like Run Command and Patch Manager, but it is not specifically designed for secrets management. Option D (AWS Systems Manager Parameter Store) can store parameters and secrets, but it lacks automatic rotation and is less secure for credential management compared to Secrets Manager.

To determine if the activity is malicious, the engineer should check the source IP address from the CloudTrail event details. The source IP can indicate if the login came from an unexpected location, suggesting compromised credentials. Option A is wrong because the event name (CreateUser) is already known from the command output.

Option B is wrong because the time the new user was last modified does not provide direct evidence about the unauthorized nature of the login event. Option D is wrong because the IAM group memberships of the new user do not indicate whether the login itself was unauthorized.

The requirement is to encrypt log files with a KMS key that rotates every 90 days. The current key rotates every 365 days, and you cannot change the rotation period of an existing customer managed key; you must create a new key with the desired rotation period. Once created, you update the CloudTrail trail to use the new key by specifying the --kms-key-id parameter.

Option D correctly describes this process. Option A is wrong because you cannot change the rotation period of an existing key. Option B is wrong because manually rotating a key does not meet the automatic rotation requirement and is not recommended.

Option C is wrong because you cannot modify the rotation period of an existing key.

It follows the recommended pattern for cross-account access: create an IAM role in the source account with necessary permissions and attach a bucket policy in the target account granting access to that role. This ensures least privilege by delegating access through a role rather than sharing long-term credentials. Option A is wrong because using root user credentials is insecure and violates least privilege.

Option C is wrong because the IAM user should be in the source account, not the target account, and access keys should not be stored in Secrets Manager for this purpose; instead, a role is preferred. Option D is wrong because although it creates an IAM user in the source account, a role is the recommended practice for cross-account access as it avoids managing long-term credentials.

The Allow statement grants the ec2:DescribeInstances action on all instances. The Deny statement denies all ec2 actions (ec2:*) on instances when the requested region is not us-east-1. Since the request in Option A is for us-east-1, the condition in the Deny statement is false, so the Deny does not apply.

Therefore, the Allow stands and DescribeInstances is permitted. Option B (StartInstances) is not explicitly allowed by any statement, and although the Deny does not apply for us-east-1, there is no Allow, so it is implicitly denied. Option C (DescribeInstances in us-west-2) is denied because the region is not us-east-1, triggering the Deny.

Option D (StopInstances in us-east-1) is also implicitly denied because no Allow exists for that action.

The correct parameter to enforce server-side encryption with AWS KMS (SSE-KMS) when uploading an object via the AWS CLI is --server-side-encryption aws:kms, which corresponds to option D. Option A is incorrect because --kms-key-id only specifies the key ID but does not enable encryption by itself; it must be combined with --server-side-encryption aws:kms. Option B is incorrect because --sse AES256 is not a valid AWS CLI parameter; the correct parameter for SSE-S3 is --server-side-encryption AES256.

Option C is incorrect because --encryption is not a valid AWS CLI parameter for server-side encryption.

The CodeBuild service role requires the s3:PutObject permission on the artifact S3 bucket to upload build artifacts. Option B is incorrect because enabling server-side encryption does not grant write permissions; the issue is a missing IAM permission. Option C is incorrect because CloudWatch Logs are used for build logs, not for S3 access; enabling them does not resolve the access denied error.

Option D is incorrect because s3:GetObject permission is for reading objects from a source bucket, not for writing artifacts. The error specifically indicates a failure to put an object into the artifact bucket, so the needed permission is s3:PutObject on that bucket.

To automatically scan for secrets and block the pipeline, the team should add a scanning action in the build stage (Option C) using a custom or third-party action that integrates with AWS Marketplace. The build project should be configured to fail the build if the scanning tool returns a non-zero exit code (Option B), which prevents deployment from proceeding. Additionally, the CodeBuild service role needs permissions to retrieve the scanning tool, for example from an S3 bucket (Option E).

Option A is incorrect because scanning after deployment does not block the pipeline before deployment. Option D is incorrect because an S3 bucket policy does not directly block the pipeline based on secrets detection.

WS Secrets Manager (Option C) because it is specifically designed for securely storing, managing, and automatically rotating database credentials and other secrets. Amazon S3 with server-side encryption (Option A) is an object storage service and not intended for secret management; it lacks automatic rotation and fine-grained access control for secrets. AWS Systems Manager Parameter Store (Option B) can store secrets but does not natively support automatic rotation, which is a key requirement for database credentials.

AWS Key Management Service (Option D) manages encryption keys, not secrets themselves, and is used for encryption, not secret storage.

To implement a secure VPC with a public subnet and a private subnet hosting a database, three components are necessary. First, an Internet Gateway attached to the VPC (B) enables the public subnet to communicate with the internet. Second, a NAT Gateway in the public subnet (C) allows instances in the private subnet to initiate outbound traffic to the internet (e.g., for updates) while keeping them private.

Third, a security group for the database (E) must be configured to allow inbound traffic only from the application tier's security group, providing a firewall that restricts access to the database. A Site-to-Site VPN connection (A) is not required because there is no on-premises connection needed. VPC Peering (D) is unnecessary as there is no need to connect to another VPC.

Therefore, options B, C, and E are correct.

SCPs can deny the s3:PutBucketEncryption action, but the bucket is created with the s3:CreateBucket action, not s3:PutBucketEncryption. The s3:CreateBucket action does not trigger s3:PutBucketEncryption when encryption is not explicitly set; encryption defaults are applied separately. To enforce encryption at creation, the SCP should deny s3:CreateBucket with a condition that the x-amz-server-side-encryption header is absent or not set to AES256.

Option B correctly identifies this issue. Option A is incorrect because s3:PutBucketEncryption is used to change encryption settings on an existing bucket, not during creation. Option C is incorrect because the SCP being attached to the wrong OU would cause a different error.

Option D is incorrect because the management account is not the one being tested.

To enforce encryption at rest for all S3 buckets, three steps are needed: (A) AWS Config rules can detect buckets without encryption, providing visibility and enforcement through remediation; (B) an S3 bucket policy that denies PutObject requests lacking encryption headers ensures objects are encrypted when uploaded; (D) enabling default encryption on each bucket ensures that new objects are encrypted even if the upload does not specify encryption. Together, these cover detection, prevention, and default behavior. Option C (server access logging) is for auditing access, not encryption.

Option E (Transfer Acceleration) improves transfer speed, not encryption.