AWS Cloud Practitioner — All Questions

Under the AWS shared responsibility model, which of the following is AWS responsible for?

• a.Encrypting the customer's application data at rest
• b.Physical security of the data centers and the hardware running the cloud✓
• c.Managing the customer's IAM user passwords
• d.Configuring security groups on the customer's EC2 instances

AWS is responsible for security 'of' the cloud, which includes the physical facilities, hardware, and the global infrastructure. Customers are responsible for security 'in' the cloud, such as configuring security groups, managing IAM, and protecting their data.

Under the shared responsibility model, which task is the customer responsible for?

• a.Replacing failed physical disks in the data center
• b.Maintaining the hypervisor that isolates instances
• c.Managing operating-system patches on their EC2 instances✓
• d.Securing the physical network cabling

For services like EC2, the customer manages the guest operating system, including patching, along with application software and firewall configuration. AWS handles the underlying physical and virtualization infrastructure.

Which AWS service is used to create users, groups, and roles and to control their permissions to AWS resources?

• a.Amazon Macie
• b.AWS Identity and Access Management (IAM)✓
• c.AWS Shield
• d.Amazon Cognito

IAM lets you manage authentication and authorization for AWS by creating users, groups, and roles and attaching policies that grant or deny access. It is the primary service for controlling who can do what in an account.

What is the AWS best practice for the root user of an AWS account?

• a.Share its credentials with the whole team
• b.Delete it immediately after account creation
• c.Enable MFA on it and avoid using it for everyday tasks✓
• d.Use it for all daily administrative tasks

The root user has unrestricted access, so AWS recommends securing it with multi-factor authentication and using it only for the few tasks that require it. Everyday work should be done with IAM users or roles that follow least privilege.

Which security measure adds a second form of verification, such as a code from a device, when signing in to AWS?

• a.An Elastic IP address
• b.Multi-factor authentication (MFA)✓
• c.A larger instance type
• d.A public S3 bucket policy

MFA requires users to present an additional authentication factor, such as a one-time code from a hardware or virtual device, beyond their password. This significantly reduces the risk of compromised credentials.

An application running on an EC2 instance needs to read objects from an S3 bucket. What is the recommended way to grant this access?

• a.Embed long-term access keys in the application code
• b.Attach an IAM role to the EC2 instance✓
• c.Share the root user credentials with the instance
• d.Make the S3 bucket public

Attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials to the application, avoiding hard-coded keys. This follows the principle of least privilege and is far more secure than embedding static keys.

Which principle recommends granting users only the permissions they need to perform their tasks and nothing more?

• a.Elastic provisioning
• b.Defense in depth
• c.Separation of billing
• d.Least privilege✓

The principle of least privilege means giving identities only the minimum permissions required for their job. This limits the potential impact if credentials are compromised or misused.

Which AWS service provides a managed distributed denial-of-service (DDoS) protection for applications running on AWS?

• a.AWS Shield✓
• b.Amazon Inspector
• c.AWS Config
• d.Amazon Macie

AWS Shield is a managed DDoS protection service. Shield Standard is automatically included at no extra cost, while Shield Advanced offers enhanced protection and support for an additional fee.

Which service helps protect web applications from common exploits such as SQL injection and cross-site scripting by filtering HTTP requests?

• a.Amazon Route 53
• b.AWS Trusted Advisor
• c.AWS WAF (Web Application Firewall)✓
• d.AWS Budgets

AWS WAF lets you create rules to filter and monitor HTTP and HTTPS requests, blocking common web exploits like SQL injection and cross-site scripting. It can be attached to services such as CloudFront, ALB, and API Gateway.

Which service uses machine learning to automatically discover and classify sensitive data such as personally identifiable information stored in Amazon S3?

• a.AWS Shield
• b.Amazon Macie✓
• c.Amazon GuardDuty
• d.AWS WAF

Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data, such as PII, in S3. It helps organizations understand where sensitive data resides and monitor its security.

Which service continuously monitors for malicious activity and unauthorized behavior using account and network telemetry such as CloudTrail and VPC flow logs?

• a.AWS Certificate Manager
• b.AWS Artifact
• c.Amazon Cognito
• d.Amazon GuardDuty✓

Amazon GuardDuty is a threat detection service that continuously analyzes logs such as CloudTrail, VPC flow logs, and DNS logs to identify suspicious activity. It generates findings without requiring you to deploy or manage sensors.

Which AWS service records API calls and account activity, providing an audit trail of who did what and when?

• a.Amazon CloudFront
• b.AWS CloudTrail✓
• c.AWS Config
• d.Amazon Inspector

AWS CloudTrail logs API calls and account events across your AWS infrastructure, creating an audit trail useful for governance, compliance, and operational troubleshooting. It answers questions about who made a change and when.

Which service continuously assesses your resource configurations and can evaluate them against desired settings for compliance?

• a.AWS Config✓
• b.AWS WAF
• c.Amazon Macie
• d.AWS Shield

AWS Config records the configuration of your AWS resources over time and can evaluate them against rules to check compliance. It is useful for auditing changes and maintaining a desired configuration state.

Which service provides on-demand access to AWS compliance reports and agreements such as SOC and PCI documents?

• a.AWS Config
• b.AWS Artifact✓
• c.Amazon GuardDuty
• d.Amazon Inspector

AWS Artifact is a self-service portal for on-demand access to AWS security and compliance reports, such as SOC reports and PCI documentation, and to agreements like the Business Associate Addendum. It helps customers meet their own audit requirements.

Which service creates, manages, and controls cryptographic keys used to encrypt data across AWS services?

• a.AWS Key Management Service (KMS)✓
• b.Amazon Cognito
• c.AWS CloudHSM only
• d.AWS WAF

AWS KMS lets you create and manage encryption keys and integrates with many AWS services to encrypt data at rest. It centralizes key management and controls who can use keys through IAM and key policies.

Which service securely stores and automatically rotates database credentials, API keys, and other secrets?

• a.AWS Secrets Manager✓
• b.AWS Artifact
• c.Amazon Macie
• d.AWS Config

AWS Secrets Manager helps you store, retrieve, and automatically rotate secrets such as database credentials and API keys. It removes the need to hard-code sensitive values in application code.

Which service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?

• a.AWS Artifact
• b.Amazon Inspector✓
• c.AWS Shield
• d.Amazon Cognito

Amazon Inspector is an automated vulnerability management service that continuously scans workloads such as EC2 instances and container images for software vulnerabilities and network exposure. It prioritizes findings to help teams remediate risks.

Which service provides sign-up, sign-in, and access control for web and mobile application users, including identity federation?

• a.AWS IAM
• b.AWS Shield
• c.Amazon Cognito✓
• d.AWS KMS

Amazon Cognito provides authentication, authorization, and user management for web and mobile apps, including social and enterprise identity federation. IAM, by contrast, manages access for people and services operating on AWS itself.

In a VPC, which stateful virtual firewall controls inbound and outbound traffic at the instance level?

• a.Network access control list (NACL)
• b.Route table
• c.Security group✓
• d.Internet gateway

A security group acts as a stateful firewall at the instance (ENI) level, where return traffic is automatically allowed. NACLs, by contrast, are stateless firewalls that operate at the subnet level.

Which statement about network ACLs (NACLs) is correct?

• a.They are stateful and automatically allow return traffic
• b.They are attached directly to individual instances
• c.They are stateless and operate at the subnet level with allow and deny rules✓
• d.They can only allow traffic and never deny it

NACLs are stateless firewalls that operate at the subnet boundary and support both allow and deny rules, evaluated in order. Because they are stateless, you must explicitly allow both request and response traffic.

A company wants to centrally manage multiple AWS accounts and apply guardrails that restrict which services accounts can use. Which combination helps?

• a.A single shared IAM user across all accounts
• b.AWS Organizations with service control policies (SCPs)✓
• c.Route 53 health checks
• d.Amazon Macie with WAF rules

AWS Organizations lets you centrally manage many accounts, and service control policies set the maximum permissions available to member accounts. This provides guardrails without granting individual permissions.

What does 'encryption in transit' protect?

• a.Data stored on an EBS volume
• b.Data archived in Amazon S3 Glacier
• c.Data printed to a physical report
• d.Data as it moves between a client and a server over the network✓

Encryption in transit protects data while it travels across networks, typically using TLS, so it cannot be read if intercepted. Encryption at rest, by contrast, protects stored data.

Which AWS service can be used to provision and manage SSL/TLS certificates for use with AWS services like load balancers and CloudFront?

• a.AWS Certificate Manager (ACM)✓
• b.AWS Config
• c.AWS Secrets Manager
• d.Amazon Inspector

AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates, and can handle automatic renewal. This simplifies enabling encryption in transit for supported services.

Which of the following is an IAM best practice?

• a.Disable MFA to simplify sign-in
• b.Use the root account for daily API calls
• c.Attach permissions directly to each individual user
• d.Grant permissions using groups and roles rather than long-term keys where possible✓

IAM best practices include using groups and roles to manage permissions, applying least privilege, enabling MFA, and rotating or avoiding long-term credentials. Managing permissions through groups scales better than per-user policies.

Which service aggregates security findings from services like GuardDuty, Inspector, and Macie into a single dashboard and runs automated best-practice checks?

• a.AWS Security Hub✓
• b.AWS Direct Connect
• c.Amazon CloudFront
• d.AWS Trusted Advisor

AWS Security Hub provides a comprehensive view of security state by aggregating and prioritizing findings from multiple AWS security services and running automated compliance checks. It helps teams manage security posture from one place.

A customer stores objects in Amazon S3 and wants AWS to manage the encryption keys and apply encryption automatically. Which option fits?

• a.Only encrypt data after downloading it locally
• b.Server-side encryption with keys managed by AWS (SSE)✓
• c.Disable encryption entirely
• d.Store keys in the application source code

Server-side encryption lets AWS encrypt object data at rest, with key management handled by S3 or KMS. This provides encryption at rest without the customer having to build their own encryption process.

Which statement best distinguishes an IAM user from an IAM role?

• a.A role always has a permanent password, while a user never does
• b.Roles can only be used by AWS employees
• c.Users cannot be assigned any permissions
• d.A user represents a specific identity with long-term credentials, while a role is assumed temporarily by trusted entities✓

An IAM user is a persistent identity with its own long-term credentials, whereas an IAM role is assumed temporarily and provides short-term credentials to whoever or whatever assumes it. Roles are ideal for granting access to applications, services, or federated users.

According to the shared responsibility model, who is responsible for classifying data and configuring access controls on it?

• a.No one is responsible
• b.The customer✓
• c.AWS alone
• d.The internet service provider

Customers are always responsible for their own data, including classifying it and configuring appropriate access controls and encryption. AWS secures the underlying infrastructure but does not manage the customer's data classification.

Which service would you use to get automated recommendations that include security checks such as identifying publicly accessible resources or missing MFA on the root account?

• a.AWS Trusted Advisor✓
• b.AWS Lambda
• c.Amazon EC2 Auto Scaling
• d.Amazon S3

AWS Trusted Advisor inspects your environment and provides recommendations across categories including security, such as flagging open ports, exposed access keys, or a root account without MFA. It helps improve security posture and follow best practices.

What is the benefit of using temporary security credentials provided by IAM roles instead of long-term access keys?

• a.They never expire, so they are easier to manage
• b.They grant full administrative access by default
• c.They are stored permanently in application code
• d.They automatically expire, reducing the risk if they are exposed✓

Temporary credentials from roles expire automatically after a short period, limiting the window of exposure if they are leaked. This is more secure than long-term keys, which remain valid until manually rotated or deleted.

Under the shared responsibility model, AWS is responsible for 'security ___ the cloud,' while the customer is responsible for 'security ___ the cloud.'

• a.around; through
• b.of; of
• c.in; of
• d.of; in✓

AWS secures the cloud infrastructure ('of the cloud'); customers secure what they put in it ('in the cloud'), including data, configuration, and access.

Which of these is always the customer's responsibility regardless of which AWS service is used?

• a.Managing their data, including classification and encryption choices✓
• b.Securing the global network backbone
• c.Maintaining the physical data-center hardware
• d.Maintaining the physical data-center hardware and the underlying hypervisor software

The customer always owns their data and its protection; AWS never assumes responsibility for how customers classify, encrypt, or grant access to data.

For Amazon S3, which security task remains with the customer under the shared responsibility model?

• a.Replacing failed physical storage drives
• b.Configuring bucket policies, access controls, and encryption settings✓
• c.Maintaining the storage facility power
• d.Replacing failed physical storage drives and maintaining the facility power and cooling

With S3, AWS manages the infrastructure and service, but customers must configure access (bucket policies, Block Public Access, IAM) and choose encryption.

Under the shared responsibility model, patching the guest operating system on an EC2 instance is whose responsibility?

• a.AWS's alone
• b.The Region operator's
• c.The customer's✓
• d.No one's; it is fully automatic

For EC2 (IaaS), the customer manages the guest OS, including patches; AWS manages the hypervisor and physical host.

For a fully managed service like AWS Lambda, how does the customer's responsibility differ from EC2?

• a.The customer must patch the underlying servers themselves
• b.The customer must patch the underlying servers, manage the hypervisor, and secure the physical hosts
• c.AWS manages the OS and runtime patching; the customer focuses on code and permissions✓
• d.Responsibility is identical to on-premises hosting

The more managed the service, the more AWS handles; for Lambda, AWS patches the OS and runtime, leaving code, data, and IAM to the customer.

Configuring a security group to restrict inbound traffic to an EC2 instance is whose responsibility?

• a.Shared equally with the ISP
• b.The hardware vendor's
• c.AWS's
• d.The customer's✓

Firewall configuration such as security groups is part of security 'in the cloud,' which the customer controls.

Which task belongs to AWS under the shared responsibility model?

• a.Setting IAM password policies
• b.Encrypting customer application data
• c.Setting IAM password policies and configuring multi-factor authentication for every user
• d.Physical and environmental controls of data centers✓

AWS is responsible for the physical facilities, hardware, and environmental controls; identity and data-protection choices are the customer's.

Who is responsible for the durability of the underlying Amazon S3 infrastructure?

• a.A third-party auditor
• b.The customer
• c.The end user
• d.AWS✓

AWS manages and is responsible for the resilient infrastructure delivering S3's durability; the customer secures what they store and how access is granted.

Which statement about the shared responsibility model is TRUE?

• a.The customer is responsible for everything in all cases
• b.AWS is responsible for everything in all cases
• c.The exact split depends on the specific AWS service being used✓
• d.AWS is responsible for absolutely everything, including the customer's own data and access controls

Responsibility shifts by service type: IaaS puts more on the customer, while managed and serverless services shift more to AWS.

Encrypting sensitive data before storing it and controlling who can access it is an example of which side of the model?

• a.Security of the cloud, which is understood to be entirely AWS's responsibility in every case
• b.Neither party's responsibility
• c.Security in the cloud (customer)✓
• d.The Region's responsibility

Data-protection choices such as encryption and access control are the customer's responsibility, 'in the cloud.'

Who is responsible for decommissioning and physically destroying failed storage media in AWS data centers?

• a.The account's IAM administrator
• b.The customer
• c.The customer's external auditor
• d.AWS✓

AWS handles secure decommissioning and physical destruction of storage media as part of securing the infrastructure.

In the shared responsibility model, which control do customers 'inherit' from AWS?

• a.Customer IAM policy design and the configuration of every security group and network ACL
• b.Customer data classification
• c.Physical and environmental data-center controls✓
• d.Application-level input validation

Customers inherit physical and environmental controls from AWS's audited data centers while retaining responsibility for their own configurations and data.

Why is assuming AWS automatically encrypts all of your data by default in every service a risky assumption?

• a.AWS charges a fee to decrypt customer data
• b.AWS forbids customers from using encryption
• c.Customers must often enable and configure encryption themselves✓
• d.AWS strictly forbids customers from applying any form of encryption to their stored data

While many services make encryption easy, enabling and configuring it is frequently the customer's responsibility; assuming it is automatic can leave data unprotected.

Which is a customer responsibility for identity and access management?

• a.Maintaining the servers that run the IAM service
• b.Creating least-privilege IAM policies and enabling MFA✓
• c.Maintaining the physical servers and networking hardware that run the global IAM service
• d.Patching the AWS Management Console backend

Customers configure IAM (users, groups, roles, policies, MFA) following least privilege; AWS operates the IAM service itself.

Configuring security groups, network ACLs, and encryption in transit for your workloads is classified as what?

• a.Something outside the model
• b.A customer responsibility in the cloud✓
• c.A responsibility that belongs entirely to AWS as part of securing the underlying infrastructure
• d.A responsibility of the DNS provider

Configuring network protection (firewalls, NACLs, TLS) for customer workloads is the customer's job, part of security in the cloud.

What are the three main types of identities you can create and manage in IAM?

• a.Stacks, templates, and drifts
• b.Regions, zones, and edges
• c.Users, groups, and roles✓
• d.Buckets, objects, and keys

IAM manages users (people or apps with long-term credentials), groups (collections of users), and roles (assumed temporarily for short-term credentials).

What is an IAM group?

• a.A collection of IAM users that share the same permissions policies✓
• b.A temporary set of credentials for applications
• c.A billing category for grouping resources
• d.A temporary set of automatically rotating credentials issued to applications and services

An IAM group lets you attach policies once and apply them to all member users; groups cannot be nested and cannot sign in.

Which statement about IAM groups is correct?

• a.Groups have their own sign-in credentials
• b.Groups can be nested inside other groups to build arbitrarily deep permission hierarchies
• c.A user can belong to multiple groups, but groups cannot contain other groups✓
• d.Groups can be nested inside other groups

Users can be members of many groups, but IAM groups cannot be nested and have no credentials of their own.

What does an IAM policy define?

• a.The physical location of the data center and the specific rack that hosts the resource
• b.The physical location of a data center
• c.The billing plan for an account
• d.Which actions are allowed or denied on which resources✓

IAM policies are JSON documents that grant or deny permissions for specific actions and resources, and are attached to users, groups, or roles.

By default, when a new IAM user is created, what permissions do they have?

• a.Full administrator access across every service and resource in the entire account
• b.None until permissions are explicitly granted✓
• c.Root-equivalent permissions
• d.Read access to all services

IAM follows an implicit deny: new users have no permissions until policies granting access are attached, embodying least privilege.