Hard Difficulty Questions

VPC Security Groups.

Why wrong: Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic. This is a preventive control, as it blocks traffic based on defined rules before it ever reaches the instance, rather than detecting or alerting on activity after it has occurred.

IAM User Permissions.

Why wrong: IAM permissions define what actions a user is allowed to perform. This is a preventive control because it enforces the principle of least privilege by restricting access before any action can be taken, thereby preventing unauthorized operations rather than detecting them after they have occurred.

Amazon GuardDuty.

Why wrong: GuardDuty is optimized for identifying anomalous patterns like unusual API calls or credential theft, but it does not allow users to define custom metric filters for specific log patterns. It would not specifically alert on a single 'Denied' event unless that event is part of a larger, suspicious behavioral pattern.

AWS Security Hub.

Why wrong: While Security Hub aggregates findings, it does not act as the primary engine for creating custom alerts based on raw log patterns. To get an alert into Security Hub, the log must first be processed by another service, such as CloudWatch or Lambda, to generate a formal finding.

AWS Trusted Advisor.

Why wrong: Trusted Advisor checks for resource optimization and security best practices, but it does not monitor real-time API logs or provide alerting capabilities for specific denied events within an account. It is not designed to function as an incident detection tool for API authorization failures.

No user, including the root user, can delete the bucket.

Why wrong: The explicit Deny on the 's3:DeleteBucket' action for all principals prevents any user from deleting the bucket. This is the intended behavior of such a policy, which serves as a 'guardrail' to prevent accidental data loss, demonstrating the strength of resource-based policies in AWS.

The policy is invalid because a Deny statement requires an explicit Condition block.

Why wrong: A Deny statement is perfectly valid without a Condition block. Applying a global Deny to all principals is a common, though highly restrictive, technique used to ensure that specific sensitive operations cannot be performed by anyone, regardless of their IAM permissions or administrative status in the account.

Users can still delete the bucket if they have an Allow policy in their IAM user.

Why wrong: AWS policy evaluation logic dictates that an explicit Deny always takes precedence over an Allow. Even if an IAM user has full administrative rights with an explicit Allow for all actions, the bucket policy's Deny will override those permissions, successfully blocking the deletion operation.

Terminate the EC2 instance immediately to stop the malicious traffic.

Why wrong: Termination causes the loss of all volatile memory and data stored in ephemeral storage, which is critical for identifying the C2 agent's behavior. Proper incident response requires imaging or isolating the instance while keeping it running or at least preserved on storage to allow for deep forensic analysis.

Reboot the instance to clear any malicious processes running in the background.

Why wrong: Rebooting clears the contents of the volatile memory (RAM), where many sophisticated malware variants reside. Any process data, network connections, or injected code stored in memory will be lost upon reboot, significantly hindering the ability to perform accurate memory forensics and identify the root cause of the compromise.

Delete all snapshots to prevent the attacker from accessing them.

Why wrong: Deleting snapshots serves no security purpose and actually destroys evidence that would be used to reconstruct the attack. Security teams need these snapshots to analyze what files were created or modified by the attacker, and deleting them would be a direct violation of standard incident response best practices.

AWS Glue

Why wrong: AWS Glue is a serverless data integration service used for ETL operations and data preparation for analytics. It is not designed for real-time threat detection or automated incident response and does not provide the security-focused alerting or remediation capabilities needed to handle unauthorized IAM credential usage.

AWS Direct Connect

Why wrong: Direct Connect provides a dedicated network connection between an on-premises data center and AWS. It is a networking service and has no role in the detection, investigation, or containment of security incidents related to IAM credentials or general cloud platform security monitoring.

Storing logs in an S3 bucket with public access enabled.

Why wrong: Public access to log files is a major security risk, allowing attackers to read or potentially delete the logs. Integrity must be protected by restricting access to the bucket to only the necessary security and audit roles, rather than exposing it to the public for any reason.

Encrypting the S3 bucket with a default AWS-managed KMS key.

Why wrong: While encryption is a best practice, it protects data at rest but does not guarantee the integrity of the log files against tampering or deletion. An attacker with sufficient privileges could still modify or delete logs unless additional controls like object locking or integrity validation are also implemented.

Using an S3 bucket in a different region than the logs.

Why wrong: Storing logs in a different region can improve availability, but it does not prevent log tampering. If an attacker has permissions, they can still access logs in a different region. Integrity validation is specifically designed to detect tampering, which is a more effective control than simple cross-region replication.

Amazon DynamoDB Tables

Why wrong: As of the current service definition, IAM Access Analyzer does not natively analyze DynamoDB tables directly via resource-based policies in the same way it does for S3 or SQS. Access to DynamoDB is typically controlled through IAM identity-based policies or VPC endpoints.

Amazon EC2 Security Groups

Why wrong: Security Groups are stateful firewalls for EC2 instances and are not analyzed by IAM Access Analyzer. To detect public access via Security Groups, services like AWS Config or Amazon Inspector's Network Reachability package should be used instead, as they focus on network-level exposure.

Enable VPC Flow Logs analysis within GuardDuty.

Why wrong: GuardDuty VPC Flow Logs analysis focuses on network traffic between instances, not data-level interactions with S3. Since S3 is a regional, public-facing service, VPC flow logs cannot capture the specific API calls or object-level access patterns required to identify data exfiltration attempts happening at the storage layer.

Configure AWS CloudTrail Insights for the S3 management events.

Why wrong: CloudTrail Insights detects anomalies in management events, such as creating or deleting buckets. It does not monitor the data plane, meaning it cannot detect the actual object-level 'GetObject' calls required to monitor for exfiltration. It is designed for operational monitoring rather than identifying granular data access anomaly patterns.

Deploy Macie to monitor S3 bucket access logs.

Why wrong: Amazon Macie is primarily designed for data discovery and classification to identify PII. While it can identify publicly accessible buckets, it is not an anomaly detection engine meant for monitoring real-time access patterns or identifying potential exfiltration activities by users; it is a sensitive data security and compliance tool.

Use TLS/SSL for all application-level communication over the link.

Why wrong: TLS/SSL provides encryption at the application layer (Layer 7), not the network layer. While this secures individual application sessions, it does not encrypt the entire network tunnel or other non-TLS traffic. The requirement specifically asked for encryption at the network layer to cover all data in transit.

Configure a Transit Gateway with VPC Peering and enable default encryption.

Why wrong: Transit Gateway and VPC Peering manage routing and connectivity but do not automatically encrypt traffic across a Direct Connect link. While traffic between VPCs within the same region is encrypted by the AWS infrastructure, this does not extend to the hybrid connection between on-premises and the cloud.

Deploy the firewalls behind an Application Load Balancer and use host-based routing.

Why wrong: Application Load Balancers operate at Layer 7 and are designed for HTTP/HTTPS traffic. They do not support the transparent inspection of all outbound traffic (including non-HTTP protocols) and cannot easily be used to intercept and forward raw IP packets to a firewall fleet while maintaining the original packet headers.

Use a Transit Gateway with VPC Peering and ECMP enabled for load balancing.

Why wrong: While Transit Gateway can route traffic to a central security VPC, ECMP (Equal-Cost Multi-Path) alone does not guarantee flow symmetry for stateful appliances across different VPCs without additional complex configuration. GWLB is the purpose-built AWS service specifically designed to solve the flow symmetry and appliance scaling problem.

Set up a Network Load Balancer with Proxy Protocol enabled for the firewall instances.

Why wrong: A Network Load Balancer can handle high volumes of traffic, but it requires the target appliances to be configured as standard proxies or targets. It does not provide the transparent 'bump-in-the-wire' capability that a Gateway Load Balancer offers, making it difficult to inspect all outbound traffic without modifying client configurations.

Change the default SSH port from 22 to a non-standard port like 2222.

Why wrong: Changing the port is 'security through obscurity' and does not prevent access by determined attackers who can quickly scan all ports. It provides a false sense of security while complicating management. Modern security practices focus on disabling inbound access entirely through methods like Session Manager, rather than attempting to hide services.

Install a third-party antivirus agent on every EC2 instance.

Why wrong: While antivirus can be part of a defense-in-depth strategy, it does not address the fundamental issue of securing the SSH protocol itself. The priority for hardening SSH should be preventing unauthorized network access and authentication, which is achieved through configuration changes and better access management tools like AWS Systems Manager.

Add the CloudFront IP ranges to the ALB's Security Group inbound rules.

Why wrong: CloudFront IP ranges are public and can change frequently, requiring constant manual updates or automation. Furthermore, allowing all CloudFront IPs would still permit traffic from distributions owned by other AWS customers, failing to isolate the ALB to only the company's specific distribution and its associated security policies.

Configure CloudFront to use an Origin Access Control (OAC) with the ALB as the target.

Why wrong: Origin Access Control is specifically designed for securing access to Amazon S3 buckets, not for Application Load Balancers. For ALBs, the recommended security mechanism involves header verification or AWS WAF, as OAC does not support the protocol handshakes required for load balancer origins in the same manner as S3.

Configure the ALB to only accept traffic containing a custom header set by CloudFront.

Why wrong: By adding a secret custom header in the CloudFront origin settings and creating an ALB listener rule that checks for this header, you ensure only requests through your distribution are processed. This effectively hides the origin from direct internet access even if the ALB has a public IP.

The user is missing the 's3:GetObject' permission.

Why wrong: The 's3:ListBucket' permission is sufficient for listing the contents of a bucket. The 's3:GetObject' permission is only required if the user attempts to download or read the content of the files themselves, which is not required for the initial 'ls' command to execute successfully.

The resource ARN is incorrectly formatted for S3.

Why wrong: The resource ARN 'arn:aws:s3:::production-data' is the correct format for referencing an S3 bucket in an IAM policy. The list action is bucket-level, and the resource scope is correctly defined for that action, so this does not contribute to the Access Denied error.

The user needs the 's3:PutObject' permission to list files.

Why wrong: The 's3:PutObject' permission is strictly for uploading data to a bucket. It is entirely unrelated to the ability to list objects within a bucket. Providing this permission would violate the principle of least privilege and would not resolve the issue preventing the list operation from working.

AWS Network Firewall

Why wrong: AWS Network Firewall provides managed stateful network firewall and intrusion detection capabilities at the VPC boundary, rather than stateless inspection specifically at the subnet boundary combined with instance-level security groups.

AWS Shield Advanced

Why wrong: AWS Shield Advanced is a managed security service that safeguards applications against distributed denial of service attacks and does not act as a packet filtering mechanism for subnets or instances.

Amazon Route 53 Resolver DNS Firewall

Why wrong: DNS Firewall filters and monitors outbound DNS queries made from resources within a VPC, protecting against domain generation algorithms and data exfiltration over DNS, but it is not a general network packet filtering feature.

Create an IAM policy in the compromised account to deny CloudTrail deletion.

Why wrong: If the attacker has administrative access, they can simply modify or delete any IAM policy you create within that account. An account-level policy does not provide sufficient protection against a compromised administrator role, as the attacker can elevate their own permissions to override or remove local security restrictions.

Use AWS Config Rules to automatically re-enable CloudTrail if disabled.

Why wrong: While AWS Config can trigger remediation, it is reactive rather than preventative. An attacker could still delete logs or stop logging for a period of time before the remediation runs, and they might also have the permissions to disable the Config recorder itself to prevent the remediation from firing.

Enable S3 Object Lock in compliance mode for all log buckets.

Why wrong: S3 Object Lock is an excellent control for data integrity, but it does not prevent the attacker from stopping the CloudTrail service or modifying the logging configuration. While it protects existing logs, the attacker could stop the delivery of new logs, resulting in a gap in the audit trail.

Terminate the EC2 instance immediately to stop the data exfiltration.

Why wrong: Terminating an instance results in the loss of volatile memory and instance store data, destroying critical forensic evidence. Best practice dictates isolating the instance using security groups or network ACLs to block traffic while maintaining the state for memory analysis and post-mortem disk investigation.

Attach a new IAM role with administrative privileges to the instance.

Why wrong: Attaching administrative privileges to a compromised instance increases the blast radius of the attack. Any existing malware could use the elevated permissions to perform further malicious actions, such as disabling logs, deleting snapshots, or escalating privileges across the entire AWS account environment, worsening the initial security incident.

Remove the VPC flow logs to save storage costs during the investigation.

Why wrong: VPC Flow Logs are a critical source of truth for network traffic patterns, including source and destination IP addresses, ports, and protocols. Deleting these logs would remove the only evidence documenting the C2 communication, making it impossible to determine the extent of the exfiltration or the attacker's origin.

Enable transparent data encryption on the RDS instance and configure security groups to restrict traffic exclusively to application server IP addresses.

Why wrong: Transparent data encryption secures data at rest on disk rather than traffic traversing the network in transit. While security groups restrict network paths, they do not provide cryptographic protection or encryption for packets moving across network wires.

Implement AWS Shield Advanced on the database subnet to automatically encrypt all database packets traversing the internal VPC network interfaces.

Why wrong: AWS Shield Advanced is a managed DDoS protection service designed to safeguard applications against volumetric and application-layer attacks. It does not provide cryptographic encryption for database connections or manage transport-layer security protocols.

Deploy a Network Load Balancer in front of the database and configure TLS termination listeners with self-signed cryptographic certificates.

Why wrong: Amazon RDS does not natively support placing a Network Load Balancer directly in front of managed database engines for TLS termination in this manner. Furthermore, self-signed certificates introduce trust risks and fail enterprise validation controls.

The user must have the AdministratorAccess managed policy attached.

Why wrong: Administrator access is not required to assume a role. The user only needs permission to perform the 'sts:AssumeRole' action. Granting administrative privileges would be a significant security risk, violating the principle of least privilege, as it allows the user to do far more than just assume the intended role.

The trusting account must share the root user password with the trusted account.

Why wrong: Sharing passwords is a catastrophic security failure and is never required. IAM roles are specifically designed to allow cross-account access without sharing any credentials. The trust relationship is managed through metadata (ARNs and account IDs) in the IAM trust policy, keeping each account's authentication domain strictly separate and secure.

Assign IAM policies directly to the root user of every member account.

Why wrong: Modifying the root user in member accounts is an anti-pattern. The root user should have multi-factor authentication enabled and be locked away. Assigning policies to it does not scale and is unnecessary, as SCPs already provide the required governance across all identities in the account, including the root user.

Configure individual IAM users in every account to ensure fine-grained control.

Why wrong: Managing individual IAM users in every account is a high-maintenance and insecure approach. It is better to use AWS IAM Identity Center to centrally manage identities across all accounts. Manual user creation increases the surface area for credential leaks and makes consistent security posture enforcement nearly impossible at scale.

Enable AWS CloudTrail only in the primary management account.

Why wrong: CloudTrail must be enabled in all accounts to maintain a comprehensive audit log. Logging only in the management account provides zero visibility into actions taken within member accounts. Centralized logging is a non-negotiable security requirement for compliance, detection of unauthorized activity, and incident response within an enterprise-level AWS environment.

Store the root access keys in a secure, encrypted S3 bucket.

Why wrong: Root access keys should not exist. They should be deleted immediately after account creation. Storing them in an S3 bucket, even if encrypted, creates a single point of failure and potential target. The root user should only be accessed via the console using credentials and MFA, never via programmatic access keys.

Use the root account for daily administrative tasks to simplify management.

Why wrong: Using the root account for daily tasks is extremely dangerous. It violates the principle of least privilege and significantly increases the risk of accidental resource deletion or configuration changes. Administrative tasks should always be performed using an IAM user or role with the minimum necessary permissions required for the job.