Task 4.2: Implement strategies to protect data and infrastructure.

• ATurn on default encryption for the account's Amazon S3 buckets

  Incorrect

  Default bucket encryption applies to objects in S3. It does not affect EBS volumes or snapshots.

• BTurn on EBS encryption by default in eu-west-1

  Correct

  Encryption by default is a Region-specific setting that makes new EBS volumes and snapshot copies in that Region encrypted, with no change to how they are launched.

• CTurn on automatic key rotation for the AWS managed key that EBS uses

  Incorrect

  AWS KMS already rotates AWS managed keys every year, and rotation cannot be turned on or off for them. Rotation does not encrypt unencrypted volumes either.

• DUse Elastic Volumes to change every new unencrypted volume to encrypted

  Incorrect

  An existing unencrypted volume cannot be encrypted directly; it takes a snapshot and a new encrypted volume, one at a time.

One Region setting covers every launch path. It has no effect on existing volumes, which still need the snapshot-and-copy route.

• AValidate the certificate again by email instead of by DNS

  Incorrect

  DNS, email and HTTP validation are all ways to prove domain ownership. The method does not decide where CloudFront can use the certificate.

• BAttach the certificate to the load balancer's HTTPS listener first

  Incorrect

  A certificate for the load balancer may be in any Region, but that covers only the connection from CloudFront to the origin, not viewers.

• CRequest or import the certificate in us-east-1 and select it

  Correct

  To use an ACM certificate for HTTPS between viewers and CloudFront, the certificate must be requested or imported in US East (N. Virginia).

• DChange the distribution's security policy to a newer minimum TLS version

  Incorrect

  The security policy sets the minimum protocol and the ciphers used with viewers. It does not change which certificates can be chosen.

Viewer certificates for CloudFront come from us-east-1; origin certificates on a load balancer can live in the load balancer's own Region.

• AKeep the password in the environment variables and encrypt them with a customer managed KMS key

  Incorrect

  Lambda already encrypts environment variables at rest, and AWS recommends Secrets Manager instead for database credentials. Nothing here changes the password.

• BStore the password as a Parameter Store SecureString and turn on rotation for its KMS key

  Incorrect

  KMS key rotation generates new key material for the key. The password encrypted with it stays the same, in the store and in the database.

• CStore the password in an encrypted S3 object that a scheduled script updates every month

  Incorrect

  This is home-grown rotation that the team must build and keep in step with the database, which Secrets Manager already provides.

• DStore the credentials in AWS Secrets Manager and turn on automatic rotation every 30 days

  Correct

  Secrets Manager rotation updates the credentials in both the secret and the database on a schedule, and the function reads the secret at run time.

Rotating a database password means changing it in two places at once. Secrets Manager rotation is built for exactly that; key rotation and encrypted storage are not.

• AAmazon Macie with automated sensitive data discovery

  Correct

  Macie discovers sensitive data in S3 with machine learning and pattern matching, and automated discovery continually samples objects across the bucket inventory and reports findings.

• BAmazon GuardDuty protection for the account and its S3 buckets

  Incorrect

  GuardDuty is a threat detection service that looks for suspicious and malicious activity, not for the kind of data stored in objects.

• CAmazon Inspector for the account

  Incorrect

  Inspector scans EC2 instances, ECR images and Lambda functions for software vulnerabilities and network exposure.

• DAWS Config with rules for the S3 buckets

  Incorrect

  Config records and evaluates resource configurations, such as bucket settings. It does not look inside objects.

Classification starts with knowing where sensitive data is. For S3, that discovery is Macie's job.

• ACreate an EventBridge rule that matches GuardDuty Finding events with a severity filter

  Correct

  GuardDuty sends finding events to EventBridge, and a rule's event pattern can match on the detail.severity field.

• BExport findings to an Amazon S3 bucket that the on-call engineer reviews each morning

  Incorrect

  Export to S3 is for keeping findings longer and tracking history. A daily review does not meet "within minutes".

• CSet an Amazon SNS topic with the on-call email subscription as the rule's target

  Correct

  EventBridge delivers matched events to targets such as SNS topics, and the topic delivers the message to its email subscriber.

• DTurn on CloudTrail Insights events for the account

  Incorrect

  CloudTrail Insights detects unusual API call or error rates. It does not deliver GuardDuty findings to anyone.

• ECreate a GuardDuty suppression rule that matches high-severity findings

  Incorrect

  A suppression rule automatically archives matching new findings, which hides exactly the findings the team wants to see.

Findings become notifications through EventBridge: a rule that selects the findings, and an SNS topic that reaches people.