AWS Cloud Practitioner — All Questions

In an IAM policy statement, what does the 'Action' element specify?

• a.The specific API operations being allowed or denied✓
• b.The physical Region and Availability Zone in which the target resource is located
• c.The monetary cost of the operation
• d.The physical Region of the resource

The Action element lists the service operations (for example s3:GetObject) that the statement allows or denies.

Which is TRUE about the account root user compared with IAM users?

• a.Root can be permission-restricted by group policies
• b.IAM users always have more access than root
• c.IAM users always have strictly more access to the account than the root user ever does
• d.The root user has full, unrestricted access that IAM policies cannot limit✓

The root user has complete account access and should be secured with MFA and avoided for daily tasks; IAM users receive only the permissions you grant.

What does enabling an IAM account password policy let an administrator enforce?

• a.Requirements such as minimum length, complexity, and rotation✓
• b.Managed DDoS protection for the account
• c.Automatic encryption of all S3 buckets
• d.Automatic encryption of all S3 buckets and EBS volumes created anywhere in the account

An account password policy sets rules like minimum length, character requirements, expiration, and reuse prevention for IAM users.

Why should you avoid attaching policies directly to individual users at scale?

• a.Users cannot have any policies attached to them
• b.It automatically deletes the user account
• c.Users cannot have any policies attached to them directly under any circumstances at all
• d.Managing permissions through groups and roles is easier to maintain and audit✓

Assigning permissions via groups (or roles) centralizes management and scales better than maintaining per-user policies.

An IAM role's trust policy defines what?

• a.Which principals are allowed to assume the role✓
• b.The billing account charged for the role
• c.The encryption key used by the role
• d.The Region where the role runs

A role has two parts: a permissions policy (what it can do) and a trust policy (who is allowed to assume it).

A mobile app needs users to sign in with an external identity provider and then get temporary AWS access. Which approach fits best?

• a.Embedding long-term access keys in the app
• b.Identity federation so external identities receive temporary AWS credentials✓
• c.Creating a separate long-term IAM user and password for every single application user
• d.Creating an IAM user for every single app user

Federation lets users authenticate with an external identity provider and receive temporary AWS credentials, avoiding an IAM user per person.

What credentials does an IAM user use for programmatic access via the CLI or SDK?

• a.A KMS data key
• b.An SSL certificate from ACM
• c.An access key ID and secret access key✓
• d.A console password only

Programmatic access uses access keys (ID plus secret); the console uses a password, ideally with MFA. Keys should be rotated and never hard-coded.

What is a key security reason to rotate IAM access keys regularly?

• a.It limits how long a leaked key remains usable✓
• b.It speeds up API calls
• c.It increases the account's storage limits
• d.It is required to use the Free Tier

Rotating keys reduces the window during which a compromised key is valid, a standard credential-hygiene practice.

Which IAM feature helps you find and remove unused users, keys, and permissions?

• a.The AWS Pricing Calculator
• b.Amazon CloudFront access logs that are delivered to an S3 bucket for later manual review
• c.The IAM credential report and last-used information✓
• d.Amazon CloudFront access logs

IAM provides a credential report and 'last used' data so you can identify and remove stale users, keys, and permissions.

What does combining least privilege with regular access reviews achieve?

• a.Every user gradually gains admin rights
• b.Permissions stay minimal and are tightened as needs change✓
• c.Permissions can never be changed again
• d.Every user gradually gains full administrator rights over time in an automatic fashion

Granting minimal permissions and reviewing them regularly keeps access aligned to actual needs and reduces attack surface.

Which service would help detect an EC2 instance communicating with a known malicious IP address?

• a.Amazon Macie
• b.AWS Certificate Manager
• c.AWS Artifact
• d.Amazon GuardDuty✓

GuardDuty analyzes logs and threat intelligence to flag activity like communication with known-malicious IPs, without deploying agents.

Which service offers automatic, always-on protection against common network-layer DDoS attacks at no additional cost?

• a.AWS Shield Standard✓
• b.Amazon Inspector
• c.AWS Shield Advanced
• d.AWS WAF

Shield Standard is automatically included for all AWS customers at no extra cost; Shield Advanced adds enhanced protection for a fee.

What additional benefit does AWS Shield Advanced provide over Shield Standard?

• a.Enhanced DDoS protection, cost protection, and access to the DDoS response team✓
• b.Physical security of the data centers
• c.Automatic fixes to application code
• d.Free unlimited compute capacity

Shield Advanced adds protection against larger attacks, DDoS cost protection, and access to the Shield Response Team for an additional fee.

You need to block requests containing SQL-injection patterns before they reach your Application Load Balancer. Which service creates those rules?

• a.AWS WAF✓
• b.Amazon GuardDuty
• c.Amazon Macie
• d.AWS Config

AWS WAF filters HTTP and HTTPS requests with rules, including managed rule groups, to block common exploits on CloudFront, ALB, and API Gateway.

Which service should you use to find personally identifiable information (PII) accidentally stored in S3 buckets?

• a.AWS Shield
• b.Amazon Macie✓
• c.Amazon Inspector
• d.AWS Trusted Advisor

Macie uses machine learning to discover and classify sensitive data such as PII in S3 and alerts you to exposure.

Which service automatically scans your EC2 instances and container images for known software vulnerabilities (CVEs)?

• a.Amazon Cognito
• b.Amazon Inspector✓
• c.AWS Shield
• d.Amazon Macie

Amazon Inspector continuously scans workloads for software vulnerabilities (CVEs) and unintended network exposure, prioritizing findings.

Which service aggregates security findings and runs automated checks against standards like CIS and PCI DSS?

• a.AWS Security Hub✓
• b.Amazon EFS
• c.AWS Direct Connect
• d.Amazon Route 53

Security Hub centralizes findings from GuardDuty, Inspector, and Macie, and runs automated checks against frameworks like CIS and PCI DSS.

Which service records API activity in your account to support security auditing and investigations?

• a.AWS WAF
• b.AWS CloudTrail✓
• c.Amazon CloudWatch metrics
• d.AWS Artifact

CloudTrail logs API calls and events, providing an audit trail of who did what, when, and from where, essential for investigations and compliance.

What is the difference between AWS CloudTrail and Amazon CloudWatch?

• a.CloudTrail encrypts data while CloudWatch stores backups
• b.CloudTrail is for billing and CloudWatch is for DNS
• c.CloudTrail records API activity for auditing; CloudWatch monitors metrics, logs, and alarms✓
• d.They are the same service under two names

CloudTrail answers 'who did what' (audit); CloudWatch answers 'how is it performing' (metrics, logs, alarms).

Which service continuously monitors and records resource configuration changes to assess compliance over time?

• a.Amazon SNS
• b.AWS Shield
• c.AWS Config✓
• d.Amazon Macie

AWS Config tracks configuration changes and evaluates resources against rules, giving a history useful for compliance and troubleshooting.

Which service uses machine learning to analyze VPC Flow Logs, DNS logs, and CloudTrail events for threats?

• a.AWS Config
• b.Amazon ElastiCache
• c.AWS Artifact
• d.Amazon GuardDuty✓

GuardDuty ingests these data sources and applies ML and threat intelligence to surface findings such as compromised instances or reconnaissance.

Which service gives automated best-practice recommendations across security, cost, performance, fault tolerance, and service limits?

• a.AWS CloudFormation
• b.AWS Secrets Manager
• c.Amazon Inspector
• d.AWS Trusted Advisor✓

Trusted Advisor inspects your environment and recommends improvements across five categories, including security checks like exposed keys and open ports.

A security check flags that your S3 bucket is publicly accessible. Which feature can prevent public access at the account or bucket level?

• a.S3 Transfer Acceleration
• b.S3 Block Public Access✓
• c.S3 Requester Pays
• d.S3 Versioning

S3 Block Public Access settings override permissive policies and ACLs to keep buckets private, guarding against accidental public exposure.

Which managed service centrally configures and enforces firewall rules such as WAF and security-group policies across accounts in an organization?

• a.Amazon CloudFront
• b.AWS Snowball
• c.Amazon Athena
• d.AWS Firewall Manager✓

AWS Firewall Manager centrally applies and enforces WAF rules, Shield Advanced protections, and security-group policies across an AWS Organization.

Which service provides a managed, stateful firewall for filtering traffic entering and leaving a VPC?

• a.Amazon Macie
• b.AWS Artifact
• c.AWS Cost Explorer
• d.AWS Network Firewall✓

AWS Network Firewall is a managed, stateful firewall for VPCs, providing intrusion prevention and traffic filtering at the network perimeter.

What is a primary use of Amazon Detective?

• a.To provision virtual servers on demand
• b.To analyze and investigate the root cause of security findings✓
• c.To deliver content from edge locations
• d.To provision and automatically scale fleets of virtual servers across many Regions

Amazon Detective automatically collects and correlates data to help you analyze and investigate the root cause of potential security issues.

Which statement about AWS WAF managed rules is accurate?

• a.They fully replace the need for IAM
• b.They are used only for billing alerts
• c.They provide physical data-center security
• d.They are preconfigured rule groups maintained to address common threats✓

AWS Managed Rules for WAF offer curated, maintained rule groups, reducing the effort of writing rules yourself.

An organization wants a single, consolidated view of its security posture across many accounts. Which service is designed for this?

• a.Amazon EC2 Auto Scaling
• b.AWS Security Hub✓
• c.Amazon Redshift
• d.AWS Direct Connect

Security Hub provides a consolidated, cross-account view of security and compliance state, aggregating findings and standards checks.

Which service can filter malicious bot and scraping traffic in addition to common web exploits?

• a.AWS WAF with Bot Control✓
• b.Amazon EBS snapshots
• c.Amazon Kinesis
• d.AWS Snowmobile

AWS WAF, including its Bot Control managed rule group, can filter malicious bot traffic and common web exploits at the application layer.

In terms of security controls, what kind of service is Amazon GuardDuty?

• a.A physical control for data centers
• b.A preventive control that blocks all traffic
• c.A billing optimization control
• d.A detective control that identifies threats✓

GuardDuty is a detective control: it detects and alerts on suspicious activity but does not itself block traffic; remediation is handled separately.

What is the difference between encryption at rest and encryption in transit?

• a.At rest uses TLS while in transit uses disk encryption
• b.At rest protects stored data; in transit protects data moving across networks✓
• c.At rest is for backups and in transit is for billing
• d.They are two names for the same thing

Encryption at rest secures data on disk or storage; encryption in transit (typically TLS) secures data as it travels between systems.

Which service lets you create and control the encryption keys used to protect data, integrated across many AWS services?

• a.AWS Trusted Advisor
• b.AWS Artifact
• c.AWS Key Management Service (KMS)✓
• d.Amazon Macie

AWS KMS centrally creates, manages, and controls cryptographic keys, integrating with services like S3, EBS, and RDS for encryption at rest.

What is a benefit of using AWS KMS-managed keys for encryption?

• a.Centralized key control tied to IAM and key policies, with usage logged for audit✓
• b.Keys are stored in your application source code
• c.Keys are embedded directly in your application source code and shared with every developer
• d.It removes the need for any access control

KMS centralizes key control, ties usage to IAM and key policies, and logs key use in CloudTrail for auditing.

Which service provides dedicated, single-tenant hardware security modules for managing your own encryption keys to meet strict compliance?

• a.Amazon Cognito
• b.AWS Config
• c.Amazon Inspector
• d.AWS CloudHSM✓

AWS CloudHSM offers dedicated hardware security modules for customers needing exclusive control of keys for compliance; KMS is the more managed option.

For Amazon S3, which option encrypts objects using keys fully managed by AWS with no customer key management?

• a.Encryption only after you download objects
• b.Client-side encryption with your own library
• c.Server-side encryption with S3-managed keys (SSE-S3)✓
• d.No encryption at all

SSE-S3 has S3 manage the encryption keys and process automatically; SSE-KMS uses KMS keys, and client-side encryption is done before upload.

What is the main difference between SSE-KMS and SSE-S3 for S3 encryption?

• a.SSE-KMS uses AWS KMS keys, adding control and audit logging of key use✓
• b.There is no difference between them
• c.SSE-S3 is not actually encryption
• d.SSE-KMS stores the data unencrypted

Both encrypt at rest, but SSE-KMS uses KMS keys, adding key policies, usage permissions, and CloudTrail auditing of key use.

Which service manages and can automatically renew SSL/TLS certificates for AWS services to enable encryption in transit?

• a.AWS Config
• b.AWS Certificate Manager (ACM)✓
• c.Amazon Macie
• d.AWS Secrets Manager

ACM provisions, manages, and auto-renews TLS certificates for services like ELB, CloudFront, and API Gateway, simplifying encryption in transit.

What does client-side encryption mean?

• a.AWS encrypts the data only after storing it
• b.The data is never actually encrypted
• c.Data is encrypted by the customer before it is sent to AWS✓
• d.Only AWS ever holds the keys

With client-side encryption you encrypt data locally before uploading, so it is already encrypted in transit and at rest, and you control the keys.

Which service is best for storing and automatically rotating database credentials and API keys?

• a.Amazon GuardDuty
• b.AWS Artifact
• c.AWS Shield
• d.AWS Secrets Manager✓

Secrets Manager securely stores secrets and can automatically rotate them (for example RDS credentials), removing hard-coded secrets from code.

How does AWS Systems Manager Parameter Store relate to storing configuration and secrets?

• a.It provisions and manages fleets of physical servers dedicated entirely to your workloads
• b.It securely stores configuration data and secrets, optionally encrypted with KMS✓
• c.It replaces the need for IAM roles
• d.It provisions physical servers on demand

Parameter Store holds configuration values and secrets (SecureString via KMS); Secrets Manager adds built-in rotation for secrets specifically.

A customer needs full ownership and control of key material for regulatory reasons, with dedicated hardware. Which is most appropriate?

• a.Amazon CloudFront
• b.AWS Trusted Advisor
• c.SSE-S3
• d.AWS CloudHSM✓

CloudHSM provides dedicated hardware security modules giving customers exclusive control of keys for strict compliance; managed KMS is simpler but shared.

Why is encrypting data both at rest and in transit considered defense in depth?

• a.It protects data in multiple states so a single failure does not expose it✓
• b.It makes data impossible to ever read again
• c.It removes the need for any access control
• d.It is required only to use the Free Tier

Layering encryption across storage and network states means data stays protected even if one layer is bypassed, an example of defense in depth.

Which service provides on-demand downloads of AWS compliance reports such as SOC and ISO certifications?

• a.Amazon Inspector
• b.AWS Shield
• c.AWS Config
• d.AWS Artifact✓

AWS Artifact is a self-service portal to download AWS audit reports (SOC, ISO, PCI) and manage agreements, helping customers meet compliance needs.

In the shared responsibility model, AWS compliance certifications such as ISO 27001 cover what?

• a.The security and compliance of the underlying cloud infrastructure✓
• b.The customer's IAM policies
• c.The customer's application source code
• d.The customer's data classification decisions

AWS certifications attest to the infrastructure AWS manages; customers still must achieve compliance for their own workloads and data built on top.

What does AWS Organizations enable?

• a.Automatic application development
• b.Physical access to data centers
• c.Central management and consolidated billing for multiple AWS accounts✓
• d.Free unlimited compute for all accounts

AWS Organizations lets you centrally manage multiple accounts, apply policies, and consolidate billing across the organization.

What is a service control policy (SCP) in AWS Organizations?

• a.A network routing rule
• b.A guardrail that sets the maximum permissions available to member accounts✓
• c.A policy that grants permissions directly to users
• d.A billing discount agreement

SCPs define the ceiling of allowed actions for accounts or organizational units; they restrict but do not by themselves grant permissions, which IAM still does.

An SCP denies use of a service in an organizational unit, but a user there has an IAM policy allowing it. What is the result?

• a.The two cancel out and access is random
• b.Access is denied because the SCP caps the maximum allowed permissions✓
• c.The user account is automatically deleted
• d.Access is allowed because IAM overrides SCPs

Effective permissions are the intersection of SCPs and IAM policies; if an SCP denies an action, no IAM policy can grant it.

How can grouping accounts into organizational units (OUs) help governance?

• a.It gives every account root access
• b.It disables billing for the accounts
• c.It removes all IAM controls
• d.You can apply policies like SCPs to many accounts at once by OU✓

OUs let you organize accounts hierarchically and apply consistent guardrails (SCPs) to groups of accounts, simplifying governance at scale.

A healthcare company needs to review and accept the Business Associate Addendum (BAA) for HIPAA. Where can it manage that agreement?

• a.AWS Artifact✓
• b.Amazon CloudFront
• c.Amazon SQS
• d.AWS Lambda

AWS Artifact provides compliance reports and lets customers review and accept agreements such as the BAA for HIPAA.

What is a governance benefit of consolidated billing in AWS Organizations?

• a.One payer with organization-wide visibility while accounts stay isolated✓
• b.It disables CloudTrail for all accounts
• c.It makes all account data public
• d.It merges all IAM users into a single user

Consolidated billing gives one bill and organization-wide cost visibility while accounts remain isolated for security, and can earn volume discounts.