Security pillar principles in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Principle of Least Privilege

Which option best describes the principle of least privilege in cloud security?

A Access is granted only during business hours regardless of role.

B All users have full access to all resources to ensure flexibility.

C Users and systems are given only the permissions they need to perform their tasks, no more.

D Permissions are granted based on the user's seniority in the company.

💡 Hint

Think about minimizing access to reduce risk.

The principle of least privilege means giving users and systems only the permissions they need to do their job, nothing extra. This reduces the chance of accidental or malicious misuse.

❓ Architecture

intermediate

Designing Secure Network Architecture

You want to design a secure network architecture in AWS. Which option correctly describes the use of security groups?

A Security groups act as virtual firewalls controlling inbound and outbound traffic at the instance level.

B Security groups automatically back up EC2 instances every hour.

C Security groups are used to encrypt data stored in S3 buckets.

D Security groups manage user permissions for AWS Management Console access.

💡 Hint

Think about controlling traffic to and from servers.

Security groups control the traffic allowed to reach EC2 instances by acting as virtual firewalls at the instance level.

❓ security

advanced

AWS IAM Role Usage for Secure Access

Which option correctly explains why using AWS IAM roles is more secure than using long-term access keys?

A IAM roles provide temporary credentials that automatically expire, reducing risk if compromised.

B IAM roles allow unlimited access to all AWS services without restrictions.

C IAM roles require manual rotation of credentials every 30 days.

D IAM roles store user passwords securely in AWS Secrets Manager.

💡 Hint

Think about credential lifespan and risk.

IAM roles provide temporary security credentials that expire automatically, which limits the window of opportunity for misuse if credentials are exposed.

✅ Best Practice

advanced

Implementing Multi-Factor Authentication (MFA)

What is the main security benefit of enabling Multi-Factor Authentication (MFA) on AWS accounts?

A It automatically encrypts all data stored in AWS S3 buckets.

B It requires users to provide two or more verification factors, making unauthorized access much harder.

C It disables password login and allows only biometric access.

D It grants users temporary admin privileges during login.

💡 Hint

Think about adding extra steps to prove identity.

MFA adds an extra layer of security by requiring users to provide additional verification beyond just a password, reducing the risk of account compromise.

❓ service_behavior

expert

AWS CloudTrail Behavior for Security Auditing

Which option correctly describes the behavior of AWS CloudTrail in relation to security auditing?

A CloudTrail encrypts data at rest in S3 but does not log any API activity.

B CloudTrail automatically blocks unauthorized API calls in real-time without user intervention.

C CloudTrail manages user permissions and access control policies for AWS resources.

D CloudTrail records API calls and events across AWS accounts, enabling detailed auditing of user and service activity.

💡 Hint

Think about tracking what actions happen in your AWS account.

CloudTrail logs all API calls and events, providing a history of actions for auditing and security analysis.

Practice

1. Which of the following is a primary goal of the AWS Security Pillar?

easy

A. Protect cloud resources from unauthorized access

B. Increase the speed of data processing

C. Reduce the cost of cloud services

D. Improve user interface design

Solution

1. Step 1: Understand the purpose of the Security Pillar

   The Security Pillar focuses on protecting cloud resources from threats and unauthorized access.

2. Step 2: Match the goal with the options

   Only Protect cloud resources from unauthorized access directly relates to protecting resources from unauthorized access, which is the main goal.

3. Final Answer:

   Protect cloud resources from unauthorized access -> Option A

4. Quick Check:

   Security Pillar = Protect resources [OK]

Hint: Security pillar means protecting resources from threats [OK]

Common Mistakes:

• Confusing security with cost or speed improvements
• Choosing options unrelated to protection
• Mixing security goals with usability goals

2. Which AWS service is primarily used to manage user access and permissions securely?

easy

A. Amazon S3

B. AWS CloudFormation

C. Amazon EC2

D. AWS Identity and Access Management (IAM)

Solution

1. Step 1: Identify the service for managing access

   AWS IAM is designed to control who can access AWS resources and what actions they can perform.

2. Step 2: Compare with other services

   Amazon S3 stores data, EC2 runs servers, CloudFormation manages infrastructure as code, but none manage user permissions directly.

3. Final Answer:

   AWS Identity and Access Management (IAM) -> Option D

4. Quick Check:

   Access control service = IAM [OK]

Hint: IAM controls user access and permissions in AWS [OK]

Common Mistakes:

• Confusing storage or compute services with access control
• Selecting services that do not handle permissions
• Ignoring the role of IAM in security

3. Consider this AWS CloudTrail configuration snippet:

{
  "TrailName": "MyTrail",
  "IsLogging": true,
  "IncludeGlobalServiceEvents": false
}

What is the effect of setting IncludeGlobalServiceEvents to false?

medium

A. Logging will be disabled for the trail

B. Global service events like IAM changes will not be logged

C. All AWS service events will be logged globally

D. Only global service events will be logged

Solution

1. Step 1: Understand the IncludeGlobalServiceEvents setting

   This setting controls whether global AWS service events (like IAM or AWS STS) are included in the logs.

2. Step 2: Interpret the false value

   Setting it to false means these global events will NOT be logged by this trail.

3. Final Answer:

   Global service events like IAM changes will not be logged -> Option B

4. Quick Check:

   IncludeGlobalServiceEvents false = no global logs [OK]

Hint: False means global events are excluded from logging [OK]

Common Mistakes:

• Assuming false disables all logging
• Confusing global events with regional events
• Thinking false means logging only global events

4. You wrote this IAM policy snippet but it does not restrict access as expected:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "arn:aws:s3:::example-bucket"
  }]
}

What is the main issue causing the policy to not restrict access properly?

medium

A. The Action "s3:*" is invalid syntax

B. The Effect should be Deny instead of Allow

C. The Resource ARN is missing the bucket objects path

D. The Version date is incorrect

Solution

1. Step 1: Check the Resource ARN format

   The ARN "arn:aws:s3:::example-bucket" refers only to the bucket itself, not the objects inside it.

2. Step 2: Understand access scope

   To allow or restrict access to objects, the ARN must include "/*" to cover all objects, e.g., "arn:aws:s3:::example-bucket/*".

3. Final Answer:

   The Resource ARN is missing the bucket objects path -> Option C

4. Quick Check:

   Bucket ARN needs /* for objects [OK]

Hint: Bucket ARN must include /* to cover objects [OK]

Common Mistakes:

• Using Allow instead of Deny incorrectly
• Assuming s3:* is invalid
• Ignoring the need for object path in ARN

5. You want to design a secure AWS environment that automatically detects unusual activity and isolates affected resources. Which combination of AWS services best supports this Security Pillar principle?

hard

A. AWS CloudTrail, Amazon GuardDuty, AWS Systems Manager

B. AWS Config, Amazon S3, AWS Lambda

C. Amazon EC2, AWS IAM, AWS CloudFormation

D. AWS Trusted Advisor, Amazon RDS, AWS SNS

Solution

1. Step 1: Identify services for detecting unusual activity

   Amazon GuardDuty analyzes logs and detects suspicious behavior automatically.

2. Step 2: Identify services for logging and managing resources

   AWS CloudTrail records API activity for auditing, and AWS Systems Manager helps isolate and manage affected resources.

3. Step 3: Evaluate other options

   Other options lack the combination of detection, logging, and automated management needed for this security goal.

4. Final Answer:

   AWS CloudTrail, Amazon GuardDuty, AWS Systems Manager -> Option A

5. Quick Check:

   Detect + log + isolate = CloudTrail + GuardDuty + Systems Manager [OK]

Hint: Detect threats with GuardDuty, log with CloudTrail, manage with Systems Manager [OK]

Common Mistakes:

• Choosing services that do not detect threats automatically
• Ignoring the need for logging and management together
• Confusing monitoring with storage or compute services