Section-Based – Security and Compliance (DevOps)

A DevOps engineer has been tasked to implement a reliable solution to maintain all of their Windows and Linux servers both in AWS and in on-premises data center. There should be a system that allows them to easily update the operating systems of their servers and apply the core application patches with minimum management overhead. The patches must be consistent across all levels in order to meet the company’s security compliance.

Which of the following is the MOST suitable solution that you should implement?

A company uses a fleet of Linux and Windows servers for its enterprise applications. An automated daily check of each golden AMI owned is needed to monitor the latest Common Vulnerabilities and Exposures (CVE) using Amazon Inspector.

Which among the options below is the MOST suitable solution that should be implemented?

A company has an internal application that is hosted on an Amazon EC2 instance running in a VPC. As part of the setup, the application needed to download an object from the S3 bucket. However, the application received an AccessDenied error in logs when trying to download the object from the restricted S3 bucket.

Which of the following should the DevOps Engineer investigate to identify the cause of the issue? (Select TWO.)

A large hospital has an online medical record system that is hosted in a fleet of Windows EC2 instances with several EBS volumes attached to it. The IT Security team mandated that the latest security patches should be installed to all of their Amazon EC2 instances using an automated patching system. They should also have to implement a functionality that checks all of their EC2 instances if they are using an approved Amazon Machine Image (AMI) in their AWS Cloud environment. The patching system should not impede developers from launching instances using an unapproved AMI, but nonetheless, they still have to be notified if there are non-compliant EC2 instances in their VPC.

As a DevOps Engineer, which of the following should you implement to protect and monitor all of your instances as required above?

A company has a PROD, DEV, and TEST environment in its software development department, each contains hundreds of EC2 instances and other AWS services. There was a series of security patches that have been released on the official Ubuntu operating system for a critical flaw that was recently discovered. Although this is an urgent matter, there is no guarantee that these patches will be bug-free and production-ready. This is why a DevOps engineer was instructed to immediately patch all of their affected EC2 instances in all the environments, except for the PROD environment. The EC2 instances in their PROD environment will only be patched after the initial patches have been verified to work effectively in their non-PROD environments. Each environment also has different baseline patch requirements that you will need to satisfy.

How should the DevOps engineer perform this task with the LEAST amount of effort?

A business has its AWS accounts managed by AWS Organizations and has employees in different countries. The business is reviewing its AWS account security policies and is looking for a way to monitor its AWS accounts for unusual behavior that is associated with an IAM identity. The business wants to:

• send a notification to any employee for whom the unusual activity is detected.

• send a notification to the user’s team leader.

• an external messaging platform will send the notifications. The platform requires a target user-id for each recipient.

The business already has an API that can be used to retrieve the team leader’s and the employee’s user-id from IAM user names.

Which solution will satisfy the requirements?

A business wants to leverage AWS CloudFormation to deploy its infrastructure. The business would like to restrict deployment to two particular regions and wants to implement a strict tagging requirement. Developers are expected to deploy various versions of the same application and want to guarantee that resources are deployed in compliance with the business policy while still enabling developers to deploy different versions of the application.

Which of the following is the MOST suitable solution?

A technology consulting company has an Oracle Real Application Clusters (RAC) database on their on-premises network which they want to migrate to AWS Cloud. Their Chief Technology Officer instructed the DevOps team to automate the patch management process of the operating system in which their database will run. They are also mandated as well to set up scheduled backups to comply with the disaster recovery plan of the company.

What should the DevOps team do to satisfy the requirement for this scenario with the LEAST amount of effort?

A leading IT consulting firm is building a GraphQL API service and a mobile application that lets people post photos and videos of the traffic situations and other issues in the city’s public roads. Users can include a text report and constructive feedback to the authorities. The department of public works shall rectify the problems based on the data gathered by the system. In order for the mobile app to run on various mobile and tablet devices, the firm decided to develop it using the React Native mobile framework, which will consume and send data to the GraphQL API. The backend service will be responsible for storing the photos and videos in an Amazon S3 bucket. The API will also need access to the Amazon DynamoDB database to store the text reports. The firm has recently deployed the mobile app prototype, however, during testing, the GraphQL API showed a lot of issues. The team decided to remove the API to proceed with the project and refactor the mobile application instead so that it will directly connect to both DynamoDB and S3 as well as handle user authentication.

Which of the following options provides a cost-effective and scalable architecture for this project? (Select TWO.)

A cloud-based payments company is heavily using Amazon EC2 instances to host their applications in AWS Cloud. They would like to improve the security of their cloud resources by ensuring that all of their EC2 instances were launched from pre-approved AMIs only. The list of AMIs is set and managed by their IT Security team. Their Software Development team has an automated CI/CD process that launches several EC2 instances with new and untested AMIs for testing. The development process must not be affected by the new solution, which will be implemented by their Lead DevOps Engineer.

Which of the following can the Engineer implement to satisfy the requirement with the LEAST impact on the development process? (Select TWO.)

An organization has a fleet of Amazon EC2 instances and uses SSH for remote access. Whenever a DevOps Engineer leaves the organization, the SSH keys are rotated as a security measure. The Chief Information Officer (CIO) required to stop the use of EC2 key pairs for operational efficiency and instead utilize AWS Systems Manager Session Manager. To strengthen security, access to Session Manager should be limited solely through a private network.

Which set of actions should the new DevOps Engineer take to meet the CIO requirements? (Select TWO.)

A multinational insurance firm has recently consolidated its multiple AWS accounts using AWS Organizations with several Organizational units (OUs) that group each department of the firm. Their IT division consists of two teams: the DevOps team and the Release & Deployment team. The first one is responsible for protecting its cloud infrastructure and ensuring that all of its AWS resources are compliant, while the latter is responsible for deploying new applications to AWS Cloud. The DevOps team has been instructed to set up a system that regularly checks if all of the running EC2 instances are using an approved AMI. However, the solution should not stop the Release & Deployment team from deploying an EC2 instance running on a non-approved AMI for their release process. The DevOps team must build a notification system that sends the compliance state of the AWS resources to improve and maintain the security of their cloud resources.

Which of the following is the MOST suitable solution that the DevOps team should implement?