Security pillar principles in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Principle of Least Privilege

Which option best describes the principle of least privilege in cloud security?

A Access is granted only during business hours regardless of role.

B All users have full access to all resources to ensure flexibility.

C Users and systems are given only the permissions they need to perform their tasks, no more.

D Permissions are granted based on the user's seniority in the company.

💡 Hint

Think about minimizing access to reduce risk.

The principle of least privilege means giving users and systems only the permissions they need to do their job, nothing extra. This reduces the chance of accidental or malicious misuse.

❓ Architecture

intermediate

Designing Secure Network Architecture

You want to design a secure network architecture in AWS. Which option correctly describes the use of security groups?

A Security groups act as virtual firewalls controlling inbound and outbound traffic at the instance level.

B Security groups automatically back up EC2 instances every hour.

C Security groups are used to encrypt data stored in S3 buckets.

D Security groups manage user permissions for AWS Management Console access.

💡 Hint

Think about controlling traffic to and from servers.

Security groups control the traffic allowed to reach EC2 instances by acting as virtual firewalls at the instance level.

❓ security

advanced

AWS IAM Role Usage for Secure Access

Which option correctly explains why using AWS IAM roles is more secure than using long-term access keys?

A IAM roles provide temporary credentials that automatically expire, reducing risk if compromised.

B IAM roles allow unlimited access to all AWS services without restrictions.

C IAM roles require manual rotation of credentials every 30 days.

D IAM roles store user passwords securely in AWS Secrets Manager.

💡 Hint

Think about credential lifespan and risk.

IAM roles provide temporary security credentials that expire automatically, which limits the window of opportunity for misuse if credentials are exposed.

✅ Best Practice

advanced

Implementing Multi-Factor Authentication (MFA)

What is the main security benefit of enabling Multi-Factor Authentication (MFA) on AWS accounts?

A It automatically encrypts all data stored in AWS S3 buckets.

B It requires users to provide two or more verification factors, making unauthorized access much harder.

C It disables password login and allows only biometric access.

D It grants users temporary admin privileges during login.

💡 Hint

Think about adding extra steps to prove identity.

MFA adds an extra layer of security by requiring users to provide additional verification beyond just a password, reducing the risk of account compromise.

❓ service_behavior

expert

AWS CloudTrail Behavior for Security Auditing

Which option correctly describes the behavior of AWS CloudTrail in relation to security auditing?

A CloudTrail encrypts data at rest in S3 but does not log any API activity.

B CloudTrail automatically blocks unauthorized API calls in real-time without user intervention.

C CloudTrail manages user permissions and access control policies for AWS resources.

D CloudTrail records API calls and events across AWS accounts, enabling detailed auditing of user and service activity.

💡 Hint

Think about tracking what actions happen in your AWS account.

CloudTrail logs all API calls and events, providing a history of actions for auditing and security analysis.