Architecting on AWS Certification Safety Practices & PPE 4 — Questions and Answers
Question 1: Which AWS service protects web applications from common exploits like SQL injection and cross-site scripting (XSS) by inspecting HTTP/HTTPS requests?
- AWS Shield
- Amazon GuardDuty
- AWS WAF (Correct answer)
- AWS Firewall Manager
Correct answer: AWS WAF
AWS WAF (Web Application Firewall) inspects web requests and blocks those matching rules for threats like SQL injection and XSS.
Question 2: An architect wants to enforce MFA for all IAM users when they access the AWS Management Console. What is the correct approach?
- Attach an IAM policy requiring MFA as a condition on all actions (Correct answer)
- Enable MFA in the account security settings
- Require MFA at the AWS Organizations level via SCP
- Configure Cognito to enforce MFA
Correct answer: Attach an IAM policy requiring MFA as a condition on all actions
An IAM policy with a condition key (aws:MultiFactorAuthPresent) denies actions unless MFA is active, effectively requiring MFA for console access.
Question 3: A company wants to manage and rotate database credentials automatically without hardcoding them in application code. Which AWS service provides this capability?
- AWS KMS
- AWS Systems Manager Parameter Store
- AWS Secrets Manager (Correct answer)
- IAM roles
Correct answer: AWS Secrets Manager
AWS Secrets Manager stores, retrieves, and automatically rotates secrets like database credentials on a configurable schedule.
Question 4: Which defense-in-depth approach should an architect use to protect an application that requires both web-tier and database-tier security?
- Place all resources in the same security group
- Use separate security groups for web and database tiers with the DB group only allowing traffic from the web group (Correct answer)
- Apply a single NACL to the entire VPC
- Use AWS WAF to protect both the web and database layers
Correct answer: Use separate security groups for web and database tiers with the DB group only allowing traffic from the web group
Tiered security groups implement defense in depth by ensuring the database tier only accepts traffic explicitly from the web tier, not from any external source.
Question 5: AWS Shield Standard is automatically enabled for all AWS customers. What additional protection does AWS Shield Advanced provide?
- Protection against SQL injection attacks
- DDoS cost protection and access to the AWS DDoS Response Team (DRT) (Correct answer)
- Automatic WAF rule updates
- Encryption of data in transit
Correct answer: DDoS cost protection and access to the AWS DDoS Response Team (DRT)
AWS Shield Advanced adds financial protection against DDoS-related cost spikes and provides access to the specialized AWS DDoS Response Team.
Question 6: Which IAM entity should applications running on EC2 use to securely access other AWS services without storing long-term credentials?
- IAM user with access keys stored in the instance
- IAM role attached to the EC2 instance (Correct answer)
- IAM group permissions
- Root account credentials
Correct answer: IAM role attached to the EC2 instance
IAM roles attached to EC2 instances provide temporary, automatically-rotated credentials, eliminating the need to store long-term access keys.
Question 7: A company needs to ensure that all resources created in AWS comply with security tagging standards. Which AWS service continuously monitors and alerts on compliance?
- AWS Trusted Advisor
- Amazon Inspector
- AWS Config with managed rules (Correct answer)
- AWS CloudTrail
Correct answer: AWS Config with managed rules
AWS Config evaluates resource configurations against rules (including required-tags rules) and flags non-compliant resources in real time.
Architecting on AWS Certification Safety Practices & PPE 4
Which AWS service protects web applications from common exploits like SQL injection and cross-site scripting (XSS) by inspecting HTTP/HTTPS requests?