Scenario practice questions

During a security review, a security engineer notices that an S3 bucket contains sensitive data but has a bucket policy that allows access from any principal in the account. The engineer needs to identify any unintended cross-account access to this bucket. Which AWS service should be used?

Trap 1: AWS Config

Config tracks configuration changes, but does not analyze policies for cross-account access.

Trap 2: AWS Trusted Advisor

Trusted Advisor checks for security best practices but not specific policy analysis.

Trap 3: Amazon Macie

Macie discovers sensitive data, but does not analyze policies for unintended access.

A
AWS Config
Why wrong: Config tracks configuration changes, but does not analyze policies for cross-account access.
B
AWS IAM Access Analyzer
Access Analyzer reviews resource policies to identify external entities.
C
AWS Trusted Advisor
Why wrong: Trusted Advisor checks for security best practices but not specific policy analysis.
D
Amazon Macie
Why wrong: Macie discovers sensitive data, but does not analyze policies for unintended access.

Question 2mediummultiple choice

A company has a requirement to grant cross-account access to an S3 bucket named 'shared-data' in Account A (111111111111) to users in Account B (222222222222). The security team has set up a bucket policy in Account A that grants read-only access to the IAM role 'DataReader' in Account B. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:role/DataReader"},"Action":["s3:GetObject"],"Resource":"arn:aws:s3:::shared-data/*"}]}. A user in Account B assumes the 'DataReader' role, but when trying to read an object from the bucket, they receive an 'Access Denied' error. What is the MOST likely reason for this error?

Trap 1: The bucket policy principal must be the IAM user ARN, not the role…

A role ARN is a valid principal for a bucket policy.

Trap 2: The bucket policy is missing the 's3:ListBucket' action, which is…

s3:GetObject does not require ListBucket; the error is Access Denied, not NoSuchKey.

Trap 3: The bucket objects are encrypted with a KMS key, and the role does…

The question does not mention encryption; it is not the most likely cause.

A
The bucket policy principal must be the IAM user ARN, not the role ARN.
Why wrong: A role ARN is a valid principal for a bucket policy.
B
The bucket policy is missing the 's3:ListBucket' action, which is required to read objects.
Why wrong: s3:GetObject does not require ListBucket; the error is Access Denied, not NoSuchKey.
C
The IAM role 'DataReader' does not have an IAM policy that allows s3:GetObject on the bucket.
The role needs both a trust policy and an IAM policy granting the action; the IAM policy is missing.
D
The bucket objects are encrypted with a KMS key, and the role does not have permission to decrypt.
Why wrong: The question does not mention encryption; it is not the most likely cause.

Question 3mediummultiple choice

Refer to the exhibit. A security engineer is analyzing a VPC Flow Log entry from an EC2 instance with private IP 10.0.1.5. The log shows an outbound connection to IP 203.0.113.5 on port 443 from source port 22. The connection was accepted. What is the most likely scenario?

Exhibit

Refer to the exhibit.
[2023-01-15 12:34:56] 10.0.1.5 203.0.113.5 22 443 6 10 1000 1234567890 1234567891 ACCEPT OK

Trap 1: The instance is connecting to a remote server on the internal…

Remote IP is public (203.0.113.5).

Trap 2: The instance is receiving an SSH connection from the remote IP.

Log shows outbound from instance.

Trap 3: The instance is making an HTTPS request to a web server.

Source port 22 is not HTTPS.

A
The instance is responding to an inbound SSH connection from the remote IP.
Flow logs capture both directions; source port 22 indicates reply.
B
The instance is connecting to a remote server on the internal network.
Why wrong: Remote IP is public (203.0.113.5).
C
The instance is receiving an SSH connection from the remote IP.
Why wrong: Log shows outbound from instance.
D
The instance is making an HTTPS request to a web server.
Why wrong: Source port 22 is not HTTPS.

Question 4hardmultiple choice

A company uses AWS Lambda functions to process sensitive data. The security team wants to ensure that if a Lambda function is compromised, the attacker cannot use the function's IAM role to access other AWS resources. The team has implemented the principle of least privilege by restricting the IAM role's permissions. However, they are concerned about a scenario where an attacker could use the Lambda function to execute AWS API calls that are not intended by the application. What additional measure should the team implement to reduce the risk of such lateral movement?

Trap 1: Enable AWS CloudTrail data events for the Lambda function.

Detective, not preventive.

Trap 2: Attach a service control policy (SCP) that denies all actions…

SCPs apply at the account level, not just the function.

Trap 3: Place the Lambda function inside a VPC with no internet access.

Does not prevent API calls to AWS services via VPC endpoints or internet.

A
Use AWS IAM Access Analyzer to generate and refine the IAM policy based on actual usage.
Helps create least privilege policies by analyzing usage patterns.
B
Enable AWS CloudTrail data events for the Lambda function.
Why wrong: Detective, not preventive.
C
Attach a service control policy (SCP) that denies all actions except those explicitly allowed.
Why wrong: SCPs apply at the account level, not just the function.
D
Place the Lambda function inside a VPC with no internet access.
Why wrong: Does not prevent API calls to AWS services via VPC endpoints or internet.

Question 5easymultiple choice

A developer needs to grant an IAM user the ability to launch EC2 instances with specific tags. Which IAM condition key should be used to enforce that the instance is tagged with 'Environment=Production'?

Trap 1: aws:ResourceTag

Checks existing tags on resource.

Trap 2: aws:SourceIp

Source IP condition, not tags.

Trap 3: ec2:ResourceTag

ec2:ResourceTag is a valid condition key that checks tags on existing resources, not on the request. For enforcing tags at launch, aws:RequestTag should be used.

A
aws:ResourceTag
Why wrong: Checks existing tags on resource.
B
aws:SourceIp
Why wrong: Source IP condition, not tags.
C
ec2:ResourceTag
Why wrong: ec2:ResourceTag is a valid condition key that checks tags on existing resources, not on the request. For enforcing tags at launch, aws:RequestTag should be used.
D
aws:RequestTag
Enforces tags at request time.

Question 6mediummultiple choice

A company's security engineer is configuring a web application firewall (WAF) to protect a public-facing Application Load Balancer (ALB). The application is vulnerable to SQL injection attacks. Which AWS WAF rule should be used to mitigate this threat?

Trap 1: Add a rule to block cross-site scripting (XSS) attacks.

XSS is different from SQL injection.

Trap 2: Add a rate-based rule to limit requests per IP.

Rate-based rules limit request rate, not specific attacks.

Trap 3: Add a geographic match rule to block traffic from specific…

Geo-blocking does not prevent SQL injection.

A
Add a rule to block cross-site scripting (XSS) attacks.
Why wrong: XSS is different from SQL injection.
B
Add a rule from the AWS Managed Rules for SQL injection.
SQL injection rule group blocks SQLi patterns.
C
Add a rate-based rule to limit requests per IP.
Why wrong: Rate-based rules limit request rate, not specific attacks.
D
Add a geographic match rule to block traffic from specific countries.
Why wrong: Geo-blocking does not prevent SQL injection.

Question 7hardmultiple choice

A company uses AWS CloudTrail to log all API calls. The security team notices that some expected log entries are missing for actions performed by an IAM role assumed by an EC2 instance. The instance has the required permissions. What is the MOST likely cause of the missing log entries?

Trap 1: The EC2 instance is in a VPC that has a VPC endpoint for…

Incorrect. There is no VPC endpoint for CloudTrail. CloudTrail uses public endpoints. VPC endpoint policies apply to other services.

Trap 2: CloudTrail trail is not configured to log data events for EC2.

Incorrect. CloudTrail data events are only for S3 and Lambda, not for EC2. EC2 actions are management events.

Trap 3: The IAM role used by the EC2 instance has a permissions boundary…

Incorrect. CloudTrail logs API calls regardless of the caller's IAM permissions. A permissions boundary does not affect CloudTrail logging, and `cloudtrail:PutLogEvents` is not a standard action.

A
The EC2 instance is in a VPC that has a VPC endpoint for CloudTrail, but the endpoint policy denies logging.
Why wrong: Incorrect. There is no VPC endpoint for CloudTrail. CloudTrail uses public endpoints. VPC endpoint policies apply to other services.
B
CloudTrail is not logging read-only API calls by default; the trail must be configured to log read events.
Correct. If the CloudTrail trail is configured to log only write events, read-only API calls will not appear in the logs, which could explain the missing entries.
C
CloudTrail trail is not configured to log data events for EC2.
Why wrong: Incorrect. CloudTrail data events are only for S3 and Lambda, not for EC2. EC2 actions are management events.
D
The IAM role used by the EC2 instance has a permissions boundary that excludes cloudtrail:PutLogEvents.
Why wrong: Incorrect. CloudTrail logs API calls regardless of the caller's IAM permissions. A permissions boundary does not affect CloudTrail logging, and `cloudtrail:PutLogEvents` is not a standard action.

Question 8hardmultiple choice

A security engineer is troubleshooting an issue where an IAM policy allows access to S3 but the user is denied access to a specific bucket. The policy has the following statement:

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

What is the most likely cause of the denial?

Trap 1: The policy statement is too broad and AWS automatically denies…

This is incorrect. AWS does not automatically deny access to specific buckets because a policy is broad. A broad allow policy grants access unless a deny exists elsewhere.

Trap 2: The S3 bucket has a bucket policy that denies access to the user.

This is incorrect. A bucket policy with a deny could cause the denial, but it is not the most likely cause given the IAM allow and the troubleshooting context of IAM policies. The question asks for the most likely cause, which is an explicit deny in a different policy.

Trap 3: The policy is attached to the user but the user is assuming a role…

This is incorrect. Assuming a role would change the effective permissions, but there is no indication the user is assuming a role. The user's own policy is an allow, and role assumption is not mentioned.

A
The policy statement is too broad and AWS automatically denies access to specific buckets.
Why wrong: This is incorrect. AWS does not automatically deny access to specific buckets because a policy is broad. A broad allow policy grants access unless a deny exists elsewhere.
B
An explicit deny statement in a different policy (e.g., SCP, permissions boundary) is overriding the allow.
This is correct. An explicit deny in a service control policy (SCP), permissions boundary, or another IAM policy takes precedence over any allow, causing the denial.
C
The S3 bucket has a bucket policy that denies access to the user.
Why wrong: This is incorrect. A bucket policy with a deny could cause the denial, but it is not the most likely cause given the IAM allow and the troubleshooting context of IAM policies. The question asks for the most likely cause, which is an explicit deny in a different policy.
D
The policy is attached to the user but the user is assuming a role that does not have S3 permissions.
Why wrong: This is incorrect. Assuming a role would change the effective permissions, but there is no indication the user is assuming a role. The user's own policy is an allow, and role assumption is not mentioned.

Question 9mediummultiple choice

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to read objects from an S3 bucket only from the office IP range 192.0.2.0/24. However, the user reports that they can access objects from any IP address. What is the most likely reason?

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}
```

Trap 1: The condition key is misspelled; it should be aws:SourceIp without…

Condition key is correct.

Trap 2: The policy is attached to the user, but the bucket has a bucket…

If bucket policy allows, then user policy condition might be overridden, but not the most likely.

Trap 3: The resource ARN is missing the bucket name.

Resource is correct.

A
The policy does not include an explicit Deny for requests outside the IP range.
Without explicit Deny, other policies may allow access.
B
The condition key is misspelled; it should be aws:SourceIp without the 's'.
Why wrong: Condition key is correct.
C
The policy is attached to the user, but the bucket has a bucket policy that allows public access.
Why wrong: If bucket policy allows, then user policy condition might be overridden, but not the most likely.
D
The resource ARN is missing the bucket name.
Why wrong: Resource is correct.

Question 10mediummultiple choice

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The instance is launched in a VPC with a VPC endpoint for S3. The IAM role has a policy that grants s3:GetObject on the bucket. However, the application on the instance receives 'Access Denied' errors when trying to read objects. What is the MOST likely cause?

Trap 1: The EC2 instance does not have an encryption key to decrypt the…

Access denied is not related to encryption keys.

Trap 2: The S3 bucket policy does not explicitly allow the IAM role.

Bucket policies are not required if the IAM role grants access.

Trap 3: The IAM role is not attached to the EC2 instance profile.

The role is attached; otherwise the application would not have any access.

A
The VPC endpoint policy for S3 does not allow the required action.
VPC endpoint policies can override IAM permissions.
B
The EC2 instance does not have an encryption key to decrypt the objects.
Why wrong: Access denied is not related to encryption keys.
C
The S3 bucket policy does not explicitly allow the IAM role.
Why wrong: Bucket policies are not required if the IAM role grants access.
D
The IAM role is not attached to the EC2 instance profile.
Why wrong: The role is attached; otherwise the application would not have any access.