Infrastructure security
Practise only this domain. 57 questions with explanations, 20 at a time.
Start infrastructure securitySample questions
- A media company streams video from a private S3 bucket through a CloudFront distribution. The bucket uses KMS encryption. The team wants direct requests to the bucket endpoint to fail unless they come from that distribution, signed with SigV4. Which setup achieves this?Medium
- A company runs several microservices on an Amazon EKS cluster. Each microservice needs read access to one S3 prefix, and no service should inherit access that belongs to another. The team also wants no static keys stored anywhere in the cluster or the images. Which design meets these goals?Medium
- A company must block one known malicious address from reaching any resource in a VPC. Which control accomplishes that?Medium
- A team needs a managed firewall for their VPC that supports custom Suricata-compatible rules and stateful inspection of traffic between subnets. Which service should they deploy?Easy
- A company wants to inspect incoming HTTP requests to a public web application and block injection attempts using AWS-managed rule groups before the requests reach the application. Which service should they put in front of the app?Medium
- A web application is absorbing a large DDoS attack. The team wants managed volumetric mitigation plus application-layer rate limiting and bot controls they can tune themselves. Which combination provides both?Hard
- A company needs a private, dedicated connection between its data center and AWS that bypasses the public internet entirely. Which service should they order?Easy
- A team runs workloads on Amazon EKS and must protect Kubernetes Secrets stored in etcd. Which feature should they turn on?Hard
- A security team wants to block unsigned container images from being deployed to Amazon ECS. Which approach provides image signing plus verification before a task starts?Hard