AWS Cloud Security and Incident Response Automation GASAE Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A company wants to deploy a new AWS environment with a consistent security baseline. They plan to use AWS CloudFormation to define the infrastructure. The security team requires that all S3 buckets have encryption enabled and that all EC2 instances use a specific IAM role. What is the best way to enforce these requirements in the CloudFormation template?

   • AUse AWS Systems Manager to apply the security baseline to the resources after they are created.
   • BDefine the S3 buckets with encryption properties and the EC2 instances with the required IAM role in the CloudFormation template, and use AWS Config rules to detect any drift from these settings.
   • CUse AWS Config rules to evaluate the resources after deployment and manually remediate any non-compliant resources.
   • DUse AWS Service Catalog to deploy the CloudFormation template, and rely on the service catalog to enforce the security baseline.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary benefit of using AWS Security Hub for incident response?

   • AIt replaces the need for GuardDuty
   • BIt provides a single place to view and prioritize security findings
   • CIt blocks malicious IP addresses
   • DIt automatically remediates all security issues
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security engineer is configuring automated response for a GuardDuty finding that indicates a compromised EC2 instance. The engineer wants to isolate the instance by removing its security group membership and also send a notification to the security team. The response must be triggered within seconds of the finding being generated and must not require any manual intervention. Which combination of services should the engineer use?

   • AEventBridge rule that matches the GuardDuty finding and invokes a Lambda function that modifies the instance's security groups and publishes to an SNS topic.
   • BLambda function that polls GuardDuty every minute for new findings, isolates the instance, and sends an SNS notification.
   • CCloudWatch alarm based on the GuardDuty finding metric that triggers an SNS topic, which then sends an email to the security team for manual isolation.
   • DAWS Config rule that detects the GuardDuty finding and invokes a Step Functions state machine to isolate the instance and send a notification.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company wants to automatically detect S3 buckets that are publicly accessible and remediate them by removing the public access. The remediation should only apply to buckets that are not explicitly required to be public for a specific application. The company wants to use AWS Config to evaluate bucket configurations and trigger remediation. Which approach should be used?

   • AUse AWS Trusted Advisor to check S3 bucket permissions and send an SNS notification to the security team for manual remediation.
   • BCreate an AWS Config managed rule for S3 bucket public read/write access, and set up automatic remediation with a Lambda function that removes the bucket policy, but exclude the specific application buckets using resource tags.
   • CUse AWS GuardDuty to detect public S3 buckets and automatically apply a bucket policy that denies public access.
   • DCreate a custom AWS Config rule that checks for public access and automatically remediates by deleting the bucket.
   Reveal Solution Discussion Select an answer first