Free 312-40 sample questions

Correct answer: False

This statement is false. While AWS manages the physical security and availability of the KMS hardware, the customer is responsible for configuring the key policies (IAM), managing grants, enabling or disabling keys, and configuring automatic key rotation. For SSE-KMS, this is a shared responsibility. The customer defines the key and its access policies; AWS manages the underlying service that performs the encryption.

Correct answer: Deploy the Synapse workspace with a Managed Virtual Network, enable the data exfiltration protection feature, use Managed Private Endpoints for connections to other PaaS services, and create a Private Endpoint for connecting to the workspace.

This is the most comprehensive and secure solution. A Managed VNet isolates the workspace. Data exfiltration protection blocks outbound public internet traffic. Managed Private Endpoints secure connections to other Azure services. A Private Endpoint for the workspace itself ensures all client connections originate from the private network, satisfying all stated requirements.

Correct answer: Amazon Inspector

Amazon Inspector is the correct service. It is an automated vulnerability management service that continuously scans AWS workloads (EC2, ECR for containers) for software vulnerabilities and unintended network exposure. It automatically discovers running workloads, scans them, and provides a prioritized list of findings.

Correct answer: aws iam list-attached-role-policies

This is the correct command. `aws iam list-attached-role-policies --role-name ` lists the names and ARNs of the managed policies that are attached to the specified IAM role. This is a primary step in enumerating permissions during a penetration test.

Correct answer: Pilot Light: Replicate the RDS database to a read replica in the DR region and use S3 Cross-Region Replication. Keep a small EC2 instance running in the DR region to act as the core, ready to scale out.

The Pilot Light strategy provides a balance between cost and recovery time. The core infrastructure is running (the 'pilot light'), and data is actively replicated (RDS read replica, S3 CRR), which supports a low RPO. In a disaster, the infrastructure can be scaled out relatively quickly (e.g., via Auto Scaling), meeting the < 1 hour RTO without the cost of a fully scaled-out warm standby environment.

Correct answer: AWS CloudTrail Logs

AWS CloudTrail is the correct source. It provides a record of actions taken by a user, role, or an AWS service. All management API calls, including `PutBucketAcl`, are recorded in CloudTrail logs, providing the necessary audit trail for forensic investigation of permission changes.

Correct answer: Azure Policy

Azure Policy is the correct service. It allows you to create policies that enforce and control the properties of a resource. These policies can enforce rules for resource configuration, such as allowing only certain VM SKUs or requiring tags. It has built-in policy initiatives that map to compliance frameworks like NIST, making it the ideal tool for governance and compliance enforcement.

Correct answer: Place each tier in a separate private subnet. Use distinct Security Groups for each tier (e.g., Web-SG, App-SG, DB-SG). Configure rules so that Web-SG only accepts traffic from the load balancer, App-SG only from Web-SG, and DB-SG only from App-SG.

This is the ideal implementation. It uses subnetting for network segmentation and granular, stateful Security Groups to enforce the principle of least privilege. Traffic flow is strictly controlled between tiers (ELB -> Web -> App -> DB), providing strong defense-in-depth.

Correct answer: Data Sovereignty

Data sovereignty is the concept that information which has been converted and stored in binary digital form is subject to the laws of the country in which it is located. For GDPR compliance, this means ensuring EU citizen data is stored and processed within designated regions (like EU regions offered by cloud providers) to comply with legal requirements about data residency and cross-border transfers.

Correct answers: During the build phase, after the image is created but before it is pushed to the registry.; After the image is pushed to the container registry (e.g., Azure Container Registry).; During runtime, after the container has been deployed to the AKS cluster.

Scanning during the build phase ('shift left') is a critical best practice. It provides the earliest possible feedback to developers, allowing them to fix vulnerabilities before the image is even stored in a registry.

Scanning images in the registry is essential. Most registries, like ACR, have built-in scanning capabilities. This ensures that even images built outside the pipeline are checked and provides a continuous assessment for newly discovered vulnerabilities in existing images.

Runtime scanning is another layer of defense. It can detect vulnerabilities in running containers that might have been missed, or it can identify malicious processes and activities. Services like Microsoft Defender for Containers provide this capability.