AWS Security and Compliance Exam Scenarios

Purpose of This Lesson

This lesson focuses on recognizing the appropriate AWS security or compliance feature for common operational scenarios. The central skill is matching the requirement to the correct control point: IAM policies for identity and resource authorization, AWS KMS for key management, Amazon Inspector for vulnerability assessment, AWS WAF for web-request filtering, AWS Shield Advanced for DDoS protection, AWS Artifact for compliance documentation, and federation services for integrating existing directories.

Because this material is exam-oriented, pay close attention to ownership under the AWS shared responsibility model and to distinctions between automatic and manual key rotation.

Key Concepts

• IAM password policy: Controls requirements for IAM user passwords, including password expiration when users must change passwords regularly.
• IAM policy conditions: Add context-based restrictions to identity or resource policies. Conditions can restrict S3 access by source IP or EC2 permissions by resource tags.
• S3 bucket policy: A resource-based policy that can restrict access to a bucket using a condition such as an IP address range.
• AWS KMS customer managed keys: Support automatic rotation of the backing key. Existing encrypted data remains readable because the data key is not changed.
• Imported KMS key material: Requires a replacement KMS key when the imported material must be rotated. An alias can be updated to reference the replacement key.
• Amazon Inspector: Assesses EC2 instances for vulnerabilities and exposures. Missing findings can indicate that the Inspector agent on affected instances needs to be checked and restarted.
• AWS WAF: Filters HTTP(S) requests and can mitigate patterns such as cross-site scripting, excessive request rates, and repeated suspicious requests from an IP address.
• AWS Shield Advanced: Provides enhanced DDoS protection and is appropriate when an application requires minimized downtime and 24/7 support during repeated attacks.
• AWS Artifact: Provides information and documentation about AWS compliance, including PCI status.
• Federation and directory integration: SAML federation can map LDAP user groups to IAM roles. Active Directory users can be integrated for AWS Management Console access using a VPN tunnel and AD Connector.
• Shared responsibility: Customers are responsible for correcting overly permissive IAM policies and for creating and attaching policies needed for their own access model, including cross-account access.

Security and Compliance Decision Context

IAM password expiration

When a company wants IAM users to change passwords on a regular schedule, configure an IAM password policy and enable password expiration. This is an account-level identity control rather than an S3, KMS, or EC2 setting.

Restricting S3 access by source IP

Use an S3 bucket policy with a condition that evaluates the request’s source IP address or range. The important pattern is a condition-based restriction in a resource policy, not an IAM policy statement that lacks an IP condition.

Restricting EC2 access by tags

To control access to a group of EC2 instances identified by specific tags, use an IAM policy with a condition based on the resource tag. Attach the policy to the IAM users or groups that need the permission. The tag condition allows the authorization decision to target resources without listing every instance individually.

Correcting excessive SQS permissions

If an IAM policy for an SQS queue allows more access than intended, the customer must correct the policy. IAM permission configuration is a customer responsibility under the shared responsibility model.

KMS rotation choices

For a customer managed KMS key, automatic key rotation is the low-effort option when annual rotation is required. Rotation changes the backing key material used by KMS, while the data key used to encrypt the data is not changed; previously encrypted data remains readable.

Imported key material is different. If the key must be rotated on a schedule such as every six months, create a new KMS key with new imported key material and update the application’s alias to point to the new key. An alias provides an abstraction that lets the application continue referring to the logical key name while the alias target changes.

ACM certificate requests

When AWS Certificate Manager rejects a certificate request, submit the request using the correct domain name. Do not use the Application Load Balancer’s fully qualified domain name as the certificate’s requested domain when that is not the intended certificate name.

Inspector findings and assessments

If Amazon Inspector findings are missing for affected EC2 instances, verify that the Inspector agent is installed and restart the agent. For recurring vulnerability verification, use Inspector and perform regular assessments. If the requirement is to check whether vulnerable software versions are installed, create and run an Amazon Inspector assessment template.

WAF request inspection and rate control

AWS WAF can inspect HTTP request characteristics and enforce rules. A string match statement can use information in a request header, such as when requests need to be counted or identified by a header value from front-end servers.

For suspicious high-volume HTTP traffic reaching an Application Load Balancer from many sources, use a WAF rate-based rule with a defined threshold. WAF is also suitable for blocking repeated 404-request activity from an IP address, especially when the pattern suggests automated reconnaissance or information collection.

Cross-site scripting is another WAF use case. A WAF rule can help mitigate XSS attempts against a web application.

DDoS protection and compliance evidence

For repeated DDoS attacks where minimizing downtime and obtaining 24/7 support are requirements, select AWS Shield Advanced. For understanding the PCI compliance status of AWS infrastructure, consult AWS Artifact rather than attempting to infer compliance from a service configuration.

Directory integration and federation

Organizations using LDAP can integrate internal identities with AWS by configuring SAML federation and mapping LDAP user groups to IAM roles and permissions policies. When moving from IAM user accounts to on-premises Active Directory accounts for AWS Management Console access, configure a VPN tunnel and use AD Connector.

Exam- or Assessment-Relevant Takeaways

• Password changes on a schedule point to an IAM password policy with password expiration.
• Source-IP restrictions for an S3 bucket point to an S3 bucket policy with a condition.
• Tag-based EC2 authorization requires an IAM policy condition tied to resource tags.
• Excessive permissions in an IAM or SQS access policy are corrected by the customer.
• Annual rotation with minimal effort favors automatic rotation for a customer managed KMS key.
• Imported KMS material is not rotated by simply enabling the normal automatic rotation choice; use a new KMS key, new imported material, and an updated alias.
• Missing Inspector findings should prompt an agent check and restart on affected instances.
• Recurring EC2 vulnerability checks call for Inspector assessments.
• High request rates call for a WAF rate-based rule; header-based matching calls for a string match statement.
• Repeated DDoS attacks plus 24/7 support requirements indicate Shield Advanced.
• AWS compliance documentation, including PCI information, is found in AWS Artifact.
• LDAP-to-AWS role mapping uses SAML federation; on-premises Active Directory console access uses VPN plus AD Connector.

Tool / Feature Decision Guide

Requirement	Appropriate feature or action	Decisive reason
Force IAM users to change passwords regularly	IAM password policy with password expiration	Controls IAM user password lifecycle
Restrict an S3 bucket by source IP range	S3 bucket policy with an IP condition	Resource-based access control evaluates request source
Limit EC2 permissions to tagged instances	IAM policy condition using resource tags	Authorization targets resources by tag
Rotate a customer managed KMS key annually with minimal effort	Enable automatic key rotation	KMS rotates backing key material while preserving readability
Rotate imported KMS material every six months	Create a new KMS key, import new material, update the alias	Imported material requires replacement-key handling in this scenario
Investigate missing EC2 Inspector findings	Verify and restart the Inspector agent	The affected instance may not be reporting correctly
Identify or count requests by a header value	AWS WAF string match statement	Examines request-header content
Control excessive request volume	AWS WAF rate-based rule with a threshold	Detects and blocks traffic exceeding the defined rate
Mitigate XSS attempts	AWS WAF rule	Filters malicious web requests
Reduce downtime during repeated DDoS attacks and obtain 24/7 support	AWS Shield Advanced	Matches the enhanced DDoS and support requirement
Find AWS PCI compliance information	AWS Artifact	Provides AWS compliance information and documentation
Map LDAP groups to AWS permissions	SAML federation with IAM roles	Connects directory groups to AWS role-based access
Use on-premises Active Directory for console access	VPN tunnel with AD Connector	Integrates the existing directory with AWS access

Common Traps / Misconceptions

• Confusing IAM policies with bucket policies: An S3 bucket source-IP restriction is commonly represented as a bucket policy condition because the control is placed on the bucket resource.
• Forgetting the condition element: Tag-based access does not come from merely attaching a policy to a user or group; the policy must evaluate the relevant resource tag.
• Assuming KMS rotation changes the data key: Automatic KMS rotation changes backing key material. It does not change the data key, so existing encrypted data remains readable.
• Treating imported material like standard KMS key material: The imported-material scenario requires a new KMS key and alias update for the new material.
• Using Inspector without checking the agent: Missing findings may be a reporting or agent issue, not proof that no vulnerabilities exist.
• Using WAF for every security problem: WAF is for web-request inspection and filtering. DDoS protection with enhanced support points to Shield Advanced.
• Looking for PCI status in service settings: AWS Artifact is the source for AWS compliance information.
• Confusing federation approaches: LDAP group-to-role mapping is associated with SAML federation, while the described on-premises Active Directory console integration uses a VPN tunnel and AD Connector.
• Misapplying the shared responsibility model: AWS operates the underlying cloud infrastructure, but customers must correct their IAM policies and configure their access controls.

Real-World Engineer / Analyst Notes

• Use conditions to make permissions more narrowly scoped instead of granting broad access to all resources of a service.
• Treat aliases as an operational indirection layer. They allow applications to use a stable reference while key-management operations change the underlying KMS key.
• When vulnerability results appear incomplete, validate the assessment mechanism and instance-side reporting before concluding that the environment is clean.
• Set WAF thresholds based on expected traffic patterns. A threshold that is too low can block legitimate clients, while one that is too high may fail to control abusive traffic.
• Separate prevention, detection, and evidence: WAF and IAM enforce access controls, Inspector identifies vulnerabilities, and Artifact supplies compliance documentation.
• Directory federation reduces dependence on standalone IAM user accounts by connecting existing organizational identities to AWS roles and permissions.

Quick Reference Summary

• Password expiration: IAM password policy.
• S3 source IP restriction: Bucket policy plus IP condition.
• EC2 tag-based access: IAM policy plus tag condition.
• Overly permissive IAM policy: Customer corrects it.
• Annual customer managed KMS rotation: Enable automatic key rotation.
• Imported KMS material rotation: New key, new imported material, alias update.
• Missing Inspector findings: Check and restart the agent.
• Recurring vulnerability checks: Inspector assessments.
• Header-based request matching: WAF string match statement.
• Excessive or suspicious request rates: WAF rate-based rule.
• XSS mitigation: WAF.
• DDoS plus 24/7 support: Shield Advanced.
• PCI information: AWS Artifact.
• LDAP group mapping: SAML federation to IAM roles.
• On-premises Active Directory console access: VPN tunnel plus AD Connector.

Flashcards

Q: A company wants IAM users to change their passwords on a recurring schedule. Which AWS control should you configure?
A: Configure an IAM password policy and enable password expiration. This applies to IAM user password lifecycle requirements.

Q: How should access to an S3 bucket be restricted to specified source IP ranges?
A: Use an S3 bucket policy with a condition that evaluates the source IP address or range. The restriction belongs in the resource policy for the bucket.

Q: What policy design is appropriate when users should access only EC2 instances with specific tags?
A: Attach an IAM policy to the relevant users or groups and use a condition based on the EC2 resource tags. The condition narrows authorization to matching instances.

Q: Who must correct an IAM policy for an SQS queue when it grants excessive access?
A: The customer must correct it. IAM permissions and customer-configured access policies fall under the customer side of the shared responsibility model.

Q: A customer managed KMS key must be rotated annually with minimal effort. What should be selected?
A: Enable automatic key rotation for the customer managed KMS key. KMS rotates the backing key material while keeping the data key unchanged.

Q: What happens to the data key and readability of existing data when KMS backing key material is rotated?
A: The data key is not changed, and existing encrypted data remains readable. The rotated backing key material supports the KMS operation without replacing the data key.

Q: An application uses imported KMS key material and references the key through an alias. How should the key be rotated every six months?
A: Create a new KMS key with new imported key material, then update the alias to point to the new key. This lets the application retain the alias reference.

Q: What should you check first when Amazon Inspector findings are missing for affected EC2 instances?
A: Verify that the Inspector agent is installed and restart the agent. Missing reporting can prevent expected findings from appearing.

Q: Which AWS WAF rule type fits suspicious traffic that exceeds a defined request threshold?
A: Use a rate-based rule with a defined threshold. It is designed to control excessive request rates.

Q: When would a WAF string match statement be preferred over a rate-based rule?
A: Use a string match statement when the rule must inspect request content such as a header value. Use a rate-based rule when the decisive characteristic is request volume.

Q: A web application is vulnerable to cross-site scripting. Which AWS service can help mitigate the attack?
A: AWS WAF can help mitigate XSS by filtering matching malicious web requests.

Q: Which service fits repeated DDoS attacks where minimized downtime and 24/7 support are required?
A: AWS Shield Advanced. The scenario explicitly combines enhanced DDoS protection needs with continuous support.

Q: Where should a company look for the PCI status of AWS infrastructure?
A: Look in AWS Artifact, which provides AWS compliance information and documentation.

Q: How can LDAP user groups be mapped to AWS roles and permissions?
A: Configure SAML federation and map LDAP groups to IAM roles with the required permissions policies.

Q: What components support AWS Management Console access using on-premises Active Directory accounts in the described scenario?
A: Configure a VPN tunnel and use AD Connector to integrate the on-premises Active Directory with AWS access.

Practice Questions

Question 1

A company wants to limit access to an S3 bucket so that requests originating outside approved corporate IP ranges are denied. Which approach best matches the requirement?

A. Attach an IAM policy to every EC2 instance in the account
B. Create an S3 bucket policy with a source-IP condition
C. Enable automatic rotation on the account’s KMS key
D. Create an Inspector assessment template

Correct answer: B

The decisive clue is that the restriction applies to requests reaching a specific S3 bucket and depends on source IP. A bucket policy with a condition provides that resource-based restriction.

Question 2

An application encrypts data with a customer managed KMS key. The organization wants annual key rotation but wants existing encrypted data to remain readable with minimal administration. What should the engineer do?

A. Replace the data key every year manually
B. Enable automatic rotation for the customer managed KMS key
C. Create a WAF rate-based rule
D. Restart the Inspector agent on every instance

Correct answer: B

Automatic rotation changes the KMS backing key material, while the data key is not changed. This satisfies the stated rotation requirement without changing the data key.

Question 3

A web application behind an Application Load Balancer receives a large number of suspicious requests from many IP addresses. The security team wants to block clients that exceed an approved request rate. Which control should be used?

A. AWS Artifact
B. An IAM tag condition
C. An AWS WAF rate-based rule with a threshold
D. AD Connector

Correct answer: C

The scenario is based on request volume, so a WAF rate-based rule is the appropriate choice. A string match rule would instead be used to inspect specific request content such as a header value.

Question 4

An organization uses imported KMS key material. Its application references the key by alias, and policy requires rotation every six months. Which procedure is appropriate?

A. Enable standard automatic rotation on the existing imported material
B. Delete the alias so the application chooses a new key automatically
C. Create a new KMS key with new imported material and repoint the alias
D. Move the key to AWS Artifact and download a compliance report

Correct answer: C

The imported-material scenario requires a replacement KMS key with new imported material. Updating the alias preserves the application’s logical key reference.

Question 5

A company wants employees to use their on-premises Active Directory accounts to access the AWS Management Console instead of maintaining separate IAM user accounts. Which solution matches the described integration?

A. A VPN tunnel and AD Connector
B. An Inspector assessment template and WAF rule
C. A bucket policy using an IP condition only
D. A customer managed KMS key with automatic rotation

Correct answer: A

The requirement is on-premises Active Directory integration for console access. The described solution uses a VPN tunnel together with AD Connector.

WordPress Metadata

Suggested Slug:
aws-security-compliance-exam-scenarios-soa-c03

Meta Description:
Study guide to AWS security and compliance scenarios involving IAM policies, KMS rotation, Inspector, WAF, Shield Advanced, Artifact, federation, and shared responsibility.

Tags:
AWS Certified CloudOps Engineer Associate, SOA-C03, IAM, AWS KMS, Amazon Inspector, AWS WAF, AWS Shield Advanced, AWS Artifact, SAML federation, Active Directory, shared responsibility