1.2 - Securing workloads and applications
AWS Solutions Architect Associate objective 1.2 covers securing workloads and applications. A security group acts as a stateful firewall at the instance (ENI) level, allowing return traffic automatically, whereas a network ACL is stateless at the subnet level. To continuously scan running EC2 instances and container images for software vulnerabilities, Amazon Inspector assesses EC2 and ECR images and reports findings by severity. When an organization needs guaranteed DDoS protection with 24/7 access to the AWS Shield Response Team, AWS Shield Advanced is the paid tier that adds that support and cost protection over the free Shield Standard. You should also know WAF, GuardDuty, and defense in depth. Expect scenario questions that describe an instance-level firewall, continuous vulnerability scanning, or enterprise DDoS protection with expert support, and ask which security service or control - security group, Inspector or Shield Advanced - fits.
Stateful firewall at the instance/ENI = security group. Continuously scan EC2/ECR for vulnerabilities = Amazon Inspector. Guaranteed DDoS + 24/7 Shield Response Team = Shield Advanced (paid).
Practice questions
1. Which component acts as a stateful firewall at the instance (ENI) level in a VPC?
- Network ACL
- Route table
- Security group (correct answer)
- Internet gateway
Security groups are stateful firewalls attached to ENIs: return traffic is allowed automatically. Network ACLs are stateless and operate at the subnet level.
2. A web app behind an Application Load Balancer suffers SQL injection and cross-site scripting attempts. Which service filters these at Layer 7?
- AWS Shield Standard
- AWS WAF (correct answer)
- Amazon GuardDuty
- AWS Network Firewall
AWS WAF inspects HTTP(S) requests and blocks patterns like SQLi and XSS via managed or custom rules, attached to ALB, CloudFront, or API Gateway. Shield handles DDoS; GuardDuty is threat detection.
3. You must give a mobile app temporary, limited AWS credentials after users log in with Google. Which service issues those credentials?
- AWS IAM Access Analyzer
- AWS Certificate Manager
- Amazon Macie
- Amazon Cognito with STS (correct answer)
Cognito identity pools exchange a federated login (Google, etc.) for temporary AWS credentials via STS, scoped by an IAM role. This avoids embedding credentials in the app.
4. Which managed service continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to detect compromised instances and unusual API activity?
- Amazon Macie
- AWS Config
- Amazon GuardDuty (correct answer)
- AWS Trusted Advisor
GuardDuty is a threat-detection service that ingests CloudTrail, VPC Flow Logs, and DNS logs to flag anomalies such as crypto-mining, credential exfiltration, or reconnaissance, without deploying agents.
5. A firm must discover and classify personally identifiable information (PII) stored across hundreds of S3 buckets. Which service is purpose-built for this?
- Amazon Macie (correct answer)
- Amazon Inspector
- AWS Secrets Manager
- Amazon GuardDuty
Macie uses machine learning and pattern matching to discover, classify, and report sensitive data such as PII in S3, and alerts on exposed or unencrypted buckets.
6. An operations team needs shell access to EC2 instances in private subnets without opening port 22 or running a bastion host. Which approach meets this?
- Assign public IPs to the instances and restrict SSH by security group
- Deploy a NAT gateway and forward inbound SSH traffic to the instances
- Place all instances in a public subnet with a strict network ACL on port 22
- Use AWS Systems Manager Session Manager with an instance IAM role (correct answer)
Session Manager gives auditable, browser or CLI shell access through the SSM agent and outbound HTTPS only, so no inbound ports, bastion, or SSH keys are needed.