ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS DevOps Engineer Professional All Questions

View all questions & answers for the AWS DevOps Engineer Professional exam
Go to Exam

Exam AWS DevOps Engineer Professional topic 1 question 129 discussion

Exam question from Amazon's AWS DevOps Engineer Professional
Question #: 129
Topic #: 1
[All AWS DevOps Engineer Professional Questions]

A security team is concerned that a developer can unintentionally attach an Elastic IP address to an Amazon EC2 instance in production. No developer should be allowed to attach an Elastic IP address to an instance. The security team must be notified if any production server has an Elastic IP address at any time.

How can this task be automated?

  • A. Use Amazon Athena to query AWS CloudTrail logs to check for any associate-address attempts. Create an AWS Lambda function to disassociate the Elastic IP address from the instance, and alert the security team.
  • B. Attach an IAM policy to the developers' IAM group to deny associate-address permissions. Create a custom AWS Config rule to check whether an Elastic IP address is associated with any instance tagged as production, and alert the security team.
  • C. Ensure that all IAM groups associated with developers do not have associate-address permissions. Create a scheduled AWS Lambda function to check whether an Elastic IP address is associated with any instance tagged as production, and alert the security team if an instance has an Elastic IP address associated with it.
  • D. Create an AWS Config rule to check that all production instances have EC2 IAM roles that include deny associate-address permissions. Verify whether there is an Elastic IP address associated with any instance, and alert the security team if an instance has an Elastic IP address associated with it.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by Imstack at Dec. 23, 2022, 3:46 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Piccaso
2 years, 3 months ago
Selected Answer: B
Check with Lambda function does not prevent the accidents safely. D looks at only EC2 with a specifc IAM roles
upvoted 2 times
...
Bulti
2 years, 3 months ago
Selected Answer: B
B is correct. Config rule to check if EIP is associated with the EC2 instance and have have a IAM policy on the IAM group to ensure that no developer belonging to that IAM group is allowed to attach EIP.
upvoted 3 times
...
saggy4
2 years, 4 months ago
Selected Answer: B
A - This only checks and remidiates, does not restrict the developers to attach EIP B - Correct C - This is not optimal D - EC2 IAM roles are not responsible for the EIP attachment the roles associated to developers are
upvoted 4 times
...
Imstack
2 years, 4 months ago
B - correct
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago