Day 5 - Week 1 Consolidated Review: Revisiting the First Week Through Operator Scenarios

A game company serving Korean users operates in ap-northeast-2. The operations team wants to know in advance and prepare for the fact that during a us-east-1 outage, "console login remains possible, but writes such as creating new IAM users or changing Route 53 records may not be." What is the most appropriate additional measure on the SDK/CLI side?

• AExplicitly pin the STS global endpoint (sts.amazonaws.com) and disable regional endpoints in all SDK configurations to unify on a single entry point
• BEnforce the STS regional endpoint (sts.ap-northeast-2.amazonaws.com), and document in the runbook that global writes like IAM and Route 53 depend on us-east-1
• CBlock the us-east-1 endpoint with Route 53 health checks and automatically shift traffic to an ap-northeast-2 secondary record with a failover routing policy
• DCreate a new IAM Identity Center instance in ap-northeast-2 and move the home Region so all us-east-1 control plane dependencies of IAM and Route 53 disappear

An operations team running a web service on an ASG lost all traffic when AZ-a failed. Root-cause analysis showed the NAT GW existed only in AZ-a, and the private subnet route tables of AZ-b and AZ-c all pointed at the AZ-a NAT GW. What's the answer?

• AMove the NAT GW from AZ-a to AZ-b, and point all AZs' private subnet routes at the new AZ-b NAT GW to keep a single management point
• BCreate one NAT GW per AZ, and make each private subnet's route table point to the NAT GW in its own AZ
• CReplace all NAT GWs with NAT Instances managed by an ASG, and handle AZ failure with a single instance's self-heal
• DRemove the NAT GW and attach the Internet Gateway directly to the private subnet route tables to simplify the outbound path

An EC2 instance attempts a PUT to an S3 bucket encrypted with SSE-KMS using a KMS CMK and gets AccessDenied. The IAM Policy has `s3:PutObject Allow`, and the Bucket Policy also has an Allow. In CloudTrail, both an `s3.amazonaws.com` event and a `kms.amazonaws.com` event are logged as failures. The most likely cause is?

• AAn Organization SCP explicitly Denies `s3:PutObject`, neutralizing the Allows in the IAM and Bucket Policies
• BThe KMS Key Policy doesn't allow the EC2 Role for `kms:GenerateDataKey` and `kms:Decrypt`
• CThe S3 bucket is in a different region, so the cross-region PUT is blocked, and the KMS CMK is region-bound so it fails together
• DIMDSv2 is disabled and the hop limit dropped to 0, so the instance can't obtain temporary credentials

A company operates 60 AWS accounts with 200 employees. Employees join and leave every week, and the security team is exhausted by access key rotation and missed offboarding. The most efficient change is?

• AIssue IAM User access keys to all employees, with EventBridge schedules + Lambda automatically rotating every 90 days and revoking inactive keys
• BAdopt IAM Identity Center + external IdP (Azure AD / Okta) federation + Permission Set-based permission management
• CPut per-department IAM Users in one master account and configure hub-and-spoke access to the other 59 accounts with Cross-Account Roles + sts:AssumeRole
• DStore all employees' access keys in Secrets Manager, rotate daily with a rotation Lambda, and audit usage history with CloudTrail

A company runs 50 accounts under Organizations and wants to prevent all accounts from using any region other than `us-east-1` and `ap-northeast-2`. The goal is data sovereignty compliance. The most efficient method is?

• AAdd an `aws:RequestedRegion` NotResource Deny condition to every IAM Policy in every account, and run a review process forcing the same condition on new policies
• BApply an SCP at the root OU, with an `aws:RequestedRegion` Condition denying everything outside the allowed regions + exempting global services like IAM and Route 53 via NotAction
• CDetect non-compliant resources with the Config Rule `region-restriction`, plus SNS alerts and SSM Automation to automatically terminate violating resources
• DDeploy a region-deny IAM Policy to all accounts at once with CloudFormation StackSets, and detect changes with drift detection

An operator wants to delegate IAM Role creation to developers, while enforcing that those Roles' effective permissions cannot exceed the company's standard policy scope. Which combination is correct?

• AGrant developers AdministratorAccess, but detect excessive permission use after the fact with CloudTrail + Config and alert
• BGrant developers `iam:CreateRole` and `iam:AttachRolePolicy` Allow + an `iam:PermissionsBoundary` Condition enforcing the company's standard boundary
• CApply an SCP to the developer accounts' OU to cap the effective permissions of developer-created IAM Roles at the company standard
• DAllow Role creation only through Service Catalog products, and Deny all `iam:CreateRole` outside approved permission templates

A company wants to collect CloudTrail logs from 50 member accounts in one place and prevent operators from modifying or deleting those logs. The goal is meeting PCI-DSS requirement 10.5.5. The standard pattern is?

• ACreate individual trails per member account, gather logs into a central S3 bucket via cross-account IAM permissions, then restrict deletion with a bucket policy
• BOrganization Trail + an isolated S3 bucket in the Log Archive Account + S3 Object Lock (Compliance mode, WORM)
• CCloudWatch Logs Subscription Filters + a Cross-Account Destination to aggregate all accounts' logs in real time into a central Log Group
• DBack up the trail's S3 bucket daily with AWS Backup, keep it in a separate vault, and restore if tampered

An operations team wants to prevent metadata SSRF attacks against EC2 instances. What is the strongest quadruple-defense operational standard?

• ABlock the 169.254.169.254/32 destination with Security Group outbound rules, applied uniformly to all instances
• BEnforce IMDSv2 + hop limit 1 + block IMDSv1 instance creation with an SCP + detect and auto-remediate existing non-compliant instances with the Config rule `ec2-imdsv2-check`
• CDon't attach an IAM instance profile to instances, and inject credentials into applications separately via Secrets Manager
• DExplicitly Deny 169.254.169.254 metadata IP traffic with subnet NACL inbound/outbound rules

An operator wants to see the EC2 instance inventory of 100 accounts at once. The security team wants OS patch status, tags, and instance types. The most efficient method is?

• ALog into each account sequentially via SSO, export the EC2 console list to CSV, and manually merge in a spreadsheet
• BResource Explorer multi-account search, or Systems Manager Inventory + Resource Data Sync aggregating into S3 and querying with Athena
• CA central-account Lambda iterates over 100 accounts daily via cross-account roles, calls describe-instances, and loads results into DynamoDB
• DDeploy an EC2 metadata collection script to all accounts with CloudFormation StackSets and centrally aggregate results via SNS

An operations team created an EventBridge `aws.health` rule to receive us-east-1 outage alerts at 3 AM. The standard pattern for receiving all events without gaps is?

• ACreate just one `aws.health` rule in us-east-1 and rely on all global service events flowing into us-east-1
• BCreate identical rules in both us-east-1 and us-west-2, routing to the same SNS topic (remove duplicate alerts with a dedupe key)
• CCreate identical `aws.health` rules in every enabled region, including regions with no workloads, to reduce the chance of gaps to zero
• DTurn on Organizational Health View in the management account and create the rule once; events from all regions and accounts route automatically

A security operator must separate start/stop permissions for 200 EC2 instances across 5 departments. There are 100 employees and 200 EC2 instances; employees join and leave weekly and department transfers are frequent. The most scalable approach is?

• ACreate 5 department IAM Groups and write 200 separate IAM Policies specifying each instance's ARN, mapped to the Groups
• BOne ABAC policy that Allows `ec2:StartInstances` and `ec2:StopInstances` only when the employee's IdC `PrincipalTag/Department` matches the EC2's `ResourceTag/Department`
• CCreate 5 shared departmental IAM Users, share the access keys within each department, and just reset the password on department transfers
• DWrap departmental EC2 launch/start/stop in Service Catalog products and control permissions with an approval workflow

A security operator wants to see the GuardDuty findings, Security Hub scores, Inspector vulnerabilities, and Macie data classification results of 100 accounts in one place. The standard pattern is?

• ALog into each account's console one by one via SSO, check the 4 services' findings, and manually compile a weekly report
• BDesignate a Security Account as the Delegated Administrator for each of GuardDuty / Security Hub / Inspector / Macie, with member accounts auto-enrolled
• CA central Lambda collects each account's findings hourly via cross-account roles, loads them into a separate RDS/DynamoDB, and serves a dashboard
• DSend findings from each account's EventBridge rules to a central SNS, then analyze them in a self-built SIEM (OpenSearch)