Skip to content
BytePatterns

SCS-C03 · Domain 3: Infrastructure Security · 18% of the exam

Task 3.2: Design, implement, and troubleshoot security controls for compute workloads

Securing what runs: hardened AMIs and container images, the right instance profile or execution role, Inspector scans and GuardDuty runtime monitoring, automated patching, keyless admin access with Session Manager, security checks in the pipeline, and guardrails for generative AI applications.

Study it

  • Hardened images: EC2 Image Builder, AMIs and container images

    Partly covered by: Images, Layers & Multi-Stage Builds

  • Roles for compute: instance profiles, service roles and execution roles

    Partly covered by: Shared Responsibility & IAM

  • Vulnerabilities and runtime threats: Inspector, GuardDuty and Patch Manager

    Lesson coming

  • Admin access without SSH keys: Session Manager and EC2 Instance Connect

    Lesson coming

  • Securing the pipeline and generative AI applications

    Partly covered by: Guardrails

Sample questions

Try each one before opening the answer. Every option is explained, with the AWS documentation page that proves it.

Question 1 · choose 1

Administrators need shell access to private EC2 instances. Security requires that no inbound ports are open on the instances, that no SSH keys are managed, that access is granted through IAM, and that every session's commands and output are stored in an S3 bucket encrypted with a KMS key. Which solution meets these requirements?

  1. AEC2 Instance Connect Endpoint with temporary SSH keys pushed for each connection
  2. BA bastion host in a public subnet with SSH keys stored in Secrets Manager
  3. CSession Manager with session logging to an S3 bucket encrypted with the key
  4. DSystems Manager Run Command with command output written to the encrypted bucket
Show the answer and why

  • AEC2 Instance Connect Endpoint with temporary SSH keys pushed for each connection

    Incorrect

    The instance security group must allow inbound SSH from the endpoint, and the service does not record session output to S3.

  • BA bastion host in a public subnet with SSH keys stored in Secrets Manager

    Incorrect

    A bastion needs an open SSH port and keys to manage, which the requirements rule out.

  • CSession Manager with session logging to an S3 bucket encrypted with the key

    Correct

    Session Manager needs no inbound ports, bastions or SSH keys, is controlled with IAM policies, and can log session data to S3 with KMS encryption.

  • DSystems Manager Run Command with command output written to the encrypted bucket

    Incorrect

    Run Command sends commands without opening ports, but it does not provide interactive shell sessions for administrators.

"No open ports, no keys, IAM-controlled, sessions recorded" is the definition of Session Manager with session logging.

AWS documentation

Task 3.2Report a problem with this question

Question 2 · choose 1

A team stores container images in Amazon ECR. Images must be checked for vulnerabilities in both operating system packages and Python libraries, and images already in the registry must be checked again automatically when a new CVE that affects them is published. What should the team configure?

  1. AECR basic scanning with scan on push for every repository
  2. BECR basic scanning with a scheduled EventBridge rule that starts manual scans each night
  3. CAmazon Inspector Lambda standard scanning for the account
  4. DECR enhanced scanning with Amazon Inspector set to continuous scanning
Show the answer and why

  • AECR basic scanning with scan on push for every repository

    Incorrect

    Basic scanning checks operating system packages only and runs on push or manually, so new CVEs do not trigger a rescan.

  • BECR basic scanning with a scheduled EventBridge rule that starts manual scans each night

    Incorrect

    Repeated basic scans still cover operating system packages only, not Python libraries.

  • CAmazon Inspector Lambda standard scanning for the account

    Incorrect

    Lambda scanning covers Lambda functions and layers, not container images in ECR.

  • DECR enhanced scanning with Amazon Inspector set to continuous scanning

    Correct

    Enhanced scanning covers operating system and programming language packages, and continuous scanning rescans images when Inspector adds a relevant CVE.

Language packages and rescans on new CVEs are the two features that separate enhanced scanning with Inspector from basic scanning.

AWS documentation

Task 3.2Report a problem with this question

Question 3 · choose 1

A company runs workloads on Amazon EKS clusters with EC2 nodes and on Amazon ECS tasks on AWS Fargate. The security team wants to detect threats inside the running workloads, such as a crypto-mining process starting or a reverse shell opening a network connection. What should the team turn on?

  1. AGuardDuty EKS Protection for all EKS clusters in the account
  2. BGuardDuty Runtime Monitoring with the automated security agent
  3. CGuardDuty Malware Protection for EC2 with GuardDuty-initiated scans
  4. DAmazon Inspector continuous scanning of the images in ECR
Show the answer and why

  • AGuardDuty EKS Protection for all EKS clusters in the account

    Incorrect

    EKS Protection analyzes EKS audit logs of the Kubernetes API. It does not see processes or network connections inside containers.

  • BGuardDuty Runtime Monitoring with the automated security agent

    Correct

    Runtime Monitoring observes process execution, file access and network connections on EKS, ECS on Fargate and EC2 through its security agent.

  • CGuardDuty Malware Protection for EC2 with GuardDuty-initiated scans

    Incorrect

    Malware Protection scans EBS volumes, for example after a finding. It does not watch running processes and does not cover Fargate tasks.

  • DAmazon Inspector continuous scanning of the images in ECR

    Incorrect

    Inspector finds known vulnerabilities in images. It does not detect what a running container does.

Runtime threats need runtime visibility: the GuardDuty security agent. Note that GuardDuty does not support EKS clusters running on Fargate.

AWS documentation

Task 3.2Report a problem with this question

Question 4 · choose 2

A customer support assistant is built on a foundation model in Amazon Bedrock. The security team must stop users from overriding the system instructions with jailbreak or prompt injection attempts, and the assistant must never show customers' Social Security numbers or phone numbers in its answers; they must be replaced with a placeholder. Which Amazon Bedrock Guardrails settings should the team use? (Choose TWO.)

  1. AA content filter with the Prompt Attack category turned on
  2. BDenied topics that describe attempts to change the assistant's instructions
  3. CA contextual grounding check with a high threshold
  4. DA word filter that lists the digits 0 through 9
  5. EA sensitive information filter that masks the SSN and phone number entity types
Show the answer and why

  • AA content filter with the Prompt Attack category turned on

    Correct

    The Prompt Attack category of content filters detects attempts to override instructions, such as jailbreaks and prompt injection.

  • BDenied topics that describe attempts to change the assistant's instructions

    Incorrect

    Denied topics block subjects that are unwanted in the application. Attacks on instructions are handled by the Prompt Attack filter.

  • CA contextual grounding check with a high threshold

    Incorrect

    Grounding checks detect responses that are not supported by the source material. They do not hide PII or stop prompt attacks.

  • DA word filter that lists the digits 0 through 9

    Incorrect

    Word filters match whole words and phrases, so a list of digits would neither find whole numbers reliably nor replace them with a placeholder.

  • EA sensitive information filter that masks the SSN and phone number entity types

    Correct

    Sensitive information filters can block or mask PII such as SSNs in user inputs and model responses.

Map each risk to its safeguard: instruction attacks to the Prompt Attack content filter, PII in answers to a sensitive information filter with the mask action.

AWS documentation

Lesson: GuardrailsTask 3.2Report a problem with this question

Question 5 · choose 1

A Lambda function URL was created with auth type NONE and a resource policy that allows public access. Only IAM principals in the company's accounts should be able to call it. What should the team change?

  1. ASet the auth type to AWS_IAM and grant the callers
  2. BKeep NONE and rename the function so the URL is harder to guess
  3. CKeep NONE and add a longer function timeout
  4. DKeep NONE and put the function in a VPC
Show the answer and why

  • ASet the auth type to AWS_IAM and grant the callers

    Correct

    With AWS_IAM, Lambda authenticates and authorizes requests with IAM, so only permitted principals can invoke the URL.

  • BKeep NONE and rename the function so the URL is harder to guess

    Incorrect

    A new name keeps the URL public.

  • CKeep NONE and add a longer function timeout

    Incorrect

    The timeout has nothing to do with who can call the URL.

  • DKeep NONE and put the function in a VPC

    Incorrect

    With NONE, Lambda does not authenticate callers at all.

With NONE, only the resource-based policy limits callers, and it must grant public access for the URL to work.

AWS documentation

Task 3.2Report a problem with this question

Question 6 · choose 1

A hardening standard says that containers in Amazon ECS tasks must not be able to write to their root file system. Which task definition setting enforces this?

  1. Aprivileged set to false for each container
  2. BreadonlyRootFilesystem set to true
  3. CnetworkMode set to awsvpc
  4. Dessential set to true
Show the answer and why

  • Aprivileged set to false for each container

    Incorrect

    This removes elevated privileges but does not make the file system read-only.

  • BreadonlyRootFilesystem set to true

    Correct

    When true, the container gets read-only access to its root file system.

  • CnetworkMode set to awsvpc

    Incorrect

    The network mode has nothing to do with file system access.

  • Dessential set to true

    Incorrect

    Essential decides whether the task stops when the container stops.

Applications that need scratch space can mount a separate volume.

AWS documentation

Task 3.2Report a problem with this question

Question 7 · choose 1

A developer puts a database password into an EC2 instance's user data so that a startup script can use it. Why is this a problem?

  1. AUser data is deleted from the instance after the first boot
  2. BStartup scripts cannot read user data when IMDSv2 is required
  3. CUser data is encrypted with a key the instance cannot read
  4. DAnyone with access to the instance can read its user data
Show the answer and why

  • AUser data is deleted from the instance after the first boot

    Incorrect

    User data stays readable from the instance after boot.

  • BStartup scripts cannot read user data when IMDSv2 is required

    Incorrect

    User data can be read through IMDSv2 as well.

  • CUser data is encrypted with a key the instance cannot read

    Incorrect

    User data is readable from the instance; that is the problem.

  • DAnyone with access to the instance can read its user data

    Correct

    Instance metadata and user data are not protected by authentication or cryptographic methods, so sensitive data does not belong there.

Read secrets at run time from Secrets Manager or Parameter Store with the instance profile instead.

AWS documentation

Task 3.2Report a problem with this question

Question 8 · choose 1

The Kubernetes API server endpoint of an Amazon EKS cluster is reachable from the internet. The company wants kubectl access only from inside its VPC and connected networks. What should the team configure?

  1. AUse the private endpoint and turn off public access
  2. BRestrict endpoint access with the nodes' security group
  3. CRotate the cluster's Kubernetes certificates
  4. DPut the worker nodes in private subnets only
Show the answer and why

  • AUse the private endpoint and turn off public access

    Correct

    The cluster can expose a private endpoint inside the VPC, and public access can be limited or disabled.

  • BRestrict endpoint access with the nodes' security group

    Incorrect

    Node security groups do not control the API server endpoint.

  • CRotate the cluster's Kubernetes certificates

    Incorrect

    New certificates leave the endpoint reachable.

  • DPut the worker nodes in private subnets only

    Incorrect

    Node placement does not change who can reach the API server.

If some public access is still needed, limit it to known CIDR blocks.

AWS documentation

Task 3.2Report a problem with this question

Question 9 · choose 2

Teams in other accounts must pull images from a central private Amazon ECR repository. Which settings are required? (Choose TWO.)

  1. ATag immutability turned on for the central repository
  2. BA repository policy allowing those accounts to pull
  3. CAn S3 bucket policy for the image layer storage
  4. Decr:GetAuthorizationToken in the callers' IAM policies
  5. EA lifecycle policy that keeps only the last ten images
Show the answer and why

  • ATag immutability turned on for the central repository

    Incorrect

    Immutability prevents tag overwrites; it grants no access.

  • BA repository policy allowing those accounts to pull

    Correct

    A repository policy grants principals in other accounts access to the repository's images.

  • CAn S3 bucket policy for the image layer storage

    Incorrect

    ECR access is controlled with ECR and IAM policies, not bucket policies.

  • Decr:GetAuthorizationToken in the callers' IAM policies

    Correct

    Users need ecr:GetAuthorizationToken through an IAM policy before they can authenticate to a registry and pull images.

  • EA lifecycle policy that keeps only the last ten images

    Incorrect

    Lifecycle policies clean up images; they grant no access.

Cross-account pulls need both sides: the repository policy and the caller's IAM permissions.

AWS documentation

Task 3.2Report a problem with this question

Practise domain 3 →Practise all domains →