AWS Certified Security Specialty · Free Practice Question Medium
Question 9
A company has moved its business-critical data to an Amazon EFS file system which will be accessed by multiple EC2 instances.
Which of the following would you recommend to exercise access control such that only the permitted EC2 instances can read from the EFS file system? (Select two)
-
A
Use Amazon GuardDuty to curb unwanted access to the EFS file system
-
B
Set up the IAM policy root credentials to control and configure the clients accessing the EFS file system
-
C
Use VPC security groups to control the network traffic to and from your file system
-
D
Use an IAM policy to control access for clients who can mount your file system with the required permissions
-
E
Use Network ACLs to control the network traffic to and from your Amazon EC2 instance
Reveal correct answers
Correct answers: C, D
Explanation
Correct options:
Use VPC security groups to control the network traffic to and from your file system
Use an IAM policy to control access for clients who can mount your file system with the required permissions
You control which EC2 instances can access your EFS file system by using VPC security group rules and AWS Identity and Access Management (IAM) policies. Use VPC security groups to control the network traffic to and from your file system. Attach an IAM policy to your file system to control which clients can mount your file system and with what permissions, and you may use EFS Access Points to manage application access. Control access to files and directories with POSIX-compliant user and group-level permissions.
Files and directories in an Amazon EFS file system support standard Unix-style read, write, and execute permissions based on the user ID and group IDs. When an NFS client mounts an EFS file system without using an access point, the user ID and group ID provided by the client is trusted. You can also use EFS access points to override user ID and group IDs used by the NFS client. When users attempt to access files and directories, Amazon EFS checks their user IDs and group IDs to verify that each user has permission to access the objects
Incorrect options:
Use Network ACLs to control the network traffic to and from your Amazon EC2 instance - Network ACLs operate at the subnet level and not at the instance level.
Set up the IAM policy root credentials to control and configure the clients accessing the EFS file system - There is no such thing as an IAM policy root credentials and this statement has been added as a distractor.
Use Amazon GuardDuty to curb unwanted access to the EFS file system - Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. It cannot be used for access control to the EFS file system.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison
https://docs.aws.amazon.com/efs/latest/ug/accessing-fs-nfs-permissions.html
https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
