AWS Cloud Practitioner — All Questions

Under the AWS shared responsibility model, which of the following is AWS responsible for?

• a.Encrypting the customer's application data at rest
• b.Physical security of the data centers and the hardware running the cloud✓
• c.Managing the customer's IAM user passwords
• d.Configuring security groups on the customer's EC2 instances

AWS is responsible for security 'of' the cloud, which includes the physical facilities, hardware, and the global infrastructure. Customers are responsible for security 'in' the cloud, such as configuring security groups, managing IAM, and protecting their data.

Under the shared responsibility model, which task is the customer responsible for?

• a.Replacing failed physical disks in the data center
• b.Maintaining the hypervisor that isolates instances
• c.Managing operating-system patches on their EC2 instances✓
• d.Securing the physical network cabling

For services like EC2, the customer manages the guest operating system, including patching, along with application software and firewall configuration. AWS handles the underlying physical and virtualization infrastructure.

Which AWS service is used to create users, groups, and roles and to control their permissions to AWS resources?

• a.Amazon Macie
• b.AWS Identity and Access Management (IAM)✓
• c.AWS Shield
• d.Amazon Cognito

IAM lets you manage authentication and authorization for AWS by creating users, groups, and roles and attaching policies that grant or deny access. It is the primary service for controlling who can do what in an account.

What is the AWS best practice for the root user of an AWS account?

• a.Share its credentials with the whole team
• b.Delete it immediately after account creation
• c.Enable MFA on it and avoid using it for everyday tasks✓
• d.Use it for all daily administrative tasks

The root user has unrestricted access, so AWS recommends securing it with multi-factor authentication and using it only for the few tasks that require it. Everyday work should be done with IAM users or roles that follow least privilege.

Which security measure adds a second form of verification, such as a code from a device, when signing in to AWS?

• a.An Elastic IP address
• b.Multi-factor authentication (MFA)✓
• c.A larger instance type
• d.A public S3 bucket policy

MFA requires users to present an additional authentication factor, such as a one-time code from a hardware or virtual device, beyond their password. This significantly reduces the risk of compromised credentials.

An application running on an EC2 instance needs to read objects from an S3 bucket. What is the recommended way to grant this access?

• a.Embed long-term access keys in the application code
• b.Attach an IAM role to the EC2 instance✓
• c.Share the root user credentials with the instance
• d.Make the S3 bucket public

Attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials to the application, avoiding hard-coded keys. This follows the principle of least privilege and is far more secure than embedding static keys.

Which principle recommends granting users only the permissions they need to perform their tasks and nothing more?

• a.Elastic provisioning
• b.Defense in depth
• c.Separation of billing
• d.Least privilege✓

The principle of least privilege means giving identities only the minimum permissions required for their job. This limits the potential impact if credentials are compromised or misused.

Which AWS service provides a managed distributed denial-of-service (DDoS) protection for applications running on AWS?

• a.AWS Shield✓
• b.Amazon Inspector
• c.AWS Config
• d.Amazon Macie

AWS Shield is a managed DDoS protection service. Shield Standard is automatically included at no extra cost, while Shield Advanced offers enhanced protection and support for an additional fee.

Which service helps protect web applications from common exploits such as SQL injection and cross-site scripting by filtering HTTP requests?

• a.Amazon Route 53
• b.AWS Trusted Advisor
• c.AWS WAF (Web Application Firewall)✓
• d.AWS Budgets

AWS WAF lets you create rules to filter and monitor HTTP and HTTPS requests, blocking common web exploits like SQL injection and cross-site scripting. It can be attached to services such as CloudFront, ALB, and API Gateway.

Which service uses machine learning to automatically discover and classify sensitive data such as personally identifiable information stored in Amazon S3?

• a.AWS Shield
• b.Amazon Macie✓
• c.Amazon GuardDuty
• d.AWS WAF

Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data, such as PII, in S3. It helps organizations understand where sensitive data resides and monitor its security.

Which service continuously monitors for malicious activity and unauthorized behavior using account and network telemetry such as CloudTrail and VPC flow logs?

• a.AWS Certificate Manager
• b.AWS Artifact
• c.Amazon Cognito
• d.Amazon GuardDuty✓

Amazon GuardDuty is a threat detection service that continuously analyzes logs such as CloudTrail, VPC flow logs, and DNS logs to identify suspicious activity. It generates findings without requiring you to deploy or manage sensors.

Which AWS service records API calls and account activity, providing an audit trail of who did what and when?

• a.Amazon CloudFront
• b.AWS CloudTrail✓
• c.AWS Config
• d.Amazon Inspector

AWS CloudTrail logs API calls and account events across your AWS infrastructure, creating an audit trail useful for governance, compliance, and operational troubleshooting. It answers questions about who made a change and when.

Which service continuously assesses your resource configurations and can evaluate them against desired settings for compliance?

• a.AWS Config✓
• b.AWS WAF
• c.Amazon Macie
• d.AWS Shield

AWS Config records the configuration of your AWS resources over time and can evaluate them against rules to check compliance. It is useful for auditing changes and maintaining a desired configuration state.

Which service provides on-demand access to AWS compliance reports and agreements such as SOC and PCI documents?

• a.AWS Config
• b.AWS Artifact✓
• c.Amazon GuardDuty
• d.Amazon Inspector

AWS Artifact is a self-service portal for on-demand access to AWS security and compliance reports, such as SOC reports and PCI documentation, and to agreements like the Business Associate Addendum. It helps customers meet their own audit requirements.

Which service creates, manages, and controls cryptographic keys used to encrypt data across AWS services?

• a.AWS Key Management Service (KMS)✓
• b.Amazon Cognito
• c.AWS CloudHSM only
• d.AWS WAF

AWS KMS lets you create and manage encryption keys and integrates with many AWS services to encrypt data at rest. It centralizes key management and controls who can use keys through IAM and key policies.

Which service securely stores and automatically rotates database credentials, API keys, and other secrets?

• a.AWS Secrets Manager✓
• b.AWS Artifact
• c.Amazon Macie
• d.AWS Config

AWS Secrets Manager helps you store, retrieve, and automatically rotate secrets such as database credentials and API keys. It removes the need to hard-code sensitive values in application code.

Which service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?

• a.AWS Artifact
• b.Amazon Inspector✓
• c.AWS Shield
• d.Amazon Cognito

Amazon Inspector is an automated vulnerability management service that continuously scans workloads such as EC2 instances and container images for software vulnerabilities and network exposure. It prioritizes findings to help teams remediate risks.

Which service provides sign-up, sign-in, and access control for web and mobile application users, including identity federation?

• a.AWS IAM
• b.AWS Shield
• c.Amazon Cognito✓
• d.AWS KMS

Amazon Cognito provides authentication, authorization, and user management for web and mobile apps, including social and enterprise identity federation. IAM, by contrast, manages access for people and services operating on AWS itself.

In a VPC, which stateful virtual firewall controls inbound and outbound traffic at the instance level?

• a.Network access control list (NACL)
• b.Route table
• c.Security group✓
• d.Internet gateway

A security group acts as a stateful firewall at the instance (ENI) level, where return traffic is automatically allowed. NACLs, by contrast, are stateless firewalls that operate at the subnet level.

Which statement about network ACLs (NACLs) is correct?

• a.They are stateful and automatically allow return traffic
• b.They are attached directly to individual instances
• c.They are stateless and operate at the subnet level with allow and deny rules✓
• d.They can only allow traffic and never deny it

NACLs are stateless firewalls that operate at the subnet boundary and support both allow and deny rules, evaluated in order. Because they are stateless, you must explicitly allow both request and response traffic.

A company wants to centrally manage multiple AWS accounts and apply guardrails that restrict which services accounts can use. Which combination helps?

• a.A single shared IAM user across all accounts
• b.AWS Organizations with service control policies (SCPs)✓
• c.Route 53 health checks
• d.Amazon Macie with WAF rules

AWS Organizations lets you centrally manage many accounts, and service control policies set the maximum permissions available to member accounts. This provides guardrails without granting individual permissions.

What does 'encryption in transit' protect?

• a.Data stored on an EBS volume
• b.Data archived in Amazon S3 Glacier
• c.Data printed to a physical report
• d.Data as it moves between a client and a server over the network✓

Encryption in transit protects data while it travels across networks, typically using TLS, so it cannot be read if intercepted. Encryption at rest, by contrast, protects stored data.

Which AWS service can be used to provision and manage SSL/TLS certificates for use with AWS services like load balancers and CloudFront?

• a.AWS Certificate Manager (ACM)✓
• b.AWS Config
• c.AWS Secrets Manager
• d.Amazon Inspector

AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates, and can handle automatic renewal. This simplifies enabling encryption in transit for supported services.

Which of the following is an IAM best practice?

• a.Disable MFA to simplify sign-in
• b.Use the root account for daily API calls
• c.Attach permissions directly to each individual user
• d.Grant permissions using groups and roles rather than long-term keys where possible✓

IAM best practices include using groups and roles to manage permissions, applying least privilege, enabling MFA, and rotating or avoiding long-term credentials. Managing permissions through groups scales better than per-user policies.

Which service aggregates security findings from services like GuardDuty, Inspector, and Macie into a single dashboard and runs automated best-practice checks?

• a.AWS Security Hub✓
• b.AWS Direct Connect
• c.Amazon CloudFront
• d.AWS Trusted Advisor

AWS Security Hub provides a comprehensive view of security state by aggregating and prioritizing findings from multiple AWS security services and running automated compliance checks. It helps teams manage security posture from one place.

A customer stores objects in Amazon S3 and wants AWS to manage the encryption keys and apply encryption automatically. Which option fits?

• a.Only encrypt data after downloading it locally
• b.Server-side encryption with keys managed by AWS (SSE)✓
• c.Disable encryption entirely
• d.Store keys in the application source code

Server-side encryption lets AWS encrypt object data at rest, with key management handled by S3 or KMS. This provides encryption at rest without the customer having to build their own encryption process.

Which statement best distinguishes an IAM user from an IAM role?

• a.A role always has a permanent password, while a user never does
• b.Roles can only be used by AWS employees
• c.Users cannot be assigned any permissions
• d.A user represents a specific identity with long-term credentials, while a role is assumed temporarily by trusted entities✓

An IAM user is a persistent identity with its own long-term credentials, whereas an IAM role is assumed temporarily and provides short-term credentials to whoever or whatever assumes it. Roles are ideal for granting access to applications, services, or federated users.

According to the shared responsibility model, who is responsible for classifying data and configuring access controls on it?

• a.No one is responsible
• b.The customer✓
• c.AWS alone
• d.The internet service provider

Customers are always responsible for their own data, including classifying it and configuring appropriate access controls and encryption. AWS secures the underlying infrastructure but does not manage the customer's data classification.

Which service would you use to get automated recommendations that include security checks such as identifying publicly accessible resources or missing MFA on the root account?

• a.AWS Trusted Advisor✓
• b.AWS Lambda
• c.Amazon EC2 Auto Scaling
• d.Amazon S3

AWS Trusted Advisor inspects your environment and provides recommendations across categories including security, such as flagging open ports, exposed access keys, or a root account without MFA. It helps improve security posture and follow best practices.

What is the benefit of using temporary security credentials provided by IAM roles instead of long-term access keys?

• a.They never expire, so they are easier to manage
• b.They grant full administrative access by default
• c.They are stored permanently in application code
• d.They automatically expire, reducing the risk if they are exposed✓

Temporary credentials from roles expire automatically after a short period, limiting the window of exposure if they are leaked. This is more secure than long-term keys, which remain valid until manually rotated or deleted.

Under the shared responsibility model, AWS is responsible for 'security ___ the cloud,' while the customer is responsible for 'security ___ the cloud.'

• a.around; through
• b.of; of
• c.in; of
• d.of; in✓

AWS secures the cloud infrastructure ('of the cloud'); customers secure what they put in it ('in the cloud'), including data, configuration, and access.

Which of these is always the customer's responsibility regardless of which AWS service is used?

• a.Managing their data, including classification and encryption choices✓
• b.Securing the global network backbone
• c.Maintaining the physical data-center hardware
• d.Maintaining the physical data-center hardware and the underlying hypervisor software

The customer always owns their data and its protection; AWS never assumes responsibility for how customers classify, encrypt, or grant access to data.

For Amazon S3, which security task remains with the customer under the shared responsibility model?

• a.Replacing failed physical storage drives
• b.Configuring bucket policies, access controls, and encryption settings✓
• c.Maintaining the storage facility power
• d.Replacing failed physical storage drives and maintaining the facility power and cooling

With S3, AWS manages the infrastructure and service, but customers must configure access (bucket policies, Block Public Access, IAM) and choose encryption.

Under the shared responsibility model, patching the guest operating system on an EC2 instance is whose responsibility?

• a.AWS's alone
• b.The Region operator's
• c.The customer's✓
• d.No one's; it is fully automatic

For EC2 (IaaS), the customer manages the guest OS, including patches; AWS manages the hypervisor and physical host.

For a fully managed service like AWS Lambda, how does the customer's responsibility differ from EC2?

• a.The customer must patch the underlying servers themselves
• b.The customer must patch the underlying servers, manage the hypervisor, and secure the physical hosts
• c.AWS manages the OS and runtime patching; the customer focuses on code and permissions✓
• d.Responsibility is identical to on-premises hosting

The more managed the service, the more AWS handles; for Lambda, AWS patches the OS and runtime, leaving code, data, and IAM to the customer.

Configuring a security group to restrict inbound traffic to an EC2 instance is whose responsibility?

• a.Shared equally with the ISP
• b.The hardware vendor's
• c.AWS's
• d.The customer's✓

Firewall configuration such as security groups is part of security 'in the cloud,' which the customer controls.

Which task belongs to AWS under the shared responsibility model?

• a.Setting IAM password policies
• b.Encrypting customer application data
• c.Setting IAM password policies and configuring multi-factor authentication for every user
• d.Physical and environmental controls of data centers✓

AWS is responsible for the physical facilities, hardware, and environmental controls; identity and data-protection choices are the customer's.

Who is responsible for the durability of the underlying Amazon S3 infrastructure?

• a.A third-party auditor
• b.The customer
• c.The end user
• d.AWS✓

AWS manages and is responsible for the resilient infrastructure delivering S3's durability; the customer secures what they store and how access is granted.

Which statement about the shared responsibility model is TRUE?

• a.The customer is responsible for everything in all cases
• b.AWS is responsible for everything in all cases
• c.The exact split depends on the specific AWS service being used✓
• d.AWS is responsible for absolutely everything, including the customer's own data and access controls

Responsibility shifts by service type: IaaS puts more on the customer, while managed and serverless services shift more to AWS.

Encrypting sensitive data before storing it and controlling who can access it is an example of which side of the model?

• a.Security of the cloud, which is understood to be entirely AWS's responsibility in every case
• b.Neither party's responsibility
• c.Security in the cloud (customer)✓
• d.The Region's responsibility

Data-protection choices such as encryption and access control are the customer's responsibility, 'in the cloud.'

Who is responsible for decommissioning and physically destroying failed storage media in AWS data centers?

• a.The account's IAM administrator
• b.The customer
• c.The customer's external auditor
• d.AWS✓

AWS handles secure decommissioning and physical destruction of storage media as part of securing the infrastructure.

In the shared responsibility model, which control do customers 'inherit' from AWS?

• a.Customer IAM policy design and the configuration of every security group and network ACL
• b.Customer data classification
• c.Physical and environmental data-center controls✓
• d.Application-level input validation

Customers inherit physical and environmental controls from AWS's audited data centers while retaining responsibility for their own configurations and data.

Why is assuming AWS automatically encrypts all of your data by default in every service a risky assumption?

• a.AWS charges a fee to decrypt customer data
• b.AWS forbids customers from using encryption
• c.Customers must often enable and configure encryption themselves✓
• d.AWS strictly forbids customers from applying any form of encryption to their stored data

While many services make encryption easy, enabling and configuring it is frequently the customer's responsibility; assuming it is automatic can leave data unprotected.

Which is a customer responsibility for identity and access management?

• a.Maintaining the servers that run the IAM service
• b.Creating least-privilege IAM policies and enabling MFA✓
• c.Maintaining the physical servers and networking hardware that run the global IAM service
• d.Patching the AWS Management Console backend

Customers configure IAM (users, groups, roles, policies, MFA) following least privilege; AWS operates the IAM service itself.

Configuring security groups, network ACLs, and encryption in transit for your workloads is classified as what?

• a.Something outside the model
• b.A customer responsibility in the cloud✓
• c.A responsibility that belongs entirely to AWS as part of securing the underlying infrastructure
• d.A responsibility of the DNS provider

Configuring network protection (firewalls, NACLs, TLS) for customer workloads is the customer's job, part of security in the cloud.

What are the three main types of identities you can create and manage in IAM?

• a.Stacks, templates, and drifts
• b.Regions, zones, and edges
• c.Users, groups, and roles✓
• d.Buckets, objects, and keys

IAM manages users (people or apps with long-term credentials), groups (collections of users), and roles (assumed temporarily for short-term credentials).

What is an IAM group?

• a.A collection of IAM users that share the same permissions policies✓
• b.A temporary set of credentials for applications
• c.A billing category for grouping resources
• d.A temporary set of automatically rotating credentials issued to applications and services

An IAM group lets you attach policies once and apply them to all member users; groups cannot be nested and cannot sign in.

Which statement about IAM groups is correct?

• a.Groups have their own sign-in credentials
• b.Groups can be nested inside other groups to build arbitrarily deep permission hierarchies
• c.A user can belong to multiple groups, but groups cannot contain other groups✓
• d.Groups can be nested inside other groups

Users can be members of many groups, but IAM groups cannot be nested and have no credentials of their own.

What does an IAM policy define?

• a.The physical location of the data center and the specific rack that hosts the resource
• b.The physical location of a data center
• c.The billing plan for an account
• d.Which actions are allowed or denied on which resources✓

IAM policies are JSON documents that grant or deny permissions for specific actions and resources, and are attached to users, groups, or roles.

By default, when a new IAM user is created, what permissions do they have?

• a.Full administrator access across every service and resource in the entire account
• b.None until permissions are explicitly granted✓
• c.Root-equivalent permissions
• d.Read access to all services

IAM follows an implicit deny: new users have no permissions until policies granting access are attached, embodying least privilege.

When an explicit deny and an explicit allow both apply to a request, what happens?

• a.The request is decided at random
• b.The explicit allow always wins
• c.Both are ignored and access errors out
• d.The explicit deny always wins✓

In IAM policy evaluation, an explicit deny overrides any allow; access is granted only if allowed and not explicitly denied.

What is the benefit of using an IAM role for cross-account access instead of sharing credentials?

• a.It disables logging between the accounts
• b.Trusted identities assume the role for temporary access without sharing long-term keys✓
• c.It makes both accounts share one root password
• d.It makes both accounts permanently share a single root password and set of access keys for all users

A role with a trust policy lets identities from another account assume it and receive temporary credentials, avoiding shared long-term keys.

Which IAM mechanism delivers temporary, automatically rotating credentials to an application running on an EC2 instance?

• a.The root user's console password
• b.An instance profile that provides role credentials✓
• c.A hard-coded access key file on disk
• d.A hard-coded, long-term access key file stored directly on the instance's local disk

Attaching a role via an instance profile gives the application temporary credentials from instance metadata, rotated automatically, with no static keys.

Why is multi-factor authentication (MFA) recommended for AWS sign-in?

• a.It completely replaces the need for any password when a user signs in to the account
• b.It grants administrator access faster
• c.It encrypts data at rest automatically
• d.A stolen password alone cannot grant access without the second factor✓

MFA adds a second verification factor (a device code or hardware key), so a compromised password by itself cannot be used to sign in.

Which is an IAM best practice for the AWS account root user?

• a.Create access keys with it for automation
• b.Use it for all daily administrative work
• c.Enable MFA and use it only for the few tasks that require it✓
• d.Use it for all daily administrative work and for routine automation and deployment scripts

The root user should be protected with MFA and used only for the rare tasks that require it; daily work uses least-privilege IAM identities.

Which type of IAM policy is created and maintained by AWS to cover common use cases?

• a.Customer managed policies
• b.Session policies
• c.Inline policies
• d.AWS managed policies✓

AWS managed policies are predefined by AWS for common permission sets; customer managed and inline policies are created by you for finer control.

What is an inline policy in IAM?

• a.A policy embedded directly in a single user, group, or role✓
• b.A policy that only ever affects billing data and cost-allocation reports for the account
• c.A policy shared across all Regions by default
• d.A policy AWS applies to every account automatically

An inline policy is attached to and lives with one specific identity, maintaining a strict one-to-one relationship rather than being reusable.

Which approach best follows least privilege when granting a developer access?

• a.Grant full administrator access for convenience and to avoid any future permission requests
• b.Grant only the specific permissions the developer's tasks require✓
• c.Grant full administrator access for convenience
• d.Give access to every service just in case

Least privilege means granting only the permissions needed for the job, reducing risk if credentials are compromised.

How does AWS IAM Identity Center (successor to AWS SSO) help organizations?

• a.It stores objects for static websites
• b.It removes the need for any encryption
• c.It centrally manages workforce sign-in and access across multiple AWS accounts✓
• d.It stores and serves static website objects and media files from edge locations worldwide

IAM Identity Center provides centralized single sign-on and permission management across many AWS accounts and applications.

What is the recommended alternative to long-term access keys for programmatic access where possible?

• a.Sharing the console password widely
• b.Publishing keys in code repositories
• c.Temporary credentials from IAM roles✓
• d.Using the root user's access keys

Roles provide short-lived credentials that expire automatically, reducing exposure compared with long-term access keys that persist until rotated.

In an IAM policy statement, what does the 'Action' element specify?

• a.The specific API operations being allowed or denied✓
• b.The physical Region and Availability Zone in which the target resource is located
• c.The monetary cost of the operation
• d.The physical Region of the resource

The Action element lists the service operations (for example s3:GetObject) that the statement allows or denies.

Which is TRUE about the account root user compared with IAM users?

• a.Root can be permission-restricted by group policies
• b.IAM users always have more access than root
• c.IAM users always have strictly more access to the account than the root user ever does
• d.The root user has full, unrestricted access that IAM policies cannot limit✓

The root user has complete account access and should be secured with MFA and avoided for daily tasks; IAM users receive only the permissions you grant.

What does enabling an IAM account password policy let an administrator enforce?

• a.Requirements such as minimum length, complexity, and rotation✓
• b.Managed DDoS protection for the account
• c.Automatic encryption of all S3 buckets
• d.Automatic encryption of all S3 buckets and EBS volumes created anywhere in the account

An account password policy sets rules like minimum length, character requirements, expiration, and reuse prevention for IAM users.

Why should you avoid attaching policies directly to individual users at scale?

• a.Users cannot have any policies attached to them
• b.It automatically deletes the user account
• c.Users cannot have any policies attached to them directly under any circumstances at all
• d.Managing permissions through groups and roles is easier to maintain and audit✓

Assigning permissions via groups (or roles) centralizes management and scales better than maintaining per-user policies.

An IAM role's trust policy defines what?

• a.Which principals are allowed to assume the role✓
• b.The billing account charged for the role
• c.The encryption key used by the role
• d.The Region where the role runs

A role has two parts: a permissions policy (what it can do) and a trust policy (who is allowed to assume it).

A mobile app needs users to sign in with an external identity provider and then get temporary AWS access. Which approach fits best?

• a.Embedding long-term access keys in the app
• b.Identity federation so external identities receive temporary AWS credentials✓
• c.Creating a separate long-term IAM user and password for every single application user
• d.Creating an IAM user for every single app user

Federation lets users authenticate with an external identity provider and receive temporary AWS credentials, avoiding an IAM user per person.

What credentials does an IAM user use for programmatic access via the CLI or SDK?

• a.A KMS data key
• b.An SSL certificate from ACM
• c.An access key ID and secret access key✓
• d.A console password only

Programmatic access uses access keys (ID plus secret); the console uses a password, ideally with MFA. Keys should be rotated and never hard-coded.

What is a key security reason to rotate IAM access keys regularly?

• a.It limits how long a leaked key remains usable✓
• b.It speeds up API calls
• c.It increases the account's storage limits
• d.It is required to use the Free Tier

Rotating keys reduces the window during which a compromised key is valid, a standard credential-hygiene practice.

Which IAM feature helps you find and remove unused users, keys, and permissions?

• a.The AWS Pricing Calculator
• b.Amazon CloudFront access logs that are delivered to an S3 bucket for later manual review
• c.The IAM credential report and last-used information✓
• d.Amazon CloudFront access logs

IAM provides a credential report and 'last used' data so you can identify and remove stale users, keys, and permissions.

What does combining least privilege with regular access reviews achieve?

• a.Every user gradually gains admin rights
• b.Permissions stay minimal and are tightened as needs change✓
• c.Permissions can never be changed again
• d.Every user gradually gains full administrator rights over time in an automatic fashion

Granting minimal permissions and reviewing them regularly keeps access aligned to actual needs and reduces attack surface.

Which service would help detect an EC2 instance communicating with a known malicious IP address?

• a.Amazon Macie
• b.AWS Certificate Manager
• c.AWS Artifact
• d.Amazon GuardDuty✓

GuardDuty analyzes logs and threat intelligence to flag activity like communication with known-malicious IPs, without deploying agents.

Which service offers automatic, always-on protection against common network-layer DDoS attacks at no additional cost?

• a.AWS Shield Standard✓
• b.Amazon Inspector
• c.AWS Shield Advanced
• d.AWS WAF

Shield Standard is automatically included for all AWS customers at no extra cost; Shield Advanced adds enhanced protection for a fee.

What additional benefit does AWS Shield Advanced provide over Shield Standard?

• a.Enhanced DDoS protection, cost protection, and access to the DDoS response team✓
• b.Physical security of the data centers
• c.Automatic fixes to application code
• d.Free unlimited compute capacity

Shield Advanced adds protection against larger attacks, DDoS cost protection, and access to the Shield Response Team for an additional fee.

You need to block requests containing SQL-injection patterns before they reach your Application Load Balancer. Which service creates those rules?

• a.AWS WAF✓
• b.Amazon GuardDuty
• c.Amazon Macie
• d.AWS Config

AWS WAF filters HTTP and HTTPS requests with rules, including managed rule groups, to block common exploits on CloudFront, ALB, and API Gateway.

Which service should you use to find personally identifiable information (PII) accidentally stored in S3 buckets?

• a.AWS Shield
• b.Amazon Macie✓
• c.Amazon Inspector
• d.AWS Trusted Advisor

Macie uses machine learning to discover and classify sensitive data such as PII in S3 and alerts you to exposure.

Which service automatically scans your EC2 instances and container images for known software vulnerabilities (CVEs)?

• a.Amazon Cognito
• b.Amazon Inspector✓
• c.AWS Shield
• d.Amazon Macie

Amazon Inspector continuously scans workloads for software vulnerabilities (CVEs) and unintended network exposure, prioritizing findings.

Which service aggregates security findings and runs automated checks against standards like CIS and PCI DSS?

• a.AWS Security Hub✓
• b.Amazon EFS
• c.AWS Direct Connect
• d.Amazon Route 53

Security Hub centralizes findings from GuardDuty, Inspector, and Macie, and runs automated checks against frameworks like CIS and PCI DSS.

Which service records API activity in your account to support security auditing and investigations?

• a.AWS WAF
• b.AWS CloudTrail✓
• c.Amazon CloudWatch metrics
• d.AWS Artifact

CloudTrail logs API calls and events, providing an audit trail of who did what, when, and from where, essential for investigations and compliance.

What is the difference between AWS CloudTrail and Amazon CloudWatch?

• a.CloudTrail encrypts data while CloudWatch stores backups
• b.CloudTrail is for billing and CloudWatch is for DNS
• c.CloudTrail records API activity for auditing; CloudWatch monitors metrics, logs, and alarms✓
• d.They are the same service under two names

CloudTrail answers 'who did what' (audit); CloudWatch answers 'how is it performing' (metrics, logs, alarms).

Which service continuously monitors and records resource configuration changes to assess compliance over time?

• a.Amazon SNS
• b.AWS Shield
• c.AWS Config✓
• d.Amazon Macie

AWS Config tracks configuration changes and evaluates resources against rules, giving a history useful for compliance and troubleshooting.

Which service uses machine learning to analyze VPC Flow Logs, DNS logs, and CloudTrail events for threats?

• a.AWS Config
• b.Amazon ElastiCache
• c.AWS Artifact
• d.Amazon GuardDuty✓

GuardDuty ingests these data sources and applies ML and threat intelligence to surface findings such as compromised instances or reconnaissance.

Which service gives automated best-practice recommendations across security, cost, performance, fault tolerance, and service limits?

• a.AWS CloudFormation
• b.AWS Secrets Manager
• c.Amazon Inspector
• d.AWS Trusted Advisor✓

Trusted Advisor inspects your environment and recommends improvements across five categories, including security checks like exposed keys and open ports.

A security check flags that your S3 bucket is publicly accessible. Which feature can prevent public access at the account or bucket level?

• a.S3 Transfer Acceleration
• b.S3 Block Public Access✓
• c.S3 Requester Pays
• d.S3 Versioning

S3 Block Public Access settings override permissive policies and ACLs to keep buckets private, guarding against accidental public exposure.

Which managed service centrally configures and enforces firewall rules such as WAF and security-group policies across accounts in an organization?

• a.Amazon CloudFront
• b.AWS Snowball
• c.Amazon Athena
• d.AWS Firewall Manager✓

AWS Firewall Manager centrally applies and enforces WAF rules, Shield Advanced protections, and security-group policies across an AWS Organization.

Which service provides a managed, stateful firewall for filtering traffic entering and leaving a VPC?

• a.Amazon Macie
• b.AWS Artifact
• c.AWS Cost Explorer
• d.AWS Network Firewall✓

AWS Network Firewall is a managed, stateful firewall for VPCs, providing intrusion prevention and traffic filtering at the network perimeter.

What is a primary use of Amazon Detective?

• a.To provision virtual servers on demand
• b.To analyze and investigate the root cause of security findings✓
• c.To deliver content from edge locations
• d.To provision and automatically scale fleets of virtual servers across many Regions

Amazon Detective automatically collects and correlates data to help you analyze and investigate the root cause of potential security issues.

Which statement about AWS WAF managed rules is accurate?

• a.They fully replace the need for IAM
• b.They are used only for billing alerts
• c.They provide physical data-center security
• d.They are preconfigured rule groups maintained to address common threats✓

AWS Managed Rules for WAF offer curated, maintained rule groups, reducing the effort of writing rules yourself.

An organization wants a single, consolidated view of its security posture across many accounts. Which service is designed for this?

• a.Amazon EC2 Auto Scaling
• b.AWS Security Hub✓
• c.Amazon Redshift
• d.AWS Direct Connect

Security Hub provides a consolidated, cross-account view of security and compliance state, aggregating findings and standards checks.

Which service can filter malicious bot and scraping traffic in addition to common web exploits?

• a.AWS WAF with Bot Control✓
• b.Amazon EBS snapshots
• c.Amazon Kinesis
• d.AWS Snowmobile

AWS WAF, including its Bot Control managed rule group, can filter malicious bot traffic and common web exploits at the application layer.

In terms of security controls, what kind of service is Amazon GuardDuty?

• a.A physical control for data centers
• b.A preventive control that blocks all traffic
• c.A billing optimization control
• d.A detective control that identifies threats✓

GuardDuty is a detective control: it detects and alerts on suspicious activity but does not itself block traffic; remediation is handled separately.

What is the difference between encryption at rest and encryption in transit?

• a.At rest uses TLS while in transit uses disk encryption
• b.At rest protects stored data; in transit protects data moving across networks✓
• c.At rest is for backups and in transit is for billing
• d.They are two names for the same thing

Encryption at rest secures data on disk or storage; encryption in transit (typically TLS) secures data as it travels between systems.

Which service lets you create and control the encryption keys used to protect data, integrated across many AWS services?

• a.AWS Trusted Advisor
• b.AWS Artifact
• c.AWS Key Management Service (KMS)✓
• d.Amazon Macie

AWS KMS centrally creates, manages, and controls cryptographic keys, integrating with services like S3, EBS, and RDS for encryption at rest.

What is a benefit of using AWS KMS-managed keys for encryption?

• a.Centralized key control tied to IAM and key policies, with usage logged for audit✓
• b.Keys are stored in your application source code
• c.Keys are embedded directly in your application source code and shared with every developer
• d.It removes the need for any access control

KMS centralizes key control, ties usage to IAM and key policies, and logs key use in CloudTrail for auditing.

Which service provides dedicated, single-tenant hardware security modules for managing your own encryption keys to meet strict compliance?

• a.Amazon Cognito
• b.AWS Config
• c.Amazon Inspector
• d.AWS CloudHSM✓

AWS CloudHSM offers dedicated hardware security modules for customers needing exclusive control of keys for compliance; KMS is the more managed option.

For Amazon S3, which option encrypts objects using keys fully managed by AWS with no customer key management?

• a.Encryption only after you download objects
• b.Client-side encryption with your own library
• c.Server-side encryption with S3-managed keys (SSE-S3)✓
• d.No encryption at all

SSE-S3 has S3 manage the encryption keys and process automatically; SSE-KMS uses KMS keys, and client-side encryption is done before upload.

What is the main difference between SSE-KMS and SSE-S3 for S3 encryption?

• a.SSE-KMS uses AWS KMS keys, adding control and audit logging of key use✓
• b.There is no difference between them
• c.SSE-S3 is not actually encryption
• d.SSE-KMS stores the data unencrypted

Both encrypt at rest, but SSE-KMS uses KMS keys, adding key policies, usage permissions, and CloudTrail auditing of key use.

Which service manages and can automatically renew SSL/TLS certificates for AWS services to enable encryption in transit?

• a.AWS Config
• b.AWS Certificate Manager (ACM)✓
• c.Amazon Macie
• d.AWS Secrets Manager

ACM provisions, manages, and auto-renews TLS certificates for services like ELB, CloudFront, and API Gateway, simplifying encryption in transit.

What does client-side encryption mean?

• a.AWS encrypts the data only after storing it
• b.The data is never actually encrypted
• c.Data is encrypted by the customer before it is sent to AWS✓
• d.Only AWS ever holds the keys

With client-side encryption you encrypt data locally before uploading, so it is already encrypted in transit and at rest, and you control the keys.

Which service is best for storing and automatically rotating database credentials and API keys?

• a.Amazon GuardDuty
• b.AWS Artifact
• c.AWS Shield
• d.AWS Secrets Manager✓

Secrets Manager securely stores secrets and can automatically rotate them (for example RDS credentials), removing hard-coded secrets from code.

How does AWS Systems Manager Parameter Store relate to storing configuration and secrets?

• a.It provisions and manages fleets of physical servers dedicated entirely to your workloads
• b.It securely stores configuration data and secrets, optionally encrypted with KMS✓
• c.It replaces the need for IAM roles
• d.It provisions physical servers on demand

Parameter Store holds configuration values and secrets (SecureString via KMS); Secrets Manager adds built-in rotation for secrets specifically.

A customer needs full ownership and control of key material for regulatory reasons, with dedicated hardware. Which is most appropriate?

• a.Amazon CloudFront
• b.AWS Trusted Advisor
• c.SSE-S3
• d.AWS CloudHSM✓

CloudHSM provides dedicated hardware security modules giving customers exclusive control of keys for strict compliance; managed KMS is simpler but shared.

Why is encrypting data both at rest and in transit considered defense in depth?

• a.It protects data in multiple states so a single failure does not expose it✓
• b.It makes data impossible to ever read again
• c.It removes the need for any access control
• d.It is required only to use the Free Tier

Layering encryption across storage and network states means data stays protected even if one layer is bypassed, an example of defense in depth.

Which service provides on-demand downloads of AWS compliance reports such as SOC and ISO certifications?

• a.Amazon Inspector
• b.AWS Shield
• c.AWS Config
• d.AWS Artifact✓

AWS Artifact is a self-service portal to download AWS audit reports (SOC, ISO, PCI) and manage agreements, helping customers meet compliance needs.

In the shared responsibility model, AWS compliance certifications such as ISO 27001 cover what?

• a.The security and compliance of the underlying cloud infrastructure✓
• b.The customer's IAM policies
• c.The customer's application source code
• d.The customer's data classification decisions

AWS certifications attest to the infrastructure AWS manages; customers still must achieve compliance for their own workloads and data built on top.

What does AWS Organizations enable?

• a.Automatic application development
• b.Physical access to data centers
• c.Central management and consolidated billing for multiple AWS accounts✓
• d.Free unlimited compute for all accounts

AWS Organizations lets you centrally manage multiple accounts, apply policies, and consolidate billing across the organization.

What is a service control policy (SCP) in AWS Organizations?

• a.A network routing rule
• b.A guardrail that sets the maximum permissions available to member accounts✓
• c.A policy that grants permissions directly to users
• d.A billing discount agreement

SCPs define the ceiling of allowed actions for accounts or organizational units; they restrict but do not by themselves grant permissions, which IAM still does.

An SCP denies use of a service in an organizational unit, but a user there has an IAM policy allowing it. What is the result?

• a.The two cancel out and access is random
• b.Access is denied because the SCP caps the maximum allowed permissions✓
• c.The user account is automatically deleted
• d.Access is allowed because IAM overrides SCPs

Effective permissions are the intersection of SCPs and IAM policies; if an SCP denies an action, no IAM policy can grant it.

How can grouping accounts into organizational units (OUs) help governance?

• a.It gives every account root access
• b.It disables billing for the accounts
• c.It removes all IAM controls
• d.You can apply policies like SCPs to many accounts at once by OU✓

OUs let you organize accounts hierarchically and apply consistent guardrails (SCPs) to groups of accounts, simplifying governance at scale.

A healthcare company needs to review and accept the Business Associate Addendum (BAA) for HIPAA. Where can it manage that agreement?

• a.AWS Artifact✓
• b.Amazon CloudFront
• c.Amazon SQS
• d.AWS Lambda

AWS Artifact provides compliance reports and lets customers review and accept agreements such as the BAA for HIPAA.

What is a governance benefit of consolidated billing in AWS Organizations?

• a.One payer with organization-wide visibility while accounts stay isolated✓
• b.It disables CloudTrail for all accounts
• c.It makes all account data public
• d.It merges all IAM users into a single user

Consolidated billing gives one bill and organization-wide cost visibility while accounts remain isolated for security, and can earn volume discounts.

Which practice supports a strong multi-account strategy on AWS?

• a.Disabling CloudTrail organization-wide
• b.Running everything in the root account
• c.Sharing one IAM user everywhere
• d.Separating prod and dev into different accounts with SCP guardrails✓

Isolating environments into separate accounts under Organizations, with SCP guardrails and centralized logging, limits blast radius and improves governance.

AWS Compliance Programs and certifications primarily help customers do what?

• a.Avoid all of their own compliance obligations
• b.Get free AWS promotional credits
• c.Bypass encryption requirements entirely
• d.Meet their own audit requirements by relying on AWS's audited controls✓

AWS's compliance programs provide audited assurance for the infrastructure, which customers use as a foundation for their own compliance; responsibility is shared.

Which statement correctly contrasts security groups with network ACLs?

• a.NACLs are stateful and attach to instances
• b.Security groups work only at the subnet level
• c.Security groups are stateful at the instance level; NACLs are stateless at the subnet level✓
• d.Both are stateless and behave identically

Security groups are stateful instance-level firewalls (return traffic auto-allowed); NACLs are stateless subnet-level filters needing explicit rules both ways.

How does enabling Amazon S3 Versioning help protect data?

• a.It blocks all public access to the bucket
• b.It reduces storage cost to zero
• c.It preserves previous versions so you can recover from accidental deletes or overwrites✓
• d.It encrypts the entire bucket automatically

Versioning keeps prior object versions, protecting against accidental or malicious deletion and overwrites; it pairs well with MFA Delete.

What does enabling MFA Delete on an S3 bucket require?

• a.A Reserved Instance purchase
• b.A public bucket policy
• c.An MFA code to permanently delete versions or change the versioning state✓
• d.A larger EC2 instance type

MFA Delete adds a requirement for a multi-factor code before permanently deleting versions, guarding critical data against unauthorized deletion.

Which practice helps protect critical workloads against accidental data loss?

• a.Turning off encryption entirely
• b.Regular backups plus cross-Region or cross-account copies✓
• c.Storing a single copy in one AZ only
• d.Disabling all logging to save cost

Maintaining backups and copies across Regions or accounts improves durability and recoverability, supporting both reliability and data protection.

What is a security use of Amazon CloudWatch alarms?

• a.Alerting or triggering actions when metrics cross thresholds, such as unusual activity✓
• b.Physically securing the data centers and destroying decommissioned storage media on site
• c.Physically securing the data centers
• d.Provisioning IAM users automatically

CloudWatch alarms can notify teams or trigger automated responses when metrics (like failed logins or CPU spikes) breach thresholds, aiding detection.

Which combination provides an audit trail plus alerting and threat detection for account activity?

• a.Route 53 combined with CloudFront
• b.Only an S3 bucket with public access enabled
• c.CloudTrail for API logging with CloudWatch alarms and GuardDuty for detection✓
• d.EBS snapshots used entirely on their own

CloudTrail records activity, CloudWatch alarms on patterns, and GuardDuty adds ML-based threat detection, together supporting monitoring and response.

What does the principle of 'defense in depth' mean for securing AWS workloads?

• a.Granting broad permissions to move faster
• b.Applying multiple layers of security controls so no single failure is catastrophic✓
• c.Encrypting nothing in order to save cost
• d.Relying on one strong firewall and nothing else

Defense in depth layers controls (network, identity, encryption, monitoring) so that if one control fails, others still protect the workload.

A company wants to ensure only encrypted connections reach its application. Which approach helps enforce encryption in transit?

• a.Disable certificates entirely
• b.Store keys in the web page source
• c.Require HTTPS/TLS with ACM certificates and redirect HTTP to HTTPS✓
• d.Allow only unencrypted HTTP traffic

Enforcing TLS with ACM-managed certificates and redirecting HTTP to HTTPS ensures data in transit is encrypted between clients and the application.