312-40 Practice Questions

Preventive guardrails are implemented using Service Control Policies (SCPs) which are part of AWS Organizations. They are designed to enforce policies and prevent actions that would lead to a policy violation. An SCP can be configured to deny actions like cloudtrail:StopLogging or cloudtrail:DeleteTrail for all principals in an account, including the root user, making it the correct tool for this requirement.

This statement is false. Microsoft's Rules of Engagement for penetration testing explicitly prohibit any kind of Denial of Service (DoS or DDoS) tests. Performing such attacks is a violation of the terms of service and can lead to account suspension, regardless of notification.

Isolating the instance is a critical first step. It contains the potential threat, prevents communication with an attacker's C2 server, and stops lateral movement, all while keeping the instance running to preserve volatile memory.

Creating a snapshot of the EBS volume provides a forensically sound, point-in-time copy of the disk. This allows the investigator to analyze the disk contents later without altering the original evidence.

ISO/IEC 27017 places emphasis on the relationship and clear communication between the provider and customer. A key customer-side control is to establish clear agreements on how security is managed, including how incidents are monitored, reported, and responded to. This ensures clarity in the shared responsibility model.

This is the correct answer. When a Lambda function is placed inside a VPC, it uses network interfaces within the specified private subnets. These subnets do not have a default route to the internet. To access public services like S3 or DynamoDB, the VPC must have a NAT Gateway (for general internet access) or specific VPC Gateway/Interface Endpoints (for private access to AWS services).

The most probable cause is a permissions issue. When using a central S3 bucket for AWS Organizations' CloudTrail logs, the IAM role or user credentials used by the SIEM's data connector must have the necessary s3:GetObject and s3:ListBucket permissions on that specific bucket. Network ACLs are stateless and less likely to be the root cause for a service-level integration. CloudTrail is enabled by default for management events, so it's unlikely to be disabled. A misconfigured trail would affect log generation, not ingestion by an external system if logs are present in S3.

Secret Manager is GCP's dedicated service for storing, managing, and accessing secrets. It provides versioning, automatic rotation (via Cloud Functions), and integration with other GCP services. IAM is used to define granular permissions, specifying which principals (users, service accounts) can access which secrets.

IAM provides the authorization mechanism to control access to Secret Manager. You use IAM policies to grant roles like 'Secret Manager Secret Accessor' to specific service accounts or users, enforcing the principle of least privilege. Secret Manager relies on IAM for its access control.

This statement is false. While AWS manages the physical security and availability of the KMS hardware, the customer is responsible for configuring the key policies (IAM), managing grants, enabling or disabling keys, and configuring automatic key rotation. For SSE-KMS, this is a shared responsibility. The customer defines the key and its access policies; AWS manages the underlying service that performs the encryption.

This is the most comprehensive and secure solution. A Managed VNet isolates the workspace. Data exfiltration protection blocks outbound public internet traffic. Managed Private Endpoints secure connections to other Azure services. A Private Endpoint for the workspace itself ensures all client connections originate from the private network, satisfying all stated requirements.

Amazon Inspector is the correct service. It is an automated vulnerability management service that continuously scans AWS workloads (EC2, ECR for containers) for software vulnerabilities and unintended network exposure. It automatically discovers running workloads, scans them, and provides a prioritized list of findings.