AWS Cloud Practitioner — All Questions

When an explicit deny and an explicit allow both apply to a request, what happens?

• a.The request is decided at random
• b.The explicit allow always wins
• c.Both are ignored and access errors out
• d.The explicit deny always wins✓

In IAM policy evaluation, an explicit deny overrides any allow; access is granted only if allowed and not explicitly denied.

What is the benefit of using an IAM role for cross-account access instead of sharing credentials?

• a.It disables logging between the accounts
• b.Trusted identities assume the role for temporary access without sharing long-term keys✓
• c.It makes both accounts share one root password
• d.It makes both accounts permanently share a single root password and set of access keys for all users

A role with a trust policy lets identities from another account assume it and receive temporary credentials, avoiding shared long-term keys.

Which IAM mechanism delivers temporary, automatically rotating credentials to an application running on an EC2 instance?

• a.The root user's console password
• b.An instance profile that provides role credentials✓
• c.A hard-coded access key file on disk
• d.A hard-coded, long-term access key file stored directly on the instance's local disk

Attaching a role via an instance profile gives the application temporary credentials from instance metadata, rotated automatically, with no static keys.

Why is multi-factor authentication (MFA) recommended for AWS sign-in?

• a.It completely replaces the need for any password when a user signs in to the account
• b.It grants administrator access faster
• c.It encrypts data at rest automatically
• d.A stolen password alone cannot grant access without the second factor✓

MFA adds a second verification factor (a device code or hardware key), so a compromised password by itself cannot be used to sign in.

Which is an IAM best practice for the AWS account root user?

• a.Create access keys with it for automation
• b.Use it for all daily administrative work
• c.Enable MFA and use it only for the few tasks that require it✓
• d.Use it for all daily administrative work and for routine automation and deployment scripts

The root user should be protected with MFA and used only for the rare tasks that require it; daily work uses least-privilege IAM identities.

Which type of IAM policy is created and maintained by AWS to cover common use cases?

• a.Customer managed policies
• b.Session policies
• c.Inline policies
• d.AWS managed policies✓

AWS managed policies are predefined by AWS for common permission sets; customer managed and inline policies are created by you for finer control.

What is an inline policy in IAM?

• a.A policy embedded directly in a single user, group, or role✓
• b.A policy that only ever affects billing data and cost-allocation reports for the account
• c.A policy shared across all Regions by default
• d.A policy AWS applies to every account automatically

An inline policy is attached to and lives with one specific identity, maintaining a strict one-to-one relationship rather than being reusable.

Which approach best follows least privilege when granting a developer access?

• a.Grant full administrator access for convenience and to avoid any future permission requests
• b.Grant only the specific permissions the developer's tasks require✓
• c.Grant full administrator access for convenience
• d.Give access to every service just in case

Least privilege means granting only the permissions needed for the job, reducing risk if credentials are compromised.

How does AWS IAM Identity Center (successor to AWS SSO) help organizations?

• a.It stores objects for static websites
• b.It removes the need for any encryption
• c.It centrally manages workforce sign-in and access across multiple AWS accounts✓
• d.It stores and serves static website objects and media files from edge locations worldwide

IAM Identity Center provides centralized single sign-on and permission management across many AWS accounts and applications.

What is the recommended alternative to long-term access keys for programmatic access where possible?

• a.Sharing the console password widely
• b.Publishing keys in code repositories
• c.Temporary credentials from IAM roles✓
• d.Using the root user's access keys

Roles provide short-lived credentials that expire automatically, reducing exposure compared with long-term access keys that persist until rotated.

In an IAM policy statement, what does the 'Action' element specify?

• a.The specific API operations being allowed or denied✓
• b.The physical Region and Availability Zone in which the target resource is located
• c.The monetary cost of the operation
• d.The physical Region of the resource

The Action element lists the service operations (for example s3:GetObject) that the statement allows or denies.

Which is TRUE about the account root user compared with IAM users?

• a.Root can be permission-restricted by group policies
• b.IAM users always have more access than root
• c.IAM users always have strictly more access to the account than the root user ever does
• d.The root user has full, unrestricted access that IAM policies cannot limit✓

The root user has complete account access and should be secured with MFA and avoided for daily tasks; IAM users receive only the permissions you grant.

What does enabling an IAM account password policy let an administrator enforce?

• a.Requirements such as minimum length, complexity, and rotation✓
• b.Managed DDoS protection for the account
• c.Automatic encryption of all S3 buckets
• d.Automatic encryption of all S3 buckets and EBS volumes created anywhere in the account

An account password policy sets rules like minimum length, character requirements, expiration, and reuse prevention for IAM users.

Why should you avoid attaching policies directly to individual users at scale?

• a.Users cannot have any policies attached to them
• b.It automatically deletes the user account
• c.Users cannot have any policies attached to them directly under any circumstances at all
• d.Managing permissions through groups and roles is easier to maintain and audit✓

Assigning permissions via groups (or roles) centralizes management and scales better than maintaining per-user policies.

An IAM role's trust policy defines what?

• a.Which principals are allowed to assume the role✓
• b.The billing account charged for the role
• c.The encryption key used by the role
• d.The Region where the role runs

A role has two parts: a permissions policy (what it can do) and a trust policy (who is allowed to assume it).

A mobile app needs users to sign in with an external identity provider and then get temporary AWS access. Which approach fits best?

• a.Embedding long-term access keys in the app
• b.Identity federation so external identities receive temporary AWS credentials✓
• c.Creating a separate long-term IAM user and password for every single application user
• d.Creating an IAM user for every single app user

Federation lets users authenticate with an external identity provider and receive temporary AWS credentials, avoiding an IAM user per person.

What credentials does an IAM user use for programmatic access via the CLI or SDK?

• a.A KMS data key
• b.An SSL certificate from ACM
• c.An access key ID and secret access key✓
• d.A console password only

Programmatic access uses access keys (ID plus secret); the console uses a password, ideally with MFA. Keys should be rotated and never hard-coded.

What is a key security reason to rotate IAM access keys regularly?

• a.It limits how long a leaked key remains usable✓
• b.It speeds up API calls
• c.It increases the account's storage limits
• d.It is required to use the Free Tier

Rotating keys reduces the window during which a compromised key is valid, a standard credential-hygiene practice.

Which IAM feature helps you find and remove unused users, keys, and permissions?

• a.The AWS Pricing Calculator
• b.Amazon CloudFront access logs that are delivered to an S3 bucket for later manual review
• c.The IAM credential report and last-used information✓
• d.Amazon CloudFront access logs

IAM provides a credential report and 'last used' data so you can identify and remove stale users, keys, and permissions.

What does combining least privilege with regular access reviews achieve?

• a.Every user gradually gains admin rights
• b.Permissions stay minimal and are tightened as needs change✓
• c.Permissions can never be changed again
• d.Every user gradually gains full administrator rights over time in an automatic fashion

Granting minimal permissions and reviewing them regularly keeps access aligned to actual needs and reduces attack surface.

Which service would help detect an EC2 instance communicating with a known malicious IP address?

• a.Amazon Macie
• b.AWS Certificate Manager
• c.AWS Artifact
• d.Amazon GuardDuty✓

GuardDuty analyzes logs and threat intelligence to flag activity like communication with known-malicious IPs, without deploying agents.

Which service offers automatic, always-on protection against common network-layer DDoS attacks at no additional cost?

• a.AWS Shield Standard✓
• b.Amazon Inspector
• c.AWS Shield Advanced
• d.AWS WAF

Shield Standard is automatically included for all AWS customers at no extra cost; Shield Advanced adds enhanced protection for a fee.

What additional benefit does AWS Shield Advanced provide over Shield Standard?

• a.Enhanced DDoS protection, cost protection, and access to the DDoS response team✓
• b.Physical security of the data centers
• c.Automatic fixes to application code
• d.Free unlimited compute capacity

Shield Advanced adds protection against larger attacks, DDoS cost protection, and access to the Shield Response Team for an additional fee.

You need to block requests containing SQL-injection patterns before they reach your Application Load Balancer. Which service creates those rules?

• a.AWS WAF✓
• b.Amazon GuardDuty
• c.Amazon Macie
• d.AWS Config

AWS WAF filters HTTP and HTTPS requests with rules, including managed rule groups, to block common exploits on CloudFront, ALB, and API Gateway.

Which service should you use to find personally identifiable information (PII) accidentally stored in S3 buckets?

• a.AWS Shield
• b.Amazon Macie✓
• c.Amazon Inspector
• d.AWS Trusted Advisor

Macie uses machine learning to discover and classify sensitive data such as PII in S3 and alerts you to exposure.

Which service automatically scans your EC2 instances and container images for known software vulnerabilities (CVEs)?

• a.Amazon Cognito
• b.Amazon Inspector✓
• c.AWS Shield
• d.Amazon Macie

Amazon Inspector continuously scans workloads for software vulnerabilities (CVEs) and unintended network exposure, prioritizing findings.

Which service aggregates security findings and runs automated checks against standards like CIS and PCI DSS?

• a.AWS Security Hub✓
• b.Amazon EFS
• c.AWS Direct Connect
• d.Amazon Route 53

Security Hub centralizes findings from GuardDuty, Inspector, and Macie, and runs automated checks against frameworks like CIS and PCI DSS.

Which service records API activity in your account to support security auditing and investigations?

• a.AWS WAF
• b.AWS CloudTrail✓
• c.Amazon CloudWatch metrics
• d.AWS Artifact

CloudTrail logs API calls and events, providing an audit trail of who did what, when, and from where, essential for investigations and compliance.

What is the difference between AWS CloudTrail and Amazon CloudWatch?

• a.CloudTrail encrypts data while CloudWatch stores backups
• b.CloudTrail is for billing and CloudWatch is for DNS
• c.CloudTrail records API activity for auditing; CloudWatch monitors metrics, logs, and alarms✓
• d.They are the same service under two names

CloudTrail answers 'who did what' (audit); CloudWatch answers 'how is it performing' (metrics, logs, alarms).

Which service continuously monitors and records resource configuration changes to assess compliance over time?

• a.Amazon SNS
• b.AWS Shield
• c.AWS Config✓
• d.Amazon Macie

AWS Config tracks configuration changes and evaluates resources against rules, giving a history useful for compliance and troubleshooting.

Which service uses machine learning to analyze VPC Flow Logs, DNS logs, and CloudTrail events for threats?

• a.AWS Config
• b.Amazon ElastiCache
• c.AWS Artifact
• d.Amazon GuardDuty✓

GuardDuty ingests these data sources and applies ML and threat intelligence to surface findings such as compromised instances or reconnaissance.

Which service gives automated best-practice recommendations across security, cost, performance, fault tolerance, and service limits?

• a.AWS CloudFormation
• b.AWS Secrets Manager
• c.Amazon Inspector
• d.AWS Trusted Advisor✓

Trusted Advisor inspects your environment and recommends improvements across five categories, including security checks like exposed keys and open ports.

A security check flags that your S3 bucket is publicly accessible. Which feature can prevent public access at the account or bucket level?

• a.S3 Transfer Acceleration
• b.S3 Block Public Access✓
• c.S3 Requester Pays
• d.S3 Versioning

S3 Block Public Access settings override permissive policies and ACLs to keep buckets private, guarding against accidental public exposure.

Which managed service centrally configures and enforces firewall rules such as WAF and security-group policies across accounts in an organization?

• a.Amazon CloudFront
• b.AWS Snowball
• c.Amazon Athena
• d.AWS Firewall Manager✓

AWS Firewall Manager centrally applies and enforces WAF rules, Shield Advanced protections, and security-group policies across an AWS Organization.

Which service provides a managed, stateful firewall for filtering traffic entering and leaving a VPC?

• a.Amazon Macie
• b.AWS Artifact
• c.AWS Cost Explorer
• d.AWS Network Firewall✓

AWS Network Firewall is a managed, stateful firewall for VPCs, providing intrusion prevention and traffic filtering at the network perimeter.

What is a primary use of Amazon Detective?

• a.To provision virtual servers on demand
• b.To analyze and investigate the root cause of security findings✓
• c.To deliver content from edge locations
• d.To provision and automatically scale fleets of virtual servers across many Regions

Amazon Detective automatically collects and correlates data to help you analyze and investigate the root cause of potential security issues.

Which statement about AWS WAF managed rules is accurate?

• a.They fully replace the need for IAM
• b.They are used only for billing alerts
• c.They provide physical data-center security
• d.They are preconfigured rule groups maintained to address common threats✓

AWS Managed Rules for WAF offer curated, maintained rule groups, reducing the effort of writing rules yourself.

An organization wants a single, consolidated view of its security posture across many accounts. Which service is designed for this?

• a.Amazon EC2 Auto Scaling
• b.AWS Security Hub✓
• c.Amazon Redshift
• d.AWS Direct Connect

Security Hub provides a consolidated, cross-account view of security and compliance state, aggregating findings and standards checks.

Which service can filter malicious bot and scraping traffic in addition to common web exploits?

• a.AWS WAF with Bot Control✓
• b.Amazon EBS snapshots
• c.Amazon Kinesis
• d.AWS Snowmobile

AWS WAF, including its Bot Control managed rule group, can filter malicious bot traffic and common web exploits at the application layer.

In terms of security controls, what kind of service is Amazon GuardDuty?

• a.A physical control for data centers
• b.A preventive control that blocks all traffic
• c.A billing optimization control
• d.A detective control that identifies threats✓

GuardDuty is a detective control: it detects and alerts on suspicious activity but does not itself block traffic; remediation is handled separately.

What is the difference between encryption at rest and encryption in transit?

• a.At rest uses TLS while in transit uses disk encryption
• b.At rest protects stored data; in transit protects data moving across networks✓
• c.At rest is for backups and in transit is for billing
• d.They are two names for the same thing

Encryption at rest secures data on disk or storage; encryption in transit (typically TLS) secures data as it travels between systems.

Which service lets you create and control the encryption keys used to protect data, integrated across many AWS services?

• a.AWS Trusted Advisor
• b.AWS Artifact
• c.AWS Key Management Service (KMS)✓
• d.Amazon Macie

AWS KMS centrally creates, manages, and controls cryptographic keys, integrating with services like S3, EBS, and RDS for encryption at rest.

What is a benefit of using AWS KMS-managed keys for encryption?

• a.Centralized key control tied to IAM and key policies, with usage logged for audit✓
• b.Keys are stored in your application source code
• c.Keys are embedded directly in your application source code and shared with every developer
• d.It removes the need for any access control

KMS centralizes key control, ties usage to IAM and key policies, and logs key use in CloudTrail for auditing.

Which service provides dedicated, single-tenant hardware security modules for managing your own encryption keys to meet strict compliance?

• a.Amazon Cognito
• b.AWS Config
• c.Amazon Inspector
• d.AWS CloudHSM✓

AWS CloudHSM offers dedicated hardware security modules for customers needing exclusive control of keys for compliance; KMS is the more managed option.

For Amazon S3, which option encrypts objects using keys fully managed by AWS with no customer key management?

• a.Encryption only after you download objects
• b.Client-side encryption with your own library
• c.Server-side encryption with S3-managed keys (SSE-S3)✓
• d.No encryption at all

SSE-S3 has S3 manage the encryption keys and process automatically; SSE-KMS uses KMS keys, and client-side encryption is done before upload.

What is the main difference between SSE-KMS and SSE-S3 for S3 encryption?

• a.SSE-KMS uses AWS KMS keys, adding control and audit logging of key use✓
• b.There is no difference between them
• c.SSE-S3 is not actually encryption
• d.SSE-KMS stores the data unencrypted

Both encrypt at rest, but SSE-KMS uses KMS keys, adding key policies, usage permissions, and CloudTrail auditing of key use.

Which service manages and can automatically renew SSL/TLS certificates for AWS services to enable encryption in transit?

• a.AWS Config
• b.AWS Certificate Manager (ACM)✓
• c.Amazon Macie
• d.AWS Secrets Manager

ACM provisions, manages, and auto-renews TLS certificates for services like ELB, CloudFront, and API Gateway, simplifying encryption in transit.

What does client-side encryption mean?

• a.AWS encrypts the data only after storing it
• b.The data is never actually encrypted
• c.Data is encrypted by the customer before it is sent to AWS✓
• d.Only AWS ever holds the keys

With client-side encryption you encrypt data locally before uploading, so it is already encrypted in transit and at rest, and you control the keys.

Which service is best for storing and automatically rotating database credentials and API keys?

• a.Amazon GuardDuty
• b.AWS Artifact
• c.AWS Shield
• d.AWS Secrets Manager✓

Secrets Manager securely stores secrets and can automatically rotate them (for example RDS credentials), removing hard-coded secrets from code.

How does AWS Systems Manager Parameter Store relate to storing configuration and secrets?

• a.It provisions and manages fleets of physical servers dedicated entirely to your workloads
• b.It securely stores configuration data and secrets, optionally encrypted with KMS✓
• c.It replaces the need for IAM roles
• d.It provisions physical servers on demand

Parameter Store holds configuration values and secrets (SecureString via KMS); Secrets Manager adds built-in rotation for secrets specifically.