[DEVELOPER] Developer Security

Question 1

What is AWS Certificate Manager (ACM) primarily used for in application development?

Answer 1

Provisioning, managing, and deploying public and private SSL/TLS certificates for integrated services like Load Balancers, CloudFront, and API Gateway.

Question 2

Can an ACM-issued certificate be installed directly on an Amazon EC2 instance?

Answer 2

No.

ACM certificates must be deployed on an integrated service (e.g., ALB, CloudFront, API Gateway). For a standalone EC2 server, you would need to import a certificate.

Question 3

When retrieving secrets from Secrets Manager in code, how should developers retrieve the secret value?

Answer 3

Do not cache it.

Instead, retrieve the secret programmatically at runtime using the AWS SDK, and configure a client-side or server-side caching strategy if needed.

Question 4

What is Amazon GuardDuty and what are its primary data sources?

Answer 4

A threat detection service that continuously monitors for malicious activity and unauthorized behavior.

It analyzes:
- VPC Flow Logs,
- CloudTrail Management Event Logs
- DNS Logs.

Question 5

What is Amazon Inspector used for in a continuous integration/continuous deployment (CI/CD) pipeline?

Answer 5

An automated security assessment service that scans EC2 instances for software vulnerabilities and unintentional network exposure, and also scans container images in ECR.

Question 6

When a security issue is flagged by GuardDuty, which service can be used to visually trace and understand the root cause of the issue?

Answer 6

Amazon Detective.
It automatically collects log data and uses a graph model to visualize and analyze security findings.

Question 7

What is the pupose of a Cognito Identity Pool?

Answer 7

It allows users (authenticated via User Pools or federated) to obtain temporary AWS credentials to directly access other AWS services (like S3 or DynamoDB).