サンプル問題 1： An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A CloudOps engineer must ensure that the application can read, write, and delete messages from the SQS queues. Which solution will meet these requirements in the MOST secure manner?
A: Create an IAM user with an IAM policy that allows the sqs: SendMessage permission, the sqs: ReceiveMessage permission, and the sqs: DeleteMessage permission to the appropriate queues. Embed the IAM user's credentials in the application's configuration.
B: Create an IAM user with an IAM policy that allows the sqs: SendMessage permission, the sqs: ReceiveMessage permission, and the sqs: DeleteMessage permission to the appropriate queues. Export the IAM user's access key and secret access key as environment variables on the EC2 instance.
C: Create and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM policy to the role that allows sqs: * permissions to the appropriate queues.
D: Create and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM policy to the role that allows the sqs: SendMessage permission, the sqs: ReceiveMessage permission, and the sqs: DeleteMessage permission to the appropriate queues.
正解：D
Explanation: The most secure pattern is to use an IAM role for Amazon EC2 with the minimum required permissions. AWS guidance states: “Use roles for applications that run on Amazon EC2 instances” and “grant least privilege by allowing only the actions required to perform a task.” By attaching a role to the instance, short-lived credentials are automatically provided through the instance metadata service; this removes the need to create long-term access keys or embed secrets. Granting only sqs: SendMessage, sqs: ReceiveMessage, and sqs: DeleteMessage against the specific SQS queues enforces least privilege and aligns with CloudOps security controls. Options A and B rely on IAM user access keys, which contravene best practices for workloads on EC2 and increase credential-management risk. Option C uses a role but grants sqs: *, violating least-privilege principles. Therefore, Option D meets the security requirement with scoped, temporary credentials and precise permissions. References (AWS CloudOps Documents / Study Guide): • AWS Certified CloudOps Engineer C Associate (SOA-C03) Exam Guide C Security & Compliance • IAM Best Practices C “Use roles instead of long-term access keys,” “Grant least privilege” • IAM Roles for Amazon EC2 C Temporary credentials for applications on EC2 • Amazon SQS C Identity and access management for Amazon SQS
サンプル問題 2： A company runs an application that logs user data to an Amazon CloudWatch Logs log group. The company discovers that personal information the application has logged is visible in plain text in the CloudWatch logs. The company needs a solution to redact personal information in the logs by default. Unredacted information must be available only to the company's security team. Which solution will meet these requirements?
A: Create an Amazon S3 bucket. Create an export task from appropriate log groups in CloudWatch. Export the logs to the S3 bucket. Configure an Amazon Macie scan to discover personal data in the S3 bucket. Invoke an AWS Lambda function to move identified personal data to a second S3 bucket. Update the S3 bucket policies to grant only the security team access to both buckets.
B: Create a customer managed AWS KMS key. Configure the KMS key policy to allow only the security team to perform decrypt operations. Associate the KMS key with the application log group.
C: Create an Amazon CloudWatch data protection policy for the application log group. Configure data identifiers for the types of personal information that the application logs. Ensure that the security team has permission to call the unmask API operation on the application log group.
D: Create an OpenSearch domain. Create an AWS Glue workflow that runs a Detect PII transform job and streams the output to the OpenSearch domain. Configure the CloudWatch log group to stream the logs to AWS Glue. Modify the OpenSearch domain access policy to allow only the security team to access the domain.
正解：C
Explanation: CloudWatch Logs data protection provides native redaction/masking of sensitive data at ingestion and query. AWS documentation states it can “detect and protect sensitive data in logs” using data identifiers, and that authorized users can “use the unmask action to view the original data.” Creating a data protection policy on the log group masks PII by default for all viewers, satisfying the requirement to redact personal information. Granting only the security team permission to invoke the unmask API operation ensures that unredacted content is restricted. Option B (KMS) encrypts at rest but does not redact fields; encryption alone does not prevent plaintext visibility to authorized readers. Options A and D add complexity and latency, move data out of CloudWatch, and do not provide default inline redaction/unmask controls in CloudWatch itself. Therefore, the CloudOps-aligned, managed solution is to use CloudWatch Logs data protection with appropriate data identifiers and unmask permissions limited to the security team. References (AWS CloudOps Documents / Study Guide): • AWS Certified CloudOps Engineer C Associate (SOA-C03) Exam Guide C Monitoring & Logging • Amazon CloudWatch Logs C Data Protection (masking/redaction with data identifiers) • CloudWatch Logs C Permissions for masking and unmasking sensitive data • AWS Well-Architected Framework C Security and Operational Excellence (sensitive data handling)
サンプル問題 3： A multinational company uses an organization in AWS Organizations to manage over 200 member accounts across multiple AWS Regions. The company must ensure that all AWS resources meet specific security requirements. The company must not deploy any EC2 instances in the ap-southeast-2 Region. The company must completely block root user actions in all member accounts. The company must prevent any user from deleting AWS CloudTrail logs, including administrators. The company requires a centrally managed solution that the company can automatically apply to all existing and future accounts. Which solution will meet these requirements?
A: Create AWS Config rules with remediation actions in each account to detect policy violations. Implement IAM permissions boundaries for the account root users.
B: Enable AWS Security Hub across the organization. Create custom security standards to enforce the security requirements. Use AWS CloudFormation StackSets to deploy the standards to all the accounts in the organization. Set up Security Hub automated remediation actions.
C: Use AWS Control Tower for account governance. Configure Region deny controls. Use Service Control Policies (SCPs) to restrict root user access.
D: Configure AWS Firewall Manager with security policies to meet the security requirements. Use an AWS Config aggregator with organization-wide conformance packs to detect security policy violations.
正解：C
Explanation: AWS CloudOps governance best practices emphasize centralized account management and preventive guardrails. AWS Control Tower integrates directly with AWS Organizations and provides “Region deny controls” and “Service Control Policies (SCPs)” that apply automatically to all existing and newly created member accounts. SCPs are organization-wide guardrails that define the maximum permissions for accounts. They can explicitly deny actions such as launching EC2 instances in a specific Region, or block root user access. To prevent CloudTrail log deletion, SCPs can also include denies on cloudtrail:DeleteTrail and s3:DeleteObject actions targeting the CloudTrail log S3 bucket. These SCPs ensure that no user, including administrators, can violate the compliance requirements. AWS documentation under the Security and Compliance domain for CloudOps states: “Use AWS Control Tower to establish a secure, compliant, multi-account environment with preventive guardrails through service control policies and detective controls through AWS Config.” This approach meets all stated needs: centralized enforcement, automatic propagation to new accounts, region-based restrictions, and immutable audit logs. Options A, B, and D either detect violations reactively or lack complete enforcement and automation across future accounts. References (AWS CloudOps Documents / Study Guide): • AWS Certified CloudOps Engineer C Associate (SOA-C03) Exam Guide C Domain 4: Security and Compliance • AWS Control Tower C Preventive and Detective Guardrails • AWS Organizations C Service Control Policies (SCPs) • AWS Well-Architected Framework C Security Pillar (Governance and Centralized Controls)
