CCNA Security Questions — Page 1 of 3

MCQeasy

Which AWS service allows you to monitor API calls made in your AWS account, including who made the call, from which IP address, and when?

A.Amazon CloudWatch

B.AWS CloudTrail

C.VPC Flow Logs

D.AWS Config

AnswerB

AWS CloudTrail is the service that continuously records and stores every API call made on your account, including management events and select data events. For each event it captures the identity of the caller (IAM user/role), the source IP, the time of the call, the action taken, and the request/response details. This makes CloudTrail the authoritative source for auditing, compliance, and security investigation—exactly what the question is asking for.

Why this answer

AWS CloudTrail is the service that records API activity in your AWS account, capturing details such as the identity of the caller, the source IP address, and the timestamp of each API call. This makes it the correct choice for monitoring who made a call, from where, and when.

Exam trap

The trap here is that candidates often confuse CloudWatch (for monitoring metrics and logs) with CloudTrail (for auditing API calls), because both involve logging, but CloudTrail is specifically designed for recording API activity with caller identity and source IP details.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch is a monitoring service for metrics, logs, and alarms, not for recording API call details like caller identity or source IP. Option C is wrong because VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, not API calls made to the AWS management plane. Option D is wrong because AWS Config evaluates resource configurations and compliance rules, and does not log API call metadata such as who made the call or the source IP address.

Practice this question →

MCQmedium

A company uses AWS CloudTrail to log all API calls in their AWS account for compliance and security auditing. Their compliance officer needs to prove to an external auditor that the CloudTrail log files have not been altered or deleted after they were created. The company must use the most cost-effective and built-in AWS feature to detect any tampering with the log files. What should the company enable?

A.Enable CloudTrail log file integrity validation

B.Enable server-side encryption for the CloudTrail log file S3 bucket using SSE-KMS

C.Configure CloudTrail to send logs to CloudWatch Logs and set a metric filter for changes

D.Enable multi-factor authentication (MFA) delete on the S3 bucket

AnswerA

Correct. Log file integrity validation uses hash-based digital signatures to verify that CloudTrail log files have not been modified or deleted after they were delivered to the S3 bucket. It is a built-in, cost-effective feature designed for this purpose.

Why this answer

CloudTrail log file integrity validation uses a hash chain (SHA-256) to create a digest file that is signed with a private key, allowing you to verify that log files have not been modified, deleted, or tampered with after delivery. This is a built-in, no-cost feature that directly meets the compliance officer's requirement to prove log integrity to an external auditor without additional services or costs.

Exam trap

The trap here is that candidates confuse encryption (which protects confidentiality) with integrity validation (which proves data has not been altered), leading them to choose SSE-KMS or MFA delete instead of the built-in, cost-free integrity validation feature.

Why the other options are wrong

Server-side encryption (SSE-KMS) protects data at rest but does not provide a mechanism to detect tampering or deletion of log files after they are created; it only ensures encryption.

CloudTrail log file integrity validation is the built-in, cost-effective feature for detecting tampering. Sending logs to CloudWatch Logs with a metric filter can monitor for changes but does not provide cryptographic proof of log file integrity.

MFA delete protects against accidental or unauthorized deletion of S3 objects, but it does not provide a mechanism to detect tampering or prove that log files have not been altered after creation. The question specifically requires a feature to detect tampering, not prevent deletion.

Practice this question →

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to enforce a policy that prevents any user, including account administrators, from creating Amazon S3 buckets that are publicly accessible across the entire organization. The policy must be centrally managed and cannot be overridden by individual account administrators. Which AWS feature should the security team use?

A.AWS Config rules with auto-remediation

B.Service Control Policies (SCPs) in AWS Organizations

C.AWS Identity and Access Management (IAM) policies with a Deny effect

D.Amazon Macie with automated response

AnswerB

SCPs are a type of organization policy that you can use to specify the maximum permissions for member accounts. They apply to all users and roles in the account, including the account root user, and cannot be overridden by any IAM policy within those accounts. By attaching an SCP that denies actions that make S3 buckets public (e.g., setting a bucket policy that allows public access), the security team can enforce this restriction across the entire organization.

Why this answer

Service Control Policies (SCPs) in AWS Organizations are the correct choice because they allow the security team to centrally define a policy that denies the creation of publicly accessible S3 buckets across all accounts in the organization. SCPs apply to all users, including account administrators, and cannot be overridden by any IAM policy or local account permissions, ensuring organization-wide enforcement.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking IAM Deny effects can be centrally managed and enforced across accounts, but IAM policies are account-scoped and can be overridden by local administrators, whereas SCPs operate at the organization level and are non-overridable.

Why the other options are wrong

IAM policies with a Deny effect can be overridden by account administrators who have full administrative privileges in their own accounts, as they can modify or remove IAM policies. The question requires a centrally managed policy that cannot be overridden, which is only possible with SCPs.

Amazon Macie is a data security service that discovers and protects sensitive data, but it does not enforce policies to prevent S3 bucket creation or public access; it only detects and alerts on public buckets or sensitive data.

Practice this question →

MCQmedium

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits, including SQL injection and cross-site scripting (XSS). The solution must integrate directly with the ALB and allow custom rules to be defined. Which AWS service should the company use?

A.AWS WAF

B.AWS Shield Advanced

C.Security Groups

D.AWS Firewall Manager

AnswerA

AWS WAF is a web application firewall that protects against common web exploits like SQL injection and XSS. It integrates directly with ALB and allows custom rules to be defined.

Why this answer

AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP(S) requests. It provides managed rules to block common web exploits such as SQL injection and cross-site scripting (XSS), and allows you to define custom rules using conditions like IP addresses, HTTP headers, and URI strings. This makes it the correct choice for protecting the ALB-hosted application against these specific threats.

Exam trap

The trap here is that candidates confuse AWS Shield Advanced (Layer 3/4 DDoS protection) with AWS WAF (Layer 7 web exploit filtering), or mistakenly think Security Groups can inspect application-layer traffic when they only filter at the network and transport layers.

Why the other options are wrong

AWS Shield Advanced provides DDoS protection, not application-layer filtering for SQL injection or XSS. It does not integrate directly with ALB for custom web exploit rules.

Security Groups act as a virtual firewall at the instance level, controlling inbound and outbound traffic based on IP addresses and ports. They cannot inspect application-layer traffic for web exploits like SQL injection or XSS, nor do they integrate with ALB for custom rule definitions.

AWS Firewall Manager is a policy management service that centrally configures and manages firewall rules across accounts and resources, but it does not itself provide web application protection against SQL injection or XSS. It can manage AWS WAF rules, but the question asks for the service that directly protects against these exploits and integrates with the ALB, which is AWS WAF.

Practice this question →

MCQeasy

According to the AWS Shared Responsibility Model, for which of the following is the customer ALWAYS responsible, regardless of the AWS service used?

A.Physical security of the data center

B.Patching the underlying hypervisor

C.Customer data and its classification

D.Network infrastructure management

AnswerC

Under the shared responsibility model, the customer retains ownership and control of their data. This includes deciding what data to store, how to classify it, who can access it, and whether to encrypt it. AWS never takes responsibility for customer data classification; it's solely the customer's obligation. Thus, this is the correct answer.

Why this answer

Under the AWS Shared Responsibility Model, the customer is always responsible for customer data and its classification, regardless of the service used. This includes deciding what data to store, how it is encrypted, and how access controls are configured. AWS never assumes responsibility for the content or classification of customer data, as this is entirely under the customer's control.

Exam trap

The trap here is that candidates often confuse operational responsibilities (like patching or network management) with customer-owned data governance, leading them to select options that AWS actually manages under the 'Security of the Cloud' pillar.

How to eliminate wrong answers

Option A is wrong because physical security of the data center is AWS's responsibility, not the customer's, as part of the 'Security of the Cloud' under the shared model. Option B is wrong because patching the underlying hypervisor is managed by AWS, as it is part of the virtualization infrastructure that the customer does not have access to. Option D is wrong because network infrastructure management, including routers, switches, and the AWS global network backbone, is AWS's responsibility; the customer only manages their own virtual network configurations (e.g., VPCs, subnets, security groups).

Practice this question →

MCQeasy

Which IAM feature allows you to grant temporary, limited access to AWS resources for users who don't have AWS accounts, such as third-party contractors?

A.IAM Groups

B.IAM Roles with cross-account access

C.IAM password policies

D.Service Control Policies (SCPs)

AnswerB

IAM Roles with cross-account access are the correct approach because they create a temporary, scoped trust relationship with an external identity. You configure the role's trust policy to allow a specific external AWS account or federated identity provider to call the Security Token Service (STS) AssumeRole operation, which provides short-lived credentials in return. The role's permission policy defines exactly which actions and resources the external party may access, so you apply fine-grained least-privilege controls without ever creating a permanent IAM user for that party. Because the credentials expire automatically (typically within one hour), this design reduces risk and is the standard pattern for granting controlled access to external collaborators or applications.

Why this answer

IAM Roles with cross-account access allow you to grant temporary, limited permissions to users from another AWS account or external identity providers (e.g., third-party contractors) without creating IAM users for them. The role is assumed via AWS Security Token Service (STS), which issues temporary credentials that expire after a defined duration, ensuring least-privilege access.

Exam trap

The trap here is that candidates often confuse IAM Roles with cross-account access with IAM Groups, thinking groups can be used to grant permissions to external users, but groups only apply to IAM users within your own account.

How to eliminate wrong answers

Option A is wrong because IAM Groups are used to organize IAM users within your own AWS account and assign permissions collectively; they cannot grant access to users who don't have AWS accounts. Option C is wrong because IAM password policies only enforce password complexity and rotation rules for IAM users in your account; they do not provide any mechanism for granting temporary access to external users. Option D is wrong because Service Control Policies (SCPs) are used in AWS Organizations to set permission guardrails for member accounts, not to grant temporary access to individual users or contractors.

Practice this question →

MCQmedium

A company has enabled Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scans, and AWS Config for compliance checks. The security team wants a single, centralized dashboard that aggregates all security findings from these services, provides a consolidated security score, and allows them to automate remediation workflows. Which AWS service should the team use?

A.AWS Trusted Advisor

B.AWS Security Hub

C.AWS Systems Manager

D.Amazon Detective

AnswerB

AWS Security Hub is the correct service. It provides a comprehensive view of security alerts and compliance status across AWS accounts. It integrates with services like GuardDuty, Inspector, and Config, aggregates findings, generates a consolidated security score, and supports automated remediation through AWS Config rules and custom actions.

Why this answer

AWS Security Hub is designed to aggregate findings from multiple AWS security services, including GuardDuty, Inspector, and Config, into a single dashboard. It provides a consolidated security score (via the security standards framework) and supports automated remediation through integration with AWS Systems Manager and EventBridge. This makes it the correct choice for centralized security visibility and response.

Exam trap

The trap here is that candidates may confuse AWS Security Hub with AWS Trusted Advisor, thinking both provide security recommendations, but Trusted Advisor lacks the ability to aggregate findings from multiple security services or provide a consolidated security score and automated remediation workflows.

Why the other options are wrong

AWS Trusted Advisor provides best-practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not aggregate findings from GuardDuty, Inspector, and Config into a single dashboard with a consolidated security score and automated remediation workflows.

AWS Systems Manager is an operations hub for managing EC2 and on-premises resources, patching, and automation, but it does not aggregate security findings from GuardDuty, Inspector, and Config into a single dashboard with a consolidated security score.

Amazon Detective is designed for in-depth investigation of security findings, not for aggregating findings from multiple services into a single dashboard or providing a consolidated security score.

Practice this question →

MCQmedium

An organization needs to sign a Business Associate Agreement (BAA) with AWS to run applications that process Protected Health Information (PHI) under HIPAA. Which statement about AWS and HIPAA is accurate?

A.AWS is HIPAA certified, meaning all AWS services automatically comply with HIPAA

B.AWS will sign a BAA for eligible services, and customers are responsible for configuring services to meet HIPAA requirements

C.PHI cannot be stored in the cloud because cloud environments are inherently non-compliant with HIPAA

D.HIPAA compliance is automatic once a BAA is signed with AWS

AnswerB

For HIPAA-eligible services, AWS will enter into a BAA with the customer, acknowledging responsibilities under the Shared Responsibility Model. Customers are then responsible for the 'security IN the cloud,' which includes configuring encryption, managing access with IAM roles and policies, enabling CloudTrail audit logging, and setting retention controls so that PHI is handled per HIPAA requirements. AWS is responsible for the physical and network infrastructure, but the customer's configuration determines whether the solution actually meets HIPAA standards.

Why this answer

AWS does not have a blanket HIPAA certification; instead, it provides a Business Associate Agreement (BAA) for specific services listed in its HIPAA Eligible Services Reference. Customers must sign a BAA with AWS and then configure those eligible services (e.g., enabling encryption, access controls, logging) to meet their own HIPAA compliance obligations. This shared responsibility model means AWS is responsible for the security of the cloud, while the customer is responsible for security in the cloud.

Exam trap

The trap here is that candidates assume signing a BAA automatically makes the entire AWS environment HIPAA-compliant, ignoring the shared responsibility model and the need to configure services correctly.

How to eliminate wrong answers

Option A is wrong because AWS is not 'HIPAA certified' as a whole; HIPAA compliance is not a certification but a regulatory framework, and only specific AWS services are eligible for a BAA, not all services. Option C is wrong because PHI can be stored in the cloud if the customer uses AWS services covered by a BAA and configures them correctly, as cloud environments are not inherently non-compliant. Option D is wrong because signing a BAA is a prerequisite, not a guarantee of compliance; the customer must still implement technical and administrative safeguards (e.g., encryption, access controls, audit logging) to meet HIPAA requirements.

Practice this question →

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to prevent accounts in the 'Development' OU from launching any resources in regions outside of us-east-1 and eu-west-1. Which AWS Organizations feature allows this restriction?

A.IAM permission boundaries

B.Resource-based policies attached to each S3 bucket

C.Service Control Policies (SCPs)

D.AWS Config rules across all accounts

AnswerC

SCPs are applied at the OU or account level in AWS Organizations and act as guardrails on all accounts within the OU. An SCP denying all regions except us-east-1 and eu-west-1 would apply to every account in the Development OU, regardless of their individual IAM policies.

Why this answer

Service Control Policies (SCPs) are the correct AWS Organizations feature because they allow you to centrally control the maximum available permissions for all accounts within an OU. By attaching an SCP that denies all actions in regions other than us-east-1 and eu-west-1, the security team can enforce this restriction across all 'Development' accounts, even if IAM policies within those accounts allow broader access.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking that IAM permission boundaries or resource-based policies can enforce cross-account region restrictions, but SCPs are the only mechanism that operates at the organization level to centrally limit permissions for all accounts in an OU.

How to eliminate wrong answers

Option A is wrong because IAM permission boundaries are applied to individual IAM users or roles within a single account, not across multiple accounts in an OU, and they cannot restrict the region where resources are launched at the organization level. Option B is wrong because resource-based policies attached to S3 buckets only control access to those specific S3 buckets, not the ability to launch any resources in other regions. Option D is wrong because AWS Config rules evaluate resource configurations for compliance after resources are created, but they do not prevent the launch of resources in unauthorized regions; they only detect and report non-compliance.

Practice this question →

MCQeasy

A company's public-facing web application is being attacked with SQL injection and cross-site scripting (XSS) attempts. Which AWS service should they deploy to detect and block these web application attacks?

A.AWS Shield Standard

B.Amazon GuardDuty

C.AWS WAF

D.Amazon Inspector

AnswerC

AWS WAF is a web application firewall that operates at layer 7 (HTTP/HTTPS) and is designed to inspect incoming web traffic for malicious payloads. You can attach a web access control list (web ACL) to Application Load Balancer, CloudFront, API Gateway, or App Runner, and use managed rule groups specifically tailored to block SQL injection and cross-site scripting patterns in query strings, URI paths, headers, and request bodies. Because these attacks are differentiated by evaluating request content and structure, AWS WAF is the correct service to actively filter and block them at the edge or application layer before they reach your application.

Why this answer

AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It allows you to create custom rules to filter and monitor HTTP(S) requests based on conditions such as IP addresses, HTTP headers, or request body patterns, and can block malicious traffic before it reaches your application.

Exam trap

The trap here is that candidates often confuse AWS Shield (DDoS protection) with AWS WAF (web application firewall), but Shield operates at Layer 3/4 and cannot inspect or block application-layer payloads like SQL injection or XSS.

How to eliminate wrong answers

Option A is wrong because AWS Shield Standard provides always-on protection against DDoS attacks at the network and transport layers (Layer 3/4), not against application-layer attacks like SQL injection or XSS. Option B is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity using VPC Flow Logs, DNS logs, and CloudTrail events, but it does not actively block web application attacks at the HTTP request level. Option D is wrong because Amazon Inspector is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities and unintended network exposure, not a runtime web application firewall that can inspect and block HTTP requests.

Practice this question →

MCQmedium

Which AWS service provides centralized governance and compliance across multiple AWS accounts in an organization?

A.AWS IAM

B.AWS Config

C.AWS Organizations

D.Amazon Macie

AnswerC

AWS Organizations is the service that gives centralized governance for multiple AWS accounts, letting you create accounts, group them into organizational units, and apply service control policies that restrict the maximum permissions for all users and roles under those accounts. It also provides consolidated billing, enabling a single payer account to aggregate usage and get volume discounts. This hierarchical, policy-based management is exactly what multi-account governance requires.

Why this answer

AWS Organizations is the correct service because it provides centralized governance and compliance across multiple AWS accounts by enabling you to create a hierarchy of accounts with Service Control Policies (SCPs) that centrally control permissions. SCPs allow you to enforce compliance rules, such as restricting the use of specific AWS services or regions, across all accounts in the organization without requiring individual account-level configuration.

Exam trap

The trap here is that candidates often confuse AWS Config's compliance evaluation capabilities with centralized governance, but AWS Config is a detective service that reports on compliance after resources are created, whereas AWS Organizations provides preventive governance through SCPs that block non-compliant actions before they occur.

How to eliminate wrong answers

Option A is wrong because AWS IAM is an identity and access management service that controls permissions for individual users, groups, and roles within a single AWS account, not across multiple accounts in an organization. Option B is wrong because AWS Config is a service that evaluates and records resource configurations for compliance within individual accounts or across accounts via aggregators, but it does not provide centralized governance or policy enforcement across accounts—it is a detective tool, not a preventive one. Option D is wrong because Amazon Macie is a data security service that uses machine learning to discover and protect sensitive data in Amazon S3, and it does not provide governance or compliance controls across multiple accounts.

Practice this question →

MCQmedium

A financial services company stores sensitive transaction data in Amazon S3. The company must encrypt the data at rest using keys that are stored in a hardware security module (HSM) validated under FIPS 140-2 Level 3. Additionally, the company requires full control over the key lifecycle, including rotation and deletion, and AWS must not have any access to the keys. Which AWS service should the company use to generate and store the encryption keys?

A.AWS Key Management Service (KMS) with a customer managed key

B.AWS CloudHSM

C.AWS Secrets Manager

D.AWS Certificate Manager (ACM)

AnswerB

AWS CloudHSM provides dedicated HSMs that are FIPS 140-2 Level 3 validated. Customers have full control over the HSMs and the keys stored inside them, including the ability to rotate and delete keys. AWS cannot access the keys because the HSMs are dedicated to the customer and managed by the customer.

Why this answer

AWS CloudHSM is the correct choice because it provides dedicated hardware security modules (HSMs) that are validated under FIPS 140-2 Level 3, allowing you to generate and store encryption keys entirely within the HSM. With CloudHSM, AWS has no access to your keys, and you retain full control over key lifecycle operations such as rotation and deletion, meeting the strict compliance and security requirements of the financial services company.

Exam trap

The trap here is that candidates often confuse AWS KMS customer managed keys with full customer control, but KMS still allows AWS to manage the underlying HSM infrastructure and does not meet FIPS 140-2 Level 3 requirements, whereas CloudHSM provides exclusive customer control and a higher validation level.

Why the other options are wrong

AWS KMS with a customer managed key does not use a hardware security module (HSM) validated under FIPS 140-2 Level 3; it uses FIPS 140-2 Level 2 or Level 3 overall, but AWS retains access to the keys and does not provide exclusive customer control over the HSM.

AWS Secrets Manager is designed for securely storing and rotating secrets like database credentials, not for generating or managing encryption keys with FIPS 140-2 Level 3 validated HSMs. It does not provide the required HSM-level key control or prevent AWS access to keys.

AWS Certificate Manager (ACM) is used to provision, manage, and deploy SSL/TLS certificates, not for generating and storing encryption keys for data at rest in S3. It does not provide FIPS 140-2 Level 3 validated HSM or full customer control over key lifecycle with no AWS access.

Practice this question →

MCQmedium

A healthcare company is required to encrypt all protected health information (PHI) stored in Amazon S3. The company must maintain control over the encryption keys, rotate them annually, and log all key usage. Which AWS service or feature should they use to meet these requirements?

A.Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3)

B.AWS Key Management Service (AWS KMS) with customer managed keys

C.Amazon S3 server-side encryption with customer-provided keys (SSE-C)

D.AWS Certificate Manager (ACM)

AnswerB

AWS KMS with customer managed keys places the cryptographic key material under your direct control, allowing you to define key policies, set automatic yearly rotation, and grant granular permissions. Each decrypt operation is recorded in AWS CloudTrail, so you can verify exactly when and how the protected health information was accessed. This end-to-end governance and audit trail satisfies both the encryption and logical access control requirements of the healthcare company.

Why this answer

AWS KMS with customer managed keys is correct because it allows the healthcare company to maintain full control over the encryption keys, enforce annual rotation (via automatic or manual key rotation), and log all key usage through AWS CloudTrail. This meets the compliance requirements for protecting PHI in S3 while retaining key management authority.

Exam trap

The trap here is that candidates often confuse SSE-S3 (which is simpler but lacks key control and logging) with the required key management and audit capabilities, or they mistakenly think ACM can be used for S3 encryption when it only handles transport layer security.

Why the other options are wrong

SSE-S3 uses Amazon-managed keys, not customer-managed keys, so the company cannot maintain control over the keys, rotate them annually, or log key usage.

SSE-C requires the customer to manage the encryption keys themselves, including key rotation and logging, but AWS does not log key usage for SSE-C; the customer must implement their own logging. The question requires AWS to log all key usage, which SSE-C does not provide.

AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates, not for encrypting data at rest in S3 or managing encryption keys.

Practice this question →

MCQmedium

A company needs to allow inbound HTTPS traffic (port 443) to their EC2 web servers while blocking all other inbound traffic. The solution should be stateful — return traffic for allowed inbound connections should automatically be permitted without additional rules. Which AWS feature provides this?

A.Network Access Control Lists (NACLs)

B.AWS WAF rules

C.Security groups

D.VPC route tables

AnswerC

Security groups are stateful virtual firewalls that operate at the instance level. When you add an inbound rule allowing traffic on port 443, the security group automatically creates a temporary outbound rule to permit the corresponding return traffic, so you do not need to define a separate outbound rule for that response. This connection tracking is the core of stateful filtering, and there is no explicit deny rule—traffic is denied by default unless an allow rule exists.

Why this answer

Security groups act as a stateful virtual firewall for EC2 instances. When you allow inbound HTTPS traffic on port 443, the security group automatically tracks the connection state and permits the corresponding outbound return traffic without requiring an explicit outbound rule. This stateful behavior is inherent to security groups and is the correct choice for the described requirement.

Exam trap

The trap here is that candidates often confuse the stateless nature of Network ACLs with the stateful behavior of security groups, assuming NACLs automatically permit return traffic, which they do not.

How to eliminate wrong answers

Option A is wrong because Network ACLs are stateless, meaning you must explicitly define both inbound and outbound rules to allow return traffic; they do not automatically permit response traffic. Option B is wrong because AWS WAF is a web application firewall that inspects HTTP/HTTPS requests at the application layer (Layer 7) and does not control network-level stateful traffic filtering or port-based access. Option D is wrong because VPC route tables control the path of network traffic (routing) between subnets and gateways, not the filtering or stateful tracking of individual connections.

Practice this question →

MCQeasy

Which AWS service helps customers understand the compliance programs that AWS has been validated against, such as PCI DSS, HIPAA, and SOC 2?

A.AWS Trusted Advisor

B.AWS Config

C.AWS Artifact

D.AWS Security Hub

AnswerC

AWS Artifact is the self-service portal where you can download AWS compliance reports and agreements, including SOC, PCI, ISO, and HIPAA certifications, as well as NDAs and BAAs. It directly serves customers' audit and compliance needs by providing access to AWS's audited documentation and contractual terms. For obtaining AWS's compliance audit reports, AWS Artifact is the correct service because it is specifically designed to distribute these artifacts.

Why this answer

AWS Artifact is the correct service because it provides on-demand access to AWS’s compliance reports, such as PCI DSS, HIPAA, and SOC 2, as well as the AWS Service Organization Controls (SOC) reports. It allows customers to download and review the specific certifications and attestations that AWS has been validated against, directly supporting audit and compliance needs.

Exam trap

The trap here is that candidates often confuse services that help with internal compliance posture (like AWS Config or Security Hub) with the service that provides AWS’s own third-party compliance certifications, leading them to pick a wrong answer that sounds compliance-related but does not deliver the actual audit reports.

How to eliminate wrong answers

Option A is wrong because AWS Trusted Advisor is an advisory tool that inspects your AWS environment and provides recommendations to optimize cost, performance, security, and fault tolerance—it does not provide compliance program validation reports. Option B is wrong because AWS Config is a service that evaluates and records resource configurations against desired policies (e.g., using AWS Config rules), but it does not host or deliver third-party compliance attestations like PCI DSS or SOC reports. Option D is wrong because AWS Security Hub aggregates security findings from multiple AWS services and third-party tools, providing a centralized view of security alerts and compliance status based on standards like CIS, but it does not provide the underlying compliance program validation documents that AWS itself has been audited against.

Practice this question →

MCQmedium

Which AWS service acts as a centralized firewall for traffic inspection between VPCs, between VPCs and on-premises networks, and for internet traffic?

A.Security Groups

B.Network Access Control Lists (NACLs)

C.AWS Network Firewall

D.AWS WAF

AnswerC

AWS Network Firewall is a managed, stateful network firewall that you deploy inline at the VPC edge by attaching firewall endpoints to the VPC and updating route tables to direct traffic through them. It performs deep packet inspection, supports stateful rule groups with protocol-awareness, domain-based filtering, and Suricata-compatible intrusion detection and prevention, making it suitable for inspecting VPC-to-VPC, VPC-to-internet, and on-premises-to-VPC traffic. It integrates with AWS Firewall Manager, allowing you to centrally apply and manage firewall policies across multiple accounts and VPCs from a single governance point.

Why this answer

AWS Network Firewall is a managed service that provides a centralized firewall to inspect and filter traffic across VPCs, between VPCs and on-premises networks (via AWS Transit Gateway or VPN/Direct Connect), and for internet-bound traffic. It supports stateful and stateless rules, intrusion prevention (IPS), and domain filtering, making it the correct choice for a unified traffic inspection solution.

Exam trap

The trap here is that candidates often confuse AWS Network Firewall with Security Groups or NACLs, thinking those can provide centralized traffic inspection across VPCs and hybrid networks, but they are limited to instance-level or subnet-level filtering and lack the centralized, stateful inspection capabilities required for this use case.

How to eliminate wrong answers

Option A is wrong because Security Groups are stateful virtual firewalls that operate at the instance level (ENI) and cannot inspect traffic between VPCs or between VPCs and on-premises networks; they lack centralized management and do not support traffic inspection for internet-bound traffic across multiple VPCs. Option B is wrong because Network Access Control Lists (NACLs) are stateless, operate at the subnet level, and cannot provide centralized firewall capabilities across VPCs or hybrid connections; they also do not support stateful inspection or advanced threat detection. Option D is wrong because AWS WAF is a web application firewall that protects web applications from common exploits (e.g., SQL injection, XSS) at the application layer (HTTP/HTTPS), not a network-layer firewall for general traffic inspection between VPCs, on-premises, or internet traffic.

Practice this question →

MCQmedium

A company must encrypt all data at rest stored in Amazon S3 and wants AWS to manage the encryption keys. Which S3 encryption option requires the least operational overhead?

A.SSE-C (Customer-Provided Keys)

B.SSE-KMS (AWS KMS-Managed Keys)

C.SSE-S3 (Amazon S3-Managed Keys)

D.Client-side encryption

AnswerC

SSE-S3 (Amazon S3-Managed Keys) is the correct answer because it provides transparent, fully-managed server-side encryption with no customer key management or additional costs. AWS automatically encrypts each object with a unique key, then encrypts that key with a rotating master key, all entirely on the server side. It is the default encryption mechanism when you enable the bucket default encryption setting, requiring no code, no key storage, and no per-request API fees, making it the ideal zero-overhead encryption option.

Why this answer

SSE-S3 uses Amazon S3-managed keys, where AWS fully handles key creation, management, and rotation with no configuration required from the user. This option provides the least operational overhead because you simply enable server-side encryption on the bucket or object, and AWS manages the entire encryption process transparently.

Exam trap

The trap here is that candidates often confuse 'AWS managed keys' with SSE-KMS, assuming KMS is the default AWS-managed option, but SSE-S3 is the true fully managed key service with zero configuration overhead.

How to eliminate wrong answers

Option A is wrong because SSE-C requires you to provide and manage your own encryption keys, including key storage, rotation, and secure transmission, which adds significant operational overhead. Option B is wrong because SSE-KMS uses AWS KMS-managed keys, which still requires you to create, manage, and control key policies, permissions, and key rotation schedules, increasing operational complexity compared to SSE-S3. Option D is wrong because client-side encryption requires you to encrypt data before uploading to S3, manage encryption keys locally, and handle decryption on retrieval, resulting in the highest operational overhead of all options.

Practice this question →

MCQmedium

A company wants to set up a new multi-account AWS environment with pre-configured security guardrails, a logging account, an audit account, and a predefined structure for creating new accounts — all based on AWS best practices — with minimal manual configuration. Which AWS service provides this automated account setup?

A.AWS CloudFormation StackSets

B.AWS Organizations

C.AWS Control Tower

D.AWS Security Hub

AnswerC

Control Tower automates the entire landing zone setup: creates the management account structure, configures a log archive account, sets up an audit account, and applies mandatory guardrails (preventive SCPs and detective Config rules) following AWS best practices.

Why this answer

AWS Control Tower is the correct answer because it provides a fully automated, best-practices-based setup for a multi-account AWS environment, including pre-configured security guardrails (using Service Control Policies), a logging account, an audit account, and a predefined account structure via Account Factory. This eliminates the need for manual configuration of these foundational components.

Exam trap

The trap here is that candidates often confuse AWS Organizations (which provides the raw capability to manage multiple accounts) with AWS Control Tower (which automates the entire setup with best-practice guardrails and account factory), leading them to pick Organizations as the 'automated' solution when it actually requires significant manual configuration.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation StackSets allow you to deploy infrastructure across multiple accounts and regions, but they do not automatically set up the initial multi-account structure, guardrails, or dedicated logging/audit accounts — they require you to manually define and manage the stack instances. Option B is wrong because AWS Organizations provides the underlying organizational hierarchy and policy management (SCPs) but does not include pre-configured guardrails, a logging account, an audit account, or a predefined account creation workflow — it is a building block, not a turnkey solution. Option D is wrong because AWS Security Hub is a security posture management service that aggregates findings from various AWS services (like GuardDuty, Inspector, etc.) but does not automate the setup of a multi-account environment, guardrails, or account structure.

Practice this question →

MCQmedium

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that no Amazon EC2 instance can be launched with a public IPv4 address in any member account. The team needs a preventive control that centrally blocks the launch action if a public IP is assigned, and the control must automatically apply to all existing and future accounts in the organization. Which AWS feature should the security team use to meet these requirements?

A.AWS Config rule with an automatic remediation action that terminates the instance after launch

B.IAM policy with a condition key to deny ec2:RunInstances when a public IP is assigned

C.Service control policy (SCP) in AWS Organizations

D.AWS Firewall Manager security group policy

AnswerC

An SCP can be attached to the root organizational unit (OU) or the entire organization to deny the ec2:RunInstances action when the request includes a parameter for a public IP address (e.g., condition key 'ec2:AssociatePublicIpAddress'). SCPs are preventive policies that apply to all principals (including the root user) in all member accounts, and they are automatically inherited by new accounts added to the organization. This meets all the requirements.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum available permissions for all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action when the request includes a public IP address assignment (using the ec2:AssociatePublicIpAddress condition key), you can prevent any EC2 instance from being launched with a public IPv4 address. This control applies automatically to all existing and future member accounts without requiring per-account configuration.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, not realizing that SCPs are the only mechanism in AWS Organizations that can centrally and preventively restrict actions across all accounts, including future ones, without requiring per-account configuration.

Why the other options are wrong

AWS Config rules with automatic remediation are detective and reactive, not preventive. They terminate the instance after launch, which does not block the launch action itself and may incur costs or resource usage before termination.

IAM policies are account-level and cannot be centrally applied across all accounts in an AWS Organization. They must be attached individually to each account, and they do not automatically apply to new accounts.

AWS Firewall Manager security group policies manage security group rules across accounts, but they do not prevent EC2 instances from being launched with public IPv4 addresses. They are not a preventive control for blocking launch actions based on public IP assignment.

Practice this question →

MCQmedium

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS) at the edge, before the requests reach the application. The company wants to use pre-built rule sets maintained by AWS to quickly enable protection, and the solution should be fully managed with no servers to manage. Which AWS service should the company use?

A.AWS Shield Advanced

B.Amazon GuardDuty

C.AWS WAF

D.AWS Network Firewall

AnswerC

AWS WAF is a fully managed web application firewall that enables customers to monitor and control HTTP(S) requests to their applications. It provides managed rule groups for common threats like SQL injection and cross-site scripting (XSS). The service integrates seamlessly with Application Load Balancers, allowing traffic to be inspected at the edge before reaching the backend instances, and requires no server management.

Why this answer

AWS WAF is a fully managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates with Application Load Balancers (ALBs) and allows you to use pre-built, AWS-managed rule sets (e.g., the AWS Managed Rules for SQL injection and XSS) to quickly enable protection at the edge, before traffic reaches the EC2 instances. This meets the requirement for a serverless, managed solution with no infrastructure to maintain.

Exam trap

The trap here is that candidates often confuse AWS WAF with AWS Shield Advanced, mistakenly thinking Shield Advanced handles application-layer attacks like SQL injection, when in fact it focuses on DDoS mitigation at the network and transport layers.

Why the other options are wrong

AWS Shield Advanced provides DDoS protection, not application-layer filtering for SQL injection or XSS. It does not offer pre-built rule sets for web attacks.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not actively block web attacks like SQL injection or XSS at the edge. It operates on VPC Flow Logs, DNS logs, and CloudTrail events, not on incoming HTTP requests.

AWS Network Firewall is a managed firewall for VPC network traffic, not for web application layer attacks like SQL injection or XSS. It operates at layers 3-4 and 7 for network filtering, but lacks the pre-built web-specific rule sets that AWS WAF provides.

Practice this question →

MCQhard

A company recently migrated to AWS and needs to ensure their S3 buckets are not publicly accessible. Which combination of controls best prevents accidental public S3 exposure?

A.Enable S3 server-side encryption on all buckets

B.Enable S3 Block Public Access at the account level and use AWS Config to detect violations

C.Enable S3 versioning on all buckets

D.Enable S3 Transfer Acceleration for all buckets

AnswerB

Block Public Access at the account level enforces four settings—BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets—that override all existing and future bucket policies and ACLs, effectively making it impossible to grant public read/write access. AWS Config complements this by continuously evaluating bucket configurations against rules like s3-bucket-public-read-prohibited and s3-bucket-level-public-access-prohibited, alerting on any violation that would allow public access. This combination of preventive control and detective monitoring is the industry-standard guardrail and directly addresses the risk of public exposure from misconfigured policies.

Why this answer

S3 Block Public Access at the account level provides a centralized, enforceable guardrail that prevents any bucket or object from being made publicly accessible, overriding any bucket-level policies or ACLs. AWS Config can then continuously monitor for configuration violations, such as a bucket policy that grants public access, and trigger remediation or alerts. Together, these controls create a defense-in-depth approach that both prevents accidental exposure and detects non-compliance.

Exam trap

The trap here is that candidates often confuse data protection features (encryption, versioning, acceleration) with access control mechanisms, leading them to select options that secure data in transit or at rest but do not prevent public exposure.

How to eliminate wrong answers

Option A is wrong because S3 server-side encryption protects data at rest but does not control access permissions; a bucket can be encrypted yet still publicly readable. Option C is wrong because S3 versioning preserves object versions and aids in recovery from accidental deletion or overwrites, but it has no effect on public access controls. Option D is wrong because S3 Transfer Acceleration speeds up uploads over long distances using edge locations, but it does not modify or enforce bucket access policies.

Practice this question →

MCQmedium

A company is deploying an application that processes payment card data. Which AWS compliance program provides assurance that AWS infrastructure meets Payment Card Industry Data Security Standard requirements?

A.SOC 2 Type II

B.PCI DSS Level 1 compliance

C.HIPAA compliance

D.ISO 27001 certification

AnswerB

AWS maintains PCI DSS Level 1 compliance, which is the highest level of validation required by the Payment Card Industry Security Standards Council for service providers handling large volumes of transactions. This means AWS's infrastructure and services have undergone rigorous annual assessments and continuous monitoring to meet all PCI DSS requirements. Customers can download AWS's Attestation of Compliance directly from AWS Artifact to support their own PCI compliance obligations under the shared responsibility model.

Why this answer

PCI DSS Level 1 compliance is the highest level of validation for organizations that process payment card data, and AWS has been validated as a Level 1 service provider. This means AWS infrastructure has undergone the required on-site assessments and annual audits to meet the Payment Card Industry Data Security Standard (PCI DSS) requirements, providing assurance for the company's deployment.

Exam trap

The trap here is that candidates often confuse general security certifications (like SOC 2 or ISO 27001) with the specific, mandatory compliance program for payment card data, which is PCI DSS Level 1.

How to eliminate wrong answers

Option A is wrong because SOC 2 Type II reports focus on controls related to security, availability, processing integrity, confidentiality, and privacy, but they do not specifically certify compliance with PCI DSS requirements. Option C is wrong because HIPAA compliance is specific to the healthcare industry and protects protected health information (PHI), not payment card data. Option D is wrong because ISO 27001 certification is a general information security management standard that does not specifically address the 12 requirements of PCI DSS.

Practice this question →

MCQmedium

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The security team requires that no long-term access keys be stored on the instance. Which IAM feature should be used to grant the EC2 instance permission to access S3?

A.Create an IAM user and embed the access key in the application code

B.Store the access key in an EC2 environment variable

C.Attach an IAM role to the EC2 instance

D.Use an IAM group to assign the permissions to the EC2 instance

AnswerC

An IAM role attached to an EC2 instance (via an instance profile) provides temporary, automatically rotating credentials. The EC2 metadata service delivers these credentials to the application, eliminating the need to store any long-term access keys.

Why this answer

An IAM role can be attached to an EC2 instance, allowing the instance to obtain temporary security credentials from AWS STS via the instance metadata service. This eliminates the need to store long-term access keys on the instance, satisfying the security team's requirement. The EC2 instance automatically rotates these temporary credentials before they expire, providing secure, programmatic access to the S3 bucket.

Exam trap

The trap here is that candidates may confuse IAM roles with IAM users or groups, thinking that any IAM entity can be attached to an EC2 instance, but only IAM roles support the temporary credential workflow required for secure, keyless access.

How to eliminate wrong answers

Option A is wrong because embedding an IAM user's access key in application code stores long-term credentials on the instance, directly violating the security requirement. Option B is wrong because storing the access key in an EC2 environment variable still persists long-term credentials on the instance, which is insecure and contradicts the no-long-term-keys policy. Option D is wrong because an IAM group is used to manage permissions for IAM users, not for EC2 instances; it cannot be directly attached to an EC2 instance to grant permissions.

Practice this question →

MCQmedium

A company runs a data analytics application on an Amazon EC2 instance. The application needs to read CSV files from an Amazon S3 bucket to process them. The security team requires that no long-term AWS credentials (access key ID and secret access key) be stored on the instance. The instance is already launched in a private subnet within a VPC. Which solution meets the security requirement and provides the necessary access?

A.Store the AWS access key ID and secret access key in a configuration file on the instance's local disk.

B.Create an IAM role with the required S3 read permissions. Attach the role to the EC2 instance profile.

C.Write a resource-based policy on the S3 bucket that allows access based on the private IP address of the EC2 instance.

D.Create a new IAM user with the required permissions. Store the IAM user's access key and secret key in AWS Systems Manager Parameter Store, and configure the application to retrieve them at runtime.

AnswerB

An IAM role is the recommended identity for an EC2 application because the instance assumes the role through its instance profile, and the AWS SDK retrieves temporary credentials from the EC2 instance metadata service (IMDS). These credentials are issued by AWS STS, are valid for a limited session, and are automatically rotated before expiry, so the application never handles a long-lived secret. Attaching the role to the instance profile and allowing the application to use the SDK's default credential chain gives the instance exactly the S3 read permissions scoped by the role's policy.

Why this answer

It uses an IAM role attached to an EC2 instance profile, which allows the application to obtain temporary AWS credentials via the instance metadata service (IMDS). This eliminates the need to store long-term access keys on the instance, satisfying the security requirement while granting the necessary S3 read permissions.

Exam trap

The trap here is that candidates may think storing credentials in a secure service like Systems Manager Parameter Store (Option D) is sufficient, but it still involves long-term IAM user keys, whereas the IAM role approach provides fully temporary credentials that are automatically rotated and never stored on the instance.

Why the other options are wrong

Storing long-term AWS credentials (access key ID and secret access key) on the instance violates the security requirement that no long-term credentials be stored on the instance.

S3 bucket policies cannot grant access based on EC2 instance private IP addresses because private IPs are not a supported condition key for S3 actions; they are not reliably associated with the instance in a way that S3 can evaluate.

The question explicitly requires that no long-term AWS credentials be stored on the instance. While Parameter Store avoids storing keys on the disk, the application still retrieves and uses long-term IAM user access keys at runtime, violating the security requirement.

Practice this question →

MCQeasy

Which AWS IAM object should be used to grant permissions to an AWS service (like EC2 or Lambda) to access other AWS services on behalf of the application?

A.IAM User with access keys

B.IAM Group

C.IAM Role

D.IAM Policy

AnswerC

An IAM Role is an identity that AWS services assume to receive short-term, limited-privilege credentials from AWS STS. For EC2, you assign an instance profile to the instance, which enables it to assume the role and access other services securely. Lambda uses an execution role defined at creation time. This eliminates the need for long-term access keys and is the secure, best-practice method for service-to-service access.

Why this answer

An IAM Role is the correct AWS identity to grant permissions to an AWS service (e.g., EC2, Lambda) because it provides temporary security credentials via AWS Security Token Service (STS). Unlike IAM Users, roles are designed to be assumed by trusted entities, including AWS services, enabling them to access other AWS resources on behalf of the application without long-lived access keys.

Exam trap

The trap here is that candidates often confuse IAM Policies with IAM Roles, thinking a policy alone can grant permissions to a service, but a policy is just a permission document and must be attached to an identity (like a Role) that the service can assume.

How to eliminate wrong answers

Option A is wrong because an IAM User with access keys is a long-lived identity intended for human users or programmatic access, not for granting permissions to an AWS service; using access keys for services like EC2 or Lambda would require embedding static credentials, which is a security anti-pattern. Option B is wrong because an IAM Group is a container for IAM Users and cannot be directly assigned to an AWS service; groups are used to manage permissions for multiple users, not for service-to-service access. Option D is wrong because an IAM Policy is a document that defines permissions (e.g., JSON policy statements) but is not an identity that can be assumed; a policy must be attached to an IAM User, Group, or Role to grant permissions, and only a Role can be assumed by an AWS service.

Practice this question →

MCQmedium

A multi-national company needs to ensure their AWS resources in Europe comply with GDPR by keeping all data within EU regions. Which approach ensures data remains in Europe?

A.AWS automatically keeps EU customer data in EU regions without any configuration

B.Deploy resources only in EU AWS Regions and use SCPs to prevent deployment outside EU

C.Enable CloudTrail in all regions to monitor data movement

D.GDPR compliance requires using only AWS GovCloud Regions

AnswerB

Deploying workloads exclusively in EU Regions keeps data at rest and in transit within the EU, because AWS services do not automatically replicate data across Regions unless a feature like cross-Region replication is explicitly enabled. To enforce this at scale, you can attach service control policies (SCPs) to all accounts in an AWS Organization that use the aws:RequestedRegion condition key to deny any Create, Update, or Run action where the Region is outside an approved EU list. This combination of placement and preventive guardrails directly addresses GDPR data-residency requirements.

Why this answer

Deploying resources only in EU AWS Regions (such as eu-west-1, eu-central-1) combined with Service Control Policies (SCPs) that explicitly deny actions outside those regions ensures data residency. SCPs are organization-level policies in AWS Organizations that can restrict member accounts from launching resources in non-EU regions, providing a preventive control to enforce GDPR data localization requirements.

Exam trap

The trap here is that candidates may confuse detective controls (like CloudTrail or Config) with preventive controls (like SCPs or IAM policies), or mistakenly believe AWS automatically enforces data residency without customer configuration.

How to eliminate wrong answers

Option A is wrong because AWS does not automatically keep EU customer data in EU regions; customers must explicitly choose EU regions for resource deployment, and AWS offers global services (e.g., IAM, Route 53) that may process metadata outside the EU. Option C is wrong because CloudTrail is a detective control that logs API activity but does not prevent data from leaving EU regions; it only provides visibility after the fact. Option D is wrong because AWS GovCloud Regions are designed for US government workloads and compliance (e.g., ITAR, FedRAMP), not for GDPR compliance in Europe, and they are located in the US.

Practice this question →

MCQmedium

A company manages multiple AWS accounts using AWS Organizations and maintains hundreds of Amazon S3 buckets across these accounts. The security team wants a service that automatically scans all S3 bucket policies and identifies any bucket that grants access to an external AWS account (an account outside the organization). The team needs to receive findings when such policies are detected and wants to review the findings in a centralized dashboard. Which AWS service should the security team use to meet these requirements?

A.AWS Trusted Advisor

B.AWS IAM Access Analyzer

C.AWS Config

D.AWS Service Catalog

AnswerB

IAM Access Analyzer analyzes resource-based policies across supported resources (including S3 buckets) and identifies when access is granted to an external entity, such as an AWS account outside the organization. It provides a centralized console to review findings and can send alerts via AWS Security Hub or Amazon EventBridge. This directly meets the requirement to automatically detect buckets accessible to external accounts.

Why this answer

AWS IAM Access Analyzer helps identify resources shared with external principals by analyzing resource-based policies (such as S3 bucket policies). It can be configured to use a trusted zone (e.g., the AWS Organizations management account or a specific OU) so that any policy granting access to an AWS account outside that zone generates a finding. These findings are aggregated in the IAM Access Analyzer console, providing a centralized dashboard for review.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to monitor resource changes with the specific need to analyze policy content for external access, but Config requires custom Lambda rules or conformance packs to replicate what IAM Access Analyzer does natively.

Why the other options are wrong

AWS Trusted Advisor checks S3 bucket permissions for public access, but it does not specifically scan for access granted to external AWS accounts outside the organization. It also lacks a centralized dashboard for cross-account findings.

AWS Config evaluates resource compliance against rules but does not automatically scan S3 bucket policies for access from external AWS accounts or provide a centralized dashboard for such findings.

AWS Service Catalog is used to create and manage IT service catalogs of approved AWS resources, not for analyzing S3 bucket policies for external access. It does not provide automated scanning or centralized findings for cross-account access.

Practice this question →

MCQmedium

A security team needs to analyze VPC network traffic to detect anomalies and investigate security incidents. Which AWS service captures and stores network flow data for VPCs?

A.AWS CloudTrail

B.VPC Flow Logs

C.Amazon Inspector

D.Amazon GuardDuty

AnswerB

VPC Flow Logs capture detailed metadata about the network traffic flowing through your VPC, including source and destination IP addresses, ports, protocol, packet and byte counts, and whether the traffic was accepted or rejected. Because this information is collected for every network interface, it provides the raw data needed for forensics, traffic analysis, and detecting anomalous behavior. Therefore, VPC Flow Logs is the service that directly captures and stores the flow data described in the question.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces within a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This data is stored in Amazon CloudWatch Logs or Amazon S3, enabling security teams to analyze traffic patterns, detect anomalies, and investigate incidents. AWS CloudTrail, Amazon Inspector, and Amazon GuardDuty serve different purposes—auditing API calls, assessing vulnerabilities, and threat detection, respectively—but do not directly capture raw network flow data.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (network traffic metadata) with AWS CloudTrail (API activity logs), often selecting CloudTrail because both involve logging, but CloudTrail does not capture network-level flow data.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity and user actions within AWS, not network traffic flow data; it captures who did what and when, not the IP packets traversing VPCs. Option C is wrong because Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, but it does not capture or store ongoing network flow logs. Option D is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events to identify malicious activity, but it does not itself capture or store the raw flow data—it consumes it from VPC Flow Logs.

Practice this question →

MCQmedium

A company must maintain audit records of all user actions and configuration changes across their AWS accounts. Which AWS service should they enable to capture this information?

A.Amazon CloudWatch Logs

B.AWS Config

C.AWS CloudTrail

D.VPC Flow Logs

AnswerC

AWS CloudTrail is the service designed to record every AWS API call made by a user, role, or AWS service, capturing essential audit data such as the caller's identity, the source IP address, the request parameters, and the response elements. These events form a complete audit trail that can be used for security analysis, operational troubleshooting, and governance, and they can be delivered to an S3 bucket or CloudWatch Logs for long-term storage and monitoring. This makes CloudTrail the definitive answer for tracking user activity and API usage across all AWS accounts.

Why this answer

AWS CloudTrail is the correct service because it records API activity and user actions across AWS accounts, providing a complete audit trail of all management and data plane operations. This includes who made changes, what actions were performed, and when they occurred, which is essential for maintaining audit records of user actions and configuration changes.

Exam trap

The trap here is that candidates confuse AWS Config's resource configuration tracking with CloudTrail's API activity logging, but Config records the 'what' (resource state) while CloudTrail records the 'who, what, when, and how' (API calls and user identity).

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs is designed for monitoring, storing, and accessing log files from applications and AWS services, but it does not natively capture API-level user actions or configuration changes; it requires logs to be sent to it from other sources. Option B is wrong because AWS Config focuses on evaluating and recording resource configuration changes and compliance against rules, but it does not capture user identity or API call details—it records the state of resources, not the actions that changed them. Option D is wrong because VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol) for network interfaces, not user actions or configuration changes; they are used for network analysis and security, not audit trails of user activity.

Practice this question →

MCQmedium

A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS MySQL database. The application requires database credentials to authenticate. The security team wants to eliminate the practice of storing database credentials in the application code or configuration files. Additionally, the team needs a managed service that can automatically rotate the database credentials on a regular schedule without any manual intervention. Which AWS service should the security team use to store and manage these database credentials?

A.AWS Secrets Manager

B.AWS Systems Manager Parameter Store

C.AWS Identity and Access Management (IAM) roles

D.AWS Key Management Service (AWS KMS)

AnswerA

AWS Secrets Manager is the correct choice because it is a purpose-built service for securely storing and managing secrets such as database credentials. It natively supports automatic rotation of secrets for Amazon RDS, allowing you to configure a rotation schedule without building custom automation. The service also integrates with AWS Lambda to rotate credentials for other services, and it enforces fine-grained access control via IAM policies, ensuring that only authorized EC2 instances can retrieve the current credentials.

Why this answer

AWS Secrets Manager is the correct choice because it is a managed service specifically designed to store, manage, and automatically rotate database credentials (such as those for Amazon RDS MySQL) on a scheduled basis without manual intervention. It natively integrates with Amazon RDS to rotate credentials, eliminating the need to embed secrets in application code or configuration files, which directly addresses the security team's requirements.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store secrets, but Parameter Store lacks native automatic rotation, which is the key requirement in this question.

Why the other options are wrong

AWS Systems Manager Parameter Store does not support automatic rotation of database credentials; it requires manual updates or custom automation via AWS Lambda, whereas the question specifies a need for a managed service that automatically rotates credentials on a schedule.

IAM roles cannot store or rotate database credentials; they provide temporary permissions for AWS API actions, not authentication credentials for RDS MySQL. The question requires a managed service for storing and rotating database credentials, which IAM roles do not support.

AWS KMS is a key management service for encryption keys, not a service for storing or rotating database credentials. It does not provide automatic rotation of secrets like database passwords.

Practice this question →

MCQmedium

A company handles credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to review AWS's PCI DSS compliance reports and also download and sign the AWS Business Associate Addendum (BAA) for HIPAA eligibility. The company wants a single, managed AWS service that provides on-demand access to these compliance documents and agreements. Which AWS service should the compliance officer use?

A.AWS Trusted Advisor

B.AWS Config

C.AWS Artifact

D.Amazon Inspector

AnswerC

AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports and agreements, including PCI DSS reports and the Business Associate Addendum (BAA). It allows users to review, download, and sign these documents from a single central location.

Why this answer

AWS Artifact is the correct service because it provides on-demand, self-service access to AWS compliance reports (including PCI DSS reports) and agreements such as the Business Associate Addendum (BAA) for HIPAA. It allows the compliance officer to review, download, and sign these documents directly from the AWS Management Console, meeting the requirement for a single managed service.

Exam trap

The trap here is that candidates may confuse AWS Artifact with AWS Config or Trusted Advisor, thinking those services also handle compliance documents, but they are designed for configuration auditing and best-practice recommendations, not document repository and agreement signing.

Why the other options are wrong

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide on-demand access to compliance reports or agreements like PCI DSS reports or BAAs.

AWS Config is a service for evaluating and auditing resource configurations, not for accessing compliance reports or agreements like PCI DSS reports or BAAs.

Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS, but it does not provide on-demand access to compliance reports or agreements like PCI DSS reports or BAAs.

Practice this question →

MCQmedium

A company wants to implement multi-factor authentication for all IAM users across their AWS Organization without requiring individual account administrators to configure MFA for each user. Which approach enables organization-wide MFA enforcement?

A.Enable MFA on the root account only

B.Apply an SCP that denies all actions unless MFA is authenticated

C.Configure IAM password policies to require MFA

D.Enable AWS Config rule to check MFA status

AnswerB

Applying a service control policy at the organization root OU with a Deny statement using the `aws:MultiFactorAuthPresent` global condition key set to `false` prevents every principal in the member accounts from performing API calls unless they authenticated with MFA. SCPs act as a preventive guardrail: they cannot grant permissions, but they can deny all actions when the condition is satisfied, effectively forcing IAM users and roles to present an MFA token for each session. Because the SCP is inherited by all accounts in the OU, this enforces MFA uniformly without modifying each IAM user's permissions.

Why this answer

Service Control Policies (SCPs) can be applied at the root or organizational unit level to enforce a condition that denies all AWS API actions unless the request includes multi-factor authentication (MFA). This ensures that every IAM user across the entire AWS Organization must authenticate with MFA before performing any action, without requiring individual account administrators to configure MFA per user.

Exam trap

The trap here is that candidates confuse detective controls (like AWS Config rules) with preventive controls (like SCPs), or assume that password policies can enforce MFA at the API level when they only manage device assignment.

How to eliminate wrong answers

Option A is wrong because enabling MFA on the root account only protects the root user, not IAM users; it does not enforce MFA for any other principal in the organization. Option C is wrong because IAM password policies can require an MFA device to be assigned, but they do not enforce MFA at the API call level—users can still make requests without MFA if they have valid access keys or session tokens. Option D is wrong because an AWS Config rule can only detect and report non-compliant MFA status, not actively deny actions; it is a detective control, not a preventive enforcement mechanism.

Practice this question →

MCQeasy

What is the principle of least privilege in AWS IAM?

A.Giving all users administrator access to simplify management

B.Granting users only the minimum permissions required to perform their tasks

C.Allowing users to request additional permissions as needed

D.Restricting all access by default and never granting permissions

AnswerB

Least privilege in AWS means designing IAM policies so that each user or role receives only the specific permissions necessary to complete their assigned job function, nothing more. This is implemented through fine-grained policy statements that define precise Actions, Resources, and Conditions, rather than resorting to broad managed policies like AdministratorAccess or PowerUserAccess. The principle balances operational efficiency with security: users remain productive because they have exactly what they need, while the blast radius of accidental or malicious actions stays minimized.

Why this answer

The principle of least privilege in AWS IAM dictates that users, roles, and services should be granted only the minimum permissions necessary to perform their intended functions. This is implemented by creating fine-grained IAM policies that specify exactly which actions are allowed on which resources, reducing the attack surface and limiting the blast radius of a potential compromise. Option B correctly captures this core security concept.

Exam trap

AWS often tests the principle of least privilege by presenting Option D as a distractor, where candidates confuse 'deny by default' (which is the implicit behavior of IAM) with 'never granting permissions' (which would make the system unusable), leading them to incorrectly select the absolute denial option instead of the balanced minimum-permissions approach.

How to eliminate wrong answers

Option A is wrong because granting all users administrator access violates the principle of least privilege by providing excessive permissions, which increases security risk and contradicts the goal of minimizing access. Option C is wrong because allowing users to request additional permissions as needed describes a process for privilege escalation or just-in-time access, not the principle itself, which focuses on granting only the minimum permissions from the start. Option D is wrong because restricting all access by default and never granting permissions is an extreme interpretation that would prevent any legitimate work; the principle requires granting the minimum necessary permissions, not a complete denial of access.

Practice this question →

MCQeasy

Under the AWS Shared Responsibility Model, which scenario correctly demonstrates the customer's responsibility?

A.AWS ensuring the physical data center is protected from unauthorized entry

B.A customer configuring security groups to restrict unnecessary inbound traffic to EC2 instances

C.AWS patching the underlying hypervisor on EC2 hosts

D.AWS ensuring S3 storage hardware is replaced when it fails

AnswerB

A customer configuring security groups to restrict unnecessary inbound traffic is a classic customer responsibility. Security groups are stateful virtual firewalls attached to EC2 instances, and while AWS provides the mechanism, the customer must create appropriate rules to control allowed source IPs, ports, and protocols. AWS only guarantees the underlying infrastructure; it does not determine which traffic your instances should accept.

Why this answer

Configuring security groups to restrict inbound traffic is a customer responsibility under the Shared Responsibility Model. Security groups act as a virtual firewall for EC2 instances, and customers must define rules to control traffic at the instance level. AWS manages the underlying network infrastructure but does not configure customer-specific access controls.

Exam trap

The trap here is that candidates often confuse 'patching the hypervisor' (AWS responsibility) with 'patching the guest OS' (customer responsibility), leading them to incorrectly assign hypervisor patching to the customer under the Shared Responsibility Model.

How to eliminate wrong answers

Option A is wrong because AWS is responsible for physical security of data centers, including controlling physical access, which is part of AWS's responsibility 'Security of the Cloud'. Option C is wrong because patching the hypervisor is an AWS responsibility, as it falls under the underlying infrastructure that customers cannot access or modify. Option D is wrong because AWS handles hardware maintenance and replacement for S3 storage, which is part of the 'Security of the Cloud' where AWS manages the physical components.

Practice this question →

MCQmedium

A financial services company is undergoing an external audit. The auditor requests copies of AWS SOC 2, ISO 27001, and PCI DSS compliance reports to validate the company's cloud infrastructure controls. Where can the company's compliance team obtain these reports in a centralized manner?

A.AWS Config

B.AWS Artifact

C.AWS Audit Manager

D.AWS Security Hub

AnswerB

AWS Artifact is the correct service. It is a self-service portal that provides on-demand access to AWS compliance reports, such as SOC, ISO, and PCI DSS, as well as agreements like the Business Associate Addendum (BAA).

Why this answer

AWS Artifact is the correct service because it provides a centralized, self-service portal for on-demand access to AWS compliance reports, including SOC 2, ISO 27001, and PCI DSS. The compliance team can download these reports directly without needing to contact AWS support, making it the single source of truth for audit evidence.

Exam trap

The trap here is that candidates confuse AWS Artifact with AWS Audit Manager, thinking that Audit Manager’s evidence collection feature also provides the raw compliance reports, when in fact Audit Manager only helps you gather your own evidence while Artifact is the sole source for AWS’s pre-existing certifications.

Why the other options are wrong

AWS Config is a service for evaluating resource configurations against rules, not for accessing compliance reports like SOC 2, ISO 27001, or PCI DSS. It does not provide a repository for downloading third-party audit reports.

AWS Audit Manager helps continuously audit AWS usage, but it does not provide pre-existing compliance reports like SOC 2, ISO 27001, or PCI DSS. Those reports are available only through AWS Artifact.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not store or provide downloadable copies of third-party audit reports like SOC 2, ISO 27001, or PCI DSS. Those reports are available only through AWS Artifact.

Practice this question →

MCQmedium

A company wants to identify sensitive data (such as PII and credit card numbers) stored in Amazon S3 buckets across their organization. Which AWS service automates this discovery?

A.Amazon Inspector

B.AWS Config

C.Amazon Macie

D.Amazon GuardDuty

AnswerC

Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It recognizes personally identifiable information, financial data, and credentials, and generates severity-rated findings with details about the affected bucket and object, including compliance context such as PCI-DSS. Macie also monitors bucket policies for potential data exposure and continuously evaluates new objects as they are written.

Why this answer

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data stored in Amazon S3. It automatically identifies personally identifiable information (PII), credit card numbers, and other sensitive data types, making it the correct choice for this use case.

Exam trap

The trap here is that candidates often confuse Amazon Macie with Amazon Inspector or GuardDuty because all three are security services, but only Macie is designed for content-aware data discovery and classification of sensitive data in S3.

How to eliminate wrong answers

Option A is wrong because Amazon Inspector is an automated vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not for discovering sensitive data in S3 buckets. Option B is wrong because AWS Config is a service that evaluates and records resource configurations against desired policies, but it does not inspect the content of S3 objects for sensitive data. Option D is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior using VPC Flow Logs, DNS logs, and CloudTrail events, not for scanning S3 object content for sensitive data.

Practice this question →

MCQeasy

Which AWS feature protects S3 buckets from having their versioned objects permanently deleted without multi-factor authentication approval?

A.S3 Block Public Access

B.S3 Object Lock

C.S3 MFA Delete

D.S3 Access Points

AnswerC

S3 MFA Delete is a versioning feature that requires a multi-factor authentication code to permanently delete an object version or to suspend versioning on a bucket. Because the bucket has versioning enabled and the customer wants protection against accidental permanent deletions, MFA Delete directly addresses that risk by ensuring that even a root or admin user cannot irreversibly remove data without a second factor. This makes it the correct choice for guarding specific object versions from permanent loss.

Why this answer

S3 MFA Delete is the correct answer because it is the specific S3 versioning feature that requires multi-factor authentication (MFA) to permanently delete versioned objects or suspend versioning on a bucket. When enabled, any DeleteObject request that includes a version ID (permanent delete) or a PUT request to suspend versioning must include the x-amz-mfa header with a valid MFA code from a hardware or virtual MFA device. This prevents unauthorized or accidental permanent deletion of object versions, even by users with full S3 permissions.

Exam trap

The trap here is that candidates often confuse S3 Object Lock's WORM protection with MFA Delete, but Object Lock prevents deletion based on time-based retention, not by requiring a second authentication factor, while MFA Delete specifically mandates MFA approval for permanent deletion of versioned objects.

How to eliminate wrong answers

Option A is wrong because S3 Block Public Access is a set of settings that prevents public access to S3 buckets and objects, but it has no mechanism to require MFA for deletions or to protect versioned objects from permanent deletion. Option B is wrong because S3 Object Lock provides write-once-read-many (WORM) protection to prevent object deletion or overwrite for a specified retention period, but it does not require MFA authentication for deletion operations; it relies on retention modes (Governance/Compliance) and legal holds. Option D is wrong because S3 Access Points are network endpoints attached to buckets that simplify managing data access at scale, but they do not enforce MFA for deletions and have no role in protecting versioned objects from permanent deletion.

Practice this question →

MCQmedium

Which AWS service is used to centrally manage and enforce policies across multiple AWS accounts in an organization, such as restricting which AWS services member accounts can use?

A.AWS IAM policies

B.AWS Organizations with Service Control Policies

C.AWS Config rules

D.Amazon GuardDuty

AnswerB

AWS Organizations with Service Control Policies (SCPs) provide centralized governance by allowing you to define the maximum available permissions for every account in the organization. SCPs act as guardrails that restrict which AWS services, actions, and resources member accounts can use, even if an account's IAM policies allow more. This proactive, organization-wide control is exactly what an administrator needs to enforce consistent security and compliance requirements across all member accounts, making it the correct answer.

Why this answer

AWS Organizations with Service Control Policies (SCPs) is the correct service because SCPs enable central governance of the maximum available permissions for all accounts within an organization. SCPs act as a permission guardrail, allowing administrators to restrict which AWS services, actions, and resources member accounts can use, regardless of the IAM policies attached to those accounts. This makes SCPs the appropriate tool for enforcing organization-wide restrictions across multiple accounts.

Exam trap

The trap here is that candidates often confuse IAM policies with SCPs, not realizing that IAM policies are account-specific and cannot enforce restrictions across multiple accounts, while SCPs provide centralized, organization-wide guardrails without granting permissions themselves.

How to eliminate wrong answers

Option A is wrong because AWS IAM policies are attached to individual IAM users, groups, or roles within a single account and cannot centrally enforce restrictions across multiple AWS accounts in an organization. Option C is wrong because AWS Config rules evaluate resource configurations for compliance against desired policies but do not actively enforce or restrict which services member accounts can use. Option D is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not a policy enforcement mechanism for restricting service usage across accounts.

Practice this question →

MCQmedium

A company runs an e-commerce website on AWS and expects a high volume of traffic during Black Friday. The security team is concerned about potential DDoS attacks overwhelming the infrastructure. The company wants a managed service that provides always-on detection and automatic inline mitigation of DDoS attacks at the network and transport layers (layer 3 and 4), as well as cost protection against scaling charges due to DDoS attacks. Which AWS service should the company use?

A.AWS Shield Standard

B.AWS Shield Advanced

C.AWS WAF

D.Amazon GuardDuty

AnswerB

AWS Shield Advanced provides always-on detection and automatic inline mitigation of DDoS attacks at layers 3 and 4 (and layer 7 when integrated with AWS WAF). It also includes cost protection that provides financial coverage against scaling charges (e.g., from EC2 or ELB) incurred during a DDoS attack, as well as 24/7 access to the DDoS Response Team (DRT). This matches all the specified requirements.

Why this answer

AWS Shield Advanced is the correct choice because it provides always-on detection and automatic inline mitigation of DDoS attacks at layers 3 and 4 (network and transport layers), such as SYN floods and UDP reflection attacks. Additionally, it offers cost protection against scaling charges incurred due to DDoS-related usage spikes, which directly addresses the company's concern about financial impact from attack-induced scaling.

Exam trap

The trap here is that candidates often confuse AWS Shield Standard (free, basic protection) with AWS Shield Advanced (paid, enhanced protection) or mistakenly think AWS WAF can mitigate network-layer DDoS attacks, when in fact WAF only handles application-layer threats.

Why the other options are wrong

AWS Shield Standard provides always-on detection and automatic inline mitigation for network and transport layer DDoS attacks, but it does not offer cost protection against scaling charges due to DDoS attacks. The question specifically requires cost protection, which is only available with Shield Advanced.

AWS WAF operates at Layer 7 (application layer) and is not designed for automatic inline mitigation of network/transport layer DDoS attacks, nor does it provide cost protection against scaling charges.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, but it does not provide automatic inline mitigation of DDoS attacks or cost protection against scaling charges. It operates at the network and account level, not as a dedicated DDoS mitigation service.

Practice this question →

Matchingmedium

Match each AWS management tool to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Audit API calls and user activity

Monitoring and observability

Track resource configuration changes

Best practice recommendations

Infrastructure as code templates

Why these pairings

These management tools serve distinct purposes: CloudFormation for infrastructure provisioning, Config for configuration monitoring, and Trusted Advisor for optimization recommendations.

Practice this question →

MCQmedium

A company has 50 IAM users in a single AWS account. The security policy requires that every IAM user must have a virtual MFA device enabled for AWS Management Console access. The company wants to automatically detect any user who disables or has an inactive MFA device and immediately revoke that user's ability to access AWS resources by disabling their access keys. The solution must be fully managed, require no custom scripts, and use native AWS services. Which AWS service should the company use to define the compliance rule and automatically trigger the remediation action?

A.AWS Config

B.AWS Shield

C.AWS CloudTrail

D.AWS WAF

AnswerA

AWS Config offers managed rules like 'iam-user-mfa-enabled' to check MFA compliance. It can automatically trigger a remediation action (e.g., disabling access keys) when a noncompliant user is detected, meeting the requirement for a fully managed solution without custom scripts.

Why this answer

AWS Config is the correct service because it provides managed rules (such as the `iam-user-mfa-enabled` managed rule) that continuously evaluate IAM user configurations against compliance policies. When a user disables or has an inactive virtual MFA device, AWS Config can detect the non-compliant resource and automatically trigger a remediation action via AWS Systems Manager Automation, which can disable the user's access keys without any custom scripts.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail's logging and monitoring capabilities with AWS Config's compliance evaluation and remediation features, mistakenly thinking that CloudTrail can automatically enforce security policies when it only records events for analysis.

Why the other options are wrong

AWS Shield is a managed DDoS protection service, not a compliance or configuration management service. It cannot define rules for MFA compliance or trigger remediation actions like disabling access keys.

AWS CloudTrail records API activity but does not evaluate compliance rules or trigger automated remediation actions. It cannot detect inactive MFA devices or disable access keys on its own.

AWS WAF is a web application firewall that protects web applications from common web exploits; it does not monitor IAM user configurations or enforce compliance rules for MFA devices.

Practice this question →

MCQmedium

A company needs to store database passwords and API keys used by their applications, with automatic rotation and audit logging of access. Which AWS service is purpose-built for this?

A.AWS Systems Manager Parameter Store

B.AWS Key Management Service (KMS)

C.AWS Secrets Manager

D.Amazon S3 with bucket policies

AnswerC

AWS Secrets Manager is purpose-built for managing secrets throughout their lifecycle, with native automatic rotation for Amazon RDS credentials and other supported services. It provides fine-grained IAM-based access control per secret, ensuring only authorized applications and users can retrieve sensitive values. All API calls are logged in AWS CloudTrail, enabling robust auditability. These capabilities directly address the requirement to securely store, rotate, and manage database credentials.

Why this answer

AWS Secrets Manager is purpose-built for securely storing, automatically rotating, and auditing access to database passwords, API keys, and other secrets. It natively supports automatic rotation with built-in integrations for Amazon RDS, Redshift, and DocumentDB, and it logs every secret access call in AWS CloudTrail for audit compliance.

Exam trap

The trap here is that candidates confuse AWS Systems Manager Parameter Store (which can store secrets but lacks automatic rotation) with AWS Secrets Manager, leading them to choose Parameter Store when the question explicitly requires automatic rotation and audit logging.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store is a hierarchical store for configuration data and secrets, but it does not support automatic rotation of secrets natively (you must build custom rotation logic with Lambda). Option B is wrong because AWS Key Management Service (KMS) is a managed service for creating and controlling encryption keys, not for storing or rotating secrets like passwords or API keys. Option D is wrong because Amazon S3 with bucket policies is an object storage service that can store encrypted files but lacks built-in secret rotation, automatic expiration, or native audit logging of secret access events.

Practice this question →

MCQmedium

A healthcare company stores sensitive patient data in Amazon S3. The company must comply with a regulation that requires encryption keys to be rotated automatically every 12 months. The security team also needs to use IAM policies to control which users and roles can decrypt specific S3 objects. Which encryption solution should the company use for the S3 objects?

A.Server-side encryption with customer-provided keys (SSE-C)

B.Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer managed key

C.Client-side encryption using the AWS Encryption SDK

D.Server-side encryption with Amazon S3 managed keys (SSE-S3)

AnswerB

SSE-KMS with a customer managed key allows the company to define IAM and key policies for granular access control. AWS KMS can automatically rotate the key annually (configurable), satisfying the regulation. This is the correct solution.

Why this answer

SSE-KMS with a customer managed key is correct because it allows automatic key rotation every 12 months (configurable via the AWS KMS console) and enables fine-grained access control through IAM policies and key policies. This meets both the regulatory rotation requirement and the security team's need to control decryption of specific S3 objects.

Exam trap

The trap here is that candidates often confuse SSE-S3's automatic key management (which rotates keys but not on a customer-defined schedule) with the automatic rotation and IAM control provided only by SSE-KMS with a customer managed key.

Why the other options are wrong

SSE-C requires the customer to manage and rotate their own encryption keys, which does not satisfy the requirement for automatic key rotation every 12 months. AWS does not rotate SSE-C keys automatically.

Client-side encryption does not allow the security team to use IAM policies to control decryption of specific S3 objects, as decryption happens outside AWS. The regulation requires automatic key rotation every 12 months, which client-side encryption does not natively support.

SSE-S3 does not support automatic key rotation every 12 months; it uses S3-managed keys with no customer control over rotation schedule. Additionally, SSE-S3 does not allow using IAM policies to control decryption of specific objects.

Practice this question →

MCQmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to serve traffic over HTTPS to encrypt data in transit between clients and the ALB. The security team requires that the SSL/TLS certificate be automatically renewed before expiration and that AWS manage the entire certificate lifecycle. The company does not want to manually upload or manage private keys. Which AWS service should the company use to meet these requirements?

A.AWS Certificate Manager (ACM)

B.AWS Secrets Manager

C.AWS Identity and Access Management (IAM)

D.AWS Key Management Service (KMS)

AnswerA

ACM is the correct choice. It automates the provisioning, deployment, and renewal of SSL/TLS certificates for use with AWS services such as ALB, CloudFront, and API Gateway. ACM handles the full certificate lifecycle and keeps private keys secure.

Why this answer

AWS Certificate Manager (ACM) is the correct choice because it integrates directly with Application Load Balancers to provision, deploy, and automatically renew SSL/TLS certificates. ACM manages the entire certificate lifecycle, including private key generation and storage, without requiring manual intervention. This meets the security team's requirement for automatic renewal and AWS-managed certificate lifecycle.

Exam trap

The trap here is that candidates may confuse AWS Secrets Manager or KMS with certificate management, but neither service handles SSL/TLS certificate issuance or automatic renewal for load balancers; ACM is the only service that provides fully managed certificate lifecycle for ALB HTTPS termination.

Why the other options are wrong

AWS Secrets Manager is designed to securely store and rotate secrets like database credentials and API keys, not to manage SSL/TLS certificates for HTTPS termination. It does not integrate with ALB to automatically deploy and renew certificates.

IAM is used for managing users, groups, roles, and permissions, not for SSL/TLS certificate lifecycle management or automatic renewal. ACM is the service designed for provisioning, managing, and deploying SSL/TLS certificates.

AWS KMS is used to create and manage encryption keys for data at rest, not for SSL/TLS certificate lifecycle management. It does not provide certificate issuance, renewal, or deployment to ALBs.

Practice this question →

MCQmedium

A company hosts a web application behind an Application Load Balancer (ALB) in AWS. The application must comply with a security policy requiring TLS encryption for all traffic between users and the ALB. The company wants to automate the renewal of TLS certificates and avoid manual certificate management. Which AWS service should the company use to provision and automatically renew the certificates?

A.AWS Certificate Manager (ACM)

B.AWS Key Management Service (KMS)

C.AWS Secrets Manager

D.AWS Identity and Access Management (IAM)

AnswerA

Correct. ACM is the AWS service designed to provision, manage, and automatically renew SSL/TLS certificates for use with AWS services like ALB, CloudFront, and API Gateway.

Why this answer

AWS Certificate Manager (ACM) is the correct service because it integrates directly with Application Load Balancers to provision and automatically renew TLS certificates, eliminating manual certificate management. ACM handles the entire certificate lifecycle, including renewal, which is essential for maintaining TLS encryption compliance without operational overhead.

Exam trap

The trap here is that candidates may confuse AWS Certificate Manager with AWS Secrets Manager or KMS, thinking any 'management' service can handle certificate renewal, but only ACM is purpose-built for provisioning and automatic renewal of TLS certificates for AWS services like ALB, CloudFront, and API Gateway.

Why the other options are wrong

AWS KMS is used for creating and managing encryption keys, not for provisioning or automatically renewing TLS certificates for use with an ALB.

AWS Secrets Manager is designed to manage secrets like database credentials and API keys, not TLS certificates. It does not provide automated certificate renewal or integration with AWS Certificate Manager for provisioning certificates on an ALB.

IAM is used for managing users, groups, roles, and permissions, not for provisioning or automatically renewing TLS certificates. It cannot issue or manage certificates for use with an ALB.

Practice this question →

MCQeasy

A company is setting up their AWS account for the first time. What security action should they take immediately after creating the account?

A.Create IAM users for all employees immediately

B.Enable MFA on the root account and create an IAM admin user for daily operations

C.Create root access keys for programmatic access

D.Enable AWS Config in all regions

AnswerB

Enabling MFA on the root account adds a critical second authentication factor, protecting the account even if the root password is accidentally leaked or brute-forced, and it is the first security best practice Amazon prescribes. Creating an IAM admin user with a scoped policy such as AdministratorAccess allows administrators to perform daily tasks without ever signing in as root, reducing the risk of unintended destructive actions. This approach directly addresses the account’s most sensitive credential and establishes a secure baseline for all subsequent IAM configuration.

Why this answer

The root user has unrestricted access to the AWS account, and enabling Multi-Factor Authentication (MFA) on the root account adds a critical second layer of security to prevent unauthorized access. Creating an IAM admin user for daily operations follows the principle of least privilege, ensuring that routine administrative tasks are performed using IAM roles or users with controlled permissions, rather than the highly privileged root user. This is a foundational security best practice recommended by AWS immediately after account creation.

Exam trap

The trap here is that candidates may think creating IAM users for all employees (Option A) is the immediate priority, but the exam tests the understanding that securing the root account with MFA and creating a single IAM admin user for daily operations is the first and most critical security step, not mass user creation.

How to eliminate wrong answers

Option A is wrong because creating IAM users for all employees immediately is premature and insecure; the first step should be to secure the root account and establish an administrative IAM user, not to create users for everyone without a proper identity and access management strategy. Option C is wrong because creating root access keys for programmatic access is a severe security risk; root access keys provide unrestricted, long-term credentials that cannot be rotated or scoped, and AWS strongly advises against using root access keys for any purpose. Option D is wrong because enabling AWS Config in all regions is not an immediate security action; AWS Config is a governance and compliance service that tracks resource configuration changes, and while valuable, it should be configured after establishing basic identity security and access controls.

Practice this question →

MCQmedium

A financial services company is preparing for an annual audit. The auditors have requested a copy of the AWS SOC 2 Type II report to verify the security controls of the AWS infrastructure that the company uses. The company's compliance officer needs to directly download this report from a trusted AWS source. Which AWS service should the compliance officer use to obtain the report?

A.AWS Config

B.AWS Artifact

C.AWS Trusted Advisor

D.Amazon Inspector

AnswerB

AWS Artifact is the correct service. It is the go-to place for on-demand access to AWS compliance reports (e.g., SOC, PCI) and agreements. You can download the SOC 2 Type II report directly from AWS Artifact.

Why this answer

AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 Type II reports, ISO certifications, and PCI DSS reports. The compliance officer can directly download the SOC 2 report from the AWS Artifact console or via the AWS Artifact API, ensuring the report comes from a trusted AWS source.

Exam trap

The trap here is that candidates often confuse AWS Artifact with AWS Config or Amazon Inspector, mistakenly thinking that configuration auditing or vulnerability scanning tools can provide compliance reports, when only AWS Artifact is designed to serve as the authoritative source for AWS compliance documentation.

Why the other options are wrong

AWS Config is used for resource inventory, configuration history, and compliance auditing of AWS resources, but it does not provide access to AWS SOC reports. The SOC 2 Type II report is obtained via AWS Artifact.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide downloadable compliance reports like SOC reports.

Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It does not provide access to AWS compliance reports like SOC 2 Type II.

Practice this question →

MCQmedium

A company stores sensitive financial data in Amazon S3. The company's security policy requires that all data be encrypted at rest using a key that the company creates and manages, with the ability to rotate the key annually. The company also needs an audit trail of when the key was used and by which AWS service. Which solution should the company use to meet these requirements?

A.Use server-side encryption with S3 managed keys (SSE-S3).

B.Use server-side encryption with AWS KMS customer managed keys (SSE-KMS).

C.Use server-side encryption with customer-provided keys (SSE-C).

D.Use client-side encryption with an AWS KMS managed key.

AnswerB

SSE-KMS with a customer managed key (CMK) allows the company to create, manage, and rotate the key. Key usage is logged in AWS CloudTrail, providing the required audit trail. This is the correct solution.

Why this answer

SSE-KMS with a customer managed key (CMK) allows the company to create and manage its own encryption key, enable automatic annual key rotation via AWS KMS, and provides detailed CloudTrail audit logs of every KMS API call (e.g., Decrypt, GenerateDataKey) showing which AWS service or user used the key. This satisfies all stated requirements: customer-managed key, annual rotation, and audit trail.

Exam trap

The trap here is that candidates confuse SSE-S3's 'AWS managed' keys with customer managed keys, or assume SSE-C's customer-provided keys satisfy the 'create and manage' requirement, overlooking the need for annual rotation and audit trail capabilities.

Why the other options are wrong

SSE-S3 uses AWS-managed keys, not customer-managed keys, so the company cannot control key rotation or obtain an audit trail of key usage.

SSE-C requires the customer to manage the encryption keys themselves, including key rotation and storage, and does not provide an integrated audit trail of key usage by AWS services.

Client-side encryption does not provide an audit trail of key usage by AWS services because encryption occurs before data reaches AWS, and AWS KMS is not used for server-side operations.

Practice this question →

MCQmedium

A company's compliance team needs to know which AWS resources are not compliant with the company's tagging policy (all resources must have a 'CostCenter' tag). Which AWS service can continuously evaluate and report on this compliance?

A.Amazon CloudWatch

B.AWS Config with the required-tags rule

C.AWS Trusted Advisor

D.AWS CloudTrail

AnswerB

AWS Config with the required-tags rule is the correct choice because this service continuously records resource configuration changes and runs managed rules against them. The required-tags rule specifically checks for the presence of user-specified tag keys (e.g., CostCenter, Environment, Owner) and reports any resource lacking those tags as non-compliant. Unlike other options, AWS Config evaluates the current tag state across supported AWS resources, not just at creation time, and can trigger remediation actions automatically.

Why this answer

AWS Config with the managed 'required-tags' rule can continuously evaluate whether resources have the specified tag (e.g., 'CostCenter') and report non-compliant resources. AWS Config records configuration changes, evaluates them against rules, and provides a compliance dashboard and notifications via Amazon SNS, making it the correct service for ongoing compliance monitoring.

Exam trap

The trap here is that candidates often confuse AWS Config (configuration compliance) with AWS CloudTrail (API auditing) or Amazon CloudWatch (performance monitoring), assuming any 'monitoring' service can handle tag compliance, but only AWS Config provides continuous, rule-based evaluation of resource configurations.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch is a monitoring service for metrics, logs, and alarms, not a configuration compliance evaluator; it cannot check resource tagging policies. Option C is wrong because AWS Trusted Advisor provides best-practice recommendations (e.g., cost optimization, security) but does not perform continuous, customizable compliance evaluations against custom tagging policies. Option D is wrong because AWS CloudTrail records API activity for auditing and governance, but it does not evaluate resource configurations or tag compliance in real time.

Practice this question →

MCQmedium

Which AWS networking feature prevents resources in a private subnet from directly receiving inbound connections from the internet, while still allowing them to initiate outbound connections?

A.Internet Gateway

B.NAT Gateway

C.Security Groups

D.Network ACLs

AnswerB

A NAT gateway is a managed AWS service deployed in a public subnet with an Elastic IP address. It is placed in private subnet route tables as the destination for 0.0.0.0/0, so instances there can initiate outbound traffic to the internet. The NAT gateway translates their private source IPs to its Elastic IP for outbound packets, and for return traffic it forwards responses back; unsolicited inbound connections from the internet are dropped because there is no port forwarding or inbound mapping. This makes a NAT gateway the correct answer for one-way internet access.

Why this answer

A NAT Gateway enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. It achieves this by translating the private IP of the instance to the NAT Gateway's Elastic IP for outbound traffic, and only forwarding return traffic that matches an established outbound session.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, assuming both provide internet access, but the key distinction is that an Internet Gateway allows bidirectional inbound connections, while a NAT Gateway specifically prevents unsolicited inbound connections from the internet.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway allows both inbound and outbound traffic directly from the internet to instances in a public subnet, and does not prevent unsolicited inbound connections. Option C is wrong because Security Groups act as a stateful virtual firewall at the instance level, but they do not provide the network address translation needed to allow outbound-only internet access from a private subnet; they can filter traffic but cannot enable internet connectivity without a routing path. Option D is wrong because Network ACLs are stateless subnet-level traffic filters that can block or allow traffic based on rules, but they do not provide outbound-only internet connectivity or address translation for private subnets.

Practice this question →

MCQmedium

A company manages user access to AWS resources using IAM users. The security team wants to automatically detect if an IAM user's access key is being used from a geographic location that is unusual for that user, which could indicate a compromised credential. The team needs a managed threat detection service that monitors API activity and raises alerts for such anomalies. Which AWS service should the security team use?

A.AWS CloudTrail

B.Amazon GuardDuty

C.AWS Trusted Advisor

D.Amazon Inspector

AnswerB

Amazon GuardDuty is the correct choice. It is a managed threat detection service that uses machine learning, anomaly detection, and threat intelligence feeds to monitor for unusual API activity, including compromised credentials and access from suspicious locations. GuardDuty raises findings that can be sent to AWS Security Hub or Amazon EventBridge for automated response.

Why this answer

Amazon GuardDuty is a managed threat detection service that continuously monitors AWS API activity, including IAM user access key usage, and uses machine learning to establish baseline behavior. When it detects access from an unusual geographic location, it generates a finding alerting the security team to a potentially compromised credential. This directly meets the requirement for automated anomaly detection without manual configuration.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail's logging capability with active threat detection, not realizing that CloudTrail only records events and requires an additional service like GuardDuty to analyze and alert on anomalies.

Why the other options are wrong

AWS CloudTrail records API activity but does not analyze or alert on anomalous geographic access patterns; it is a logging service, not a threat detection service.

AWS Trusted Advisor provides best practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not monitor API activity or detect anomalous geographic usage of IAM access keys.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a threat detection service that monitors API activity for anomalous geographic access patterns.

Practice this question →

MCQmedium

A company runs a web application on Amazon EC2 that connects to an Amazon RDS database. The database credentials are currently hardcoded in the application configuration file. The security team requires that the credentials be automatically rotated every 90 days and that the application retrieves them securely from a managed service without storing them in the application code. Which AWS service should the company use to meet these requirements?

A.AWS Key Management Service (AWS KMS)

B.AWS Secrets Manager

C.AWS Systems Manager Parameter Store

D.AWS Certificate Manager (ACM)

AnswerB

AWS Secrets Manager is the correct service because it stores database credentials securely, allows retrieval via API calls, and can automatically rotate credentials for supported services like Amazon RDS on a defined schedule (e.g., every 90 days).

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including for Amazon RDS) on a schedule. It allows the application to fetch credentials at runtime via API calls, eliminating hardcoded secrets, and supports native rotation every 90 days without custom code.

Exam trap

Why the other options are wrong

AWS KMS is a key management service for encryption keys, not for storing or rotating secrets like database credentials. It does not provide automatic rotation of secrets or a secure retrieval API for application credentials.

AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it requires custom solutions (e.g., Lambda functions) to rotate credentials, whereas Secrets Manager provides built-in automatic rotation.

AWS Certificate Manager (ACM) is used to provision, manage, and deploy public and private SSL/TLS certificates, not for storing or rotating database credentials.

Practice this question →

MCQmedium

A company's security team manages AWS accounts for multiple business units using AWS Organizations. The security team needs a single place to view and prioritize all security alerts, including findings from Amazon GuardDuty, Amazon Inspector, and AWS IAM Access Analyzer. The team also wants to automatically run continuous compliance checks against industry standards such as the CIS AWS Foundations Benchmark. The solution must provide a consolidated dashboard with automated findings aggregation and compliance score tracking. Which AWS service should the security team choose?

A.AWS Config

B.AWS Security Hub

C.Amazon Detective

D.AWS Trusted Advisor

AnswerB

AWS Security Hub is designed to aggregate, organize, and prioritize security findings from across AWS services (GuardDuty, Inspector, Macie, IAM Access Analyzer, etc.) and third-party tools. It also performs automated compliance checks against standards like CIS AWS Foundations Benchmark and provides a unified dashboard with compliance scores, meeting all the stated requirements.

Why this answer

AWS Security Hub is the correct choice because it provides a single, consolidated dashboard that aggregates security findings from multiple AWS services, including Amazon GuardDuty, Amazon Inspector, and AWS IAM Access Analyzer. It also performs automated continuous compliance checks against industry standards like the CIS AWS Foundations Benchmark and tracks compliance scores over time, meeting all the stated requirements.

Exam trap

The trap here is that candidates often confuse AWS Config's compliance rules with Security Hub's consolidated findings and compliance scoring, but AWS Config lacks the ability to aggregate findings from multiple security services and track overall compliance scores against industry benchmarks.

Why the other options are wrong

AWS Config evaluates resource configurations against rules but does not aggregate findings from GuardDuty, Inspector, or IAM Access Analyzer, nor does it provide a consolidated security dashboard or compliance score tracking across multiple accounts.

Amazon Detective is designed for investigating the root cause of security findings, not for aggregating alerts from multiple services or performing compliance checks against industry benchmarks like CIS AWS Foundations.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not aggregate findings from GuardDuty, Inspector, and IAM Access Analyzer into a single dashboard, nor does it provide continuous compliance checks against industry standards like CIS AWS Foundations Benchmark.

Practice this question →

MCQeasy

A company is concerned about Distributed Denial of Service (DDoS) attacks against their website hosted on AWS. They want basic DDoS protection without incurring additional cost. Which AWS service provides automatic DDoS protection at no extra charge?

A.AWS WAF

B.Amazon GuardDuty

C.AWS Shield Advanced

D.AWS Shield Standard

AnswerD

AWS Shield Standard is enabled by default for every AWS customer at no additional charge, protecting against the most common network and transport-layer DDoS attacks, including SYN floods, UDP floods, and reflection-based attacks. It is always on and automatically integrated with Amazon CloudFront, Route 53, and Global Accelerator, giving you a baseline level of DDoS protection without any setup or configuration.

Why this answer

AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides basic protection against common infrastructure-layer DDoS attacks, such as SYN/UDP floods and reflection attacks. This matches the requirement for automatic, no-cost DDoS protection without any manual configuration or subscription.

Exam trap

The trap here is that candidates often confuse AWS WAF (which protects against application-layer threats but is not free) with DDoS protection, or they assume Shield Advanced is the only DDoS service, overlooking the always-on, no-cost Shield Standard.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that protects against application-layer attacks (e.g., SQL injection, cross-site scripting) and incurs additional costs based on rules and requests; it does not provide automatic infrastructure-layer DDoS protection. Option B is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity using machine learning and threat intelligence, but it does not actively mitigate DDoS attacks and has a cost per volume of log data analyzed. Option C is wrong because AWS Shield Advanced is a paid service (with a monthly commitment and data transfer fees) that provides enhanced DDoS protection, including 24/7 support and cost protection, not a free automatic option.

Practice this question →

MCQmedium

A company needs to ensure that none of their AWS accounts allow resources to be deployed outside of the us-east-1 and eu-west-1 regions for data sovereignty. Which control achieves this most effectively?

A.Configure AWS Config rules in each account to detect out-of-region deployments

B.Apply an SCP in AWS Organizations that denies resource creation outside approved regions

C.Train developers to only deploy in approved regions

D.Enable IAM permission boundaries restricting regions in each account

AnswerB

An SCP attached to the root or an organizational unit in AWS Organizations centrally evaluates requests from every IAM principal in member accounts and can explicitly deny actions when the `aws:RequestedRegion` condition does not match an approved list. Because SCPs act at the organization boundary, they apply uniformly to all affected accounts without per-principal setup and cannot be overridden by IAM identity or resource policies. A Deny statement using `aws:RequestedRegion` blocks create operations (like `ec2:RunInstances` or `rds:CreateDBInstance`) pre-emptively, ensuring no resource is ever provisioned in a disallowed region.

Why this answer

B is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny resource creation in non-approved regions across all member accounts. By applying an SCP with a condition that denies actions unless the `aws:RequestedRegion` is `us-east-1` or `eu-west-1`, you enforce data sovereignty at the organization level, preventing any account from deploying resources outside those regions regardless of individual account permissions.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config) with preventive controls (SCPs), or assume IAM permission boundaries can enforce region restrictions globally, when in fact SCPs are the only mechanism that applies to all principals in an account, including the root user.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive — they can detect out-of-region deployments after they occur but cannot block them, leaving a window for non-compliant resources to exist. Option C is wrong because training developers relies on human behavior and provides no technical enforcement, making it ineffective for mandatory compliance. Option D is wrong because IAM permission boundaries restrict what actions an IAM principal can perform but do not inherently limit the region; they would require complex condition keys and per-account configuration, and they cannot override permissions granted to the root user or service-linked roles, leaving gaps in enforcement.

Practice this question →

MCQmedium

A compliance officer needs to download AWS's SOC 2 Type II report and ISO 27001 certification to provide to their company's auditors as evidence that the AWS infrastructure meets regulatory standards. Where should they access these documents?

A.AWS Trusted Advisor

B.AWS Artifact

C.AWS Security Hub

D.AWS Config

AnswerB

AWS Artifact is the central repository for AWS compliance documentation. It provides access to AWS security and compliance reports (SOC 1, SOC 2, SOC 3, PCI DSS, ISO 27001) and AWS agreements on demand, at no cost.

Why this answer

AWS Artifact is the central resource for downloading AWS compliance reports, including SOC 2 Type II reports and ISO 27001 certifications. It provides on-demand access to these documents, which auditors require as evidence of AWS's adherence to regulatory standards. This service is specifically designed for compliance and audit use cases, making it the correct choice.

Exam trap

The trap here is that candidates confuse AWS Artifact with AWS Security Hub, mistakenly thinking Security Hub's compliance checks provide the actual certification documents, when in fact Security Hub only checks your own resources against compliance frameworks, not AWS's own certifications.

How to eliminate wrong answers

Option A is wrong because AWS Trusted Advisor is an optimization tool that inspects your AWS environment and provides recommendations for cost, performance, security, and fault tolerance, but it does not host or provide access to compliance reports. Option C is wrong because AWS Security Hub aggregates security alerts and automates compliance checks against standards like CIS and PCI DSS, but it does not store or deliver raw compliance certification documents such as SOC 2 or ISO 27001. Option D is wrong because AWS Config evaluates and records resource configurations for compliance with internal policies, but it does not provide access to AWS's own third-party audit reports.

Practice this question →

MCQeasy

A security auditor needs to know which IAM user deleted a specific S3 bucket last week, from which IP address the action was taken, and at what exact time. Which AWS service captures this information?

A.Amazon CloudWatch

B.AWS Config

C.AWS CloudTrail

D.Amazon GuardDuty

AnswerC

CloudTrail logs every API call to AWS services, capturing the IAM identity, source IP, timestamp, and operation details. Searching CloudTrail for DeleteBucket events would show exactly who deleted the S3 bucket, when, and from which IP.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including S3 bucket deletion actions (DeleteBucket). It captures the identity of the IAM user, the source IP address, and the exact timestamp of each API call, which directly meets the auditor's requirements.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to track resource changes (like bucket deletion) with CloudTrail's ability to log the identity and source of the API call, leading them to select Config instead of CloudTrail.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch is a monitoring service for metrics, logs, and alarms; it does not record API-level user activity or capture the specific IAM user, IP address, and timestamp of an S3 bucket deletion. Option B is wrong because AWS Config is a configuration management and compliance service that tracks resource configuration changes over time, but it does not log who performed an action or the source IP address; it focuses on resource state, not API call details. Option D is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail events for malicious activity; it does not natively store or provide raw API call history with user identity and IP address for forensic auditing.

Practice this question →

MCQmedium

A company has a compliance policy requiring that all Amazon EC2 instances in its production environment must have the tag "Environment=Production" and must be associated with a security group named "Prod-SG". The company wants to continuously monitor its AWS account and automatically detect any EC2 instances that do not meet these requirements. The IT team needs a service that can evaluate the configuration of resources against these rules and send notifications when a non-compliant resource is detected. Which AWS service should the company use?

A.AWS Trusted Advisor

B.Amazon GuardDuty

C.AWS Config

D.Amazon Inspector

AnswerC

AWS Config allows you to define rules (both managed and custom) that evaluate the configuration of your AWS resources. It continuously monitors for changes and can automatically detect resources that violate your policies, such as missing tags or incorrect security groups, and send notifications through Amazon SNS.

Why this answer

AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired rules. You can create a custom AWS Config rule to check that all EC2 instances have the tag 'Environment=Production' and are associated with the security group 'Prod-SG'. When a resource becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the IT team.

Exam trap

The trap here is that candidates confuse AWS Config (configuration auditing and compliance) with AWS Trusted Advisor (best-practice recommendations) or Amazon GuardDuty (threat detection), but only AWS Config can evaluate custom rules like tag and security group requirements.

Why the other options are wrong

AWS Trusted Advisor provides best-practice recommendations but does not continuously monitor resource configurations against custom rules like tags or security group associations.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for compliance with tagging or security group rules.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for compliance with tagging or security group rules.

Practice this question →

MCQmedium

A company wants to automatically detect potential security threats such as compromised credentials, unauthorized access attempts, and communication with known malicious IP addresses across its AWS environment. The company has enabled AWS CloudTrail, VPC Flow Logs, and DNS logs. Which AWS service should the company use to continuously analyze these logs and generate actionable security findings without requiring manual setup of data sources?

A.Amazon GuardDuty

B.AWS Config

C.AWS Trusted Advisor

D.Amazon Inspector

AnswerA

Amazon GuardDuty is a managed threat detection service that continuously ingests CloudTrail management events, VPC Flow Logs, and DNS query logs. It applies anomaly detection, machine learning, and integrated threat intelligence to uncover suspicious activity such as credential compromise, cryptocurrency mining, or unauthorized network behavior. Because its entire purpose is to analyze these telemetry sources and produce prioritized security findings, it directly matches the scenario's requirement.

Why this answer

Amazon GuardDuty is a threat detection service that continuously analyzes AWS CloudTrail, VPC Flow Logs, and DNS logs using machine learning and anomaly detection to identify compromised credentials, unauthorized access, and communication with known malicious IP addresses. It operates without requiring manual setup of data sources because it automatically ingests these logs once enabled, generating actionable security findings.

Exam trap

The trap here is that candidates often confuse Amazon Inspector (which scans for vulnerabilities) with GuardDuty (which detects threats from logs), or assume AWS Config's compliance rules can detect security threats, when in fact Config only checks configuration drift, not log-based anomalies.

Why the other options are wrong

AWS Config is designed for resource inventory, configuration history, and compliance auditing, not for analyzing logs to detect security threats like compromised credentials or malicious IPs. It does not continuously analyze CloudTrail, VPC Flow Logs, or DNS logs for threat detection.

AWS Trusted Advisor provides best-practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not continuously analyze logs like CloudTrail, VPC Flow Logs, and DNS logs to detect threats such as compromised credentials or malicious IPs. It relies on periodic checks of AWS configurations, not real-time log analysis.

Amazon Inspector is designed for vulnerability management, scanning workloads for software vulnerabilities and unintended network exposure, not for analyzing CloudTrail, VPC Flow Logs, or DNS logs to detect threats like compromised credentials or malicious IP communications.

Practice this question →

MCQmedium

A company uses AWS Organizations to manage over 50 AWS accounts. The security team has identified a high-priority requirement to prevent any security group rule in any account from allowing inbound RDP (port 3389) access from the internet (0.0.0.0/0). If a rule is created that violates this policy, the team wants it to be automatically removed. The team needs a centralized service that can enforce this policy across all current and new accounts without requiring manual setup in each account. Which AWS service should the team use?

A.AWS Config

B.AWS Firewall Manager

C.AWS IAM Access Analyzer

D.AWS Security Hub

AnswerB

AWS Firewall Manager allows organizations to centrally configure and manage security group rules and AWS WAF rules across all accounts. It can apply a common security group baseline and automatically remove non-compliant rules (e.g., inbound RDP from 0.0.0.0/0), enforcing the policy across current and new accounts without manual intervention.

Why this answer

AWS Firewall Manager is the correct choice because it provides centralized management of firewall rules across all accounts in an AWS Organization. It can enforce a security group policy that automatically removes any inbound RDP rule allowing 0.0.0.0/0, and it applies this policy to both existing and newly created accounts without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Config's detection capabilities with Firewall Manager's enforcement capabilities, assuming Config can automatically remediate without realizing it requires custom automation, while Firewall Manager provides native, centralized auto-remediation across all accounts.

Why the other options are wrong

AWS Config can detect noncompliant security group rules but cannot automatically remediate them without additional custom automation (e.g., AWS Config rules with auto-remediation via Systems Manager Automation). The question requires automatic removal, which Config alone does not provide.

AWS IAM Access Analyzer analyzes resource-based policies to identify resources shared with external entities, but it does not enforce or automatically remediate security group rules. It cannot prevent or remove inbound RDP rules from 0.0.0.0/0.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across accounts, but it does not have the capability to automatically remediate or remove non-compliant security group rules. It can detect violations but relies on other services like AWS Config or AWS Firewall Manager for enforcement.

Practice this question →

MCQhard

A company stores sensitive financial data in Amazon S3. They need to ensure that even if an attacker gains access to the S3 service, they cannot read the data without a customer-controlled encryption key. Which S3 encryption method satisfies this requirement?

A.SSE-S3 (Amazon S3-managed keys)

B.SSE-KMS with an AWS managed CMK (aws/s3)

C.SSE-KMS with a customer-managed CMK

D.S3 Versioning with MFA Delete

AnswerC

SSE-KMS with a customer-managed CMK is the only option that gives the customer direct ownership and control over the encryption key. You can define the key policy, set rotation frequency, and delete or disable the key as needed; if you delete the CMK, the S3 objects encrypted with it become permanently unreadable, even by AWS. Every call to use the key is also recorded in AWS CloudTrail, providing an independent audit trail that AWS-managed keys cannot offer. This matches the explicit requirement that the customer must control the encryption keys.

Why this answer

SSE-KMS with a customer-managed CMK ensures that the encryption key is under the customer's exclusive control, not AWS. Even if an attacker gains access to the S3 service, they cannot decrypt the data without the customer-managed CMK, which is stored in AWS KMS and can be further protected with key policies, IAM policies, and optional key rotation. This satisfies the requirement that the attacker cannot read the data without a customer-controlled encryption key.

Exam trap

The trap here is that candidates confuse 'customer-managed' with 'AWS managed' and assume any KMS key provides customer control, but only a customer-managed CMK gives the customer exclusive control over the key's lifecycle and permissions.

How to eliminate wrong answers

Option A is wrong because SSE-S3 uses Amazon S3-managed keys, where AWS controls the encryption keys, so an attacker with S3 access could potentially decrypt the data using those keys. Option B is wrong because SSE-KMS with an AWS managed CMK (aws/s3) still has the key managed by AWS, not the customer, so the customer does not have exclusive control over the encryption key. Option D is wrong because S3 Versioning with MFA Delete only protects against accidental or malicious deletion of object versions, not against reading encrypted data, and does not involve encryption keys at all.

Practice this question →

MCQmedium

A healthcare company is migrating patient records to Amazon S3. The company must comply with HIPAA and needs to automatically identify any S3 buckets that contain protected health information (PHI) and generate alerts. The solution must be fully managed and require no manual effort to scan the data. Which AWS service should the company use?

A.Amazon Macie

B.Amazon Inspector

C.AWS Config

D.AWS Security Hub

AnswerA

Amazon Macie is the correct choice because it is a fully managed data security service that uses machine learning and managed data identifiers to automatically discover, classify, and protect sensitive data stored in Amazon S3. It can detect protected health information (PHI) without requiring manual scanning or custom pattern definitions, and it integrates with AWS Security Hub to centralize findings and alerting. Macie continuously monitors S3 buckets for anomalies and produces actionable findings, making it the only service here that directly inspects object content for sensitive data.

Why this answer

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data in Amazon S3. It automatically identifies protected health information (PHI) such as medical record numbers, diagnosis codes, and patient names, and can generate alerts when such data is found in S3 buckets, meeting HIPAA compliance requirements without any manual scanning effort.

Exam trap

The trap here is that candidates often confuse Amazon Inspector (which sounds like it 'inspects' data) with Macie, but Inspector only scans for vulnerabilities in compute resources, not for sensitive data content in S3 objects.

Why the other options are wrong

Amazon Inspector is designed for vulnerability management and network security assessments of EC2 instances and container workloads, not for discovering or classifying sensitive data in S3 buckets.

AWS Config evaluates resource configurations against rules but does not automatically scan data content for PHI. It cannot identify protected health information within S3 objects, which is required for HIPAA compliance.

AWS Security Hub aggregates security findings from multiple services but does not automatically scan S3 buckets for PHI. It relies on other services like Amazon Macie to provide such findings, so it cannot directly identify PHI in S3.

Practice this question →

MCQmedium

A company has a strict security policy requiring that no Amazon S3 bucket or IAM role should be accessible to external AWS accounts unless explicitly approved. The security team needs a service that continuously analyzes resource-based policies and can generate findings when an S3 bucket policy allows access to a principal from outside the company's AWS Organization. Which AWS service should the team use?

A.AWS Config

B.IAM Access Analyzer

C.AWS Trusted Advisor

D.Amazon GuardDuty

AnswerB

IAM Access Analyzer continuously analyzes resource-based policies and generates findings when a resource is accessible from outside the AWS Organization. This matches the requirement of detecting unintended external access to S3 buckets and IAM roles.

Why this answer

IAM Access Analyzer is designed to continuously analyze resource-based policies (such as S3 bucket policies and IAM role trust policies) and generate findings when access is granted to principals outside of the trusted AWS Organization. It uses zone of trust logic to identify policies that allow access to external AWS accounts, making it the correct service for this security requirement.

Exam trap

The trap here is that candidates often confuse AWS Config (which audits resource configurations) with IAM Access Analyzer (which specifically analyzes resource-based policies for cross-account access), leading them to choose AWS Config for a use case that requires policy-level access analysis.

Why the other options are wrong

AWS Config evaluates resource compliance against rules but does not analyze resource-based policies for cross-account access. It cannot detect S3 bucket policies granting access to principals outside the AWS Organization.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for analyzing resource-based policies for cross-account access. It does not generate findings based on S3 bucket policies allowing external principals.

Practice this question →

MCQmedium

A company runs a microservices-based application on Amazon ECS. The application stores database credentials and API keys in plaintext configuration files that are baked into container images. A security audit reveals that this practice violates the company's compliance policy, which mandates that secrets must be stored separately from code, centrally managed, and automatically rotated every 90 days. Which AWS service should the company use to meet these requirements?

A.AWS Key Management Service (AWS KMS)

B.AWS CloudHSM

C.AWS Secrets Manager

D.AWS Systems Manager Parameter Store

AnswerC

AWS Secrets Manager is purpose-built for storing, managing, and automatically rotating secrets such as database credentials and API keys. It integrates with Lambda to perform rotation on a schedule and with RDS for automatic credential updates, meeting the compliance requirements.

Why this answer

AWS Secrets Manager is the correct choice because it is designed specifically for storing, managing, and automatically rotating database credentials, API keys, and other secrets throughout their lifecycle. It meets the compliance requirements by storing secrets separately from code, providing a central management console and API, and supporting automatic rotation every 90 days via built-in integration with AWS RDS, Redshift, and DocumentDB, or custom Lambda functions.

Exam trap

The trap here is that candidates often confuse AWS Secrets Manager with AWS Systems Manager Parameter Store, assuming both offer automatic rotation, but Parameter Store lacks native rotation capabilities and is primarily for configuration data, not secrets lifecycle management.

Why the other options are wrong

AWS KMS is a key management service for creating and controlling encryption keys, not for storing secrets like database credentials or API keys. It does not provide automatic rotation of secrets or a centralized secret store.

AWS CloudHSM provides hardware security modules for cryptographic key storage but does not offer automatic secret rotation or centralized management of application secrets like database credentials and API keys.

AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it requires custom solutions (e.g., Lambda) to rotate secrets, whereas the compliance policy mandates automatic rotation every 90 days.

Practice this question →

MCQeasy

A company's compliance officer needs to provide an external auditor with copies of AWS SOC 2 reports and a PCI DSS attestation of compliance. The officer needs a self-service portal to download these documents directly, without contacting AWS Support. The solution must provide the most current versions of these reports. Which AWS service should the officer use?

A.AWS Artifact

B.AWS Audit Manager

C.Amazon Inspector

D.AWS Config

AnswerA

AWS Artifact is a self-service portal that provides on-demand access to AWS compliance reports, such as SOC 2, SOC 3, PCI DSS, ISO certifications, and FedRAMP, as well as the ability to review, accept, and manage AWS agreements like the Business Associate Addendum. It allows customers to download these reports directly from the AWS Management Console without needing to contact AWS Support or open a case, making it the correct destination for an external compliance officer.

Why this answer

AWS Artifact is the correct service because it provides a self-service portal for on-demand access to AWS compliance reports, including SOC 2 reports and PCI DSS attestations of compliance. It ensures the most current versions are always available without needing to contact AWS Support, directly meeting the compliance officer's requirement for a self-service download solution.

Exam trap

The trap here is that candidates confuse AWS Artifact (a document repository for compliance reports) with AWS Audit Manager (a tool for creating and managing audit evidence), leading them to select Audit Manager for downloading reports instead of Artifact.

Why the other options are wrong

AWS Audit Manager helps audit evidence collection and report generation, but it does not provide a self-service portal to download pre-existing compliance reports like SOC 2 or PCI DSS attestations. Those reports are available only through AWS Artifact.

Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not a repository for compliance reports like SOC 2 or PCI DSS attestations.

AWS Config is used for resource inventory, configuration history, and compliance rule evaluation, not for downloading compliance reports like SOC 2 or PCI DSS attestations.

Practice this question →

MCQmedium

A company's security team wants to identify all Amazon S3 buckets that are shared with external AWS accounts or publicly accessible. The team needs a continuous evaluation that reports findings in a centralized dashboard and sends alerts when new unintended external shares are created. Which AWS service should the security team use to meet these requirements?

A.AWS Config

B.IAM Access Analyzer

C.AWS Trusted Advisor

D.Amazon GuardDuty

AnswerB

IAM Access Analyzer analyzes resource-based policies to identify resources that are shared with external entities (outside your AWS organization). It provides continuous monitoring, a dashboard of findings, and integration with AWS Security Hub and Amazon EventBridge for alerts. This directly meets the requirement.

Why this answer

IAM Access Analyzer is the correct choice because it continuously monitors resource policies, including S3 bucket policies, to identify resources shared with external AWS accounts or publicly. It provides a centralized dashboard in the IAM console to view findings and integrates with Amazon EventBridge to send alerts via Amazon SNS when new unintended external shares are created, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to detect resource changes with the specific need for continuous policy analysis and centralized findings for external access, leading them to pick AWS Config instead of IAM Access Analyzer.

Why the other options are wrong

AWS Config can evaluate resource compliance against rules but does not natively identify S3 buckets shared with external accounts or provide a centralized dashboard for such findings; it lacks the specific external access analysis that IAM Access Analyzer offers.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for identifying S3 buckets shared with external accounts or publicly accessible. It does not provide a centralized dashboard for external sharing findings or continuous evaluation of bucket policies.

Practice this question →

MCQmedium

An e-commerce company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer and Amazon CloudFront. The application has been experiencing frequent, large-scale DDoS attacks that cause significant compute and data transfer costs. The company wants to implement a managed DDoS protection service that provides financial protection against scaling costs incurred during DDoS attacks, access to a DDoS Response Team (DRT) for real-time attack mitigation support, and integration with AWS WAF for application-layer attack protection. Which AWS service should the company use to meet these requirements?

A.AWS Shield Standard

B.AWS Shield Advanced

C.AWS WAF

D.Amazon GuardDuty

AnswerB

AWS Shield Advanced is a paid service that provides enhanced DDoS protection. It includes cost protection against scaling charges incurred during a DDoS attack, 24/7 access to the DDoS Response Team (DRT) for expert support, and integration with AWS WAF for application-layer attack mitigation. This matches all the requirements described in the scenario.

Why this answer

AWS Shield Advanced is the correct choice because it provides enhanced DDoS protection with financial protection against scaling costs incurred during DDoS attacks (cost protection for EC2, ELB, CloudFront, and Route 53), 24/7 access to the DDoS Response Team (DRT) for real-time attack mitigation, and seamless integration with AWS WAF for application-layer attack protection. This fully managed service meets all three stated requirements, unlike the other options.

Exam trap

The trap here is that candidates often confuse AWS Shield Standard (free, basic protection) with AWS Shield Advanced (paid, enhanced protection with cost protection and DRT access), or mistakenly think AWS WAF alone provides DDoS mitigation and financial safeguards, when in fact WAF is only an application-layer component that must be paired with Shield Advanced for the full solution.

Why the other options are wrong

AWS Shield Standard provides basic DDoS protection but does not offer financial protection against scaling costs, access to the DDoS Response Team (DRT), or integration with AWS WAF for application-layer attack protection.

AWS WAF is a web application firewall that protects against application-layer attacks, but it does not provide financial protection against scaling costs incurred during DDoS attacks or access to a DDoS Response Team (DRT). The question requires a managed DDoS protection service with these specific features, which are only offered by AWS Shield Advanced.

Amazon GuardDuty is a threat detection service that identifies malicious activity, but it does not provide DDoS mitigation, financial protection against scaling costs, or access to a DDoS Response Team (DRT).

Practice this question →

MCQmedium

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires a mechanism to prevent any IAM user or role in any member account from modifying Amazon S3 bucket policies to grant public access. The solution must be enforced centrally and cannot be overridden by account administrators. Which AWS feature should the company use?

A.IAM permissions boundaries

B.Service control policies (SCPs)

C.AWS Config conformance packs

D.AWS CloudTrail Insights

AnswerB

SCPs are used in AWS Organizations to centrally manage permissions across all accounts. They define the maximum available permissions and can explicitly deny actions like modifying S3 bucket policies. SCPs apply to all principals in the account and cannot be bypassed by account administrators.

Why this answer

Service control policies (SCPs) are the correct choice because they allow AWS Organizations to centrally define permission guardrails that apply to all IAM users and roles across member accounts. SCPs can explicitly deny actions like s3:PutBucketPolicy to prevent any account administrator from modifying S3 bucket policies to grant public access, and these restrictions cannot be overridden by any IAM entity within the member account.

Exam trap

The trap here is that candidates often confuse SCPs with IAM permissions boundaries, thinking both are equally enforceable centrally, but SCPs operate at the organization level and cannot be bypassed by account administrators, whereas permissions boundaries are account-level and can be removed or modified by an admin with sufficient privileges.

Why the other options are wrong

IAM permissions boundaries apply to individual IAM users or roles within an account, not across multiple accounts centrally. They can be overridden by account administrators with sufficient permissions, so they do not meet the requirement for a centrally enforced, unoverridable control.

AWS Config conformance packs evaluate resource compliance against rules but cannot enforce or prevent actions; they only detect and report non-compliance after the fact.

AWS CloudTrail Insights analyzes API call patterns to detect unusual activity, but it cannot prevent or enforce restrictions on S3 bucket policy modifications. It is a detective control, not a preventive one.

Practice this question →

MCQmedium

A company stores customer data in Amazon S3 buckets. The compliance team needs to automatically discover which buckets contain personally identifiable information (PII) such as names, addresses, and credit card numbers. The team also wants to receive continuous monitoring and alerts when new sensitive data is uploaded. Which AWS service should the team use to meet these requirements?

A.Amazon Macie

B.AWS Shield

C.Amazon Inspector

D.AWS Config

AnswerA

Amazon Macie is the correct answer because it is a fully managed data security and privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3, such as PII and financial information. It continuously monitors data access activity and generates alerts when anomalies or new sensitive objects are detected, giving security teams visibility into potential data exposure across the bucket estate.

Why this answer

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data in Amazon S3. It can identify PII such as names, addresses, and credit card numbers, and it provides continuous monitoring with alerts when new sensitive data is uploaded, meeting both the discovery and ongoing monitoring requirements.

Exam trap

The trap here is that candidates often confuse Amazon Inspector (which scans for vulnerabilities) with Amazon Macie (which scans for sensitive data), because both involve 'scanning' but for entirely different purposes and resource types.

Why the other options are wrong

AWS Shield is a managed DDoS protection service, not designed for data classification or PII discovery in S3 buckets.

Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not for discovering PII in S3 buckets.

AWS Config is used to evaluate and record configuration changes of AWS resources, not to discover or monitor PII in S3 objects. It cannot inspect object content for sensitive data.

Practice this question →

MCQmedium

A company has internal security policies that require all Amazon S3 buckets to be private (not publicly accessible) and all Amazon EC2 security groups to restrict inbound SSH traffic to a specific IP range. The security team needs to continuously monitor all AWS resources across their account to detect any resource that violates these policies. They also need a historical record of configuration changes and a compliance dashboard that shows overall pass/fail status. Which AWS service should the security team use to meet these requirements?

A.AWS Config

B.AWS CloudTrail

C.Amazon GuardDuty

D.Amazon Inspector

AnswerA

AWS Config is the only service that continuously records and evaluates S3 bucket configurations against managed or custom compliance rules, such as enforced bucket policies, encryption settings, or lifecycle rules. It provides a compliance dashboard that shows whether each bucket is compliant or noncompliant with your internal policy, and it maintains a full configuration history for auditing. This makes it the correct choice for an internal policy requiring all S3 buckets to meet specific configuration standards.

Why this answer

AWS Config is the correct service because it provides continuous monitoring, compliance auditing, and historical recording of configuration changes for AWS resources. It allows you to define rules (e.g., 's3-bucket-public-read-prohibited' and 'restricted-ssh') that automatically evaluate your S3 bucket policies and EC2 security group rules against your security policies, and it offers a compliance dashboard showing pass/fail status for each resource. AWS Config also maintains a configuration history that can be used for auditing and troubleshooting.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with AWS Config (which tracks resource configuration state and compliance), leading them to choose CloudTrail because they think 'historical record of changes' refers to API logs rather than configuration item snapshots.

Why the other options are wrong

AWS CloudTrail records API activity and provides audit logs, but it does not continuously evaluate resource configurations against policies, nor does it provide a compliance dashboard or historical configuration tracking for S3 bucket policies or EC2 security group rules.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not for compliance with internal policies like S3 bucket public access or EC2 security group rules. It does not provide a compliance dashboard or historical configuration change tracking.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, but it does not provide continuous compliance monitoring, a historical record of configuration changes, or a compliance dashboard for pass/fail status against custom policies.

Practice this question →

MCQmedium

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires that no IAM users can be created in any member account. All access must use federated identities from the company's existing identity provider. The security team needs a single, centralized mechanism to enforce this restriction across all existing and future member accounts. Which AWS feature should the security team use to meet this requirement?

A.AWS Identity and Access Management (IAM) policies

B.AWS Organizations service control policies (SCPs)

C.AWS Config managed rules with automatic remediation

D.IAM Access Analyzer

AnswerB

SCPs are a centralized policy mechanism within AWS Organizations that can deny the IAM:CreateUser action across all member accounts in an organization, OU, or specific account. SCPs apply to all principals, including the root user, and affect both existing and future accounts, making them the correct choice for enforcing this restriction.

Why this answer

AWS Organizations service control policies (SCPs) allow a central administrator to define maximum permissions for all accounts within an organization. By creating an SCP that explicitly denies the `iam:CreateUser` action, the security team can enforce that no IAM users can be created in any member account, including future accounts, because SCPs are inherited by all accounts in the organization. This provides a single, centralized mechanism that cannot be overridden by account-level IAM policies.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking IAM policies can centrally control all accounts, but SCPs are the only mechanism that can enforce restrictions across an entire AWS Organization, including preventing the creation of IAM users.

Why the other options are wrong

IAM policies are attached to IAM users, groups, or roles and can only restrict permissions within a single account. They cannot be applied centrally across all accounts in an AWS Organization, nor can they prevent the creation of IAM users in member accounts.

AWS Config managed rules with automatic remediation can detect and remediate non-compliant resources, but they cannot proactively prevent IAM user creation across all accounts. They operate reactively and require per-account setup, not a single centralized mechanism like SCPs.

IAM Access Analyzer helps identify resources shared with external entities, but it does not enforce restrictions on creating IAM users. It is an auditing tool, not a preventive control.

Practice this question →

MCQmedium

A company needs to maintain a secure audit trail of all API calls made against its AWS resources. The audit trail must record the identity of the caller, the time of the call, the source IP address, and the request details. The records must be stored securely with integrity guarantees for a minimum of five years to meet compliance requirements. Which AWS service should the company use to capture and store this information?

A.AWS Config

B.Amazon GuardDuty

C.AWS CloudTrail

D.AWS Trusted Advisor

AnswerC

AWS CloudTrail is the correct service. It records all API calls made to the AWS environment, including details such as the caller's identity, time of the call, source IP address, and request parameters. The logs can be stored durably in Amazon S3 with integrity validation and can be retained for as long as needed.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing the identity of the caller, timestamp, source IP address, and request details. It stores these logs in Amazon S3 with server-side encryption and integrity validation via digest files, and can be configured to retain logs for more than five years using lifecycle policies or by archiving to Amazon S3 Glacier.

Exam trap

The trap here is that candidates confuse AWS Config's configuration tracking with CloudTrail's API activity logging, or assume GuardDuty's threat detection includes a complete audit trail, when in fact only CloudTrail provides the detailed, integrity-protected record of every API call required for compliance.

Why the other options are wrong

AWS Config records resource configuration changes and evaluates compliance, not API call audit trails. It lacks details like caller identity, source IP, and request details required for this question.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a service for capturing and storing API call audit trails with integrity guarantees for compliance.

AWS Trusted Advisor provides recommendations for optimizing AWS environments (cost, performance, security, fault tolerance, service limits), but it does not capture or store API call audit trails with caller identity, timestamps, source IP, and request details.

Practice this question →

MCQmedium

A company hosts a web application on AWS that uses Amazon CloudFront for content delivery and an Application Load Balancer (ALB) in front of Amazon EC2 instances. The security team wants to protect the application against common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that can inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. Which AWS service should the company use to meet these requirements?

A.AWS WAF

B.AWS Shield Advanced

C.AWS Firewall Manager

D.Amazon Inspector

AnswerA

AWS WAF is a web application firewall that monitors and filters HTTP/HTTPS traffic to protect against attacks such as SQL injection and cross-site scripting. It integrates directly with CloudFront and ALB, making it the correct choice for this scenario.

Why this answer

AWS WAF is a managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Amazon CloudFront and Application Load Balancers (ALB) to inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. This makes it the correct choice for the security team's requirement to filter and block specific attack patterns at the application layer.

Exam trap

The trap here is that candidates often confuse AWS Shield Advanced (Layer 3/4 DDoS protection) with AWS WAF (Layer 7 application-layer filtering), leading them to select Shield Advanced for web exploit protection instead of the correct service.

Why the other options are wrong

AWS Shield Advanced provides DDoS protection, not application-layer inspection for SQL injection or XSS. It does not inspect HTTP request payloads to block web exploits.

AWS Firewall Manager is a policy management service that centrally configures and manages firewall rules across accounts and resources, but it does not itself inspect traffic for SQL injection or XSS; it relies on AWS WAF rules to do so.

Amazon Inspector is a vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, not a web application firewall that inspects HTTP/HTTPS requests for SQL injection or XSS.

Practice this question →

MCQmedium

A financial services company must encrypt all sensitive customer data stored in Amazon S3 using an encryption key that the company manages and rotates annually. The company also needs a complete, tamper-proof record of every time the key is used (including who used it and on which object) to satisfy regulatory audit requirements. Which AWS service should the company use to meet both the key management and audit logging requirements?

A.AWS Certificate Manager (ACM)

B.AWS Key Management Service (AWS KMS)

C.AWS CloudHSM

D.AWS Secrets Manager

AnswerB

KMS enables you to create and manage customer-managed keys (CMKs) for encrypting data at rest in S3. It also integrates with AWS CloudTrail to log every key usage request, providing the required audit trail for compliance.

Why this answer

AWS KMS is the correct choice because it allows the company to create and manage a customer managed key (CMK) with annual rotation, and it integrates with AWS CloudTrail to deliver tamper-proof logs of every KMS API call (e.g., Decrypt, Encrypt, GenerateDataKey). These logs record the key ID, the IAM user or role that made the request, and the S3 object ARN (via encryption context), satisfying both key management and audit logging requirements.

Exam trap

The trap here is that candidates confuse AWS CloudHSM's hardware security with the integrated audit logging and automatic rotation capabilities of AWS KMS, assuming that a dedicated HSM is always required for regulatory compliance, when KMS with CloudTrail fully meets the tamper-proof audit requirement.

Why the other options are wrong

AWS Certificate Manager (ACM) manages SSL/TLS certificates, not encryption keys for S3 data. It does not provide the key rotation or audit logging capabilities required for customer-managed encryption keys.

AWS Secrets Manager is designed for managing secrets like database credentials and API keys, not for managing encryption keys for S3 data. It does not provide the required tamper-proof audit logs of key usage for regulatory compliance.

Practice this question →

MCQmedium

A company runs a fleet of Amazon EC2 instances that host a customer-facing web application. The security team wants to automatically identify software vulnerabilities, such as missing patches and common vulnerabilities and exposures (CVEs), in the operating system and applications running on these instances. The team also needs visibility into unintended network accessibility, such as instances with ports open to the internet. The solution must be natively integrated with AWS and should provide findings that can be viewed in a central dashboard. Which AWS service should the security team use?

A.Amazon GuardDuty

B.Amazon Inspector

C.AWS Security Hub

D.AWS Trusted Advisor

AnswerB

Amazon Inspector is a vulnerability management service that automatically discovers EC2 instances and delivers software vulnerability (CVE) findings by scanning the operating system and installed packages, using data from AWS Systems Manager. It also maps network reachability of the instance to determine which vulnerabilities are actually exposed to the internet or a VPC, and assigns a severity and risk score for each finding. This allows the security team to prioritize patching based on real attack surface rather than just patch status.

Why this answer

Amazon Inspector is the correct choice because it is a vulnerability management service that automatically scans EC2 instances for software vulnerabilities (missing patches, CVEs) and unintended network accessibility (e.g., open ports to the internet). It is natively integrated with AWS and provides findings in a central dashboard via the AWS Management Console or AWS Security Hub. This directly matches the security team's requirements for automated identification of OS/application vulnerabilities and network exposure.

Exam trap

The trap here is that candidates often confuse Amazon GuardDuty (threat detection) with Amazon Inspector (vulnerability scanning), or assume AWS Security Hub performs the scanning itself rather than aggregating findings from other services.

Why the other options are wrong

Amazon GuardDuty is a threat detection service that identifies malicious activity and unauthorized behavior using network and account logs, but it does not perform vulnerability assessments for missing patches or CVEs in OS and applications.

AWS Security Hub aggregates and prioritizes security findings from multiple AWS services (like Inspector, GuardDuty) but does not itself perform vulnerability scanning or network accessibility checks. The question requires a service that directly identifies CVEs and open ports, which is Inspector's function.

AWS Trusted Advisor provides best-practice recommendations across cost, performance, security, and fault tolerance, but it does not perform automated vulnerability scanning for missing patches or CVEs in EC2 instances. It also lacks a central findings dashboard for software vulnerabilities.

Practice this question →