Why defense in depth matters in AWS - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use multiple security layers in AWS?

Imagine your house has a lock on the front door. Why might you also want a security alarm and a fence?

In AWS, this idea is called defense in depth. Why is it important to have several security layers instead of just one?

A Because one strong layer is enough to stop all attacks

B Because if one layer fails, others still protect the system

C Because AWS requires at least three security layers by default

D Because it makes the system slower and harder to use

💡 Hint

Think about what happens if a single lock breaks.

Defense in depth means using multiple security layers so if one fails, others still protect your resources. This reduces risk and improves security.

❓ Architecture

intermediate

Identify the defense in depth layers in this AWS setup

Look at this AWS architecture:

• Public subnet with a web server behind a security group
• Private subnet with a database protected by a network ACL
• IAM roles controlling access to resources
• CloudTrail logging all API calls

Which of these is NOT a layer of defense in depth?

A Security group on the web server

B Network ACL on the private subnet

C Using a single password for all users

D CloudTrail logging API calls

💡 Hint

Think about what helps protect versus what weakens security.

Using a single password for all users is a security risk and not a protective layer. The other options are valid defense layers.

❓ security

advanced

What happens if you rely only on perimeter security in AWS?

You set up a firewall (security group) to block all traffic except from your office IP. What risk remains if you do not add other security layers?

A If the firewall is misconfigured or breached, attackers can access resources easily

B No risk remains because the firewall blocks all traffic

C AWS automatically adds other layers so you are safe

D Your office IP can never be spoofed, so no risk exists

💡 Hint

Consider what happens if the firewall rule is changed by mistake.

Relying only on perimeter security is risky because if it fails, there are no other protections inside the network.

✅ Best Practice

advanced

Which AWS service adds a defense layer by monitoring and alerting on suspicious activity?

You want to detect unusual API calls or access patterns in your AWS account. Which service helps add this layer of defense?

A AWS CloudTrail

B Amazon S3

C AWS Lambda

D Amazon EC2

💡 Hint

Think about which service records actions in your account.

AWS CloudTrail records API calls and helps detect suspicious activity, adding a monitoring layer to defense in depth.

❓ service_behavior

expert

What is the effect of enabling AWS WAF with multiple rules on your web application?

You configure AWS WAF with rules to block SQL injection, cross-site scripting, and IP blacklists. What is the combined effect on incoming traffic?

A Rules conflict and cause all traffic to be allowed without filtering

B Traffic must match all rules to be blocked, so only very specific attacks are stopped

C AWS WAF only logs traffic but does not block it automatically

D Traffic matching any rule is blocked, protecting the application from multiple attack types

💡 Hint

Consider how firewall rules usually combine to protect.

AWS WAF blocks traffic that matches any configured rule, providing layered protection against different threats.