Your security team wants to run a penetration test against your own EC2 instances on AWS. What is required first?
A.File a support ticket and wait up to 30 days
Approval requests were the old process — current policy allows testing without permission.
B.Nothing — penetration testing on permitted AWS services requires no prior approval
Correct. Own-resource pen tests on permitted services need no approval.
C.Enterprise support plan approval
No support tier is required.
D.Written consent from AWS Legal
No legal consent needed for your own resources on the permitted list.
Why this answer
AWS permits penetration testing against your resources on listed services (EC2, RDS, CloudFront, Aurora, API Gateway, Lambda, Lightsail, Elastic Beanstalk) without prior approval — you just can't test AWS infrastructure itself or others' resources.
Correct answer: B · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Basics practice session.
Practice Security Basics