CLF-C02 Practice Question 71: Security Pillar Principles
AWS Certified Cloud Practitioner (CLF-C02) · Test 8 · question 1 of 10
At a company, engineers regularly sign in to production database servers to run ad hoc queries against customer records, and they change firewall rules by hand in the console. A security architect wants to reduce direct human handling of sensitive data and to define security controls as code in version-controlled templates. Which design principles of the AWS Well-Architected Framework security pillar match these goals? (Choose TWO.)
Select 2 answers.
Show answer and explanation
Answers:
Keep people away from data means using mechanisms and tools that reduce or eliminate direct access to data and manual processing of it. That lowers the risk of mishandling, unwanted modification and human error with sensitive data, which is exactly the problem with engineers querying customer records by hand. Automate security best practices means building secure architectures with software-based security mechanisms, including controls that are defined and managed as code in version-controlled templates. That replaces the hand-edited firewall rules.
The other three are real Well-Architected design principles, but from other pillars. Option A, test recovery procedures, is a reliability principle about validating how a workload fails and recovers. Option C, experiment more often, is a performance efficiency principle about quickly comparing instance types, storage or configurations. Option E, make frequent, small, reversible changes, is an operational excellence principle about reducing the blast radius of deployments. None of the three targets human access to sensitive data or security controls as code.
Reference: Security pillar design principles