AWS module 9.3 Security

Question 1

A company gives all employees full admin access to AWS resources. Which security principles are violated and what should be implemented instead?

Answer 1

Violates:
• Strong identity foundation
• Least privilege

They should implement:
• IAM roles with minimal permissions
• Separation of duties

Question 2

A system cannot track who made changes or detect suspicious activity. Which security principle is missing and how is it implemented?

Answer 2

Enable traceability

Implemented using:
• Logging (e.g., CloudTrail)
• Monitoring
• Alerts and auditing systems

Question 3

An application secures only the database but leaves the network and application layer exposed. What is wrong with this design?

Answer 3

It violates “apply security at all layers” (defence in depth) — security must be applied across VPC, subnet, OS, application, and data layers.

Question 4

Sensitive data is encrypted at rest but intercepted during transmission. What security principle was partially implemented and what is missing?

Answer 4

Implemented: encryption at rest
Missing: encryption in transit

Both are required to fully protect data.

Question 5

A company relies on manual responses to security incidents, causing delays and damage. What should be implemented according to the Security pillar?

Answer 5

• Prepare for security events
• Automate detection and response
• Use incident response processes and simulations