CSLB General Building (B) — All Questions

Under the AWS shared responsibility model, which of the following is AWS responsible for?

• a.Physical security of the data centers and the hardware running the cloud✓
• b.Configuring security groups on the customer's EC2 instances
• c.Managing the customer's IAM user passwords
• d.Encrypting the customer's application data at rest

AWS is responsible for security 'of' the cloud, which includes the physical facilities, hardware, and the global infrastructure. Customers are responsible for security 'in' the cloud, such as configuring security groups, managing IAM, and protecting their data.

Under the shared responsibility model, which task is the customer responsible for?

• a.Maintaining the hypervisor that isolates instances
• b.Replacing failed physical disks in the data center
• c.Managing operating-system patches on their EC2 instances✓
• d.Securing the physical network cabling

For services like EC2, the customer manages the guest operating system, including patching, along with application software and firewall configuration. AWS handles the underlying physical and virtualization infrastructure.

Which AWS service is used to create users, groups, and roles and to control their permissions to AWS resources?

• a.Amazon Cognito
• b.AWS Identity and Access Management (IAM)✓
• c.AWS Shield
• d.Amazon Macie

IAM lets you manage authentication and authorization for AWS by creating users, groups, and roles and attaching policies that grant or deny access. It is the primary service for controlling who can do what in an account.

What is the AWS best practice for the root user of an AWS account?

• a.Use it for all daily administrative tasks
• b.Share its credentials with the whole team
• c.Delete it immediately after account creation
• d.Enable MFA on it and avoid using it for everyday tasks✓

The root user has unrestricted access, so AWS recommends securing it with multi-factor authentication and using it only for the few tasks that require it. Everyday work should be done with IAM users or roles that follow least privilege.

Which security measure adds a second form of verification, such as a code from a device, when signing in to AWS?

• a.Multi-factor authentication (MFA)✓
• b.A larger instance type
• c.A public S3 bucket policy
• d.An Elastic IP address

MFA requires users to present an additional authentication factor, such as a one-time code from a hardware or virtual device, beyond their password. This significantly reduces the risk of compromised credentials.

An application running on an EC2 instance needs to read objects from an S3 bucket. What is the recommended way to grant this access?

• a.Embed long-term access keys in the application code
• b.Make the S3 bucket public
• c.Attach an IAM role to the EC2 instance✓
• d.Share the root user credentials with the instance

Attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials to the application, avoiding hard-coded keys. This follows the principle of least privilege and is far more secure than embedding static keys.

Which principle recommends granting users only the permissions they need to perform their tasks and nothing more?

• a.Defense in depth
• b.Least privilege✓
• c.Separation of billing
• d.Elastic provisioning

The principle of least privilege means giving identities only the minimum permissions required for their job. This limits the potential impact if credentials are compromised or misused.

Which AWS service provides a managed distributed denial-of-service (DDoS) protection for applications running on AWS?

• a.Amazon Inspector
• b.AWS Config
• c.Amazon Macie
• d.AWS Shield✓

AWS Shield is a managed DDoS protection service. Shield Standard is automatically included at no extra cost, while Shield Advanced offers enhanced protection and support for an additional fee.

Which service helps protect web applications from common exploits such as SQL injection and cross-site scripting by filtering HTTP requests?

• a.AWS WAF (Web Application Firewall)✓
• b.AWS Trusted Advisor
• c.Amazon Route 53
• d.AWS Budgets

AWS WAF lets you create rules to filter and monitor HTTP and HTTPS requests, blocking common web exploits like SQL injection and cross-site scripting. It can be attached to services such as CloudFront, ALB, and API Gateway.

Which service uses machine learning to automatically discover and classify sensitive data such as personally identifiable information stored in Amazon S3?

• a.AWS Shield
• b.Amazon GuardDuty
• c.Amazon Macie✓
• d.AWS WAF

Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data, such as PII, in S3. It helps organizations understand where sensitive data resides and monitor its security.

Which service continuously monitors for malicious activity and unauthorized behavior using account and network telemetry such as CloudTrail and VPC flow logs?

• a.AWS Artifact
• b.Amazon GuardDuty✓
• c.AWS Certificate Manager
• d.Amazon Cognito

Amazon GuardDuty is a threat detection service that continuously analyzes logs such as CloudTrail, VPC flow logs, and DNS logs to identify suspicious activity. It generates findings without requiring you to deploy or manage sensors.

Which AWS service records API calls and account activity, providing an audit trail of who did what and when?

• a.Amazon CloudFront
• b.AWS Config
• c.Amazon Inspector
• d.AWS CloudTrail✓

AWS CloudTrail logs API calls and account events across your AWS infrastructure, creating an audit trail useful for governance, compliance, and operational troubleshooting. It answers questions about who made a change and when.

Which service continuously assesses your resource configurations and can evaluate them against desired settings for compliance?

• a.AWS Config✓
• b.AWS Shield
• c.Amazon Macie
• d.AWS WAF

AWS Config records the configuration of your AWS resources over time and can evaluate them against rules to check compliance. It is useful for auditing changes and maintaining a desired configuration state.

Which service provides on-demand access to AWS compliance reports and agreements such as SOC and PCI documents?

• a.Amazon Inspector
• b.AWS Config
• c.AWS Artifact✓
• d.Amazon GuardDuty

AWS Artifact is a self-service portal for on-demand access to AWS security and compliance reports, such as SOC reports and PCI documentation, and to agreements like the Business Associate Addendum. It helps customers meet their own audit requirements.

Which service creates, manages, and controls cryptographic keys used to encrypt data across AWS services?

• a.AWS CloudHSM only
• b.AWS Key Management Service (KMS)✓
• c.Amazon Cognito
• d.AWS WAF

AWS KMS lets you create and manage encryption keys and integrates with many AWS services to encrypt data at rest. It centralizes key management and controls who can use keys through IAM and key policies.

Which service securely stores and automatically rotates database credentials, API keys, and other secrets?

• a.AWS Config
• b.AWS Artifact
• c.Amazon Macie
• d.AWS Secrets Manager✓

AWS Secrets Manager helps you store, retrieve, and automatically rotate secrets such as database credentials and API keys. It removes the need to hard-code sensitive values in application code.

Which service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?

• a.Amazon Inspector✓
• b.AWS Shield
• c.Amazon Cognito
• d.AWS Artifact

Amazon Inspector is an automated vulnerability management service that continuously scans workloads such as EC2 instances and container images for software vulnerabilities and network exposure. It prioritizes findings to help teams remediate risks.

Which service provides sign-up, sign-in, and access control for web and mobile application users, including identity federation?

• a.AWS IAM
• b.AWS KMS
• c.Amazon Cognito✓
• d.AWS Shield

Amazon Cognito provides authentication, authorization, and user management for web and mobile apps, including social and enterprise identity federation. IAM, by contrast, manages access for people and services operating on AWS itself.

In a VPC, which stateful virtual firewall controls inbound and outbound traffic at the instance level?

• a.Network access control list (NACL)
• b.Security group✓
• c.Internet gateway
• d.Route table

A security group acts as a stateful firewall at the instance (ENI) level, where return traffic is automatically allowed. NACLs, by contrast, are stateless firewalls that operate at the subnet level.

Which statement about network ACLs (NACLs) is correct?

• a.They are attached directly to individual instances
• b.They are stateful and automatically allow return traffic
• c.They can only allow traffic and never deny it
• d.They are stateless and operate at the subnet level with allow and deny rules✓

NACLs are stateless firewalls that operate at the subnet boundary and support both allow and deny rules, evaluated in order. Because they are stateless, you must explicitly allow both request and response traffic.

A company wants to centrally manage multiple AWS accounts and apply guardrails that restrict which services accounts can use. Which combination helps?

• a.AWS Organizations with service control policies (SCPs)✓
• b.A single shared IAM user across all accounts
• c.Amazon Macie with WAF rules
• d.Route 53 health checks

AWS Organizations lets you centrally manage many accounts, and service control policies set the maximum permissions available to member accounts. This provides guardrails without granting individual permissions.

What does 'encryption in transit' protect?

• a.Data stored on an EBS volume
• b.Data archived in Amazon S3 Glacier
• c.Data as it moves between a client and a server over the network✓
• d.Data printed to a physical report

Encryption in transit protects data while it travels across networks, typically using TLS, so it cannot be read if intercepted. Encryption at rest, by contrast, protects stored data.

Which AWS service can be used to provision and manage SSL/TLS certificates for use with AWS services like load balancers and CloudFront?

• a.AWS Secrets Manager
• b.AWS Certificate Manager (ACM)✓
• c.Amazon Inspector
• d.AWS Config

AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates, and can handle automatic renewal. This simplifies enabling encryption in transit for supported services.

Which of the following is an IAM best practice?

• a.Attach permissions directly to each individual user
• b.Use the root account for daily API calls
• c.Disable MFA to simplify sign-in
• d.Grant permissions using groups and roles rather than long-term keys where possible✓

IAM best practices include using groups and roles to manage permissions, applying least privilege, enabling MFA, and rotating or avoiding long-term credentials. Managing permissions through groups scales better than per-user policies.

Which service aggregates security findings from services like GuardDuty, Inspector, and Macie into a single dashboard and runs automated best-practice checks?

• a.AWS Security Hub✓
• b.AWS Trusted Advisor
• c.Amazon CloudFront
• d.AWS Direct Connect

AWS Security Hub provides a comprehensive view of security state by aggregating and prioritizing findings from multiple AWS security services and running automated compliance checks. It helps teams manage security posture from one place.

A customer stores objects in Amazon S3 and wants AWS to manage the encryption keys and apply encryption automatically. Which option fits?

• a.Disable encryption entirely
• b.Store keys in the application source code
• c.Server-side encryption with keys managed by AWS (SSE)✓
• d.Only encrypt data after downloading it locally

Server-side encryption lets AWS encrypt object data at rest, with key management handled by S3 or KMS. This provides encryption at rest without the customer having to build their own encryption process.

Which statement best distinguishes an IAM user from an IAM role?

• a.A role always has a permanent password, while a user never does
• b.A user represents a specific identity with long-term credentials, while a role is assumed temporarily by trusted entities✓
• c.Roles can only be used by AWS employees
• d.Users cannot be assigned any permissions

An IAM user is a persistent identity with its own long-term credentials, whereas an IAM role is assumed temporarily and provides short-term credentials to whoever or whatever assumes it. Roles are ideal for granting access to applications, services, or federated users.

According to the shared responsibility model, who is responsible for classifying data and configuring access controls on it?

• a.AWS alone
• b.The internet service provider
• c.No one is responsible
• d.The customer✓

Customers are always responsible for their own data, including classifying it and configuring appropriate access controls and encryption. AWS secures the underlying infrastructure but does not manage the customer's data classification.

Which service would you use to get automated recommendations that include security checks such as identifying publicly accessible resources or missing MFA on the root account?

• a.AWS Trusted Advisor✓
• b.Amazon S3
• c.AWS Lambda
• d.Amazon EC2 Auto Scaling

AWS Trusted Advisor inspects your environment and provides recommendations across categories including security, such as flagging open ports, exposed access keys, or a root account without MFA. It helps improve security posture and follow best practices.

What is the benefit of using temporary security credentials provided by IAM roles instead of long-term access keys?

• a.They never expire, so they are easier to manage
• b.They automatically expire, reducing the risk if they are exposed✓
• c.They grant full administrative access by default
• d.They are stored permanently in application code

Temporary credentials from roles expire automatically after a short period, limiting the window of exposure if they are leaked. This is more secure than long-term keys, which remain valid until manually rotated or deleted.