SysOps Evaluation 1

A company plans to set up a bucket policy in Amazon S3 to allow users to list all the objects in the jumpingbrains bucket and retrieve them. The SysOps Administrator prepared the below policy using the AWS Policy Generator. What will happen if the Administrator applies this bucket policy in S3?

• • You will be prompted with an "Action does not apply to any resource(s) in statement" error.

• • The jumpingbrains bucket including all its objects will be publicly accessible and downloadable to anyone.

• • The jumpingbrains bucket including all its objects will be publicly visible to anyone.

• • The jumpingbrains bucket including all its objects will be publicly visible to anyone but downloading the objects is not allowed.

An international IT Consulting company is planning on setting up multiple accounts in AWS to separate their various departments and projects teams. For security purposes, the IT Security department has a requirement to ensure that certain services and actions are not allowed across all the accounts.

How would you achieve this in the most effective way?

• • Create a common IAM policy that can be applied across all accounts.

• • Activate Consolidated Billing feature across the account to control the services on each account.

• • Contact AWS and request for them to deny the services not allowed to be used across accounts.

• • Use AWS Organizations and Service Control Policies to control services on each account.

A global technology company has thousands of employees around the globe that are using Amazon VPC Cloud. As part of the company’s security compliance, IT auditors have requested a Credential report which contains a list of AWS users that contains their current status, their access key usage, and if they are using Multi-Factor Authentication (MFA) or not.

How can the SysOps Administrator generate the report required by the auditors?

• • Go to AWS EC2 dashboard and download the Credential report.

• • You can call up AWS support and have them generate the Credential report for you.

• • You can contact an AWS partner to generate the Credential report.

• • You can go to AWS IAM Console and download the Credential report.

A tech startup company plans to develop a web application hosted on EC2 that sends and fetches data to a DynamoDB table. The app is using the DynamoDB SDK and root account access keys to connect to DynamoDB.

Which of the following is the best option to improve the security of this architecture?

• Nothing, because EC2 can use DynamoDB as their both are AWS Services and the required permissions are already configured

• You should provision an IAM role with DynamoDB access. Attach the IAM role to the EC2 instances which will route all calls coming from the web app to the DynamoDB table.

• Create an IAM user and generate its access keys. Attach the policies that provide access to DynamoDB to this IAM user. Configure the Access keys inside the EC2 Instance

• You should create a separate IAM user for the web app with policies  that provides access to DynamoDB.

Due to the recent security breach in your company, the IT Security team has required you to review your existing cloud architecture and ensure that it follows the security best practices. You are managing thousands of users and teams that are heavily using AWS.

Which of the following practices should you implement? (Select TWO.)

• Provide secure access keys to your applications needing access to AWS resources.

• Use the AWS Root access keys for critical applications to access AWS resources.

• • Use a shared user account to use for each department.

• • Enable MFA for Privileged users.

• Grant access on a least privilege basis.