AWS Cloud Practitioner — All Questions

A customer needs full ownership and control of key material for regulatory reasons, with dedicated hardware. Which is most appropriate?

• a.Amazon CloudFront
• b.AWS Trusted Advisor
• c.SSE-S3
• d.AWS CloudHSM✓

CloudHSM provides dedicated hardware security modules giving customers exclusive control of keys for strict compliance; managed KMS is simpler but shared.

Why is encrypting data both at rest and in transit considered defense in depth?

• a.It protects data in multiple states so a single failure does not expose it✓
• b.It makes data impossible to ever read again
• c.It removes the need for any access control
• d.It is required only to use the Free Tier

Layering encryption across storage and network states means data stays protected even if one layer is bypassed, an example of defense in depth.

Which service provides on-demand downloads of AWS compliance reports such as SOC and ISO certifications?

• a.Amazon Inspector
• b.AWS Shield
• c.AWS Config
• d.AWS Artifact✓

AWS Artifact is a self-service portal to download AWS audit reports (SOC, ISO, PCI) and manage agreements, helping customers meet compliance needs.

In the shared responsibility model, AWS compliance certifications such as ISO 27001 cover what?

• a.The security and compliance of the underlying cloud infrastructure✓
• b.The customer's IAM policies
• c.The customer's application source code
• d.The customer's data classification decisions

AWS certifications attest to the infrastructure AWS manages; customers still must achieve compliance for their own workloads and data built on top.

What does AWS Organizations enable?

• a.Automatic application development
• b.Physical access to data centers
• c.Central management and consolidated billing for multiple AWS accounts✓
• d.Free unlimited compute for all accounts

AWS Organizations lets you centrally manage multiple accounts, apply policies, and consolidate billing across the organization.

What is a service control policy (SCP) in AWS Organizations?

• a.A network routing rule
• b.A guardrail that sets the maximum permissions available to member accounts✓
• c.A policy that grants permissions directly to users
• d.A billing discount agreement

SCPs define the ceiling of allowed actions for accounts or organizational units; they restrict but do not by themselves grant permissions, which IAM still does.

An SCP denies use of a service in an organizational unit, but a user there has an IAM policy allowing it. What is the result?

• a.The two cancel out and access is random
• b.Access is denied because the SCP caps the maximum allowed permissions✓
• c.The user account is automatically deleted
• d.Access is allowed because IAM overrides SCPs

Effective permissions are the intersection of SCPs and IAM policies; if an SCP denies an action, no IAM policy can grant it.

How can grouping accounts into organizational units (OUs) help governance?

• a.It gives every account root access
• b.It disables billing for the accounts
• c.It removes all IAM controls
• d.You can apply policies like SCPs to many accounts at once by OU✓

OUs let you organize accounts hierarchically and apply consistent guardrails (SCPs) to groups of accounts, simplifying governance at scale.

A healthcare company needs to review and accept the Business Associate Addendum (BAA) for HIPAA. Where can it manage that agreement?

• a.AWS Artifact✓
• b.Amazon CloudFront
• c.Amazon SQS
• d.AWS Lambda

AWS Artifact provides compliance reports and lets customers review and accept agreements such as the BAA for HIPAA.

What is a governance benefit of consolidated billing in AWS Organizations?

• a.One payer with organization-wide visibility while accounts stay isolated✓
• b.It disables CloudTrail for all accounts
• c.It makes all account data public
• d.It merges all IAM users into a single user

Consolidated billing gives one bill and organization-wide cost visibility while accounts remain isolated for security, and can earn volume discounts.

Which practice supports a strong multi-account strategy on AWS?

• a.Disabling CloudTrail organization-wide
• b.Running everything in the root account
• c.Sharing one IAM user everywhere
• d.Separating prod and dev into different accounts with SCP guardrails✓

Isolating environments into separate accounts under Organizations, with SCP guardrails and centralized logging, limits blast radius and improves governance.

AWS Compliance Programs and certifications primarily help customers do what?

• a.Avoid all of their own compliance obligations
• b.Get free AWS promotional credits
• c.Bypass encryption requirements entirely
• d.Meet their own audit requirements by relying on AWS's audited controls✓

AWS's compliance programs provide audited assurance for the infrastructure, which customers use as a foundation for their own compliance; responsibility is shared.

Which statement correctly contrasts security groups with network ACLs?

• a.NACLs are stateful and attach to instances
• b.Security groups work only at the subnet level
• c.Security groups are stateful at the instance level; NACLs are stateless at the subnet level✓
• d.Both are stateless and behave identically

Security groups are stateful instance-level firewalls (return traffic auto-allowed); NACLs are stateless subnet-level filters needing explicit rules both ways.

How does enabling Amazon S3 Versioning help protect data?

• a.It blocks all public access to the bucket
• b.It reduces storage cost to zero
• c.It preserves previous versions so you can recover from accidental deletes or overwrites✓
• d.It encrypts the entire bucket automatically

Versioning keeps prior object versions, protecting against accidental or malicious deletion and overwrites; it pairs well with MFA Delete.

What does enabling MFA Delete on an S3 bucket require?

• a.A Reserved Instance purchase
• b.A public bucket policy
• c.An MFA code to permanently delete versions or change the versioning state✓
• d.A larger EC2 instance type

MFA Delete adds a requirement for a multi-factor code before permanently deleting versions, guarding critical data against unauthorized deletion.

Which practice helps protect critical workloads against accidental data loss?

• a.Turning off encryption entirely
• b.Regular backups plus cross-Region or cross-account copies✓
• c.Storing a single copy in one AZ only
• d.Disabling all logging to save cost

Maintaining backups and copies across Regions or accounts improves durability and recoverability, supporting both reliability and data protection.

What is a security use of Amazon CloudWatch alarms?

• a.Alerting or triggering actions when metrics cross thresholds, such as unusual activity✓
• b.Physically securing the data centers and destroying decommissioned storage media on site
• c.Physically securing the data centers
• d.Provisioning IAM users automatically

CloudWatch alarms can notify teams or trigger automated responses when metrics (like failed logins or CPU spikes) breach thresholds, aiding detection.

Which combination provides an audit trail plus alerting and threat detection for account activity?

• a.Route 53 combined with CloudFront
• b.Only an S3 bucket with public access enabled
• c.CloudTrail for API logging with CloudWatch alarms and GuardDuty for detection✓
• d.EBS snapshots used entirely on their own

CloudTrail records activity, CloudWatch alarms on patterns, and GuardDuty adds ML-based threat detection, together supporting monitoring and response.

What does the principle of 'defense in depth' mean for securing AWS workloads?

• a.Granting broad permissions to move faster
• b.Applying multiple layers of security controls so no single failure is catastrophic✓
• c.Encrypting nothing in order to save cost
• d.Relying on one strong firewall and nothing else

Defense in depth layers controls (network, identity, encryption, monitoring) so that if one control fails, others still protect the workload.

A company wants to ensure only encrypted connections reach its application. Which approach helps enforce encryption in transit?

• a.Disable certificates entirely
• b.Store keys in the web page source
• c.Require HTTPS/TLS with ACM certificates and redirect HTTP to HTTPS✓
• d.Allow only unencrypted HTTP traffic

Enforcing TLS with ACM-managed certificates and redirecting HTTP to HTTPS ensures data in transit is encrypted between clients and the application.