AWS Certified Solutions Architect Associate · Free Practice Question Medium
Question 56
A company has moved its business critical data to Amazon Elastic File System (Amazon EFS) which will be accessed by multiple Amazon EC2 instances.
As an AWS Certified Solutions Architect - Associate, which of the following would you recommend to exercise access control such that only the permitted Amazon EC2 instances can read from the Amazon EFS file system? (Select two)
-
A
Use an IAM policy to control access for clients who can mount your file system with the required permissions
-
B
Use Amazon GuardDuty to curb unwanted access to Amazon EFS file system
-
C
Use network access control list (network ACL) to control the network traffic to and from your Amazon EC2 instance
-
D
Set up the IAM policy root credentials to control and configure the clients accessing the Amazon EFS file system
-
E
Use VPC security groups to control the network traffic to and from your file system
Reveal correct answers
Correct answers: A, E
Explanation
Correct options:
Use VPC security groups to control the network traffic to and from your file system
Use an IAM policy to control access for clients who can mount your file system with the required permissions
You control which Amazon EC2 instances can access your Amazon EFS file system by using VPC security group rules and AWS Identity and Access Management (IAM) policies. Use VPC security groups to control the network traffic to and from your file system. Attach an IAM policy to your file system to control which clients can mount your file system and with what permissions, and you may use Amazon EFS Access Points to manage application access. Control access to files and directories with POSIX-compliant user and group-level permissions.
Files and directories in an Amazon EFS file system support standard Unix-style read, write, and execute permissions based on the user ID and group IDs. When an NFS client mounts an Amazon EFS file system without using an access point, the user ID and group ID provided by the client is trusted. You can also use Amazon EFS access points to override user ID and group IDs used by the NFS client. When users attempt to access files and directories, Amazon EFS checks their user IDs and group IDs to verify that each user has permission to access the objects.
Incorrect options:
Use network access control list (network ACL) to control the network traffic to and from your Amazon EC2 instance - Network ACLs operate at the subnet level and not at the instance level.
Set up the IAM policy root credentials to control and configure the clients accessing the Amazon EFS file system - There is no such thing as an IAM policy root credentials and this statement has been added as a distractor.
Use Amazon GuardDuty to curb unwanted access to Amazon EFS file system - Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. It cannot be used for access control to the Amazon EFS file system.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison
https://docs.aws.amazon.com/efs/latest/ug/accessing-fs-nfs-permissions.html
https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
