Free Infrastructure Security Practice Questions — AWS Certified Security

Question 1 of 6 · Domain 3: Infrastructure Security

A financial services company runs a multi-tier application on Amazon ECS with AWS Fargate. The application processes sensitive customer data and must comply with PCI DSS requirements. Security auditors have identified that container images are being pulled from a public ECR repository and that runtime protection is insufficient. The security team needs to implement controls that prevent deployment of vulnerable images and detect anomalous runtime behavior. Which solution should the security engineer implement to address both vulnerabilities?

This solution comprehensively addresses both requirements. Migrating to a private ECR repository resolves the public repository exposure risk and meets compliance requirements. ECR enhanced scanning with scan-on-push provides continuous vulnerability detection in images before deployment. GuardDuty Runtime Monitoring specifically detects anomalous runtime behavior in ECS Fargate tasks including unexpected network activity, file access, and process execution. EventBridge integration enables automated response to both scan findings and runtime threats, preventing vulnerable deployments and stopping compromised tasks. This combination satisfies PCI DSS control requirements for vulnerability management and runtime threat detection.

Question 2 of 6 · Domain 3: Infrastructure Security

A company's security team is designing network segmentation for a new VPC that will host production workloads across three tiers: web (public subnet), application (private subnet), and database (isolated private subnet). The application tier must initiate outbound HTTPS connections to third-party APIs, but the database tier must have zero internet connectivity. The security team wants to enforce these requirements at the network layer with defense in depth. An auditor has requested proof that the database tier cannot reach the internet even if security group rules are misconfigured. What is the MOST secure architecture to meet these requirements?

This implements true defense in depth for network isolation. The database subnet route table explicitly lacks a 0.0.0.0/0 route (no default gateway), making internet access impossible at the routing layer. Network ACLs provide subnet-level deny rules as a second layer. Security groups provide instance-level control. VPC Flow Logs provide auditable proof of no internet traffic. The application tier can still reach the internet via NAT Gateway while database tier is cryptographically isolated. This satisfies the auditor's requirement for provable isolation even with security group misconfigurations.

Question 3 of 6 · Domain 3: Infrastructure Security

A healthcare organization runs a HIPAA-compliant application on EC2 instances behind an Application Load Balancer. The application must enforce end-to-end encryption from the client browser to the application tier. The security team has implemented ACM certificates on the ALB for TLS termination, but a compliance audit has flagged that this creates an unencrypted segment between the ALB and EC2 instances within the VPC. The auditor requires proof of encryption for the entire path. Backend instances are in an Auto Scaling group and cannot use static IP addresses. What solution provides end-to-end encryption while maintaining operational scalability?

This is the correct end-to-end encryption pattern for ALB to EC2. Target group HTTPS protocol encrypts ALB-to-backend traffic. ACM Private CA issues private certificates suitable for internal services (public ACM certificates cannot be exported to EC2). User data scripts can retrieve certificates from ACM Private CA using the AWS CLI/SDK. ALB HTTPS health checks with SNI verify backend encryption is working. Connection logs provide audit evidence of encrypted connections. This scales with Auto Scaling since user data runs on each new instance launch.

Question 4 of 6 · Domain 3: Infrastructure Security

A media company stores millions of video files in Amazon S3 across three accounts within an AWS Organization: production account (main storage), analytics account (ML processing), and archive account (cold storage). The security team needs to implement a solution where objects stored in the production S3 bucket are automatically encrypted with a customer-managed KMS key, objects copied to the analytics account use a different KMS key for that account, and objects moved to archive account are encrypted with S3-managed keys to reduce costs. Cross-account access must follow least privilege. S3 Replication is being used. What is the correct KMS key policy and S3 configuration?

S3 bucket keys reduce KMS API costs and are best practice. For S3 replication of SSE-KMS objects, you must specify SourceSelectionCriteria for SSE-KMS encrypted objects. ReplicaModifications with encryption-configuration-override allows changing encryption from source to destination (SSE-KMS in analytics, SSE-S3 in archive). Destination bucket needs permission to use source KMS key for replication service to decrypt. S3 Batch Operations with copy operation can re-encrypt objects to different encryption types. This properly handles the three different encryption requirements across accounts.

Question 5 of 6 · Domain 3: Infrastructure Security

A financial institution is migrating a legacy three-tier application to AWS that currently runs on physical servers behind a hardware firewall. The application tier makes database queries that include customer SSNs and credit card numbers in the query strings (legacy design that cannot be immediately refactored). The CISO requires that this sensitive data in transit between application and database tiers must be protected from potential VPC Flow Log exposure and from AWS administrators. The database runs on RDS PostgreSQL. Which combination of controls provides defense-in-depth protection for this data in transit?

SSL/TLS encryption (forced by rds.force_ssl=1) encrypts query strings containing sensitive data in transit, protecting from VPC Flow Logs exposure (Flow Logs capture packet headers but cannot see encrypted payload). IAM database authentication eliminates password transmission. Encrypting VPC Flow Logs with a customer-managed KMS key with restrictive policy (not granting AWS personnel access) protects log data from AWS administrators. Security groups provide network segmentation. This is the only option that actually addresses both VPC Flow Log exposure and protection from AWS administrators through encryption layers.

Question 6 of 6 · Domain 3: Infrastructure Security

A SaaS company provides a multi-tenant application where each customer's data is stored in separate S3 buckets following the pattern: company-data-{customer-id}. The application runs on EC2 instances using an IAM role. A security review identified that the current IAM role policy grants s3:* permissions to arn:aws:s3:::company-data-*, allowing any application instance to access any customer's data. The security team must implement least privilege so each application instance can only access S3 objects for the customer ID it's serving, but the solution must scale to thousands of customers without creating thousands of IAM roles. Customer ID is determined at instance launch time via a tag. What is the MOST scalable solution?

This correctly implements attribute-based access control (ABAC) using IAM policy variables and conditions. aws:PrincipalTag references tags attached to the IAM role's principal (the EC2 instance). The policy variable ${aws:PrincipalTag/customer-id} dynamically substitutes the customer-id tag value into the resource ARN, limiting access to only the S3 bucket matching the instance's customer tag. This scales infinitely—one role policy works for any number of customers. AWS Config ensures compliance by detecting untagged instances. This is the recommended AWS pattern for multi-tenant ABAC.