SOA-C02 Question 185
Select 3An organization wants to ensure their AWS environment is secure and compliant. As a SysOps Administrator, you are tasked with using AWS Trusted Advisor to review security checks. After running the Trusted Advisor Security category, you notice several flagged items. Which of the following checks should you prioritize to immediately improve the security posture of the environment? (Select TWO)
- A
IAM access keys that have not been rotated in the last 90 days
- B
S3 buckets with public access permissions
- C
EC2 instances running on older generation instance types
- D
RDS snapshots that are publicly accessible
- E
Underutilized EC2 instances
Show answer and explanation
Correct answers: A, B, D
Explanation
AWS Trusted Advisor provides security checks to ensure your environment meets best practices. The flagged items for IAM access key rotation, S3 bucket permissions, and RDS snapshot access directly impact the security of the environment and should be addressed immediately. Other issues, like older instance types or underutilized resources, do not directly impact security.
- A. Correct.
IAM access keys that have not been rotated in 90 days pose a security risk, as compromised or outdated keys can be exploited. This is a priority in Trusted Advisor security checks.
- B. Correct.
S3 buckets with public access permissions are a major security concern, as they can expose sensitive data to unauthorized users. Trusted Advisor flags this as a critical issue.
- C. Incorrect.
EC2 instances running on older generation instance types may incur higher costs or have performance limitations, but this is not directly related to security.
- D. Correct.
RDS snapshots that are publicly accessible can expose sensitive database backups to unauthorized access. Trusted Advisor flags this as a critical security risk.
- E. Incorrect.
Underutilized EC2 instances indicate resource inefficiencies but are not a security concern.