Dev on AWS Day 1

In AWS, which security aspects are the customer’s responsibility? (Choose three answers.)

• Lifecycle management of IAM credentials

• Decommissioning storage devices

• Security group and access control list (ACL) settings

• Encryption of Amazon Elastic Block Store (Amazon EBS) volumes

• Controlling physical access to compute resources

A company has AWS workloads in multiple geographical locations. A developer has created an Amazon Aurora database in the us-west-1 Region. The database is encrypted using a customer-managed AWS KMS key. Now the developer wants to create the same encrypted database in the us-east-1 Region.

Which approach should the developer take to accomplish this task?

• Create a snapshot of the database in the us-west-1 Region. Copy the snapshot to the us-east-1 Region and specify a KMS key in the us-east-1 Region. Restore the database from the copied snapshot.

• Create an unencrypted snapshot of the database in the us-west-1 Region. Copy the snapshot to the useast-1 Region. Restore the database from the copied snapshot and enable encryption using the KMS key from the us-east-1 Region

• Disable encryption on the database. Create a snapshot of the database in the us-west-1 Region. Copy the snapshot to the us-east-1 Region. Restore the database from the copied snapshot.

• In the us-east-1 Region, choose to restore the latest automated backup of the database from the us-west1 Region. Enable encryption using a KMS key in the us-east-1 Region.

AnyCompany is launching a new game app for mobile devices. Users log in to the game using their existing Facebook account and the game records player data and scoring information directly to an Amazon DynamoDB table. What is the most secure approach for signing requests to DynamoDB API?

• Create an IAM user with access credentials that are distributed with the mobile app to sign the requests.

• Distribute the AWS root account access credentials with the mobile app to sign the requests.

• Request temporary security credentials using web identity federation to sign the requests.

• Establish cross account access between the mobile app and the DynamoDB table to sign the requests.

You are about to provide an S3 bucket resource-based permissions so you can grant access to your friend, Boo. His AWS account number is 123412341234 and his IAM username is Boo. What should be the format for the ARN?

• “Principal”: {

  “AWS”: [“arn:aws:s3:123412341234:user/Boo”]

  }

• B.“Principal”: {

  “AWS”: [“arn:aws:iam::123412341234:/user/Boo”]

  }

• You cannot do it with a bucket policy. You must create user-based permissions in IAM

You run an ad-supported, photo-sharing website using Amazon S3 to serve photos to visitors of your site. At some point, you find out that other sites are linking to the photos on your site, causing loss to your business. What is an effective method to mitigate this problem?

• Store photos on an EBS volume of the web server.

• Remove public read access and use pre-signed URLs with expiry dates.

• Use CloudFront distributions for static content.

• Block the IPs of the offending websites in Security Groups.