Secure Lambda Function Essentials Quiz Quiz

Explore foundational security best practices for Lambda with this quiz, designed to enhance your knowledge on permission management, secure environment variables, and safe deployment methods. Improve your understanding of key security principles for designing and executing reliable serverless functions.

1. Minimal Permissions Principle

   Which security principle recommends granting Lambda functions only the permissions they absolutely require, instead of broad access?

   1. Maximum privilege
   2. Privilege escalation
   3. Open access
   4. Least privilege

   Explanation: The principle of least privilege advises that Lambda functions should have only the permissions necessary for their task, limiting possible damage from compromised components. 'Open access' and 'Maximum privilege' are risky because they provide unnecessary rights. 'Privilege escalation' is a security problem to be avoided, not a principle to follow. By applying least privilege, exposure to threats is minimized.

2. Sensitive Data Storage

   What is the recommended way to store sensitive data like passwords or API keys used by Lambda functions?

   1. In environment variables secured by encryption
   2. In public code repositories
   3. As plain text logs
   4. Hardcoded directly in the function code

   Explanation: Storing sensitive information in encrypted environment variables helps keep credentials secure and separate from the Lambda code. Hardcoding secrets in the code or placing them in public repositories exposes them to unauthorized users. Plain text logs are insecure as they can be easily accessed and read. Encrypting variables adds a protective layer for confidential data.

3. Network Access Restrictions

   How can you prevent a Lambda function from accessing unauthorized external networks or systems?

   1. Increase timeout to allow longer access
   2. Configure strict network and firewall settings
   3. Disable error handling
   4. Use larger memory size

   Explanation: Strict network and firewall settings help control what the Lambda function can reach, preventing unwanted network access. Increasing timeout or memory does not affect network security, but rather performance. Disabling error handling does not contribute to access restrictions. Proper network controls are essential to limit exposure.

4. Code Dependency Security

   What best practice should be followed to manage third-party libraries and dependencies in Lambda functions?

   1. Download new dependencies at every invocation
   2. Use only outdated libraries for stability
   3. Ignore dependency updates after initial deployment
   4. Regularly update and audit dependencies for vulnerabilities

   Explanation: Regular auditing and updating of dependencies help prevent exploitation through known vulnerabilities in third-party code. Ignoring updates risks leaving security holes open. Downloading dependencies on each invocation can introduce performance and security issues. Outdated libraries might have unpatched flaws, making them unsafe.

5. Code Injection Protection

   Which security measure helps to prevent injection attacks in Lambda functions that process user input, such as processing form submissions?

   1. Disable encryption
   2. Sanitize and validate all user input
   3. Use public APIs without restrictions
   4. Increase function timeout

   Explanation: Sanitizing and validating user input stops malicious data from being executed, which guards against injection attacks. Increasing timeout or disabling encryption does not address input security. Using public APIs without restrictions may expose functions to unvalidated content or attackers. Proper input handling is the key defense in this case.

6. Logging Practices

   When using logs in Lambda functions, what should you avoid to maintain good security practices?

   1. Logging function execution status
   2. Recording function invocation time
   3. Logging error messages for debugging
   4. Writing sensitive data such as passwords to logs

   Explanation: Logging sensitive information like passwords creates a serious risk if logging systems are accessed by unauthorized parties. Logging execution status, errors, and invocation times is standard practice and aids monitoring without exposing confidential information. Always ensure logs are free from secret data.

7. Role Assignment Accuracy

   Why is it important to assign specific execution roles to Lambda functions instead of sharing one role with all functions?

   1. To ensure only necessary privileges are granted per function
   2. To speed up deployment
   3. To reduce code size
   4. To increase cloud storage

   Explanation: Assigning unique roles per function ensures that each Lambda function only has the permissions it truly needs, enhancing security. Sharing one role across all functions can create excessive privileges and potential risks. The answer does not relate to deployment speed, storage, or code size. Tailoring roles strengthens access control.

8. Function Timeout Settings

   What is one reason security best practices recommend setting reasonable timeout values for Lambda functions?

   1. To maximize storage allocation
   2. To improve code readability
   3. To limit the risk of resource exhaustion attacks
   4. To increase function's computational power

   Explanation: Reasonable timeout settings reduce the likelihood of functions being exploited for prolonged execution, limiting the potential for denial-of-service or resource exhaustion attacks. Timeout settings do not enhance computational power, code readability, or storage. Controlling execution time is a practical step toward security.

9. Source Code Security

   How should Lambda code be protected during deployment to prevent unauthorized changes?

   1. Store code in a shared public folder
   2. Use cryptographic checks to verify code integrity
   3. Disable all code versioning
   4. Allow direct anonymous edits

   Explanation: Cryptographic checks ensure the code being deployed has not been altered by unauthorized parties. Storing code in public folders or allowing anonymous changes exposes it to tampering. Disabling versioning removes the ability to roll back to a known-good state. Integrity verification helps maintain trusted deployments.

10. API Gateway Security Integration

    Which method helps improve Lambda security when the function is triggered by an API call?

    1. Accept all inputs without checks
    2. Require authentication and enforce input validation at the API gateway
    3. Disable monitoring on the API
    4. Expose the API to all internet users by default

    Explanation: Adding authentication and input validation at the API gateway reduces the risk of unauthorized access and harmful data reaching the Lambda function. Accepting all inputs or exposing the API broadly increases vulnerability to attacks. Disabling monitoring eliminates security visibility. Layered defenses at the API gateway enhance overall function protection.