CCNA Security and Compliance Questions

AWS Secrets Manager natively supports automatic rotation for IAM user access keys: you configure a rotation schedule (e.g., every 30 or 90 days), and the service creates a new access key, updates the secret with the new credentials, and deletes the old key after a safe handoff—all with versioning so you can stage the new secret separately from the current one. It does not require you to write any custom scheduling code because Secrets Manager uses an AWS-provided Lambda rotation function template for IAM user keys, and it can alternate between two active keys to avoid downtime for downstream systems. This directly meets the need to 'require access to the service' without manual intervention, and it also gives you fine-grained IAM permissions to control who can access or rotate the secret, plus CloudTrail audit logs of rotation events.

Shield Advanced provides 24/7 access to the AWS DDoS Response Team (DRT), a specialized crew that can assist during an ongoing attack, perform proactive architectural reviews, and create tailored mitigations. This human-level support is a unique, paid benefit that distinguishes Shield Advanced from the free Shield Standard, making it crucial for high-risk, mission-critical applications.

This statement is correct. The IAM password policy includes PasswordReusePrevention configured to 5, which prevents a user from reusing any of their previous 5 passwords when changing or resetting a password. This means the specified number of previous passwords is stored and cannot be reused, directly matching the statement.

Combines both conditions to enforce KMS encryption and the specific customer managed key, meeting the requirement.

A KMS key policy is the resource-based policy attached directly to the customer master key (CMK) that defines which principals can use the key. For roles within the same AWS account, you can either specify the role ARNs directly in the key policy or allow the account root to delegate permissions via IAM policies. This is the authoritative mechanism to restrict key usage to only the designated IAM roles.

Attaching an IAM role to an EC2 instance provides temporary credentials through the instance metadata service (IMDS). The application can retrieve these credentials automatically without embedding long-term keys. This is the recommended best practice for granting AWS permissions to EC2 instances. The role's policy can be scoped to only the necessary S3 actions, following least privilege.

AWS CloudTrail is the correct service for recording all AWS account activity. It captures every API call made in the account, including the identity of the caller, the time of the call, the source IP address, and the requested action, delivering these events as log files. These logs can be delivered to an Amazon S3 bucket for long-term, tamper-evident storage, which directly satisfies the compliance and auditing requirement.

Enabling default encryption with SSE-KMS ensures that every object uploaded without an explicit encryption header is automatically encrypted at rest using a KMS-managed customer key. This provides envelope encryption and allows you to control key access through IAM policies, while CloudTrail records key usage for auditing. It directly addresses data-at-rest confidentiality, making it a necessary and effective security action.

AWS CloudTrail is the correct foundation because it records management events, including the iam:CreateAccessKey API call, as a JSON audit log. A CloudWatch Events rule (or Amazon EventBridge rule) can use an event pattern to match the eventSource, eventName, and other fields, then invoke an SNS topic to send an email or SMS notification. This combination provides near-real-time detection of the exact API action—something a periodic report or static policy scanner cannot deliver.

This Deny policy uses StringNotEquals on the s3:x-amz-server-side-encryption request header to block any PUT that does not explicitly specify aws:kms. Because it's an explicit deny, it overrides all allows, so objects uploaded with AES256, no encryption header, or any other value are rejected. That directly enforces the requirement that all S3 data be encrypted with SSE-KMS.

AWS Config continuously evaluates S3 bucket configurations against managed rules such as s3-bucket-server-side-encryption-enabled, which specifically verifies that default encryption is set to SSE-KMS. When a bucket is non-compliant, AWS Config can automatically invoke an SSM automation document (e.g., AWS-EnableS3BucketEncryption) to remediate the violation, enforcing SSE-KMS without manual intervention. This real-time monitoring and automated remediation capability is exactly what the SysOps administrator needs to ensure all S3 buckets meet the encryption requirement.

HTTPS uses TLS to encrypt the entire HTTP request and response payload between the EC2 instance and S3, including object data, providing confidentiality and integrity against eavesdropping and tampering. This is a client-side action: the application must explicitly use the https:// prefix in the S3 endpoint URL, and AWS recommends this as the primary measure for protecting data in transit.

AWS CloudTrail is the correct service because it records API activity across all AWS services, capturing the identity of the caller, the time of the call, the source IP address, and the user agent. Management events are logged and can be delivered to an S3 bucket or CloudWatch Logs for governance, compliance, and operational auditing. CloudTrail is specifically designed to answer 'who did what and when' at the API level, making it the authoritative audit trail for API calls in an AWS account.

A network ACL is a stateless virtual firewall at the subnet boundary. It evaluates ingress and egress rules independently, so to allow SSH from a specific CIDR you must add an inbound allow rule and a corresponding outbound rule for ephemeral ports. NACLs can explicitly deny traffic (e.g., block a hostile IP) and are applied to all instances in the subnet, making them an effective subnet-level control for SSH.

The presence of an explicit Deny statement for the s3:DeleteObject action creates an unresolvable conflict with the Allow statement in the same policy. AWS IAM evaluates all policies and any explicit Deny always overrides every Allow, regardless of how broad or specific the Allow may be. Even though the first statement grants all S3 actions, the Deny takes precedence and the request is ultimately denied.

This bucket policy is the correct preventive control. By using a Deny statement with the s3:x-amz-server-side-encryption condition key and the StringNotEquals operator, S3 evaluates the policy before accepting any PUT and rejects the request unless the header is exactly AES256. This forces every upload—from CLI, SDKs, or other IAM principals—to explicitly request SSE-S3 encryption, and it overrides any default bucket encryption behavior because the policy blocks requests that do not meet the condition.

SSE-KMS encrypts the CloudTrail log files at rest using a customer managed AWS KMS key, so an unauthorized user who gains access to the S3 bucket cannot read the logs without also having kms:Decrypt permissions. This protects the confidentiality of the log data, though it must be paired with log file validation to prove the logs have not been altered.

This is the only correct answer because it provides a centralized, preventive, and tamper-proof control. Enabling S3 Block Public Access at the account level immediately denies all public read/write access to every current and future bucket in that account. Attaching an SCP that denies s3:PutAccountPublicAccessBlock and s3:PutBucketPublicAccessBlock prevents users—even those with full S3 permissions—from modifying those settings, because SCPs cannot be overridden by IAM policies within the member account.

This is the correct approach. Managed rules evaluate compliance, and automatic remediation using Systems Manager Automation runbooks applies the fix without custom code. The runbooks perform the necessary API calls to enable encryption and backups, meeting the policy requirements.

AWS CloudTrail is the native AWS service designed to log all API activity in an account, including actions taken through the AWS Management Console, SDKs, CLI, and other services. Each event records the identity of the caller, the time of the call, the source IP address, and the request parameters. By enabling a trail, these logs can be delivered to Amazon S3 for long-term storage and integrated with CloudWatch Logs or third-party tools for monitoring and alerting.

A custom AWS Config rule can use a Lambda function to check if an EC2 instance has termination protection enabled. If not, the function can call the EC2 API to enable it. This provides automatic remediation for non-compliant resources.

AWS Config's managed rule ec2-termination-protection-check continuously evaluates each EC2 instance against the required configuration, flagging any instance without termination protection as non-compliant. When non-compliance is detected, the associated auto-remediation action invokes an AWS Systems Manager Automation document, such as AWS-EnableEC2TerminationProtection, which calls the ModifyInstanceAttribute API to enable DisableApiTermination on the instance. This serverless, event-driven workflow automatically corrects drift without custom scripts or manual intervention, fully satisfying the company's requirement for automatic remediation.

Attaching an IAM role to the EC2 instance via an instance profile is the AWS-recommended way to grant AWS API access to applications running on that instance. The AWS SDK and CLI automatically retrieve short-lived credentials from the instance metadata service (IMDSv2) and refresh them before they expire, so no secrets are stored in code, configuration, or environment variables. These credentials carry only the permissions defined in the role, and the role can be updated without changing the instance.

AWS Site-to-Site VPN connections establish IPsec tunnels that encrypt all traffic between the connected sites. By attaching these VPN connections to a transit gateway, you can interconnect multiple VPCs and route private traffic through those encrypted tunnels, achieving confidentiality for inter-VPC communication. This is the correct approach because the VPN terminates IPsec encryption at the transit gateway, and the transit gateway handles routing between all attached VPCs and VPN connections.

The most likely root cause is that the IAM group policy attached to the user's group does not include an ec2:TerminateInstances action, so modifying that policy to allow the API call resolves the issue for every member of the group. Use a statement with "Effect": "Allow" for ec2:TerminateInstances on the appropriate resource, then test with the IAM policy simulator to verify effective access.

A manual approval action is the only option that inserts a human decision gate directly into the CodePipeline execution. You configure an approval action by adding a stage of type 'Approval' with an SNS topic; the pipeline pauses once that stage is reached and sends a notification to the approver(s). The approver must have IAM permissions for codepipeline:PutApprovalResult to approve or reject, and the pipeline does not proceed to the production deployment stage until that explicit approval is granted. This enforces separation of duties and prevents unverified code from reaching production.

rds:DownloadDBLogFilePortion permits retrieving individual log file contents for the specified RDS instance, giving read-only visibility without granting modify or delete permissions. This satisfies the least-privilege requirement of viewing only logs, unlike broader rds actions that expose instance configuration or management.

AWS Config continuously records the configuration state of supported AWS resources and evaluates those configurations against AWS-managed or custom rules. For PCI DSS, you can use the managed rule pack to check for requirements like encrypted storage, restricted security group rules, and MFA on root accounts, then view the overall compliance snapshot over time. It generates a compliance timeline and aligned findings, making it the core service for automated configuration compliance.

IAM roles are the correct mechanism because a role in a target account can attach a permissions policy that precisely defines allowable actions and resources, and a trust policy in the same role lists which principals in a central account may assume it. When a user in the central account calls sts:AssumeRole, AWS returns temporary, scoped credentials that carry exactly the role's permissions, no more and no less. This gives fine-grained control while centralizing the decision about who gets to assume which role.

CloudTrail logs every S3 API call, and the event record includes the aws:SecureTransport flag, which distinguishes HTTPS from HTTP. A CloudWatch alarm on that flag lets the company immediately detect and respond to any plaintext request. As a detective control, it does not block the request at the time, but it satisfies the requirement by enabling continuous monitoring for HTTPS-only access.

AWS Config's managed rule s3-bucket-server-side-encryption-enabled continuously evaluates whether every S3 bucket has default encryption configured. When a bucket is found non-compliant, Config's automatic remediation feature can invoke an AWS Systems Manager Automation document (e.g., AWS-EnableS3BucketEncryption) to apply SSE-KMS to that bucket. Because Config is state-based, it detects both pre-existing non-compliant buckets and buckets that drift after creation. With AWS Organizations, you can deploy the rule and remediation across all accounts using CloudFormation StackSets, and aggregators centralize compliance visibility.

An SCP attached to the organization root, OUs, or individual accounts acts as a preventive guardrail: the deny effect applies to every principal, including the root user. Using a condition such as StringNotEquals on ec2:InstanceType with the approved list, the policy rejects any RunInstances call that uses a non-approved type before the API call can succeed. Because SCPs are inherited and cannot be bypassed by IAM permissions, this gives consistent, low-overhead enforcement across all current and future accounts.

SCPs are a centralized way to set permission boundaries for all accounts in the organization. By denying EC2 actions via SCP on non-production OUs, the restriction is enforced even for the root user of those accounts, and it applies to all IAM principals.

An S3 bucket policy is a resource-based policy that can be directly associated with the target bucket. By setting the Principal to '*' and adding a condition key of aws:SourceIp with the allowed CIDR ranges, the bucket denies any request that does not originate from those addresses, regardless of whether the requester is an IAM user, an anonymous caller, or a service. This is the most precise and comprehensive way to enforce an IP-based allowlist at the bucket level.

AWS CloudTrail is the authoritative audit service for KMS because every KMS API operation—including Encrypt, Decrypt, GenerateDataKey, and CreateKey—is captured as an event containing the principal, source IP, request parameters, and response. These events are delivered to an S3 bucket as JSON files, providing a durable, tamper-evident record that supports compliance and security investigations. Enabling a trail that records management events is sufficient for KMS, as KMS data-plane calls are automatically logged as management events.

HTTP headers are one of the key web request components that AWS WAF natively inspects. You can create rules that match on header names and values, such as checking the User-Agent header for known bot signatures or the Authorization header for invalid tokens. WAF supports string matching, regex pattern sets, and size constraints on header values, providing flexible control over header-based threats.

The AWS-provided rotation Lambda handles the full four-step lifecycle. The 30-day rotation schedule triggers the Lambda automatically. Because the application fetches credentials fresh per connection, it starts using the new credentials immediately after AWSCURRENT switches, with no restart needed. Secrets Manager's rotation is designed for zero downtime — the new password is validated on the database before the old version is retired.

CloudTrail logs capture the full userIdentity element for every API call, including the IAM user or role, root user, federated user, or assumed role. It also records the access key ID, source IP address, user agent, and session context, enabling you to determine exactly who performed an action. This makes CloudTrail essential for security auditing and governance.

Launching an instance via RunInstances is a complex API call that implicitly requires permission for several supporting EC2 actions, including CreateNetworkInterface, DescribeSubnets, DescribeVpcs, and CreateTags. If the IAM policy grants only "ec2:RunInstances" without including these supporting actions, the call will fail with an UnauthorizedOperation or dependency error. Thus a user with the RunInstances permission can still be blocked because the instance launch cannot complete without the ability to create and attach the necessary network interfaces.

Option 4 is correct because the Deny statement explicitly denies the s3:PutObject action when the request is not protected with server-side encryption using AWS KMS (aws:kms). Since the upload in the scenario is performed without that encryption header, the Deny statement's condition matches the request, and an explicit Deny overrides any Allow from the same bucket policy or from the role's own IAM policies. Therefore, the upload fails with an AccessDenied error.

CloudWatch Logs stores, monitors, and queries log data from applications and AWS services, including CloudTrail events, VPC flow logs, and custom logs. You can create metric filters to detect patterns and set alarms for compliance-related events. While it does not natively generate API activity records, it is essential for centralizing and retaining audit logs for operational analysis and alerting. In this scenario, CloudWatch Logs can be used to ingest trail logs for monitoring, but the actual account activity is captured by CloudTrail.

The policy includes a condition that requires the instance to have a tag key Environment with value 'Production'. Since the instance in question does not have that tag, the condition is not met, so the allow statement cannot be applied. IAM's default is to deny any request not explicitly allowed, so the user is denied permission to start the instance. The condition must be satisfied even if the resource ARN matches.

The only supported way to get encrypted-at-rest storage for data that currently lives in an unencrypted RDS instance is to create a new DB instance with encryption enabled. This is done either by taking a snapshot of the original instance and restoring it with encryption toggled on, or by launching a new encrypted instance and migrating the data with a tool such as AWS DMS. During creation, you choose an AWS KMS key, and once the instance is created, encryption cannot be removed or changed.

This is the correct root cause. The application must use HTTPS endpoints when calling S3 (e.g., https://bucket.s3.amazonaws.com) to encrypt data in transit between the EC2 instances and S3. Even when using a VPC endpoint, the application's SDK or code explicitly determines whether requests are signed and sent over TLS. If the code uses HTTP URLs or does not enforce TLS, traffic is sent in plaintext, exposing data on the network.

aws:MultiFactorAuthPresent is a boolean condition key that returns true when the caller authenticated with MFA. To enforce MFA for all IAM user console access, you attach an identity policy with a condition like "Bool": {"aws:MultiFactorAuthPresent": "true"}. This works with temporary credentials obtained via the console or sts:GetSessionToken, but it does not automatically apply to long-lived access keys unless the session is explicitly created with MFA.

Create a security group for the RDS instances and add an inbound rule that allows the database port from the security group attached to the application servers. Because security groups can reference other security groups as sources, this rule automatically restricts access to only those instances that carry the application security group, regardless of their IP addresses or whether the application tier scales up or down. This stateful, least-privilege approach is the AWS best practice for tiered access within a VPC and directly resolves the connectivity failure without affecting other subnets or relying on broad CIDR ranges.

A Service Control Policy (SCP) attached at the organization root or an organizational unit (OU) is inherited by every AWS account underneath, and it operates as an allow-list or denial of AWS API actions at the account level. Because SCPs are evaluated by AWS Organizations before IAM policies, even an account root user with full administrative rights cannot override an explicit deny of s3:PutBucketPolicy, s3:PutBucketAcl, or s3:PutBucketPublicAccessBlock, making it a true preventative guardrail across the entire organization. This is why the correct answer is to use SCPs rather than account-local controls.

Enabling default encryption on the bucket ensures that every new object stored is automatically encrypted at rest using SSE-S3 (AES-256) or an SSE-KMS key, even when the upload request does not specify an encryption header. This protects sensitive data from physical media theft or unauthorized access to underlying storage infrastructure. It is a fundamental confidentiality control that should be paired with access logging and IAM policies to fully secure the data.