Topic 1 Question 109

AWS Certified Security - Specialty

Topic 1 Question 109
A security engineer recently rotated all IAM access keys in an AWS account. The security engineer then configured AWS Config and enabled the following AWS Config managed rules: mfa-enabled-for-iam-console-access, iam-user-mfa-enabled, access-keys-rotated, and iam-user-unused-credentials-check.

The security engineer notices that all resources are displaying as noncompliant after the IAM GenerateCredentialReport API operation is invoked.

What could be the reason for the noncompliant status?
- The IAM credential report was generated within the past 4 hours.
- The security engineer does not have the GenerateCredentialReport permission.
- The security engineer does not have the GetCredenlialReport permission.
- The AWS Config rules have a MaximumExecutionFrequency value of 24 hours.
ユーザの投票
コメント(10)
- 正解だと思う選択肢: A
  The report was generated within the past 4 hours - https://repost.aws/knowledge-center/config-credential-report
  
  👍 8
  AgboolaKun2024/05/24
- 正解だと思う選択肢: A
  AWS Config rules such as mfa-enabled-for-iam-console-access, iam-user-mfa-enabled, access-keys-rotated, and iam-user-unused-credentials-check rely on data from the IAM credential report. The IAM credential report is updated automatically every four hours, and changes in IAM (such as rotating access keys) may not be reflected in the report immediately. If the IAM credential report was generated within the past 4 hours, AWS Config might not yet have the updated information, causing the resources to display as noncompliant.
  
  👍 4
  navid13652024/11/22
- 正解だと思う選択肢: A
  When these AWS Config rules are triggered, they rely on the latest IAM credential report to evaluate compliance. If the IAM credential report has been generated within the past 4 hours, it might not reflect the most recent changes, such as the rotation of access keys. To address this, it's a good practice to ensure that the IAM credential report is generated and updated at regular intervals, and AWS Config rules are then evaluated against the most recent report. You can schedule the generation of the IAM credential report and the evaluation of AWS Config rules accordingly.
  
  A &C are incorrect because the noncompliance is related to the timeliness of the IAM credential report rather than permissions. Option D is incorrect because the MaximumExecutionFrequency value doesn't affect the initial evaluation of the rules; it determines how often the rule is re-evaluated after its first evaluation.
  
  👍 3
  vikasj1in2024/07/14
シャッフルモード

ユーザの投票

コメント(10)