AWS security engineering

Correct — Grants are additive but each ceiling is conjunctive; an explicit Deny always wins.

Correct — PassRole + RunInstances/CreateFunction is a classic privilege-escalation primitive.

Correct — Limit which roles can be passed and to which service.

Correct — It lets you delegate role creation without allowing escalation past the ceiling.

Correct — Rewriting your own attached policy is self-escalation.

Correct — They surface unintended access and reachable paths before an attacker walks them.

Correct — People get short-lived, centrally-managed role sessions.

Correct — Short-lived tokens scoped to the workload; nothing static to leak.

Correct — Trust = principals + conditions; permissions are separate.

Correct — Pin the sub to specific refs/environments and assert the aud claim.

Correct — Root is the crown jewels; guard and monitor it.

Correct — Elevate on demand rather than holding permanent privilege.

Correct — The trail records what happened; GuardDuty flags the suspicious.

Correct — It is agentless log/behavior analysis, not inline blocking.

Correct — It is the single pane that dedupes and scores findings.

Correct — It accelerates root-cause during triage.

Correct — Coverage becomes an org property, not a checklist to forget.

Correct — Detection without response is theatre.

Correct — Tune, dedupe, and prioritize by severity and asset criticality.

Correct — Enable the plans relevant to your workloads.

Correct — It is continuous CVE scanning across those resource types.

Correct — A permitted action at abnormal volume/pattern is the tell.

Correct — Management events alone miss the data-plane story.

Correct — A dashboard nobody watches is not a control.

Correct — Only KMS can unwrap the stored data key; bulk data never touches KMS.

Correct — A bucket reader without key permission sees only ciphertext.

Correct — A capability a provider-owned key cannot offer.

Correct — Envelope encryption makes rotation cheap and non-disruptive.

Correct — Grants scope and can be retired without editing the key policy.

Correct — It tells you where sensitive data actually lives.

Correct — Account BPA overrides risky ACLs org-wide.

Correct — You gain governance SSE-S3’s provider key cannot offer.

Correct — A bucket-level key cuts the volume of GenerateDataKey/Decrypt calls.

Correct — Two independent permissions are needed for plaintext.

Correct — Hardware-backed keys that never leave the module, with attestable custody.

Correct — Secrets become a governed resource, not a copied file.

Correct — Deny-by-default; you open only what is needed and replies flow back.

Correct — You must allow both directions explicitly.

Correct — The DB SG allows the app SG — no IP list to maintain.

Correct — You remove the public attack surface on the data tier.

Correct — The data plane stays on the AWS backbone.

Correct — A compromised workload with open egress phones home freely.

Correct — It enables deep egress filtering and Suricata-style rules.

Correct — A key forensic and detection input.

Correct — It is not a substitute for secure code.

Correct — It cuts off C2/exfil domains and gives visibility.

Correct — Build VPCs deliberately with private subnets and scoped egress.

Correct — An internal network is not inherently trusted.

Correct — They cap the maximum available permissions for the account.

Correct — The misconfig never happens instead of being reported.

Correct — New accounts arrive secure-by-default, no checklist to forget.

Correct — Segregating logs protects evidence integrity.

Correct — Write-once retention preserves evidence.

Correct — “Someone touched logging” is a near-certain intrusion signal.

Correct — Contain first; the trail tells you the blast radius.

Correct — Contain and capture evidence rather than destroying it.

Correct — Persistence hides in the control plane; find it before restoring.

Correct — Otherwise already-issued short-lived credentials stay valid until expiry.

Correct — It answers “what did this resource look like when?”.

Correct — Speed and correctness come from practice, not invention mid-incident.