Question 420
An on-call engineering team has created automated remediation for repeated AWS Config findings, but the runbook changes EC2 network settings. It wants to ensure the automation does not run in parallel across every production instance during a broad incident. Which control must be configured?
- Set unlimited automation concurrency and use the broadest wildcard target to minimize execution time.
- Attach an unrestricted Systems Manager Automation IAM role while leaving target concurrency and error thresholds at their broadest settings.
- Use a CloudWatch composite alarm to monitor remediation failures after the entire fleet changes, with no execution concurrency limit.
- Use scoped Systems Manager Automation execution controls including rate limiting, concurrency and error thresholds for target sets.
Explanation
Correct Answer
D:Controlled automation concurrency and failure thresholds limit the blast radius of repetitive configuration repairs.
Incorrect Answers
A:Unbounded simultaneous network changes can amplify an outage across the entire production fleet.
B:IAM permission scope does not constrain how many targets the automation changes simultaneously without rate-control settings.
C:An alarm can detect failures, but it does not throttle concurrent runbook operations or cap the number of changed hosts.
Question 421
A legacy EC2 fleet currently receives a database password in launch user data. The password is reused across instances and changed manually twice each year. The database supports automated secret rotation, and applications can refresh credentials. Which change most directly improves this security design?
- Store the password in AWS Secrets Manager, allow the instance role scoped retrieval, enable supported rotation, and update clients to refresh cached credentials.
- Move the database password from user data into an EC2 launch-template parameter with the same reused value and no rotation.
- Store the password in SSM Parameter Store as plain String and grant all EC2 roles permission to read every parameter.
- Encrypt the entire EBS root volume but keep the credential hard-coded in user data and never rotate it.
Explanation
Correct Answer
A:Secrets Manager can centrally store and rotate the database secret, while instance-role access avoids embedded static credentials; client refresh behavior is needed to make rotation operational.
Incorrect Answers
B:A launch-template parameter can still expose reused static credentials and does not supply managed secret rotation or scoped runtime access.
C:Central storage alone is not least privilege, encryption or automated rotation; unrestricted parameter access recreates a broad secret exposure.
D:Disk encryption protects storage at rest but not a static password retrievable from instance launch data or reused across compromised workloads.
Question 422
A regulated company must identify CVEs in ECR container images before deployment, and prioritize vulnerabilities in EC2 workloads. Security wants findings with supported service integration rather than maintaining a one-off CVE scanner. Which solution is most appropriate?
- Enable ECR basic image scanning and treat it as a full replacement for EC2 host and runtime vulnerability findings.
- Enable GuardDuty threat detection and assume behavioral indicators are an inventory of all installed OS and container CVEs.
- Enable Amazon Inspector for supported ECR and EC2 scanning and route prioritized findings through the organization security workflow.
- Run ECR lifecycle policy cleanup to remove unused images and rely on deletion records as proof the remaining images and EC2 hosts have no CVEs.
Explanation
Correct Answer
C:Inspector provides managed vulnerability findings for supported compute and container image resources with centralized integration options.
Incorrect Answers
A:ECR image scanning helps identify package vulnerabilities in images but does not cover supported EC2 instance vulnerability assessments requested together.
B:GuardDuty identifies threats and anomalous behavior; it is not the dedicated continuous CVE vulnerability-scanning workflow for ECR and EC2.
D:Image expiration is storage hygiene, not package-based vulnerability assessment or prioritized Inspector findings.
Question 423
Security Hub is enabled in a security account, but member-account findings are scattered and cannot be reviewed across the organization in the same Region. What change best improves centralized security posture visibility?
- Configure Security Hub delegated administration with the intended organization members and required regional aggregation settings.
- Aggregate Security Hub member findings in the designated security account but configure only a cross-Region finding-aggregation link, without member enrollment in the target Region.
- Export Security Hub findings from each member to a common S3 bucket on an irregular schedule, rather than enabling service-delegated organization administration.
- Grant the security account an IAM role allowing DescribeInstances in member accounts and assume EC2 inventory equals Security Hub compliance findings.
Explanation
Correct Answer
A:Central administration can manage member enrollment and collect findings, while regional aggregation must be configured for the desired coverage.
Incorrect Answers
B:Cross-Region aggregation cannot collect findings from accounts that lack enabled Security Hub/member administrative coverage in the source Region.
C:S3 exports can support archives but do not replace centrally managed Security Hub membership and a live member finding view.
D:Resource inventory does not provide the Security Hub standard controls, integrations and findings generated in members.
Question 424
A VPC network team wants to ensure private application instances cannot unintentionally accept SSH from 0.0.0.0/0. It must detect drift from the rule and prevent reintroduction through the deployment pipeline. Which paired controls best address this?
- Evaluate security group ingress with an appropriate AWS Config rule and block noncompliant IaC changes in the pipeline before deployment.
- Use only a detective AWS Config rule for unrestricted port 22 with remediation after deployment, omitting the pipeline block for new noncompliant IaC.
- Add an SSM patch baseline to the EC2 instances and leave inbound security group permissions and IaC templates unchanged.
- Apply a CloudFormation stack policy to an EC2 instance resource but do not examine ingress rule properties in associated security groups.
Explanation
Correct Answer
A:Config detects live open-SSH drift, while a policy-as-code pipeline control prevents the same exposure from being reintroduced.
Incorrect Answers
B:Detective Config checks can alert after drift, but the requirement also mandates prevention of unsafe code reintroduction before deployment.
C:OS patching reduces host vulnerability but does not stop security groups from admitting internet SSH to private instances.
D:Stack policies can protect updates but do not comprehensively detect or prevent an SSH 0.0.0.0/0 rule through appropriate Config/IaC validation.
Question 425
A company discovers that credentials for a third-party payment API are embedded in a public Git repository. Security needs to contain possible misuse and create a safer ongoing secret distribution model. What response is appropriate?
- Rotate the third-party API token only in application configuration, keeping the provider-issued credential active and the leaked copy valid.
- Revoke or rotate the exposed API credential immediately, assess usage, and store replacement secrets in controlled Secrets Manager access paths.
- Rewrite Git history and force-push the repository before notifying the payment API provider, assuming public clones cannot retain the token.
- Disable public repository visibility but continue using the exposed token indefinitely because access was later restricted.
Explanation
Correct Answer
B:Revocation addresses possible compromise; centrally managed secret retrieval and IAM scoping reduce recurrence of plaintext repository secrets.
Incorrect Answers
A:Changing local storage does not revoke the externally issued secret; immediate provider-side revocation and use analysis are necessary.
C:Public history scrubbing cannot guarantee removal from forks or caches; rotate/revoke the credential and investigate use first.
D:Changing current repository visibility does not make a previously copied credential safe. Assume potential compromise and revoke.
Question 426
An S3 bucket contains customer identity documents and has an unexpected bucket policy granting access outside the organization. The security team needs to block accidental public exposure and identify any still-intended partner access. What is the best course?
- Enable an S3 bucket access point with a narrowed policy but keep the original bucket policy granting unintended broad public access.
- Apply appropriate S3 Block Public Access and review bucket/access point policies with IAM Access Analyzer, allowing only explicitly approved access.
- Enable server access logging and Macie discovery only, keeping the broad bucket policy while waiting for a future compliance report.
- Block all cross-account access by deleting every bucket policy statement, including an approved partner role needed for a supported workflow.
Explanation
Correct Answer
B:Public-access blocking protects against broad exposure while Access Analyzer helps identify external resource-based grants needing review.
Incorrect Answers
A:An access point does not neutralize another still-effective bucket grant; close public access and review all relevant policy paths.
C:Logging and classification are detective. They do not promptly block unintended public exposure of regulated identity documents.
D:A blanket deny may disrupt legitimate partner access; Block Public Access plus Access Analyzer-driven least-privilege review better distinguishes unintended grants.
Question 427
A multi-account security team needs to identify sensitive S3 data, including possible personal identifiers, without sampling every object manually. The company already has a delegated security administration model. Which service can perform managed discovery?
- Use Amazon Inspector enhanced ECR scanning and treat container image CVEs as evidence of customer PII in S3 objects.
- Enable GuardDuty S3 Protection for API activity and assume anomalous GetObject requests identify PII text fields inside all stored documents.
- Run IAM Access Analyzer external-access analysis against S3 bucket policies and treat external policy trust findings as sensitive-data discovery.
- Use Amazon Macie to classify eligible S3 objects for sensitive data, and manage resulting findings in the multi-account security workflow.
Explanation
Correct Answer
D:Macie performs managed sensitive-data discovery in S3 and produces findings based on supported object content, directly addressing PII classification instead of only threat or access posture.
Incorrect Answers
A:Inspector analyzes software packages and vulnerabilities in supported compute and container sources, not the content of arbitrary S3 records for personal identifiers.
B:GuardDuty S3 Protection detects suspicious S3 access behavior, not managed content classification of which objects contain personal information.
C:IAM Access Analyzer detects resource policy access paths; a bucket can be private yet contain PII, so policy findings do not replace inspecting supported object content.
Question 428
A regulated EKS cluster retrieves container images from private Amazon ECR. Vulnerability scans are already enabled, but a red-team exercise shows a malicious replacement image can be pulled from an untrusted build path. Security now requires cryptographic provenance verification before pods are admitted, not merely a CVE scan. Which design directly addresses the missing control?
- Use trusted ECR/AWS Signer image signatures and configure a supported EKS image signature-verification admission control with protected signer trust, rejecting images with missing or untrusted signatures.
- Configure Amazon Inspector to rescan vulnerable packages only and assume CVE findings prove the image was produced by the approved build pipeline.
- Require ECR enhanced vulnerability scanning on every push and assume this cryptographically authenticates the identity of the container build producer.
- Pin every EKS deployment to an ECR image digest but do not verify the signing identity or signature on the pinned contents.
Explanation
Correct Answer
A:Amazon ECR supports signing and Amazon EKS can verify signatures before permitting containers to run, using a configured trust policy; restrict signing credentials so a trusted signature actually indicates an approved producer.
Incorrect Answers
B:Vulnerability assessment finds known software issues but does not establish cryptographic integrity or trusted build origin.
C:Vulnerability scanning discovers known package exposures but does not prove that the image was signed by the trusted build pipeline.
D:Digest pinning prevents tag ambiguity but does not authenticate which producer was authorized to publish those bytes.
Question 429
An AWS Organization already enables GuardDuty for management API, DNS and VPC-flow threat detection. During an EC2 incident, analysts need additional process-execution, file-access and command-line telemetry from supported Linux instance workloads to detect malicious runtime behavior, not another CloudTrail anomaly rule. Which GuardDuty protection should be enabled and configured for supported EC2 resources?
- GuardDuty Runtime Monitoring for eligible EC2 instances, including the required security-agent deployment and supported runtime coverage configuration.
- Continue only the existing GuardDuty CloudTrail and DNS protection plans and assume they already supply the host process-execution stream.
- Enable Amazon Inspector for EC2 vulnerability management and use its CVE package inventory as a real-time shell process monitor.
- Enable CloudTrail Lake management-event queries and expect them to collect each EC2 local file open and shell command.
Explanation
Correct Answer
A:GuardDuty Runtime Monitoring uses a security agent on supported EC2 to observe process, file and network runtime events beyond standard CloudTrail/DNS analysis.
Incorrect Answers
B:Base GuardDuty detections cover managed account and network threat signals but do not supply the runtime agent’s process and file-activity observations.
C:Inspector focuses on software vulnerabilities and exposure; a vulnerability finding cannot replace runtime command and file events.
D:CloudTrail management events describe AWS API calls, not arbitrary OS-level process, file and command-line telemetry on EC2.
Question 430
A security platform already enforces S3 Block Public Access and has resolved external bucket-policy findings. The remaining problem is granting hundreds of workforce users and groups short-lived, least-privilege access to distinct project prefixes within shared approved buckets, without maintaining a separate broad IAM bucket policy for every user. Which S3 capability should it evaluate?
- Use one broadly scoped S3 bucket policy granting each workforce group access to all project prefixes, without an individual prefix grant system.
- Configure S3 Access Grants with registered bucket or prefix locations and scoped grants for approved IAM or directory identities, using vended temporary access credentials.
- Create S3 Access Points with unrestricted bucket paths and treat each access point policy as a time-limited credential-vending workflow for directory groups.
- Give each user an IAM Identity Center account permission set with s3:* on every shared project bucket and omit per-prefix authorization.
Explanation
Correct Answer
B:S3 Access Grants maps verified identities to specific S3 locations and provides short-lived scoped credentials for eligible object access.
Incorrect Answers
A:A shared broad bucket policy does not meet prefix-level least privilege or vend scoped temporary credentials for distinct workforce identities.
C:Access Points can scope resource access but do not by themselves implement S3 Access Grants' short-lived, identity-to-prefix credential vending.
D:A broad permission set does not grant separate resource-prefix scope and unnecessarily exposes unrelated project data.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests