Amazon Web Services Updated DOP-C02 Exam Questions and Answers by fabian

Amazon ECR supports enhanced scanning powered by Amazon Inspector, which provides deeper security scanning for container images including OS and programming language package vulnerabilities.

Enabling enhanced scanning (Option B) allows detection of CRITICAL and HIGH vulnerabilities.

Amazon ECR emits scan completion events via EventBridge, which can trigger Lambda functions. The Lambda function can process the scan results from Amazon Inspector and programmatically approve or reject the image in the CI/CD pipeline (Option D).

Basic scanning (Option A) is limited and does not integrate with Inspector.

Options C and E describe functionalities not natively supported (ECR does not automatically submit Rejected status; Clair is not used in AWS ECR scanning).

 Ensure that Amazon GuardDuty is Enabled:

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior.

It can detect port scans and generate findings for these events.

 Create an Amazon CloudWatch Alarm for Detected EC2 and Port Scan Findings:

Configure GuardDuty to monitor for port scans and other threats.

Create a CloudWatch alarm that triggers when GuardDuty detects port scan activities.

 Connect the Alarm to the SNS Topic:

The CloudWatch alarm should be configured to send notifications to the SNS topic subscribed by the security team.

This setup ensures that the security team receives near-real-time notifications when a port scan is detected on the EC2 instances.

Example configuration steps:

Enable GuardDuty and ensure it is monitoring the relevant AWS accounts.

Create a CloudWatch alarm:

{

" AlarmName " : " GuardDutyPortScanAlarm " ,

" MetricName " : " ThreatIntelIndicator " ,

" Namespace " : " AWS/GuardDuty " ,

" Statistic " : " Sum " ,

" Dimensions " : [

{

" Name " : " FindingType " ,

" Value " : " Recon:EC2/Portscan "

}

],

" Period " : 300,

" EvaluationPeriods " : 1,

" Threshold " : 1,

" ComparisonOperator " : " GreaterThanOrEqualToThreshold " ,

" AlarmActions " : [ " arn:aws:sns:region:account-id:SecurityAlerts " ]

}

A Lambda function in one account can mount a file system in a different account. For this scenario, you configure VPC peering between the function VPC and the file system VPC. https://docs.aws.amazon.com/lambda/latest/dg/services-efs.html

https://aws.amazon.com/ru/blogs/storage/mount-amazon-efs-file-systems-cross-account-from-amazon-eks/

1. Need to update the file system policy on EFS to allow mounting the file system into Account B.

## File System Policy

$ cat file-system-policy.json

{

" Statement " : [

{

" Effect " : " Allow " ,

" Action " : [

" elasticfilesystem:ClientMount " ,

" elasticfilesystem:ClientWrite "

],

" Principal " : {

" AWS " : " arn:aws:iam:: < aws-account-id-A > :root " # Replace with AWS account ID of EKS cluster

}

}

]

}

2. Need VPC peering between Account A and Account B as the pre-requisite

3. Need to assume cross-account IAM role to describe the mounts so that a specific mount can be chosen.

The engineer should make the following changes to achieve a policy of least permission:

A: Add a condition to ensure that the principal making the request is an AWS Lambda function. This ensures that only Lambda functions can execute this policy.

B: Narrow down the resources by specifying the ARN of EC2 instances instead of allowing all resources. This ensures that the policy only affects EC2 instances.

D: Add a condition to ensure that this policy only applies to EC2 instances tagged with “Environment: NonProduction”. This ensures that production environments are not affected by this policy.

AWS Identity and Access Management (IAM) - AWS Documentation

Certified DevOps Engineer - Professional (DOP-C02) Study Guide (page 179)