CCNA Security Questions — Page 2 of 3

MCQmedium

A company runs a fleet of Amazon EC2 instances that host a customer-facing web application. The security team wants to automatically identify software vulnerabilities, such as missing patches and common vulnerabilities and exposures (CVEs), in the operating system and applications running on these instances. The team also needs visibility into unintended network accessibility, such as instances with ports open to the internet. The solution must be natively integrated with AWS and should provide findings that can be viewed in a central dashboard. Which AWS service should the security team use?

A.Amazon GuardDuty

B.Amazon Inspector

C.AWS Security Hub

D.AWS Trusted Advisor

AnswerB

Amazon Inspector is a vulnerability management service that automatically discovers EC2 instances and delivers software vulnerability (CVE) findings by scanning the operating system and installed packages, using data from AWS Systems Manager. It also maps network reachability of the instance to determine which vulnerabilities are actually exposed to the internet or a VPC, and assigns a severity and risk score for each finding. This allows the security team to prioritize patching based on real attack surface rather than just patch status.

Why this answer

Amazon Inspector is the correct choice because it is a vulnerability management service that automatically scans EC2 instances for software vulnerabilities (missing patches, CVEs) and unintended network accessibility (e.g., open ports to the internet). It is natively integrated with AWS and provides findings in a central dashboard via the AWS Management Console or AWS Security Hub. This directly matches the security team's requirements for automated identification of OS/application vulnerabilities and network exposure.

Exam trap

The trap here is that candidates often confuse Amazon GuardDuty (threat detection) with Amazon Inspector (vulnerability scanning), or assume AWS Security Hub performs the scanning itself rather than aggregating findings from other services.

Why the other options are wrong

Amazon GuardDuty is a threat detection service that identifies malicious activity and unauthorized behavior using network and account logs, but it does not perform vulnerability assessments for missing patches or CVEs in OS and applications.

AWS Security Hub aggregates and prioritizes security findings from multiple AWS services (like Inspector, GuardDuty) but does not itself perform vulnerability scanning or network accessibility checks. The question requires a service that directly identifies CVEs and open ports, which is Inspector's function.

AWS Trusted Advisor provides best-practice recommendations across cost, performance, security, and fault tolerance, but it does not perform automated vulnerability scanning for missing patches or CVEs in EC2 instances. It also lacks a central findings dashboard for software vulnerabilities.

Practice this question →

MCQmedium

A company uses multiple AWS security services — GuardDuty, Inspector, Macie, and IAM Access Analyzer — across multiple accounts. The security team needs a single console to view, prioritise, and manage all security findings from these services and third-party tools. Which AWS service provides this aggregated view?

A.Amazon GuardDuty

B.Amazon CloudWatch

C.AWS Security Hub

D.AWS Config

AnswerC

Security Hub aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, Firewall Manager, and third-party tools into a unified dashboard. It uses the AWS Security Finding Format (ASFF) to normalise findings and allows centralised management across accounts.

Why this answer

AWS Security Hub is the correct service because it provides a single, consolidated view of security alerts and compliance status across multiple AWS accounts and services, including GuardDuty, Inspector, Macie, and IAM Access Analyzer. It aggregates findings from these native services and third-party tools into a standardized format using the AWS Security Finding Format (ASFF), enabling centralized prioritization and management. This directly addresses the requirement for a unified console to view, prioritize, and manage all security findings.

Exam trap

The trap here is that candidates often confuse AWS Security Hub with Amazon GuardDuty or AWS Config, mistakenly thinking that GuardDuty's threat detection or Config's compliance checks already provide a consolidated view, when in fact Security Hub is the dedicated aggregation service that ingests findings from multiple sources.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity using VPC Flow Logs, DNS logs, and CloudTrail events, but it does not aggregate findings from other security services or third-party tools; it only generates its own findings. Option B is wrong because Amazon CloudWatch is a monitoring and observability service for metrics, logs, and alarms, not a security findings aggregator; it lacks the standardized security finding format (ASFF) and cross-service consolidation capabilities of Security Hub. Option D is wrong because AWS Config is a resource inventory and compliance auditing service that evaluates resource configurations against rules, but it does not ingest or aggregate security findings from GuardDuty, Inspector, Macie, or third-party tools; it focuses on configuration compliance, not security alert management.

Practice this question →

MCQmedium

A company stores sensitive customer data in Amazon S3 buckets. The company's security policy requires that all objects in these buckets be encrypted at rest using an encryption key that the company can rotate annually and audit for usage. The company also needs to control which IAM users and roles can use, create, and manage these keys. The security team wants to use an AWS managed service to handle the key management lifecycle. Which AWS service should the company use to meet these requirements?

A.AWS Key Management Service (KMS)

B.Amazon S3 server-side encryption with customer-provided keys (SSE-C)

C.AWS Certificate Manager (ACM)

D.AWS Secrets Manager

AnswerA

AWS KMS is a managed encryption service that lets you create customer managed keys (CMKs) used to encrypt data at rest in Amazon S3. It integrates with S3's server-side encryption (SSE-KMS) to encrypt objects transparently, and provides centralized control over key policies, automatic annual rotation, and AWS CloudTrail auditing of key usage. This gives the company a fully managed key infrastructure without having to implement or operate their own key management hardware.

Why this answer

AWS Key Management Service (KMS) is the correct choice because it is a managed service that allows you to create, rotate, and audit customer-managed keys (CMKs) used for encrypting S3 objects at rest. KMS integrates with AWS CloudTrail to log every key usage, enabling the required audit trail, and supports annual key rotation via automatic or manual rotation. It also provides fine-grained IAM policies and key policies to control which users and roles can use, create, and manage the keys, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse AWS Secrets Manager with KMS because both manage secrets, but Secrets Manager is for rotating application secrets like database passwords, not for managing encryption keys used for S3 server-side encryption, which is a core KMS function.

Why the other options are wrong

AWS Certificate Manager (ACM) handles SSL/TLS certificates for securing network traffic, not encryption keys for data at rest in S3. It does not provide key rotation or audit capabilities for S3 object encryption.

AWS Secrets Manager is designed for managing secrets like database credentials and API keys, not for managing encryption keys with rotation and audit capabilities. It does not provide the key management lifecycle features required for encrypting S3 objects.

Practice this question →

MCQmedium

A company uses multiple AWS accounts. The security team wants to enforce two requirements for all Amazon S3 buckets: first, server-side encryption must be enabled using AWS KMS; second, no bucket can be publicly accessible. The team needs a service that continuously monitors the configuration of S3 buckets across all accounts, detects when a bucket violates either requirement, and automatically applies corrective actions (such as enabling default encryption or removing public access). Which AWS service should the security team use to meet these requirements?

A.AWS Config

B.AWS Trusted Advisor

C.AWS IAM Access Analyzer

D.AWS CloudTrail

AnswerA

AWS Config continuously records S3 bucket configuration across accounts and evaluates it against rules, detecting unencrypted or public buckets. Its remediation actions then automatically re-enable AWS KMS default encryption or remove public access, satisfying both continuous monitoring and auto-correction requirements.

Why this answer

AWS Config is the correct service because it provides continuous monitoring, evaluation, and automated remediation of resource configurations across multiple accounts. With AWS Config rules (e.g., managed rules like `s3-bucket-server-side-encryption-enabled` and `s3-bucket-public-read-prohibited`), you can detect noncompliant S3 buckets and trigger AWS Systems Manager Automation documents or Lambda functions to automatically enable default encryption or remove public access. AWS Config also supports multi-account aggregation via an aggregator, allowing the security team to enforce these requirements across all accounts from a single management account.

Exam trap

The trap here is that candidates confuse AWS Config's continuous compliance monitoring and automated remediation with AWS Trusted Advisor's advisory checks or AWS IAM Access Analyzer's policy analysis, failing to recognize that only AWS Config provides both detection and automatic corrective actions.

Why the other options are wrong

AWS Trusted Advisor provides best-practice checks and recommendations but does not automatically apply corrective actions or continuously monitor for compliance with custom rules like enabling KMS encryption.

AWS IAM Access Analyzer analyzes resource-based policies to identify resources shared with external entities, but it does not continuously monitor S3 bucket configurations for encryption or automatically apply corrective actions.

AWS CloudTrail records API activity for auditing but does not continuously monitor resource configurations or automatically apply corrective actions. It cannot detect S3 bucket encryption or public access violations and lacks remediation capabilities.

Practice this question →

MCQmedium

After GuardDuty generates a security finding about potentially compromised EC2 instances, a security analyst needs to investigate the full context of the threat — understanding which users, IPs, and resources were involved and how they relate to each other. Which AWS service helps investigators analyse and visualise these relationships?

A.Amazon GuardDuty

B.AWS CloudTrail

C.Amazon Detective

D.AWS Security Hub

AnswerC

Detective analyses security data from CloudTrail, VPC Flow Logs, and GuardDuty to automatically build a behaviour graph. Analysts use the visual interface to trace the timeline of an incident, identify affected resources, and understand attacker lateral movement.

Why this answer

Amazon Detective is designed specifically to analyze, investigate, and quickly identify the root cause of security findings by automatically collecting log data from AWS resources and building a graph model that shows relationships between users, IPs, and resources. When GuardDuty generates a finding about a potentially compromised EC2 instance, Detective can ingest that finding and provide a visual, interactive view of the entire resource interaction timeline, including network connections, API calls, and user activity, enabling investigators to understand the full context of the threat.

Exam trap

The trap here is that candidates often confuse Security Hub's aggregation and prioritization of findings with Detective's investigative and visualization capabilities, leading them to choose Security Hub when the question specifically asks for analyzing and visualizing relationships between users, IPs, and resources.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that generates security findings, but it does not provide the investigative analysis or visualization of relationships between users, IPs, and resources; it only alerts on suspicious activity. Option B is wrong because AWS CloudTrail records API calls for auditing and governance, but it does not automatically correlate events across multiple resources or build a graph model to visualize relationships; it provides raw logs that require manual correlation. Option D is wrong because AWS Security Hub aggregates and prioritizes security findings from multiple services, including GuardDuty, but it does not perform deep investigative analysis or visualize resource relationships; it is a central dashboard for compliance and security posture, not an investigation tool.

Practice this question →

MCQmedium

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to enforce that all Amazon Elastic Block Store (EBS) volumes created in any account within the organization are automatically encrypted at rest. The team needs a centrally managed solution that proactively prevents the creation of unencrypted EBS volumes without requiring individual account administrators to enable any settings. Which AWS feature should the security team use to meet these requirements?

A.AWS Key Management Service (AWS KMS) with automatic key rotation

B.AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled

C.Amazon EBS encryption by default at the account level, configured via the EC2 console in each account

D.AWS Config with a managed rule to detect unencrypted volumes and trigger an AWS Lambda function for automatic remediation

AnswerB

An SCP can be applied to the root or specific organizational units (OUs) to deny the creation of unencrypted EBS volumes. This centrally enforces the encryption requirement across all affected accounts without requiring any local configuration. It is a proactive, preventive control.

Why this answer

An SCP in AWS Organizations can centrally deny the ec2:CreateVolume API call unless the request includes a condition that encryption is enabled (e.g., ec2:Encrypted = true). This proactively prevents any user or role in any member account from creating an unencrypted EBS volume, regardless of individual account settings, meeting the requirement for a centrally managed, preventive control.

Exam trap

The trap here is that candidates confuse account-level default encryption settings (which are per-account and not centrally enforced) with SCPs, which provide organization-wide preventive controls without requiring individual account configuration.

Why the other options are wrong

AWS KMS with automatic key rotation manages encryption keys but does not enforce encryption on EBS volumes; it cannot prevent creation of unencrypted volumes.

This option requires individual account administrators to enable encryption by default in each account, which does not meet the requirement for a centrally managed solution that proactively prevents unencrypted volumes without per-account action.

AWS Config with a Lambda function is a reactive, not proactive, solution—it detects and remediates unencrypted volumes after creation, whereas the requirement is to proactively prevent creation of unencrypted volumes.

Practice this question →

MCQmedium

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that Amazon CloudTrail is enabled in all AWS Regions for every member account, and that no user (including account administrators) can disable it. The policy must apply automatically to any new accounts that are added to the organization. Which AWS feature should the security team use to enforce this requirement?

A.IAM policies with a Deny effect for CloudTrail actions

B.AWS Config rules with an auto-remediation action

C.Service Control Policies (SCPs)

D.AWS CloudTrail trails with multi-region and organization trail enabled

AnswerC

SCPs are the correct choice. They allow you to define a central permission guardrail at the organization level that applies to all accounts, including the root user. An SCP denying CloudTrail disablement will prevent any principal in the account from disabling the trail, and it automatically applies to new accounts added to the organization.

Why this answer

Service Control Policies (SCPs) are the correct choice because they allow the security team to centrally control the maximum available permissions for all accounts within an AWS Organization. By creating an SCP that denies all CloudTrail disabling actions (e.g., `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`) and attaching it to the root or specific organizational units, the policy applies automatically to all existing and new member accounts, and even account administrators cannot override it. This ensures CloudTrail remains enabled across all Regions in every account, meeting the enforcement requirement.

Exam trap

The trap here is that candidates often confuse IAM policies (which are account-specific and can be bypassed by administrators) with SCPs (which are organization-wide and cannot be overridden by account administrators), leading them to choose IAM Deny policies instead of SCPs.

Why the other options are wrong

IAM policies with a Deny effect for CloudTrail actions can be attached to IAM users, groups, or roles, but they do not apply to the root user or to users in other accounts within the organization. They also cannot prevent account administrators from modifying or removing the policy itself, and they do not automatically apply to new accounts.

AWS Config rules with auto-remediation can detect and fix noncompliant resources, but they cannot prevent users from disabling CloudTrail in the first place. The requirement is to enforce a preventive control that applies automatically to all accounts, including new ones, which SCPs provide.

Enabling an organization trail with multi-region settings ensures CloudTrail logs are delivered to a central account, but it does not prevent users in member accounts from disabling CloudTrail in their own accounts. The requirement is to enforce that CloudTrail cannot be disabled, which requires a preventive control like SCPs.

Practice this question →

MCQmedium

A financial services company stores confidential transaction records in Amazon S3. The company's compliance policy requires that all data at rest be encrypted using encryption keys that are under the company's full control. The keys must be automatically rotated every year. The company also needs a detailed audit trail of when each key was used and by which AWS principal. Which combination of AWS service and key type should the company use to meet these requirements?

A.Use Amazon S3 server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager with automatic rotation enabled.

B.Use Amazon S3 server-side encryption with AWS managed keys (SSE-S3) and enable automatic key rotation.

C.Use AWS CloudHSM to generate and store the encryption keys, and configure an AWS Lambda function to rotate the keys every year and log usage to Amazon CloudWatch Logs.

D.Use AWS Key Management Service (AWS KMS) with a customer managed key and enable automatic key rotation.

AnswerD

AWS KMS customer managed keys give you full control over the key material and key policy. You can enable automatic annual rotation, and all key usage is logged in AWS CloudTrail, providing a detailed audit trail of which principal used the key.

Why this answer

AWS KMS with a customer managed key allows the company to maintain full control over the encryption keys, enable automatic annual rotation, and provides detailed CloudTrail audit logs for every key usage, including the AWS principal that made the request. This satisfies the compliance requirements for encryption at rest, key rotation, and audit trail.

Exam trap

The trap here is that candidates often confuse SSE-C with customer managed keys in KMS, assuming that providing your own key (SSE-C) gives you full control and auditability, but SSE-C lacks automatic rotation and integrated auditing, which KMS provides.

Why the other options are wrong

SSE-C does not provide automatic key rotation; the customer must manage key rotation themselves. Additionally, SSE-C does not provide a detailed audit trail of key usage by AWS principal, as it only logs that an object was encrypted with a customer-provided key, not which key or principal used it.

AWS CloudHSM does not provide automatic key rotation; the Lambda function would need to be custom-built and managed, and CloudHSM does not natively integrate with S3 for encryption, requiring additional complexity. Moreover, CloudHSM lacks a detailed audit trail of key usage by AWS principal without additional logging setup.

Practice this question →

MCQmedium

A company has a compliance requirement that all Amazon S3 buckets must have server-side encryption (SSE) enabled and must block all public access. The company has hundreds of existing S3 buckets and creates new ones regularly. The security team needs a centralized AWS service that can continuously evaluate all buckets against these two rules, automatically detect noncompliant buckets, and then automatically remediate them by enabling SSE and blocking public access. Additionally, the team wants to receive notifications when compliance changes occur. Which AWS service should the security team use?

A.AWS Config with managed rules and automatic remediation

B.AWS Security Hub

C.AWS IAM Access Analyzer

D.Amazon Macie

AnswerA

AWS Config provides managed rules to evaluate resource configurations against best practices. It can automatically remediate noncompliant resources by invoking Systems Manager Automation documents. It also sends notifications via Amazon SNS for compliance changes, fully meeting the requirement.

Why this answer

AWS Config with managed rules such as 's3-bucket-server-side-encryption-enabled' and 's3-bucket-public-read-prohibited' can continuously evaluate all S3 buckets against these compliance requirements. When a noncompliant bucket is detected, AWS Config can automatically remediate it using SSM Automation documents (e.g., enabling SSE-S3 or SSE-KMS and applying bucket policies to block public access). Additionally, AWS Config can send notifications via Amazon SNS when compliance changes occur, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse AWS Security Hub's aggregation and visibility capabilities with the ability to perform automatic remediation, but Security Hub does not natively remediate resources; it relies on AWS Config rules or other services for that functionality.

Why the other options are wrong

AWS IAM Access Analyzer analyzes resource policies to identify unintended public or cross-account access, but it does not enforce encryption or automatically remediate noncompliant buckets, nor does it provide continuous compliance evaluation and notification for SSE and public access blocking.

Amazon Macie is designed for data security and privacy, using machine learning to discover, classify, and protect sensitive data in S3. It does not provide continuous compliance evaluation against rules like SSE or public access blocking, nor does it offer automatic remediation or notifications for those specific controls.

Practice this question →

MCQhard

A security team needs to continuously assess their AWS resources for security vulnerabilities and deviations from security best practices. Which service provides automated security assessments?

A.AWS Trusted Advisor

B.Amazon Detective

C.AWS Security Hub

D.AWS Config

AnswerC

AWS Security Hub continuously aggregates findings from services such as GuardDuty and Inspector, then evaluates them against security best practice standards like the AWS Foundational Security Best Practices. This automated, ongoing assessment satisfies the stem's requirement for continuous vulnerability and deviation detection across AWS resources.

Why this answer

AWS Security Hub is the correct answer because it provides a comprehensive view of your security posture across AWS accounts by aggregating, organizing, and prioritizing security findings from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, and AWS Macie) and third-party tools. It continuously assesses your environment against security standards and best practices (e.g., CIS AWS Foundations Benchmark, AWS Foundational Security Best Practices) and generates automated security assessments and compliance checks. This directly matches the requirement for continuous, automated security assessments.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks configuration changes) with Security Hub (which provides security assessments and aggregates findings), leading them to select AWS Config because they think 'continuous assessment' means configuration monitoring, but Security Hub is the service specifically designed for automated security posture assessments.

How to eliminate wrong answers

Option A is wrong because AWS Trusted Advisor inspects your AWS environment and provides recommendations on cost optimization, performance, security, fault tolerance, and service limits, but it does not perform continuous automated security assessments or aggregate findings from multiple security services. Option B is wrong because Amazon Detective is a security investigation service that analyzes, investigates, and identifies the root cause of security findings or suspicious activities, but it does not provide automated security assessments or compliance checks. Option D is wrong because AWS Config is a service that evaluates your resource configurations against desired configurations (via rules) and tracks configuration changes, but it does not perform security vulnerability assessments or aggregate security findings; it focuses on configuration compliance, not security posture assessment.

Practice this question →

MCQmedium

A company stores sensitive customer data in multiple Amazon S3 buckets. The security team wants to proactively identify any buckets that have been configured to allow unintended access from external AWS accounts or from the public internet. The team needs a service that continuously analyzes the resource-based policies attached to these buckets and generates findings when such unintended access is detected. Which AWS service should the security team use to meet this requirement?

A.AWS IAM Access Analyzer

B.AWS Config

C.AWS Trusted Advisor

D.Amazon Macie

AnswerA

AWS IAM Access Analyzer continuously analyzes resource-based policies—including S3 bucket policies, bucket ACLs, and access point policies—and uses automated reasoning to identify resources that are accessible from outside your intended account boundary. Unlike periodic checks, it generates a live, actionable list of findings for public access and cross-account access, updating as policies change, which makes it purpose-built for detecting unintended external access. It also provides policy recommendations to help you narrow over-permissive access, directly addressing the requirement in the scenario.

Why this answer

AWS IAM Access Analyzer is the correct service because it continuously analyzes resource-based policies (such as S3 bucket policies) to identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of its AWS account, including the 'Principal': '*' condition that allows public internet access. This directly meets the requirement for proactive, continuous monitoring of unintended access.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to monitor resource configurations with IAM Access Analyzer's specific purpose of analyzing resource-based policies for cross-account and public access, leading them to choose Config when the requirement explicitly mentions 'resource-based policies' and 'unintended access from external AWS accounts or the public internet.'

Why the other options are wrong

AWS Trusted Advisor checks S3 bucket permissions for public access but does not continuously analyze resource-based policies for unintended access from external AWS accounts; it only provides a point-in-time check for public access.

Amazon Macie is designed to discover and protect sensitive data using machine learning and pattern matching, not to analyze resource-based policies for unintended access from external accounts or the public internet.

Practice this question →

MCQmedium

A healthcare company is migrating its application and patient data to AWS. To meet HIPAA requirements, the compliance officer must review and accept the AWS Business Associate Addendum (BAA). Additionally, the auditor requires the company to provide the latest AWS SOC 2 Type II report. The compliance officer needs a single self-service portal to access both documents directly from AWS. Which AWS service should the company use?

A.AWS Config

B.AWS Artifact

C.AWS Trusted Advisor

D.AWS Security Hub

AnswerB

AWS Artifact is the correct service. It is a self-service portal that provides on-demand access to AWS compliance reports (e.g., SOC, PCI) and allows customers to review and accept agreements such as the HIPAA Business Associate Addendum (BAA).

Why this answer

AWS Artifact is the correct service because it provides a self-service portal for on-demand access to AWS compliance reports, including the Business Associate Addendum (BAA) and SOC 2 Type II reports. This directly meets the compliance officer's requirement to review and accept the BAA and provide the latest SOC 2 report from a single AWS portal.

Exam trap

The trap here is that candidates may confuse AWS Artifact with AWS Config or Security Hub, thinking those services also provide compliance documentation, but only Artifact offers direct access to signed BAAs and third-party audit reports.

Why the other options are wrong

AWS Config is used for resource inventory, configuration history, and compliance auditing of AWS resources, but it does not provide access to AWS Business Associate Addendum (BAA) or SOC reports.

AWS Trusted Advisor provides best practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide access to compliance documents like the AWS BAA or SOC reports.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not offer direct access to AWS Business Associate Addendum (BAA) or SOC 2 Type II reports. Those documents are available only through AWS Artifact.

Practice this question →

MCQmedium

A company needs to store their application's database connection strings and automatically rotate them every 30 days. Which AWS service handles secret storage with automatic rotation built in?

A.AWS Systems Manager Parameter Store

B.Amazon S3 with encryption

C.AWS Secrets Manager

D.AWS KMS

AnswerC

AWS Secrets Manager is a purpose-built service for storing database credentials, API keys, and other secrets. It encrypts them with KMS, supports automatic rotation on a configurable schedule, and includes native integration with Amazon RDS to rotate credentials without application downtime. Versioning ensures applications always retrieve the latest secret, and IAM policies provide fine-grained access control.

Why this answer

AWS Secrets Manager is the correct service because it is specifically designed to securely store secrets such as database connection strings, API keys, and passwords, and it provides built-in automatic rotation of secrets at a configurable interval (e.g., every 30 days) using AWS Lambda. This eliminates the need for custom rotation logic and integrates natively with supported databases like Amazon RDS, Redshift, and DocumentDB.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets but lacks automatic rotation) with AWS Secrets Manager, leading them to choose Parameter Store when the question explicitly requires built-in rotation.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store can store secrets but does not have built-in automatic rotation; you must implement custom rotation logic with Lambda or other services. Option B is wrong because Amazon S3 with encryption provides secure storage but lacks any native secret rotation capability and is not designed for managing secrets with lifecycle rotation policies. Option D is wrong because AWS KMS is a key management service for creating and controlling encryption keys, not for storing or rotating secrets like database connection strings.

Practice this question →

MCQmedium

A company's security team needs to investigate a potential security incident. They want to determine which IAM user launched a new, unauthorized Amazon EC2 instance two days ago. The team needs to see the exact timestamp, the source IP address, and the instance type that was launched. Which AWS service should the security team use to find this information?

A.AWS Config

B.AWS CloudTrail

C.Amazon GuardDuty

D.AWS Trusted Advisor

AnswerB

AWS CloudTrail records all API calls, including the caller identity, timestamp, source IP address, and request parameters. This enables the security team to determine which IAM user launched the EC2 instance, when, and from where.

Why this answer

AWS CloudTrail is the correct service because it records API activity in your AWS account, including the exact timestamp, source IP address, and details (such as instance type) for every RunInstances API call. This allows the security team to trace the unauthorized EC2 launch back to the specific IAM user who made the request, as CloudTrail logs include the user identity, request parameters, and response elements.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks configuration changes) with CloudTrail (which tracks who made the change and when), leading them to pick Config because they think 'configuration change' includes user identity, but Config does not log the principal or source IP.

Why the other options are wrong

AWS Config records resource configuration changes and compliance, but does not capture detailed API call logs like timestamps, source IPs, or instance types for specific actions. It cannot provide the exact timestamp and source IP of the launch event.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, but it does not provide a historical audit trail of API calls like launching an EC2 instance. It cannot show the exact timestamp, source IP, and instance type for a specific past event.

AWS Trusted Advisor provides best practice checks and recommendations for cost optimization, performance, security, and fault tolerance, but it does not log or provide detailed event history like API calls or user actions. It cannot show the exact timestamp, source IP, or instance type for a specific EC2 launch.

Practice this question →

MCQmedium

A company is preparing for a third-party security audit. The auditors require the company to provide up-to-date AWS compliance reports, such as the SOC 2 report and the ISO 27001 certificate, as part of the evidence. The company needs to access these documents from a centralized, self-service portal within their AWS account. They also need to accept the terms and conditions for the reports. Which AWS service should the company use to meet these requirements?

A.AWS Config

B.AWS Artifact

C.AWS Security Hub

D.AWS CloudTrail

AnswerB

AWS Artifact is the correct service. It provides a self-service portal for downloading AWS compliance reports and managing agreements. Customers can access SOC, ISO, PCI DSS reports, and accept agreements like the BAA directly from the console.

Why this answer

AWS Artifact is the correct service because it provides a centralized, self-service portal for accessing AWS compliance reports, such as SOC 2 and ISO 27001 certificates, directly within the AWS Management Console. It also allows users to accept the terms and conditions for these reports, fulfilling the audit requirements without needing to contact AWS support.

Exam trap

The trap here is that candidates may confuse AWS Artifact with AWS Config or AWS Security Hub, assuming those services also provide compliance reports, but only Artifact offers the specific self-service portal for downloading and accepting terms for AWS compliance documents.

Why the other options are wrong

AWS Config is used for resource inventory, configuration history, and compliance rules, not for accessing third-party compliance reports like SOC 2 or ISO 27001.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not provide access to AWS compliance reports like SOC 2 or ISO 27001 certificates. The question specifically requires a centralized portal to download these reports, which is not a feature of Security Hub.

AWS CloudTrail records API activity for auditing, but it does not provide access to compliance reports like SOC 2 or ISO 27001. The question specifically requires a centralized portal for downloading such reports, which is not a CloudTrail feature.

Practice this question →

MCQmedium

A security team suspects unauthorised network traffic is reaching a subnet in their VPC. They need to capture metadata about the IP traffic (source IP, destination IP, port, protocol, accept/reject status) flowing through their VPC network interfaces for analysis. Which AWS feature provides this network traffic metadata?

A.AWS CloudTrail

B.Amazon GuardDuty

C.VPC Flow Logs

D.AWS WAF logs

AnswerC

VPC Flow Logs capture IP traffic metadata for elastic network interfaces (ENIs) in a VPC, including source and destination IP/port, protocol, and whether the traffic was accepted or rejected by security groups and network ACLs. They can be published to Amazon CloudWatch Logs or Amazon S3 and can be created at the VPC, subnet, or ENI level, making them the direct, standard feature for analyzing VPC network traffic.

Why this answer

VPC Flow Logs capture metadata about IP traffic flowing through VPC network interfaces, including source/destination IP addresses, ports, protocol numbers, and accept/reject status (based on security group and NACL rules). This is the correct service because it is specifically designed to log network traffic metadata at the VPC, subnet, or network interface level, enabling security analysis without impacting network performance.

Exam trap

The trap here is that candidates confuse VPC Flow Logs with CloudTrail or GuardDuty, mistakenly thinking that CloudTrail captures network traffic or that GuardDuty generates the raw metadata, when in fact VPC Flow Logs are the only service that directly captures the specified network traffic metadata at the interface level.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API calls and management events (e.g., who launched an EC2 instance), not network traffic metadata like IP addresses or ports. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and other data sources to identify malicious activity, but it does not itself generate or provide raw network traffic metadata. Option D is wrong because AWS WAF logs capture HTTP/HTTPS request details (e.g., URI, headers) for web ACL evaluations, not general IP traffic metadata across all protocols (e.g., TCP, UDP, ICMP) at the network interface level.

Practice this question →

MCQeasy

A company wants to enable HTTPS on their Application Load Balancer using an SSL/TLS certificate. They want a managed service that provisions, renews, and deploys the certificate automatically at no cost for certificates used with integrated AWS services. Which AWS service provides this?

A.AWS KMS

B.AWS Secrets Manager

C.AWS Certificate Manager

D.AWS IAM

AnswerC

AWS Certificate Manager (ACM) is the purpose-built AWS service for provisioning, deploying, and managing public SSL/TLS certificates at no charge for integrated services such as Application Load Balancers, Amazon CloudFront, and API Gateway. ACM automates certificate renewal by re-validating domain ownership before expiration, eliminating the manual effort and cost of purchasing certificates from a third-party CA. It also integrates natively with AWS services, so you can attach a certificate to a load balancer or distribution with just a few clicks. This is precisely why ACM is the correct answer for free, automated SSL/TLS certificate management.

Why this answer

AWS Certificate Manager (ACM) is the correct service because it is a managed service that provisions, renews, and deploys SSL/TLS certificates automatically at no additional cost when used with integrated AWS services like Application Load Balancers. ACM handles the entire certificate lifecycle, including automatic renewal before expiration, and integrates natively with ALB to enable HTTPS without manual intervention.

Exam trap

The trap here is that candidates may confuse AWS Secrets Manager with ACM because both involve 'secrets' and 'rotation,' but Secrets Manager does not handle SSL/TLS certificate provisioning or deployment to load balancers, and it incurs costs per secret.

How to eliminate wrong answers

Option A is wrong because AWS KMS (Key Management Service) is a service for creating and managing encryption keys, not SSL/TLS certificates; it does not provision or renew certificates for HTTPS. Option B is wrong because AWS Secrets Manager is designed to rotate and manage secrets such as database credentials and API keys, not SSL/TLS certificates for load balancers; it does not automatically deploy certificates to ALB. Option D is wrong because AWS IAM (Identity and Access Management) can be used to upload and manage SSL/TLS certificates as server certificates for legacy use, but it does not provide automatic provisioning, renewal, or deployment, and certificates managed in IAM incur costs and require manual renewal.

Practice this question →

MCQmedium

A financial services company is preparing for an annual compliance audit. The compliance team needs to continuously assess whether their AWS environment adheres to industry standards such as PCI DSS. They want to automate the collection of evidence, such as IAM policy changes and S3 bucket configurations, and generate audit-ready reports. They also need to identify gaps in their controls and receive remediation recommendations. Which AWS service should the company use?

A.AWS Config

B.AWS Audit Manager

C.AWS Artifact

D.AWS Security Hub

AnswerB

AWS Audit Manager helps you continuously assess your AWS usage to simplify risk assessment and compliance with regulations and industry standards. It automatically collects evidence from various AWS services, maps it to controls in frameworks like PCI DSS, and generates audit-ready reports. It also identifies control gaps and provides remediation recommendations.

Why this answer

AWS Audit Manager is the correct choice because it is specifically designed to continuously assess compliance with industry standards like PCI DSS. It automates the collection of evidence (e.g., IAM policy changes, S3 bucket configurations) and generates audit-ready reports, while also identifying control gaps and providing remediation recommendations. This directly matches the company's need for automated evidence collection and gap analysis.

Exam trap

The trap here is that candidates often confuse AWS Audit Manager with AWS Config or AWS Security Hub, but Audit Manager is the only service that combines automated evidence collection, framework-specific assessments, and remediation recommendations for compliance audits.

Why the other options are wrong

AWS Config is a service for evaluating resource configurations against rules, but it does not generate audit-ready reports or provide remediation recommendations for compliance frameworks like PCI DSS. The question specifically requires automated evidence collection and report generation, which is the purpose of AWS Audit Manager.

AWS Artifact is a service for downloading compliance reports and agreements, not for automating evidence collection, continuous assessment, or generating audit-ready reports with remediation recommendations.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not automate the collection of evidence for audit reports or generate audit-ready reports with remediation recommendations as required by the question.

Practice this question →

MCQmedium

A company uses multiple AWS accounts to store data in Amazon S3. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled. The team needs a service that can continuously monitor all S3 bucket configurations across all accounts, automatically detect any bucket that does not have encryption enabled, and automatically apply the encryption setting to bring the bucket into compliance. Which AWS service should the team use?

A.AWS Config

B.AWS Trusted Advisor

C.AWS Security Hub

D.AWS CloudTrail

AnswerA

AWS Config is the correct service because it continuously records S3 bucket resource configurations and evaluates them against managed or custom rules, such as s3-bucket-server-side-encryption-enabled. When a bucket is non-compliant, AWS Config can trigger automatic remediation using SSM Automation documents to enable encryption, and it can aggregate compliance status across multiple accounts using a multi-account aggregator.

Why this answer

AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. Using a managed rule like 's3-bucket-server-side-encryption-enabled', AWS Config can automatically detect S3 buckets that lack server-side encryption and, through AWS Config rules with auto-remediation (via Systems Manager Automation or Lambda), automatically apply the encryption setting to bring non-compliant buckets into compliance.

Exam trap

The trap here is that candidates often confuse AWS Config's monitoring and remediation capabilities with AWS Security Hub's aggregation or Trusted Advisor's advisory checks, forgetting that only AWS Config can both detect and automatically fix non-compliant resource configurations.

Why the other options are wrong

AWS Trusted Advisor provides best-practice checks and recommendations, but it cannot automatically remediate non-compliant S3 buckets by applying encryption settings. It only offers manual or automated remediation for a limited set of checks, not including S3 bucket encryption.

AWS Security Hub aggregates security findings from multiple services but does not automatically remediate non-compliant S3 bucket encryption settings. It lacks the ability to automatically apply encryption; it only provides visibility and centralized alerts.

AWS CloudTrail records API activity but does not continuously monitor configurations or automatically remediate non-compliant resources like S3 buckets without encryption.

Practice this question →

MCQmedium

A company runs a public-facing e-commerce website on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team has discovered that attackers are attempting SQL injection attacks through the website's search feature. The company wants to use a managed AWS service to inspect incoming HTTP requests and block these malicious payloads before they reach the application. Which AWS service should the company use?

A.AWS Shield Standard

B.AWS WAF

C.Network ACLs

D.Amazon GuardDuty

AnswerB

AWS WAF is a web application firewall that inspects HTTP and HTTPS requests and can block common threats such as SQL injection and cross-site scripting. It integrates directly with Application Load Balancers, Amazon CloudFront, and API Gateway, making it the correct service for this use case.

Why this answer

AWS WAF is a managed web application firewall that allows you to create rules to inspect HTTP/HTTPS requests and block common attack patterns, such as SQL injection and cross-site scripting. By associating a WAF web ACL with the Application Load Balancer, the company can filter incoming traffic and block malicious payloads before they reach the EC2 instances.

Exam trap

The trap here is that candidates often confuse AWS Shield (which protects against DDoS at Layer 3/4) with AWS WAF (which protects against application-layer attacks like SQL injection), leading them to choose Shield Standard instead of WAF.

Why the other options are wrong

AWS Shield Standard provides DDoS protection but does not inspect application-layer payloads like SQL injection strings; it only mitigates volumetric attacks.

Network ACLs are stateless and operate at the subnet level, filtering traffic based on IP addresses, ports, and protocols. They cannot inspect application-layer payloads like SQL injection attempts.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not actively inspect and block HTTP requests at the application layer like a web application firewall. It cannot prevent SQL injection attacks in real-time.

Practice this question →

MCQmedium

Which AWS service provides a managed way to create, control, and rotate encryption keys used to protect your data?

A.AWS Certificate Manager

B.AWS Secrets Manager

C.AWS Key Management Service (KMS)

D.AWS CloudHSM

AnswerC

AWS KMS is the managed service for creating, controlling, and rotating the cryptographic keys that protect your data. It centralises key lifecycle management and integrates with other AWS services, directly meeting the requirement for managed key creation, control, and rotation.

Why this answer

AWS Key Management Service (KMS) is the correct answer because it is a fully managed service that allows you to create, control, and rotate encryption keys used to protect your data. KMS integrates with other AWS services to encrypt data at rest and provides centralized key management, including automatic annual rotation for customer-managed keys. It uses hardware security modules (HSMs) to protect key material, but the service itself handles the management and rotation lifecycle.

Exam trap

The trap here is that candidates confuse AWS Secrets Manager (which rotates secrets) with KMS (which rotates encryption keys), but Secrets Manager does not create or manage the encryption keys themselves—it uses KMS for that purpose.

How to eliminate wrong answers

Option A is wrong because AWS Certificate Manager (ACM) manages SSL/TLS certificates, not encryption keys for data protection; it handles certificate provisioning, renewal, and deployment, but does not create or rotate symmetric encryption keys. Option B is wrong because AWS Secrets Manager is designed to securely store, retrieve, and rotate secrets such as database credentials and API keys, not to create or manage encryption keys; while it can rotate secrets, it relies on KMS to encrypt those secrets at rest. Option D is wrong because AWS CloudHSM provides dedicated hardware security modules (HSMs) that give you full control over the HSM appliance and key management, but it is not a managed service for creating, controlling, and rotating keys—you must manage the HSM cluster, key policies, and rotation yourself, and it does not offer automatic key rotation.

Practice this question →

MCQmedium

A company's security policy requires that all Amazon S3 buckets have default encryption enabled (SSE-S3 or SSE-KMS). A recent audit found several buckets without encryption enabled. The company wants an automated solution to continuously monitor all existing and new S3 buckets, detect any bucket that does not have default encryption enabled, and automatically remediate by enabling encryption. The solution must also maintain a compliance score and allow the security team to review non-compliant resources. Which AWS service should the company use to meet these requirements?

A.AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action using an AWS Systems Manager Automation document

B.Amazon GuardDuty with a finding type for S3 bucket encryption

C.AWS Trusted Advisor with the S3 Bucket Permissions check

D.AWS CloudTrail with a trail that logs S3 API calls and an Amazon CloudWatch alarm

AnswerA

AWS Config continuously evaluates resource configurations against rules. The managed rule checks for S3 bucket default encryption. Automatic remediation via Systems Manager Automation can enable encryption on non-compliant buckets. This meets all stated requirements: continuous monitoring, detection, remediation, compliance score, and review capability.

Why this answer

AWS Config with the managed rule `s3-bucket-server-side-encryption-enabled` continuously evaluates S3 buckets against the encryption requirement. When a non-compliant bucket is detected, an automatic remediation action can invoke an AWS Systems Manager Automation document to enable default encryption (SSE-S3 or SSE-KMS). AWS Config also provides a compliance score dashboard and allows the security team to review non-compliant resources, meeting all stated requirements.

Exam trap

The trap here is that candidates confuse AWS Config's compliance evaluation and remediation capabilities with GuardDuty's threat detection or Trusted Advisor's advisory checks, but only AWS Config provides continuous monitoring, automated remediation, and a compliance score for resource configuration rules.

Why the other options are wrong

Amazon GuardDuty does not monitor S3 bucket encryption settings; it detects threats like suspicious API calls or unauthorized access, not compliance with encryption policies.

AWS Trusted Advisor's S3 Bucket Permissions check only reviews bucket access policies and permissions, not default encryption settings. It cannot detect or remediate missing encryption, nor does it provide compliance scoring or automated remediation.

CloudTrail logs S3 API calls but cannot detect encryption status or enforce compliance; CloudWatch alarms only react to metrics, not audit encryption settings.

Practice this question →

Matchingmedium

Match each AWS database service to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Managed relational database

NoSQL key-value and document database

Data warehousing

In-memory caching

MySQL/PostgreSQL-compatible relational database

Why these pairings

Amazon RDS provides managed relational databases, DynamoDB offers NoSQL capabilities, Redshift is for data warehousing, and ElastiCache is for caching. Common confusions involve mixing up Redshift and ElastiCache due to their related but distinct use cases.

Practice this question →

MCQmedium

A company is preparing for a PCI DSS compliance audit. The security team needs to ensure that all AWS API calls are logged and that the logs are continuously analyzed for suspicious or unauthorized activity. The team wants a managed security service that uses machine learning to identify threats, generates findings for review, and can trigger automated remediation through AWS Lambda. Which AWS service should the team use?

A.AWS CloudTrail

B.Amazon GuardDuty

C.AWS Config

D.Amazon Inspector

AnswerB

Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning and integrated threat intelligence. It analyzes CloudTrail logs, VPC Flow Logs, and DNS logs, generates findings, and can trigger automated responses through AWS Lambda, meeting all the requirements.

Why this answer

Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS API calls (via CloudTrail), VPC Flow Logs, and DNS logs for suspicious activity. It generates actionable security findings and can trigger automated remediation through AWS Lambda, making it the correct choice for the described requirements.

Exam trap

The trap here is that candidates confuse AWS CloudTrail's logging capability with GuardDuty's threat detection, overlooking that CloudTrail alone does not analyze logs or trigger automated responses.

Why the other options are wrong

AWS CloudTrail logs API calls but does not provide continuous analysis with machine learning to identify threats or generate findings for automated remediation.

AWS Config is a service for evaluating resource configurations against desired policies, not for continuous threat detection or analyzing API call logs for suspicious activity. It does not use machine learning to identify threats or generate findings for security incidents.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a threat detection service that analyzes API call logs for suspicious activity using machine learning.

Practice this question →

100

MCQeasy

Which AWS service continuously assesses your AWS resources for security vulnerabilities, unintended network exposure, and deviations from security best practices?

A.AWS Security Hub

B.Amazon Inspector

C.AWS Config

D.Amazon Macie

AnswerB

Amazon Inspector is the correct choice because it is purpose-built for continuously scanning EC2 instances and Amazon ECR container images for software vulnerabilities (CVEs) and unintended network exposure. It uses an agent-based or agentless assessment to gather package inventory and compare versions against known CVE databases, then produces a prioritized list of findings with severity and remediation guidance. Inspector also integrates with AWS Systems Manager and AWS Security Hub, making it the underlying service that performs the vulnerability assessment in the AWS environment.

Why this answer

Amazon Inspector is a vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It uses a combination of network reachability analysis and agent-based or agentless assessments to detect deviations from security best practices, such as missing patches or open ports to the internet.

Exam trap

The trap here is that candidates often confuse AWS Security Hub (a central dashboard for findings) with the actual scanning service, leading them to choose Security Hub instead of Inspector, even though Security Hub does not perform the underlying vulnerability assessments.

How to eliminate wrong answers

Option A is wrong because AWS Security Hub is a central security posture management service that aggregates findings from multiple AWS services (including Inspector) and checks compliance against standards like CIS AWS Foundations, but it does not perform the actual vulnerability scanning itself. Option C is wrong because AWS Config is a resource inventory and configuration tracking service that evaluates resource configurations against desired policies (e.g., whether an S3 bucket is public), but it does not scan for software vulnerabilities or network exposure. Option D is wrong because Amazon Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data (e.g., PII) in S3 buckets, not to assess compute resources for security vulnerabilities or network exposure.

Practice this question →

101

MCQhard

A company's security policy requires that access keys for IAM users must be rotated every 90 days. Which AWS service can automatically detect users with non-compliant key age?

A.AWS CloudTrail

B.AWS Config with the access-keys-rotated rule

C.Amazon GuardDuty

D.AWS IAM Access Analyzer

AnswerB

The AWS Config managed rule access-keys-rotated continuously evaluates the age of IAM access keys against a configurable maximum threshold (commonly 90 days). It flags keys that exceed this limit as non-compliant, enabling automated remediation or manual review. Because it is a compliance rule, it proactively enforces your organization's credential rotation policy without requiring you to write custom code.

Why this answer

AWS Config with the 'access-keys-rotated' managed rule automatically checks whether IAM user access keys have been rotated within the specified number of days (default 90). When a key exceeds the configured maximum age, AWS Config flags the resource as non-compliant, enabling automated detection and remediation.

Exam trap

The trap here is that candidates often confuse AWS Config's compliance rules (which evaluate resource configurations like key age) with CloudTrail's auditing capabilities (which log actions but do not enforce policies), leading them to incorrectly select CloudTrail.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity (e.g., key creation, deletion) but does not evaluate compliance against a rotation policy; it lacks built-in rules for key age checks. Option C is wrong because Amazon GuardDuty is a threat detection service that analyzes DNS, VPC flow logs, and CloudTrail events for malicious activity, not for IAM key rotation compliance. Option D is wrong because AWS IAM Access Analyzer identifies resources shared with external entities (e.g., cross-account access), not internal key rotation age.

Practice this question →

102

MCQmedium

A compliance team needs to track the configuration history of AWS resources, determine when a security group was last modified, and verify that all EC2 instances comply with a rule requiring encryption on all attached EBS volumes. Which AWS service provides these capabilities?

A.AWS CloudTrail

B.Amazon CloudWatch

C.AWS Config

D.Amazon GuardDuty

AnswerC

AWS Config is purpose-built to record and evaluate the configuration of AWS resources over time. It creates configuration items (CIs) whenever a resource changes, maintains a configuration history that you can review or export, and compares each configuration against rules you define, such as 'EBS volumes should be encrypted.' Non-compliant resources are identified and can be remediated, and you can also view resource relationships. This makes it the definitive choice for configuration compliance and history.

Why this answer

AWS Config is the correct service because it provides configuration history of AWS resources, tracks changes to security groups (including last modification time), and allows you to define rules—such as requiring encryption on all EBS volumes attached to EC2 instances—and evaluate resources against those rules. It records configuration changes as configuration items and can trigger evaluations against managed or custom rules, making it ideal for compliance auditing.

Exam trap

The trap here is that candidates confuse AWS CloudTrail's API logging with AWS Config's configuration tracking, but CloudTrail only records the API call that made the change, not the resulting configuration state or compliance evaluation.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity (who did what, when, and from where) but does not track the configuration state or history of resources over time, nor does it evaluate compliance rules. Option B is wrong because Amazon CloudWatch monitors metrics, logs, and alarms for operational health and performance, but it does not track resource configuration history or enforce compliance rules like encryption requirements. Option D is wrong because Amazon GuardDuty is a threat detection service that analyzes DNS logs, VPC flow logs, and CloudTrail events for malicious activity, not for tracking configuration changes or evaluating compliance rules.

Practice this question →

103

MCQeasy

A company hires 10 new developers and needs to assign them identical AWS permissions — read access to S3 and the ability to launch EC2 instances. What is the AWS best practice for assigning these permissions efficiently?

A.Attach an inline policy to each of the 10 IAM users individually

B.Create an IAM group, attach the required policies to the group, and add all 10 users to the group

C.Create one IAM user account and share the credentials with all 10 developers

D.Grant the developers root account access with MFA enabled

AnswerB

IAM groups are specifically designed for this purpose. Assign policies once to the group, add users to the group, and all users inherit the permissions. Future permission changes only need to be made to the group.

Why this answer

AWS best practice for assigning identical permissions to multiple users is to create an IAM group, attach the required policies to the group, and add users to the group. This centralizes permission management, ensures consistency, and simplifies updates — changing the group policy automatically affects all members.

Exam trap

CLF-C02 often tests IAM best practices, and the trap is choosing individual user policies or credential sharing as 'efficient' solutions, when the group-based approach is the correct, secure, and scalable answer.

How to eliminate wrong answers

Option A is wrong because attaching inline policies to each user individually is inefficient, error-prone, and violates the principle of least administrative effort. Option C is wrong because sharing credentials among users is a severe security anti-pattern that eliminates accountability and violates AWS best practices. Option D is wrong because granting root account access is overly permissive and dangerous; root should be locked down with MFA and not used for daily tasks.

Practice this question →

104

MCQmedium

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to enforce a policy that prevents any employee from deploying resources in AWS Regions outside of the United States. The company’s legal department requires a preventive control that automatically blocks all resource creation in non-approved Regions for every account, including any new accounts added in the future. The team wants a solution that requires minimal ongoing administration. Which AWS feature should the security team use?

A.Create an IAM policy with a condition that denies `ec2:RunInstances` if the Region is not `us-east-1` or `us-west-2`, and attach it to all IAM users and roles.

B.Configure an AWS Config rule that checks for resources in non-approved Regions and automatically terminates them using a custom Lambda function.

C.Attach a Service Control Policy (SCP) in AWS Organizations that denies access to all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region.

D.Use VPC endpoint policies to restrict traffic to only the approved AWS Regions.

AnswerC

This is correct. An SCP is a centralized, preventive control that applies to all principals (users, roles) in member accounts. The condition `aws:RequestedRegion` is supported by most AWS services, allowing the policy to block resource creation in any non-approved Region. It automatically applies to new accounts added to the organization.

Why this answer

A Service Control Policy (SCP) attached to the root or an OU in AWS Organizations can deny all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region (e.g., `us-east-1` or `us-west-2`). This provides a preventive, account-wide guard that automatically applies to all existing and future accounts in the organization, requiring no per-user or per-role configuration and minimal ongoing administration.

Exam trap

The trap here is that candidates confuse detective controls (AWS Config) with preventive controls (SCPs) or mistakenly think IAM policies can enforce organization-wide restrictions, but SCPs are the only mechanism that applies to all accounts and principals in AWS Organizations without ongoing maintenance.

Why the other options are wrong

IAM policies attached to users/roles do not apply to the root user or new accounts automatically, and they require manual attachment to every principal, failing the 'minimal ongoing administration' and 'every account including new ones' requirements.

AWS Config with a custom Lambda function is a detective and reactive control, not a preventive one. It would terminate resources after creation, not block them, and requires ongoing maintenance of the Lambda function and Config rules.

VPC endpoint policies only control traffic to AWS services through VPC endpoints, not resource creation across all accounts and regions. They cannot block deployments in non-approved regions for accounts not using VPC endpoints.

Practice this question →

105

MCQmedium

A company's external auditor requires the company to provide evidence that the AWS infrastructure used by the company meets SOC 2 and ISO 27001 standards. The company needs to download the latest AWS SOC 2 report and ISO 27001 certification to share with the auditor. Which AWS service or feature should the company use to retrieve these documents?

A.AWS Audit Manager

B.AWS Artifact

C.AWS Config

D.AWS Trusted Advisor

AnswerB

AWS Artifact is the only service that provides on-demand access to AWS's own compliance reports and agreements. It hosts downloadable artifacts such as SOC 1/2/3 reports, ISO 27001/9001 certifications, PCI DSS reports, and HIPAA attestations, exactly matching an external auditor's request for AWS compliance evidence. No other AWS service serves as the central repository for these certifications.

Why this answer

AWS Artifact is the correct service because it provides on-demand access to AWS security and compliance reports, including SOC 2 and ISO 27001 certifications. The company can download the latest versions directly from the AWS Artifact console or API, satisfying the auditor's request for evidence without needing to configure any additional resources.

Exam trap

The trap here is that candidates confuse AWS Artifact (a document repository for compliance reports) with AWS Audit Manager (a tool for automating internal audits), leading them to select Audit Manager when the question specifically asks for downloading existing reports.

Why the other options are wrong

AWS Audit Manager helps audit AWS resource usage by creating evidence and reports, but it does not provide pre-existing compliance reports like SOC 2 or ISO 27001; those are available only through AWS Artifact.

AWS Config is used for resource inventory, configuration history, and compliance auditing of AWS resources, but it does not provide downloadable SOC 2 or ISO 27001 reports. Those reports are accessed via AWS Artifact.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but does not provide downloadable compliance reports like SOC 2 or ISO 27001 certifications.

Practice this question →

106

MCQmedium

A company processes credit card transactions and must comply with PCI DSS requirements. Customer payment data is stored in Amazon RDS for MySQL. The security team needs to ensure that all automated database snapshots are encrypted at rest using customer-managed encryption keys that are automatically rotated every 365 days. The team wants a fully managed AWS service to create and control these encryption keys. Which AWS service should the company use to meet these requirements?

A.AWS Key Management Service (AWS KMS)

B.AWS CloudHSM

C.AWS Secrets Manager

D.AWS Certificate Manager (ACM)

AnswerA

AWS KMS is the correct service because it is a fully managed key management service that creates and controls customer master keys (CMKs) used for data-at-rest encryption. It supports automatic annual rotation of key material, which satisfies the compliance requirement, and its integration with Amazon RDS lets you encrypt DB instances and snapshots transparently. When you enable RDS encryption, AWS KMS keys are used to encrypt the storage, automated backups, and snapshots, so the key rotation requirements are met without manual overhead.

Why this answer

AWS KMS is the correct service because it provides a fully managed, centralized way to create and control customer-managed keys (CMKs) that can be used to encrypt Amazon RDS automated snapshots. KMS supports automatic annual key rotation (365 days) as a built-in feature, and it integrates directly with RDS to enforce encryption at rest for snapshots without requiring any manual key management. This meets the PCI DSS requirement for customer-controlled encryption keys with automated rotation.

Exam trap

The trap here is that candidates confuse CloudHSM's hardware-based key control with KMS's fully managed key rotation and integration, assuming that any HSM service automatically handles key rotation, when in fact CloudHSM requires you to implement rotation logic yourself.

Why the other options are wrong

AWS CloudHSM provides hardware security modules (HSMs) but is not a fully managed service for creating and controlling encryption keys with automatic rotation; it requires manual key management and does not integrate directly with RDS for automated snapshot encryption.

AWS Secrets Manager is designed to manage secrets like database credentials, not to create or control encryption keys. It does not provide customer-managed key rotation or direct encryption key management for RDS snapshots.

AWS Certificate Manager (ACM) manages SSL/TLS certificates for securing network communications, not encryption keys for data at rest. It cannot create or control customer-managed encryption keys for RDS snapshots.

Practice this question →

107

MCQmedium

A healthcare startup is migrating its patient records database to Amazon RDS for PostgreSQL. The company must comply with HIPAA and ensure that all protected health information (PHI) is encrypted at rest and in transit. Which task is the company responsible for under the AWS shared responsibility model?

A.Encrypting the physical disk drives in the AWS data center that host the database.

B.Enabling encryption at rest for the Amazon RDS instance and configuring SSL for connections.

C.Applying operating system patches to the Amazon RDS database engine.

D.Configuring network ACLs to block all traffic except from authorized sources.

AnswerB

This is the customer's responsibility. The customer must choose to enable encryption at rest when creating or modifying the RDS instance and must configure SSL/TLS settings to ensure data in transit is encrypted. AWS provides the underlying infrastructure, but the customer controls the encryption settings.

Why this answer

Under the AWS shared responsibility model, the customer is responsible for encryption in transit and at rest for the data they store in AWS services. For Amazon RDS, enabling encryption at rest (via AWS KMS) and configuring SSL/TLS for client connections are customer-side tasks. AWS handles the physical security of data centers and the underlying infrastructure, but the customer must explicitly enable these encryption features to meet HIPAA compliance.

Exam trap

The trap here is that candidates often confuse customer-managed patching (Option C) with AWS-managed patching in RDS, or they assume network ACLs (Option D) satisfy encryption requirements, when the question specifically targets encryption responsibilities under HIPAA.

Why the other options are wrong

Under the AWS shared responsibility model, AWS is responsible for the security of the physical infrastructure, including encrypting physical disk drives. The customer does not perform this task.

Configuring network ACLs is a network-level security task, but the question specifically requires encryption at rest and in transit. Network ACLs do not provide encryption; they control traffic flow. The customer's responsibility for encryption is to enable RDS encryption and SSL, not to manage network ACLs for this purpose.

Practice this question →

108

MCQmedium

A company uses an Amazon RDS for PostgreSQL database for its production application. The security policy requires that database passwords be rotated automatically every 90 days. The database credentials are currently stored in a configuration file on an Amazon EC2 instance. The company wants a fully managed AWS service that can securely store the credentials, automatically rotate them on a schedule, and update the RDS instance without requiring code changes to the application. Which AWS service should the company use to meet these requirements?

A.AWS Secrets Manager

B.AWS Systems Manager Parameter Store

C.AWS Key Management Service (KMS)

D.AWS Certificate Manager (ACM)

AnswerA

AWS Secrets Manager is the correct service because it natively supports automatic rotation for Amazon RDS database credentials via built-in Lambda rotation functions. It directly updates the RDS password during rotation and can be configured on a schedule, eliminating the need for custom application code or manual credential updates. This tight integration with RDS makes it the purpose-built secrets management service for this use case.

Why this answer

AWS Secrets Manager is the correct choice because it is a fully managed service designed specifically to securely store database credentials, automatically rotate them on a defined schedule (e.g., every 90 days), and natively integrate with Amazon RDS to update the password without requiring any application code changes. The application can retrieve the current credentials at runtime using the Secrets Manager API, eliminating the need for hardcoded or file-based credentials.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store secrets, but Parameter Store lacks native automatic rotation and RDS integration, making it unsuitable for the rotation requirement.

Why the other options are wrong

AWS Systems Manager Parameter Store does not support automatic rotation of RDS database passwords; it only stores parameters securely. Secrets Manager is required for automated rotation.

AWS KMS is a key management service for encryption keys, not for storing or rotating database credentials. It does not provide automatic rotation of passwords or direct integration with RDS for credential updates.

AWS Certificate Manager (ACM) is designed to manage SSL/TLS certificates, not database credentials. It cannot store or rotate database passwords, nor update RDS instances with new credentials.

Practice this question →

109

MCQeasy

Which AWS IAM feature allows you to set the maximum permissions that IAM entities in an account can have, regardless of what their identity-based policies allow?

A.IAM Conditions

B.Permission Boundaries

C.Service Control Policies (SCPs)

D.Resource-based policies

AnswerB

A permission boundary is a managed policy that is explicitly attached to an IAM user or role to define the absolute maximum permissions that entity can be granted. When evaluating an entity's effective permissions, AWS takes the intersection of the identity-based policies (which may grant broad access) and the permission boundary; any action not allowed by the boundary is blocked even if explicitly allowed by an attached policy. This creates a hard ceiling on the entity's permissions, ensuring that even if more permissive policies are attached, the boundary limits what the principal can actually do. Because the question asks for the mechanism that caps the maximum permissions of an IAM entity, permission boundaries are precisely the correct answer.

Why this answer

Permission Boundaries are an AWS IAM feature that sets the maximum permissions an IAM entity (user or role) can have. They act as a guardrail, limiting the effective permissions to the intersection of the identity-based policy and the boundary, regardless of what the identity-based policy allows. This ensures that even if a policy grants broad access, the boundary caps it at a defined maximum.

Exam trap

The trap here is confusing Permission Boundaries with Service Control Policies (SCPs), as both set permission limits, but SCPs operate at the AWS Organizations account level, not at the individual IAM entity level within a single account.

How to eliminate wrong answers

Option A is wrong because IAM Conditions are used to specify when a policy is in effect (e.g., based on IP address, time, or MFA status), not to set a hard cap on maximum permissions. Option C is wrong because Service Control Policies (SCPs) are an AWS Organizations feature that apply to all accounts within an organization, not to individual IAM entities within a single account. Option D is wrong because Resource-based policies are attached directly to AWS resources (like S3 buckets or KMS keys) and grant cross-account access, but they do not limit the maximum permissions of an IAM entity.

Practice this question →

110

MCQmedium

A company hosts a multi-tier web application on AWS. The web tier runs on Amazon EC2 instances in a public subnet, and the database tier runs on Amazon EC2 instances in a private subnet. The security team needs to configure security groups to allow only the web tier instances to communicate with the database tier on port 3306 (MySQL). The web tier must be accessible from the internet on port 443. Which security group configuration meets these requirements?

A.Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.

B.Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing 0.0.0.0/0 on port 3306.

C.Web security group: inbound rule allowing the web security group as source on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.

D.Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the internet-facing Application Load Balancer security group as source on port 3306.

AnswerA

This is correct. The web SG allows internet traffic on port 443, and the database SG uses the web SG as a source, which permits only traffic from instances associated with the web SG on port 3306.

Why this answer

It uses a security group reference as the source for the database security group's inbound rule on port 3306, which allows traffic only from instances associated with the web security group. The web security group allows inbound HTTPS traffic from the internet (0.0.0.0/0) on port 443, meeting the requirement for public access. This configuration ensures least-privilege access by restricting database communication to only the web tier, without exposing the database to the internet or requiring IP-based rules.

Exam trap

The trap here is that candidates often confuse security group references with IP-based rules or incorrectly assume that the web security group should reference itself for inbound internet traffic, rather than using 0.0.0.0/0 for public access.

Why the other options are wrong

This option allows any IP (0.0.0.0/0) to access the database on port 3306, violating the requirement that only the web tier should communicate with the database.

The web security group's inbound rule references itself as source on port 443, which would only allow traffic from other instances in the same web security group, not from the internet. The requirement is to allow internet traffic on port 443.

The database tier is in a private subnet and should only accept traffic from the web tier, not from an ALB. The ALB does not directly communicate with the database; the web tier instances do. Using the ALB security group as source would allow traffic from the ALB, which is unnecessary and incorrect.

Practice this question →

111

MCQmedium

A company encrypts data stored in Amazon S3, Amazon RDS, and Amazon EBS. The security team needs a managed service to create, rotate, and control the encryption keys used to protect this data, with full audit trails of key usage. Which AWS service should they use?

A.AWS CloudHSM

B.AWS Secrets Manager

C.AWS KMS

D.AWS Certificate Manager

AnswerC

AWS KMS is the correct choice because it is a fully managed service that creates, stores, and rotates customer master keys (CMKs) used for encrypting data at rest in services like S3, RDS, and EBS. It integrates with CloudTrail to automatically log every key usage and management event, delivering the auditable trail required for compliance. Unlike other options, KMS is purpose-built for encryption key lifecycle management and provides fine-grained access control via key policies and IAM, making it the right fit for the scenario.

Why this answer

AWS KMS is a managed service that allows you to create, rotate, and control encryption keys used to protect data in Amazon S3, Amazon RDS, and Amazon EBS. It integrates with AWS CloudTrail to provide full audit trails of key usage, meeting the security team's requirements for a managed key management solution.

Exam trap

The trap here is that candidates often confuse AWS KMS with AWS CloudHSM, mistakenly thinking CloudHSM is required for full control and audit trails, but KMS provides managed key rotation and native CloudTrail integration without the operational overhead of managing HSMs.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides dedicated hardware security modules (HSMs) for key storage but requires manual management of key rotation and does not offer native integration with AWS services for automatic key creation and rotation like KMS does. Option B is wrong because AWS Secrets Manager is designed to manage and rotate secrets such as database credentials and API keys, not encryption keys for data at rest in S3, RDS, or EBS. Option D is wrong because AWS Certificate Manager handles SSL/TLS certificates for securing network traffic, not encryption keys for data at rest.

Practice this question →

112

MCQmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application connects to an Amazon RDS for MySQL database. The database password is currently hardcoded in the application configuration file, and the security team is concerned about the risk of exposure. The company wants to remove the hardcoded credential and instead have the application retrieve the database password securely at runtime. Additionally, the security team requires that the password be automatically rotated every 90 days without any manual intervention or custom scripting. Which AWS service should the company use to meet these requirements?

A.AWS Systems Manager Parameter Store (SecureString parameters)

B.AWS Key Management Service (AWS KMS)

C.AWS Secrets Manager

D.AWS Identity and Access Management (IAM) roles for Amazon EC2

AnswerC

AWS Secrets Manager is a fully managed service built specifically to store, retrieve, and rotate secrets such as database credentials. It provides native, automated rotation for Amazon RDS databases without requiring custom code or additional infrastructure — you simply attach the required IAM role and choose a rotation interval. Because Secrets Manager natively meets both the secure storage and automatic rotation requirements, it is the best choice for this use case.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including RDS for MySQL) without custom code. It supports native, automatic rotation of secrets every 90 days via a built-in Lambda rotation function, meeting the security team's requirement for zero manual intervention. Unlike Parameter Store, Secrets Manager provides automatic rotation out of the box, which is the key differentiator here.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (SecureString) with Secrets Manager, but Parameter Store lacks native automatic rotation, which is the critical requirement in this scenario.

Why the other options are wrong

AWS Systems Manager Parameter Store (SecureString) does not support automatic rotation of secrets. The question explicitly requires automatic rotation every 90 days without manual intervention or custom scripting, which Parameter Store cannot provide.

AWS KMS is a key management service for encryption keys, not a secrets storage service. It does not natively store or rotate database passwords; it only encrypts data. The requirement to retrieve and automatically rotate secrets is outside KMS's scope.

IAM roles grant permissions to EC2 instances but cannot store or retrieve secrets like database passwords; they are used for AWS API access, not for secure secret retrieval at runtime.

Practice this question →

113

MCQmedium

A company operates a global e-commerce website behind Amazon CloudFront. Security analysts have noticed a pattern of SQL injection attempts and cross-site scripting attacks targeting the web application. The company needs a fully managed service that can inspect incoming HTTP(S) requests and block these common web exploits before they reach the application origin. The solution must integrate with CloudFront and allow the security team to author custom rules. Which AWS service should the company use?

A.AWS Shield Advanced

B.AWS WAF

C.Amazon GuardDuty

D.AWS Firewall Manager

AnswerB

AWS WAF is a web application firewall that monitors and filters web requests for common attack patterns such as SQL injection and cross-site scripting. It integrates with CloudFront and allows you to define custom rules to block malicious traffic before it reaches your application.

Why this answer

AWS WAF is a fully managed web application firewall that integrates directly with Amazon CloudFront to inspect HTTP(S) requests. It provides pre-configured rule groups (e.g., the SQL injection and cross-site scripting rule sets) and allows the security team to author custom rules to block common web exploits before they reach the origin. This makes it the correct choice for the described use case.

Exam trap

The trap here is that candidates confuse AWS Shield Advanced (which handles volumetric DDoS) with AWS WAF (which handles application-layer exploits like SQL injection and XSS), leading them to select Shield Advanced when the question explicitly describes web application attacks.

Why the other options are wrong

AWS Shield Advanced provides DDoS protection but does not inspect HTTP(S) requests for SQL injection or cross-site scripting attacks, nor does it allow custom rule authoring for web exploits.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not inspect or block HTTP(S) requests at the application layer. It cannot prevent SQL injection or XSS attacks.

AWS Firewall Manager is a policy management service that centrally configures and manages firewall rules across multiple accounts and resources, but it does not itself inspect HTTP(S) requests or block web exploits like SQL injection or XSS. It can manage AWS WAF rules, but the question asks for the service that directly inspects and blocks these attacks, which is AWS WAF.

Practice this question →

114

MCQeasy

What is the purpose of AWS Shield Standard?

A.To encrypt data at rest in S3 buckets

B.To protect AWS resources against common DDoS attacks

C.To monitor API calls made to AWS services

D.To filter malicious web traffic using rules

AnswerB

AWS Shield Standard is the correct answer because it provides automatic, always-on detection and inline mitigation for common Layer 3 and Layer 4 DDoS attacks, including SYN floods, UDP floods, and reflection attacks. This protection is included with all AWS accounts at no additional cost and covers resources such as CloudFront distributions, Elastic Load Balancers, and S3 buckets. Shield Standard runs transparently in the background, so no configuration or management is required.

Why this answer

AWS Shield Standard is a free, always-on service that protects all AWS customers from common, infrastructure-layer Distributed Denial of Service (DDoS) attacks, such as SYN floods, UDP floods, and reflection attacks. It uses network flow monitoring and inline mitigation techniques at the AWS edge to automatically detect and block malicious traffic targeting AWS resources like EC2, ELB, CloudFront, and Route 53. This makes option B correct because its sole purpose is to provide baseline DDoS protection without any additional configuration or cost.

Exam trap

The trap here is that candidates often confuse AWS Shield Standard with AWS WAF, mistakenly thinking Shield Standard provides application-layer filtering (like SQL injection or XSS protection), when in fact it only handles infrastructure-layer DDoS attacks, while WAF is needed for Layer 7 web traffic inspection.

How to eliminate wrong answers

Option A is wrong because encrypting data at rest in S3 buckets is handled by AWS Key Management Service (KMS) or S3 server-side encryption (SSE), not by Shield Standard, which is a network-layer DDoS mitigation service. Option C is wrong because monitoring API calls to AWS services is the function of AWS CloudTrail, which logs API activity for auditing and governance, not Shield Standard. Option D is wrong because filtering malicious web traffic using rules is the purpose of AWS WAF (Web Application Firewall), which operates at Layer 7 and inspects HTTP/HTTPS requests, whereas Shield Standard focuses on Layer 3/4 volumetric DDoS attacks.

Practice this question →

115

MCQmedium

Which AWS service provides hardware-based key management and cryptographic operations using FIPS 140-2 Level 3 validated hardware security modules (HSMs)?

A.AWS Key Management Service (KMS)

B.AWS CloudHSM

C.AWS Secrets Manager

D.Amazon Macie

AnswerB

AWS CloudHSM provides you with dedicated, single-tenant hardware security modules that are validated to FIPS 140-2 Level 3, offering a higher security bar than KMS. With CloudHSM, your cryptographic keys are generated and stored entirely on hardware that you control, and AWS has no visibility or access to your keys. This makes it the correct choice when you need full control over key lifecycle, regulatory-grade tamper-resistant hardware, and a physically isolated cryptographic boundary that satisfies strict compliance requirements.

Why this answer

AWS CloudHSM is the correct answer because it provides dedicated, single-tenant hardware security modules (HSMs) that are FIPS 140-2 Level 3 validated. This allows customers to perform cryptographic operations (e.g., key generation, signing, encryption) using hardware that meets the highest security level required for regulated workloads like PKI and financial services.

Exam trap

The trap here is that candidates confuse AWS KMS (which also uses HSMs) with CloudHSM, not realizing that KMS uses multi-tenant, FIPS 140-2 Level 2 HSMs by default and does not offer dedicated, single-tenant hardware or direct HSM access for custom cryptographic operations.

How to eliminate wrong answers

Option A is wrong because AWS KMS is a managed service that uses FIPS 140-2 Level 2 validated HSMs (or Level 3 in some regions for specific operations) but does not provide dedicated, single-tenant hardware or direct access to the HSM for custom cryptographic operations. Option C is wrong because AWS Secrets Manager is a service for rotating and managing secrets (e.g., database credentials, API keys) and does not perform cryptographic operations or use HSMs directly. Option D is wrong because Amazon Macie is a data security service that uses machine learning to discover and protect sensitive data (e.g., PII) in S3, and it has no involvement with hardware-based key management or cryptographic operations.

Practice this question →

116

MCQmedium

A company manages 15 AWS accounts and wants to centrally deploy and enforce consistent AWS WAF rules, security groups, and Shield Advanced protections across all accounts and regions from a single administrator account. Which AWS service provides this centralised security policy management?

A.AWS WAF

B.AWS Security Hub

C.AWS Firewall Manager

D.AWS Shield Advanced

AnswerC

AWS Firewall Manager is the correct answer because it provides centralized security policy management within AWS Organizations, allowing you to deploy WAF rules, Shield Advanced protections, VPC security groups, and Network Firewall policies across all accounts and resources in a single action. Policies are automatically applied to new accounts or resources as they are added, ensuring consistent enforcement. This makes it the only service in the list that is purpose-built for centrally managing WAF rules across multi-account environments.

Why this answer

AWS Firewall Manager is the correct service because it provides centralized security policy management across multiple AWS accounts and regions. It allows an administrator to define and enforce AWS WAF rules, security group rules, and Shield Advanced protections from a single administrator account, ensuring consistent compliance across all accounts in an AWS Organization.

Exam trap

The trap here is that candidates confuse AWS WAF (a resource-level protection service) with Firewall Manager (a multi-account policy management service), leading them to select AWS WAF instead of the centralized governance solution.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall service that protects individual resources (e.g., CloudFront, ALB) but does not centrally manage policies across multiple accounts or regions. Option B is wrong because AWS Security Hub aggregates security findings and compliance checks from various services but does not enforce or deploy security policies like WAF rules or security groups. Option D is wrong because AWS Shield Advanced provides DDoS protection for specific resources but lacks the centralized policy management and enforcement capabilities across accounts and regions that Firewall Manager offers.

Practice this question →

117

MCQmedium

A security team wants to automatically identify S3 buckets, IAM roles, and other resources in their AWS account that have policies granting access to external AWS accounts or the public internet — including findings they may not be aware of. Which AWS service performs this analysis?

A.Amazon GuardDuty

B.AWS Config

C.AWS IAM Access Analyzer

D.Amazon Macie

AnswerC

IAM Access Analyzer uses automated reasoning to analyse resource-based policies and generate findings when resources are accessible from outside the account or organisation. It covers S3 buckets, IAM roles, KMS keys, SQS queues, Lambda functions, and Secrets Manager secrets.

Why this answer

AWS IAM Access Analyzer is the correct service because it is specifically designed to analyze resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) and identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of your AWS account, including the public internet, even for resources you may not be aware of. This directly matches the security team's requirement to automatically identify such exposures.

Exam trap

The trap here is that candidates often confuse IAM Access Analyzer with Amazon GuardDuty, assuming GuardDuty's threat detection includes policy analysis, but GuardDuty focuses on operational threats (e.g., compromised credentials) rather than static policy evaluation for external access.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior using VPC Flow Logs, DNS logs, and CloudTrail events, but it does not analyze resource policies for external access. Option B is wrong because AWS Config evaluates resource configurations against desired rules and tracks configuration changes, but it does not specifically analyze policies for cross-account or public access; it can only trigger rules that you define manually. Option D is wrong because Amazon Macie uses machine learning to discover and protect sensitive data in S3 buckets, but it does not analyze IAM roles or other resource policies for external access permissions.

Practice this question →

118

MCQmedium

A company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team has noticed an increase in volumetric distributed denial-of-service (DDoS) attacks targeting the application's IP address. The company wants a managed AWS service that provides automatic, always-on protection against common network-layer DDoS attacks at no additional cost. Which AWS service should the company use?

A.AWS WAF

B.AWS Shield Standard

C.AWS Shield Advanced

D.AWS Network Firewall

AnswerB

AWS Shield Standard is a free, always-on service that automatically detects and mitigates common network-layer and transport-layer DDoS attacks, including SYN floods, UDP reflections, and amplification attacks. Because it is enabled by default for every AWS customer and requires no configuration, it protects a public web application on EC2 with no additional cost. Shield Standard automatically covers the Elastic IP and public interfaces of EC2, directly meeting the company's requirement for zero additional expense while addressing the network-layer DDoS threat.

Why this answer

AWS Shield Standard is the correct choice because it provides automatic, always-on protection against common network-layer (Layer 3/4) DDoS attacks, such as SYN floods and UDP reflection attacks, at no additional cost. It is integrated with Elastic Load Balancing (ELB), Amazon CloudFront, and Amazon Route 53, making it ideal for protecting a public-facing web application behind an Application Load Balancer without requiring any configuration or extra fees.

Exam trap

The trap here is that candidates often confuse AWS WAF (Layer 7) with network-layer DDoS protection, or assume Shield Advanced is required for any DDoS protection, when Shield Standard already provides free, automatic coverage for common volumetric attacks at Layer 3/4.

Why the other options are wrong

AWS WAF is a web application firewall that protects against application-layer attacks (e.g., SQL injection, cross-site scripting), not volumetric network-layer DDoS attacks. The question specifies network-layer DDoS protection, which AWS WAF does not provide.

AWS Shield Advanced is a paid service ($3,000/month) and does not provide automatic, always-on protection at no additional cost, which contradicts the question's requirement for no additional cost.

AWS Network Firewall is a managed firewall service for VPC traffic inspection and filtering, but it does not provide automatic, always-on DDoS protection at no additional cost. It is not designed to mitigate volumetric DDoS attacks at the network layer.

Practice this question →

119

MCQmedium

A company operates hundreds of AWS accounts under AWS Organizations. The security team wants a single dashboard that aggregates security findings from Amazon GuardDuty, Amazon Inspector, and AWS Macie across all accounts. Additionally, they want to continuously assess the accounts against the CIS AWS Foundations Benchmark and receive a consolidated compliance score. Which AWS service should the security team use?

A.AWS Config

B.AWS Security Hub

C.Amazon GuardDuty

D.AWS Trusted Advisor

AnswerB

Correct. AWS Security Hub is designed to aggregate, organize, and prioritize security findings from multiple AWS services (GuardDuty, Inspector, Macie, etc.) and third-party tools. It also provides continuous compliance checks against industry standards such as the CIS AWS Foundations Benchmark and displays a consolidated compliance score, all from a single dashboard.

Why this answer

AWS Security Hub is the correct service because it provides a single dashboard that aggregates security findings from multiple AWS services, including GuardDuty, Inspector, and Macie, across all accounts in an AWS Organization. It also integrates with AWS Config rules to continuously assess accounts against the CIS AWS Foundations Benchmark and provides a consolidated compliance score, meeting both requirements.

Exam trap

The trap here is that candidates often confuse AWS Config's compliance evaluation capabilities with Security Hub's consolidated dashboard and cross-service aggregation, leading them to choose AWS Config despite it lacking the single-pane-of-glass view for findings from multiple security services.

Why the other options are wrong

AWS Config evaluates resource configurations against rules but does not aggregate security findings from GuardDuty, Inspector, and Macie, nor does it provide a consolidated compliance score for CIS AWS Foundations Benchmark across multiple accounts.

Amazon GuardDuty is a threat detection service that identifies malicious activity, but it does not aggregate findings from other services, assess against CIS benchmarks, or provide a consolidated compliance score.

AWS Trusted Advisor provides best-practice recommendations for cost optimization, performance, security, fault tolerance, and service limits, but it does not aggregate security findings from GuardDuty, Inspector, and Macie, nor does it provide a consolidated compliance score against the CIS AWS Foundations Benchmark.

Practice this question →

120

MCQmedium

A company is preparing for a SOC 2 Type II audit and needs to provide its auditor with evidence of AWS's operational security controls. The security team has been asked to download the latest SOC 2 Type II report published by AWS. The team must access the report through a self-service portal without needing to contact AWS Support. Which AWS service should the security team use to meet this requirement?

A.AWS Artifact

B.AWS Audit Manager

C.AWS Config

D.AWS Trusted Advisor

AnswerA

AWS Artifact is a self-service portal that provides on-demand access to AWS compliance reports, including SOC 2 Type II, PCI DSS, and ISO 27001. Customers can download these reports directly without contacting AWS Support, making it the correct service for this requirement.

Why this answer

AWS Artifact is the correct service because it provides a self-service portal for downloading AWS compliance reports, including SOC 2 Type II reports, without needing to contact AWS Support. It offers on-demand access to AWS’s security and compliance documents, directly meeting the requirement for auditor evidence.

Exam trap

The trap here is that candidates may confuse AWS Audit Manager (which helps manage your own audits) with AWS Artifact (which provides AWS’s own compliance reports), leading them to select Audit Manager for downloading AWS’s SOC reports.

Why the other options are wrong

AWS Audit Manager helps audit and assess AWS usage, but it does not provide access to AWS's own SOC 2 Type II reports. The requirement is to download AWS's published report, which is available through AWS Artifact.

AWS Config is used for recording and evaluating configuration changes of AWS resources, not for accessing compliance reports like SOC 2 reports. It does not provide a self-service portal for downloading audit reports.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide access to compliance reports like SOC 2 Type II reports.

Practice this question →

121

Matchingmedium

Match each AWS support plan to its key feature.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Customer service & documentation only

Business hours email support

24/7 phone & chat support

Concierge support team & proactive guidance

Technical Account Manager (TAM) & business-critical support

Why these pairings

The correct matches are: Basic – customer service and forums; Developer – business hours email; Business – 24/7 phone/chat; Enterprise – TAM and event management. Common confusions include attributing higher-level features to lower-level plans.

Practice this question →

122

MCQmedium

A company manages over 100 AWS accounts using AWS Organizations. The security team wants a centralized service that continuously monitors for malicious or unauthorized behavior across all accounts. The service must analyze AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs to automatically detect threats such as anomalous API calls, crypto-mining activity, and compromised credentials. The security team wants to receive actionable alerts without having to write custom detection rules or manage underlying infrastructure. Which AWS service should the security team use?

A.Amazon Inspector

B.AWS Trusted Advisor

C.Amazon GuardDuty

D.AWS Config

AnswerC

Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts and workloads for malicious activity. It analyzes CloudTrail management events, VPC Flow Logs, and DNS logs to detect threats such as anomalous API calls, crypto-mining, and compromised credentials. It operates without requiring custom rules and can be centrally enabled across all accounts in an AWS Organization.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It natively analyzes AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs across all accounts in an AWS Organization, automatically generating actionable alerts without requiring custom rules or infrastructure management.

Exam trap

The trap here is that candidates often confuse Amazon Inspector (a vulnerability scanner) with GuardDuty (a threat detector), or assume AWS Config can perform threat detection when it is actually a compliance and configuration tracking service.

Why the other options are wrong

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a threat detection service that analyzes CloudTrail, VPC Flow Logs, or DNS logs for malicious behavior.

AWS Trusted Advisor provides best-practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not continuously monitor for malicious activity or analyze CloudTrail, VPC Flow Logs, or DNS logs to detect threats like crypto-mining or compromised credentials.

AWS Config is a service for evaluating resource configurations against desired policies, not for threat detection. It does not analyze CloudTrail logs, VPC Flow Logs, or DNS logs to identify malicious activity.

Practice this question →

123

MCQmedium

A company discovered that an IAM user's access keys were accidentally committed to a public GitHub repository. Which immediate action should they take first?

A.Delete the GitHub repository

B.Immediately deactivate or delete the exposed IAM access keys

C.Enable MFA for the IAM user

D.Move the credentials to a private repository

AnswerB

Deactivating or deleting the exposed IAM access keys is the correct and urgent first step because it immediately invalidates the credential material that an attacker may already be using. Deactivation temporarily disables the keys and can be reversed after investigation, whereas deletion permanently removes them, but both actions stop ongoing unauthorized API calls in near real time. This should be followed by rotation (creating new keys) and auditing CloudTrail for any malicious activity performed with the compromised keys.

Why this answer

The immediate priority when IAM access keys are exposed is to revoke their validity to prevent unauthorized use. Deactivating or deleting the keys ensures that any malicious actor who obtained them from the public repository can no longer authenticate as the IAM user, stopping potential data breaches or resource abuse. This aligns with the AWS security best practice of rotating credentials upon suspected compromise.

Exam trap

The trap here is that candidates may focus on removing the public exposure (e.g., deleting the repo or moving to private) rather than understanding that the keys themselves must be invalidated, as the damage is already done once they are publicly accessible.

How to eliminate wrong answers

Option A is wrong because deleting the GitHub repository does not invalidate the already-exposed access keys; the keys remain active and can still be used by anyone who copied them. Option C is wrong because enabling MFA adds a second factor for future console logins but does not affect the validity of the already-leaked access keys, which are used for programmatic access and bypass MFA entirely. Option D is wrong because moving the credentials to a private repository does not revoke the keys; they are still active and could have been copied by unauthorized parties before the move, leaving the account vulnerable.

Practice this question →

124

MCQmedium

A company runs a web application that connects to an Amazon RDS for MySQL database. The security policy requires that the database password be rotated every 30 days. The development team wants a fully managed solution that automatically rotates the password, handles the update in RDS, and provides the application with the latest credentials without any code changes. The application should also continue to work during the rotation process. Which AWS service should the company use to meet these requirements?

A.AWS Secrets Manager

B.AWS Systems Manager Parameter Store

C.AWS Key Management Service (AWS KMS)

D.AWS Identity and Access Management (IAM)

AnswerA

Correct. AWS Secrets Manager is a fully managed service that stores, rotates, and retrieves secrets such as database credentials. It supports automatic rotation with built-in integration for Amazon RDS, Aurora, Redshift, and other services. Secrets Manager can rotate passwords on a schedule and use versioning to ensure that applications continue to work during rotation by serving the current version while a new version is being created.

Why this answer

AWS Secrets Manager is the correct choice because it provides a fully managed service for automatic password rotation every 30 days, directly integrates with Amazon RDS for MySQL to update the database credentials, and supplies the latest credentials to the application via the Secrets Manager API without requiring any code changes. The rotation process is designed to ensure application availability by using a staged rotation strategy (e.g., creating a new credential while the old one remains valid) so the application continues to work during the rotation.

Exam trap

AWS often tests the distinction between Secrets Manager (for automatic rotation and RDS integration) and Systems Manager Parameter Store (for static configuration or manual rotation), leading candidates to choose Parameter Store because it can store secrets but lacks the automated rotation and RDS-specific update capability required here.

Why the other options are wrong

AWS Systems Manager Parameter Store does not support automatic password rotation for RDS databases. It can store secrets but requires custom logic to rotate and update credentials, which does not meet the requirement for a fully managed, automatic rotation solution.

AWS KMS is a key management service for encryption keys, not for rotating database passwords. It does not provide automatic password rotation or direct integration with RDS for credential updates.

IAM manages permissions for users and services, not database credentials. It cannot automatically rotate or provide RDS database passwords to applications without code changes.

Practice this question →

125

MCQmedium

A company operates a healthcare application on AWS that must comply with HIPAA regulations. The application stores sensitive patient data in Amazon S3. The compliance team requires that all data at rest in S3 be encrypted with a key that the company manages. The company also needs the ability to automatically rotate the encryption key every 365 days and to audit all key usage through AWS CloudTrail. Which AWS service should the company use to meet these requirements?

A.AWS Certificate Manager (ACM)

B.AWS Key Management Service (KMS) with a customer managed key

C.AWS CloudHSM

D.Amazon S3 server-side encryption with S3-managed keys (SSE-S3)

AnswerB

KMS with a customer managed key enables you to create and control the lifecycle of encryption keys. Automatic key rotation every 365 days is supported for customer managed keys, and all key usage is recorded in CloudTrail for auditing.

Why this answer

AWS KMS with a customer managed key (CMK) allows the company to create and control the encryption key used for S3 server-side encryption, meeting HIPAA's requirement for customer-managed keys. KMS supports automatic key rotation every 365 days (or custom period) and integrates with AWS CloudTrail to log every key usage (e.g., Decrypt, Encrypt API calls) for auditing. This combination satisfies all stated requirements: encryption at rest, customer-managed key, automatic rotation, and auditability.

Exam trap

The trap here is that candidates may confuse AWS CloudHSM (which offers dedicated HSM control) with KMS's simpler managed rotation and auditing, overlooking that CloudHSM requires manual rotation and lacks native CloudTrail integration for key usage logs.

Why the other options are wrong

ACM manages SSL/TLS certificates for encryption in transit, not encryption at rest. It does not provide key management for S3 data encryption or key rotation capabilities.

AWS CloudHSM provides hardware-based key storage but does not offer automatic key rotation or native integration with AWS CloudTrail for key usage auditing. The question requires automatic rotation every 365 days and CloudTrail auditing, which are features of AWS KMS, not CloudHSM.

SSE-S3 uses encryption keys managed entirely by AWS, not by the customer. The requirement specifies that the company must manage the encryption key, and SSE-S3 does not provide customer-managed key rotation or auditing via CloudTrail.

Practice this question →

126

MCQmedium

Which AWS service helps detect unusual API activity and potential security threats by analyzing AWS CloudTrail, VPC Flow Logs, and DNS logs?

A.AWS Security Hub

B.Amazon Macie

C.Amazon GuardDuty

D.AWS CloudTrail

AnswerC

Amazon GuardDuty is a fully managed threat detection service that continuously ingests and analyzes AWS CloudTrail event logs, VPC Flow Logs, and DNS query logs using machine learning, anomaly detection, and integrated threat intelligence feeds. It identifies suspicious activity such as compromised credentials, crypto mining, lateral movement, and reconnaissance, then produces security findings for downstream response. GuardDuty is specifically designed to detect threats from these log sources, making it the correct answer to the question's scenario.

Why this answer

Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to identify malicious activity. It analyzes data sources including AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to detect unusual API calls, potentially compromised instances, and other security threats.

Exam trap

The trap here is that candidates confuse AWS CloudTrail (the logging service) with GuardDuty (the threat detection service), assuming that simply enabling CloudTrail provides threat detection, when in fact CloudTrail only records events and requires a separate analysis engine like GuardDuty to identify malicious patterns.

How to eliminate wrong answers

Option A is wrong because AWS Security Hub is a centralized security posture management service that aggregates findings from multiple AWS services (including GuardDuty) and checks compliance against standards, but it does not directly analyze raw logs like CloudTrail, VPC Flow Logs, or DNS logs. Option B is wrong because Amazon Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data (e.g., PII) stored in Amazon S3, not to analyze API activity or network logs. Option D is wrong because AWS CloudTrail is the service that records API activity for governance and auditing, but it does not perform threat detection or analysis; it simply provides the log data that other services like GuardDuty can consume.

Practice this question →

127

MCQeasy

A company stores sensitive financial data in an Amazon S3 bucket. The security policy requires that all data must be encrypted in transit. The security administrator discovers that some automated scripts are using HTTP instead of HTTPS to upload files. The administrator must enforce that any request that does not use HTTPS is denied by the S3 bucket policy. Which condition key should the administrator include in the bucket policy to enforce this requirement?

A.aws:SourceIp

B.aws:Referer

C.aws:SecureTransport

D.s3:x-amz-server-side-encryption

AnswerC

This condition key checks if the request was sent over SSL/TLS. When set to 'false', the condition matches HTTP requests, allowing the policy to deny them. This is the correct key to enforce encryption in transit.

Why this answer

The `aws:SecureTransport` condition key in an S3 bucket policy evaluates whether the request was sent over HTTPS (TLS). Setting it to `false` denies any request that uses HTTP, enforcing encryption in transit as required by the security policy.

Exam trap

The trap here is that candidates may confuse `aws:SecureTransport` with other condition keys like `aws:SourceIp` or `aws:Referer`, which control different aspects of access (network origin or referrer) rather than the transport protocol itself.

Why the other options are wrong

The aws:SourceIp condition key restricts access based on IP address, not on whether the connection uses HTTPS. It cannot enforce encryption in transit.

The aws:Referer condition key checks the HTTP Referer header, which is used to identify the web page that linked to the requested resource. It does not enforce encryption in transit; it is used to prevent unauthorized cross-site requests or hotlinking.

The s3:x-amz-server-side-encryption condition key enforces server-side encryption at rest, not encryption in transit. The question specifically requires encryption in transit (HTTPS), which is controlled by aws:SecureTransport.

Practice this question →

128

MCQeasy

A small e-commerce company wants its developers to sign in to the AWS Management Console using their existing corporate credentials and enforce multi-factor authentication centrally, without creating separate long-term IAM users for each person. Which AWS service should the company use?

A.AWS Directory Service for Microsoft Active Directory

B.AWS IAM Identity Center

C.Amazon Cognito user pools with hosted UI

D.AWS Identity and Access Management (IAM) groups with password policies

AnswerB

IAM Identity Center connects to an external identity provider through SAML 2.0 or SCIM, or provides its own directory, and issues short-lived credentials for console and CLI access. It centralizes permission sets and MFA enforcement, so developers use corporate credentials without per-person IAM users, matching the company's requirement.

Why this answer

IAM Identity Center is the AWS workforce identity service that federates corporate directories and identity providers, then maps users to permission sets across accounts. It enforces MFA at the identity layer and issues short-lived credentials, removing the need to create and rotate individual IAM users while simplifying multi-account access.

Exam trap

The trap here is confusing workforce identity for employees with customer identity for application end users, which is what Cognito provides.

Practice this question →

129

MCQmedium

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that no Amazon S3 bucket in any account within the organization can be made publicly accessible. The team wants a centrally managed, preventive control that applies to all existing and future accounts and cannot be overridden by individual account administrators. Which AWS feature should the security team use to meet these requirements?

A.S3 Block Public Access account-level settings

B.AWS Config managed rule s3-bucket-public-read-prohibited

C.Amazon Macie with a sensitive data discovery job

D.Service control policy (SCP) in AWS Organizations

AnswerD

Service control policies (SCPs) are a feature of AWS Organizations. They allow centralized, preventive control over the maximum permissions granted to accounts within the organization. An SCP can deny actions that would make an S3 bucket public, such as s3:PutBucketAcl or s3:PutBucketPolicy. SCPs apply to all accounts (including future accounts) and cannot be overridden by account administrators, meeting all requirements.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally define and enforce permission guardrails across all accounts in the organization. An SCP that denies the `s3:PutBucketPublicAccessBlock` action and related public-access actions ensures that no S3 bucket can be made publicly accessible, and this policy applies to all existing and future accounts without being overridden by individual account administrators.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config rules) with preventive controls (like SCPs), or assume account-level settings (like S3 Block Public Access) can be centrally enforced across an organization without an SCP.

Why the other options are wrong

S3 Block Public Access account-level settings can be overridden by individual account administrators and do not apply automatically to new accounts created outside the organization's management account.

AWS Config managed rules are detective, not preventive; they can detect public buckets but do not block them, and they can be overridden by account administrators.

Amazon Macie is a data security service that discovers sensitive data using machine learning, but it does not provide preventive controls to block public access to S3 buckets. It is detective, not preventive, and cannot enforce policies across all accounts.

Practice this question →

130

MCQmedium

A company runs a web application behind an Application Load Balancer (ALB) in a VPC. The application must comply with a security standard that requires encryption in transit for all web traffic. The company needs a service to centrally manage SSL/TLS certificates, automatically renew them, and deploy them to the ALB without manual intervention. Which AWS service should the company use to meet these requirements?

A.AWS Certificate Manager (ACM)

B.AWS Key Management Service (AWS KMS)

C.AWS Secrets Manager

D.AWS Identity and Access Management (IAM)

AnswerA

AWS Certificate Manager is the correct service because it natively provisions, manages, and deploys public and private SSL/TLS certificates to integrated AWS services, including Application Load Balancers. ACM automates certificate renewal and handles domain validation, eliminating the manual overhead of tracking expiration dates and uploading replacements. Once a certificate is associated with an ALB, ACM continues to manage the certificate lifecycle without requiring administrator intervention.

Why this answer

AWS Certificate Manager (ACM) is the correct service because it provides centralized management of SSL/TLS certificates, supports automatic renewal for certificates issued by ACM, and can seamlessly deploy these certificates to an Application Load Balancer (ALB) without any manual intervention. This directly meets the requirement for encryption in transit and compliance with the security standard.

Exam trap

The trap here is that candidates often confuse AWS KMS (for encryption at rest) or Secrets Manager (for secrets) with ACM, because all three involve 'keys' or 'certificates,' but only ACM handles SSL/TLS certificates for encryption in transit and integrates with ALB for automatic deployment and renewal.

Why the other options are wrong

AWS KMS is used to create and manage encryption keys for data at rest, not for SSL/TLS certificates for encryption in transit. It cannot automatically renew or deploy certificates to an ALB.

AWS Secrets Manager is designed to manage secrets like database credentials and API keys, not SSL/TLS certificates. It does not automatically renew or deploy certificates to an Application Load Balancer.

IAM is used for managing users, groups, roles, and permissions, not for centrally managing SSL/TLS certificates with automatic renewal and deployment to an ALB.

Practice this question →

131

MCQmedium

A company is undergoing a compliance audit to demonstrate that its AWS environment adheres to industry standards such as PCI DSS and SOC. The auditor requests the company to provide the latest AWS compliance reports to verify the security controls implemented by AWS. The company needs to obtain these reports directly from AWS in a downloadable format. Which AWS service should the company use to meet this requirement?

A.AWS Config

B.AWS Trusted Advisor

C.AWS Artifact

D.AWS Security Hub

AnswerC

AWS Artifact is the correct service for downloading AWS compliance reports. It provides on-demand access to AWS security and compliance documents, including SOC reports, PCI DSS reports, and ISO certifications, which are commonly requested by auditors.

Why this answer

AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC and PCI DSS reports, in a downloadable format. This allows the company to directly obtain the latest reports from AWS to share with auditors, meeting the compliance audit requirement without needing to configure or manage any other service.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks configuration changes) with AWS Artifact (which provides compliance reports), leading them to select a service that manages compliance rules rather than one that delivers the actual audit documentation.

Why the other options are wrong

AWS Config is used for resource inventory, configuration history, and compliance rules, but it does not provide downloadable compliance reports like PCI DSS or SOC reports. The question specifically asks for AWS compliance reports, which are available through AWS Artifact.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide downloadable compliance reports for standards like PCI DSS or SOC.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not offer downloadable compliance reports like those required for PCI DSS or SOC audits. The question specifically asks for obtaining AWS compliance reports directly from AWS, which is the function of AWS Artifact.

Practice this question →

132

MCQmedium

A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS for MySQL database. Currently, the database administrator (DBA) hardcodes the database password in the application configuration file. A recent security audit recommends removing the password from the code and implementing automated password rotation every 30 days. The company wants a managed AWS service that can store the password securely and rotate it on a schedule without requiring custom code. Which AWS service should the company use?

A.AWS KMS (Key Management Service)

B.AWS Systems Manager Parameter Store

C.AWS Secrets Manager

D.AWS IAM (Identity and Access Management)

AnswerC

Secrets Manager is designed for securely storing secrets such as database credentials, API keys, and other sensitive data. It offers built-in automatic secret rotation with integration to RDS and other services, meeting the requirement without custom code.

Why this answer

AWS Secrets Manager is the correct choice because it is a managed service specifically designed to securely store database credentials and other secrets, with built-in capability to automatically rotate passwords on a defined schedule (e.g., every 30 days) without requiring custom code. It integrates natively with Amazon RDS for MySQL, enabling automated rotation of the master user password via a pre-built Lambda function, which directly addresses the security audit's requirement to remove hardcoded passwords and implement rotation.

Exam trap

The trap here is that candidates confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store encrypted strings, but Parameter Store lacks native automated rotation, which is the critical requirement in this question.

Why the other options are wrong

AWS KMS is a key management service for encryption keys, not for storing secrets like database passwords or rotating them on a schedule. It does not provide automated secret rotation.

AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it requires custom code or AWS Lambda to implement rotation, whereas the question specifies a managed service that rotates passwords automatically without custom code.

AWS IAM is for managing users, groups, and permissions, not for storing secrets like database passwords. It cannot store or rotate secrets on a schedule.

Practice this question →

133

MCQmedium

A company is required by their compliance framework to encrypt all data at rest and in transit. Which AWS service provides centralized key creation, management, rotation, and audit logging for encryption keys used across AWS services?

A.AWS Secrets Manager

B.AWS CloudHSM

C.AWS Key Management Service (KMS)

D.Amazon Macie

AnswerC

AWS Key Management Service (KMS) is a fully managed service that centralizes the creation, storage, and lifecycle management of encryption keys. It integrates with AWS CloudTrail to log every key operation, offers fine-grained IAM policies for key usage, and can automatically rotate keys annually. Keys are protected by FIPS-validated HSMs in AWS data centers. These capabilities make KMS the correct answer for a service that provides cryptographic key management with auditability and access control.

Why this answer

AWS Key Management Service (KMS) is the correct choice because it is a fully managed service that provides centralized control over encryption keys, including creation, rotation, and audit logging via AWS CloudTrail. It integrates seamlessly with other AWS services (e.g., S3, EBS, RDS) to encrypt data at rest and supports TLS/SSL for data in transit, meeting compliance requirements for key lifecycle management.

Exam trap

The trap here is that candidates confuse AWS Secrets Manager's secret rotation capability with encryption key management, but Secrets Manager does not create or manage encryption keys—it relies on KMS for that purpose.

How to eliminate wrong answers

Option A is wrong because AWS Secrets Manager is designed to manage secrets (e.g., database credentials, API keys) and can rotate them, but it does not provide native encryption key creation or centralized key management for AWS services; it relies on KMS for encryption. Option B is wrong because AWS CloudHSM offers dedicated hardware security modules (HSMs) for key storage and cryptographic operations, but it requires manual key management, lacks built-in automatic rotation, and does not provide centralized audit logging via CloudTrail without additional configuration. Option D is wrong because Amazon Macie is a data security service that uses machine learning to discover and protect sensitive data (e.g., PII) in S3, but it does not create, manage, or rotate encryption keys.

Practice this question →

134

MCQeasy

A company's compliance team is preparing documentation for a third-party audit. The auditor requires a copy of the AWS SOC 3 report, which provides an overview of AWS's security controls and is intended for public distribution. The team needs to securely download the most recent version of this report directly from AWS. Which AWS service should the team use?

A.AWS Artifact

B.AWS Trusted Advisor

C.AWS Config

D.AWS CloudTrail

AnswerA

AWS Artifact is the correct service for this scenario. It is a self-service portal that provides on-demand access to AWS compliance reports, including SOC 3, PCI DSS, ISO certifications, and FedRAMP documentation. Once the security team signs a non-disclosure agreement (or for public reports like SOC 3, no NDA is required), they can download the report directly from AWS Artifact for their compliance documentation.

Why this answer

AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications. The SOC 3 report is specifically designed for public distribution, and AWS Artifact allows users to securely download the most recent version directly from AWS without needing to contact support or navigate third-party sites.

Exam trap

The trap here is that candidates may confuse operational auditing services (CloudTrail, Config) with compliance document delivery (Artifact), or mistakenly think Trusted Advisor provides compliance reports instead of optimization recommendations.

Why the other options are wrong

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide access to compliance reports like SOC 3. The team needs a service that offers downloadable audit reports, which is AWS Artifact.

AWS Config is used for resource inventory, configuration history, and compliance auditing of AWS resources, not for downloading SOC reports. It does not provide access to AWS compliance documentation.

AWS CloudTrail records API activity for governance and auditing, but it does not provide access to SOC reports. The question specifically asks for downloading a SOC 3 report, which is available through AWS Artifact.

Practice this question →

135

MCQeasy

What does the principle of least privilege mean in the context of AWS IAM?

A.All IAM users should have the same level of access to ensure consistency

B.Grant only the minimum permissions necessary to perform required tasks

C.Use AWS managed policies instead of customer-managed policies

D.Rotate IAM access keys every 90 days

AnswerB

Least privilege means each IAM user, role, or resource gets exactly the permissions required to perform its intended task and nothing more. By starting with no access and adding only specific actions, resources, and conditions, you minimize the potential damage from accidental mistakes, malicious actions, or compromised credentials. This is the foundational principle for restricting blast radius and is the correct answer here.

Why this answer

The principle of least privilege in AWS IAM means granting only the permissions that are strictly necessary for a user, role, or service to perform its intended functions. This minimizes the attack surface by ensuring that even if credentials are compromised, the potential damage is limited to only the allowed actions and resources. AWS IAM enforces this through fine-grained policy statements that specify exact actions, resources, and conditions.

Exam trap

The trap here is that candidates confuse security best practices (like key rotation or using managed policies) with the core definition of least privilege, which is solely about minimizing permission scope, not about policy source or credential management.

How to eliminate wrong answers

Option A is wrong because granting all IAM users the same level of access violates the principle of least privilege and increases security risk; users should have different permissions based on their job functions. Option C is wrong because the principle of least privilege does not mandate using AWS managed policies over customer-managed policies; in fact, customer-managed policies often allow more precise permission scoping, while AWS managed policies may grant broader access than needed. Option D is wrong because rotating IAM access keys every 90 days is a security best practice for credential management, but it does not define or implement the principle of least privilege, which is about permission scope, not credential lifecycle.

Practice this question →

136

Drag & Dropmedium

Drag and drop the steps to configure an Application Load Balancer (ALB) in the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

ALB setup: target group first, then register instances, create ALB, configure listeners, and link target group.

Practice this question →

137

MCQmedium

A company runs a multi-tier web application on Amazon EC2 instances. The security team wants to continuously monitor the configuration of the EC2 security groups to ensure that no security group allows inbound SSH (port 22) access from the entire internet (0.0.0.0/0). If a security group is modified to allow such access, the company must be automatically notified and provided with a detailed record of the change, including the user who made the change. Which combination of AWS services should the company use to meet these requirements?

A.AWS Config with a managed rule to check for unrestricted SSH access, and Amazon Simple Notification Service (Amazon SNS) to send notifications when the rule is non-compliant.

B.AWS CloudTrail to log all API calls, and Amazon CloudWatch Logs to analyze the logs for security group modifications and trigger a notification.

C.AWS Trusted Advisor to check for security groups with unrestricted SSH access on a periodic basis, and Amazon Simple Email Service (Amazon SES) to send email alerts.

D.AWS Systems Manager Inventory to collect configuration data from EC2 instances, and Amazon CloudWatch Events to trigger a Lambda function that checks security group rules.

AnswerA

AWS Config can evaluate security group rules against a managed rule like 'restricted-ssh' (or a custom rule) and trigger an SNS notification when a resource is non-compliant. CloudTrail logs the API calls that made the change, and AWS Config can include the related CloudTrail event in its compliance history.

Why this answer

AWS Config continuously monitors the configuration of AWS resources, including security groups, and can evaluate them against managed rules such as 'restricted-ssh' (which checks that inbound SSH traffic is not allowed from 0.0.0.0/0). When a security group becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the security team, and the detailed configuration history (including the user who made the change via CloudTrail integration) is available in the AWS Config timeline. This combination directly meets the requirements for continuous monitoring, automatic notification, and a detailed record of the change.

Exam trap

The trap here is that candidates often confuse AWS Config's continuous compliance monitoring with AWS Trusted Advisor's periodic checks or AWS CloudTrail's logging-only capability, leading them to choose options that lack real-time evaluation or detailed change attribution.

Why the other options are wrong

CloudTrail logs API calls but does not continuously evaluate security group configurations against a desired state; CloudWatch Logs requires custom log analysis and does not provide a managed rule for SSH access checks. This approach lacks automated compliance monitoring and notification without additional custom development.

AWS Systems Manager Inventory collects configuration data from EC2 instances, not from security groups. It cannot monitor security group rules, and CloudWatch Events alone cannot provide detailed records of changes including the user who made them.

Practice this question →

138

MCQmedium

A company stores sensitive customer data in Amazon S3. The security policy requires that all objects be encrypted at rest using an encryption key that is automatically rotated every 12 months. The company must retain full control over the key, including the ability to immediately revoke access to the key if a security incident occurs. The security team also needs to audit every use of the key through AWS CloudTrail. Which key management solution should the company choose to meet these requirements?

A.Use an AWS KMS customer managed key (CMK) with automatic key rotation enabled.

B.Use an AWS KMS AWS managed key with automatic key rotation.

C.Use Amazon S3 server-side encryption with SSE-S3.

D.Use AWS CloudHSM to generate and manage the key.

AnswerA

A customer managed CMK is ideal here because it places the key lifecycle under your direct control: you can enable automatic rotation (default is yearly), set custom key policies and grants, and revoke access at any time. Every use of the key to encrypt or decrypt S3 objects is recorded in AWS CloudTrail, which gives auditors a verifiable trail of who accessed the data. KMS also integrates natively with S3, so encryption is applied transparently when writing objects.

Why this answer

AWS KMS customer managed keys (CMKs) allow you to enable automatic annual key rotation (every 12 months) and retain full control over the key, including the ability to immediately revoke access by disabling or deleting the key. CloudTrail integration is inherent with KMS, logging every use of the key via the `Decrypt` and `GenerateDataKey` API calls, meeting the audit requirement. This combination satisfies all stated security policy needs: encryption at rest, automatic rotation, full control, immediate revocation, and auditability.

Exam trap

The trap here is that candidates often confuse AWS managed keys (which also rotate automatically) with customer managed keys, overlooking the requirement for full customer control and immediate revocation capability that only customer managed keys provide.

Why the other options are wrong

AWS managed keys do not allow customers to control key rotation, view key metadata, or manage key policies, and they cannot be immediately revoked or deleted by the customer.

SSE-S3 uses S3-managed keys, which do not allow customer control, automatic rotation every 12 months, or auditing through CloudTrail. The question requires customer-managed keys with full control and auditability.

AWS CloudHSM does not provide automatic key rotation; key rotation must be managed manually. Additionally, CloudHSM does not integrate with AWS CloudTrail for key usage auditing, as it lacks native key usage logging.

Practice this question →

139

MCQmedium

A company hosts a critical e-commerce web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team is concerned about Layer 7 attacks, such as SQL injection and cross-site scripting (XSS). They also want to automatically block traffic from known malicious IP addresses. The company needs a managed web application firewall that integrates directly with the ALB. Which AWS service should the company use?

A.AWS WAF

B.AWS Shield Advanced

C.Amazon GuardDuty

D.AWS Firewall Manager

AnswerA

AWS WAF is a fully managed web application firewall that operates at the application layer (Layer 7). It allows you to define web access control lists (ACLs) containing rules that filter and monitor HTTP(S) requests targeted at resources such as an Application Load Balancer. These rules are specifically designed to block common attack patterns like SQL injection and cross-site scripting (XSS), making AWS WAF the appropriate service to protect the e-commerce application from these application-layer exploits.

Why this answer

AWS WAF is a managed web application firewall that protects web applications from common Layer 7 attacks, such as SQL injection and cross-site scripting (XSS), by inspecting HTTP/HTTPS requests. It integrates directly with an Application Load Balancer (ALB) to allow you to create custom rules that block or allow traffic based on request patterns, including automatically blocking traffic from known malicious IP addresses using managed IP reputation lists.

Exam trap

The trap here is that candidates often confuse AWS WAF with AWS Shield Advanced, assuming Shield Advanced provides application-layer filtering, but Shield Advanced focuses on DDoS mitigation at the network and transport layers, not on inspecting request payloads for SQL injection or XSS.

Why the other options are wrong

AWS Shield Advanced provides DDoS protection at Layer 3/4 and enhanced detection for Layer 7, but it does not include a managed web application firewall with rule sets for SQL injection or XSS, nor does it directly integrate with ALB to block traffic based on application-layer inspection.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not provide a managed web application firewall to block Layer 7 attacks like SQL injection or XSS, nor does it integrate directly with an ALB to filter incoming traffic.

AWS Firewall Manager is a policy management service that centrally configures and manages firewall rules across accounts and resources, but it does not itself provide Layer 7 protection like SQL injection or XSS blocking. It can manage AWS WAF rules, but the question asks for the service that directly provides the web application firewall, not the manager.

Practice this question →

140

MCQmedium

A financial services company uses AWS CloudTrail to log all API calls in its AWS account. The company must demonstrate to auditors that the CloudTrail log files have not been tampered with after they were delivered to the Amazon S3 bucket. The company wants to use a feature that automatically creates digest files containing a hash of each log file, allowing the auditor to mathematically verify the integrity of the logs. Which AWS feature should the company enable to meet this requirement?

A.S3 Object Lock

B.CloudTrail log file integrity validation

C.AWS Config conformance packs

D.Amazon Detective

AnswerB

CloudTrail log file integrity validation is a feature that automatically creates digest files containing the hash of each log file. These digests are signed using private keys from AWS Key Management Service (AWS KMS), enabling an auditor to verify that log files have not been altered or deleted. This feature is specifically designed for compliance scenarios that require cryptographic proof of log integrity.

Why this answer

CloudTrail log file integrity validation is the correct feature because it automatically creates digest files that contain a hash of each log file. These digest files are themselves signed using a private key, and the corresponding public key is published by AWS, enabling auditors to mathematically verify that the log files have not been tampered with after delivery to S3.

Exam trap

The trap here is that candidates may confuse S3 Object Lock's write-once-read-many (WORM) protection with cryptographic integrity validation, but Object Lock only prevents deletion/modification at the S3 layer and does not provide the hash-based digest chain needed for auditor verification.

Why the other options are wrong

S3 Object Lock prevents objects from being deleted or overwritten, but it does not create digest files or provide cryptographic verification of log file integrity after delivery.

AWS Config conformance packs are used to evaluate whether your AWS resources comply with custom or predefined rules, not to verify the integrity of CloudTrail log files after delivery.

Amazon Detective is used for analyzing and investigating security incidents by correlating data from multiple sources, but it does not create digest files or provide cryptographic verification of CloudTrail log file integrity.

Practice this question →

141

MCQmedium

A company wants to identify all resources in their AWS account that are accessible from outside the account — such as S3 buckets with public access or IAM roles with external trust. Which AWS service provides this analysis?

A.Amazon Inspector

B.AWS IAM Access Analyzer

C.Amazon GuardDuty

D.AWS Config

AnswerB

AWS IAM Access Analyzer uses automated reasoning to analyze the resource policies attached to supported resources such as S3 buckets, IAM roles, KMS keys, Lambda functions, SQS queues, and Secrets Manager secrets. It generates findings whenever a policy grants access to a principal from outside the account or outside your AWS Organization, identifying the external entity, actions, and conditions. This is exactly the static, policy-level analysis needed to detect resources reachable by external accounts.

Why this answer

AWS IAM Access Analyzer is the correct service because it analyzes resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) to identify resources shared with an external entity outside the AWS account. It uses a policy analysis engine that evaluates the principal, action, and condition elements to determine if a policy grants access to an external AWS account, an IAM user in another account, or a public principal (e.g., `"Principal": "*"`). This directly matches the requirement to find resources accessible from outside the account.

Exam trap

The trap here is that candidates often confuse Amazon Inspector's network reachability analysis with policy-based external access analysis, but Inspector only checks for network-level exposure (e.g., open ports), not for resource policies that grant permissions to external principals.

How to eliminate wrong answers

Option A is wrong because Amazon Inspector is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities and unintended network exposure, but it does not analyze resource-based policies for external access. Option C is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity using DNS logs, VPC Flow Logs, and CloudTrail events, but it does not perform policy-level analysis to identify publicly accessible resources or external trust relationships. Option D is wrong because AWS Config evaluates resource configurations against desired rules and tracks configuration changes over time, but it does not specifically analyze policies to determine if resources are accessible from outside the account; it lacks the policy analysis engine that IAM Access Analyzer provides.

Practice this question →

142

MCQmedium

A healthcare company is subject to HIPAA regulations and must record all AWS API calls made in its account for auditing. The logs must be retained for 7 years and must be protected from any modification or deletion, including by the account root user. Which combination of AWS services should the company use to meet these requirements?

A.AWS CloudTrail with log file validation enabled, and store the log files in an Amazon S3 bucket with S3 Object Lock enabled in compliance mode

B.AWS Config with a HIPAA conformance pack, and store the configuration history in an Amazon S3 bucket with versioning enabled

C.Amazon GuardDuty with findings exported to an Amazon S3 bucket, and enable MFA Delete on the bucket

D.AWS CloudTrail with log file validation enabled, and store the log files in an Amazon S3 bucket with MFA Delete enabled

AnswerA

CloudTrail records API calls, and log file validation provides integrity. S3 Object Lock in compliance mode prevents any user, including the root user, from deleting or modifying the log files for the retention period, satisfying the tamper-proof retention requirement.

Why this answer

AWS CloudTrail with log file validation enabled ensures the integrity of the API call logs by using a digital signature (SHA-256 hash) to detect any tampering. Storing these logs in an Amazon S3 bucket with S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting the objects for the specified retention period (7 years), meeting HIPAA's immutable audit log requirements.

Exam trap

The trap here is that candidates confuse MFA Delete with S3 Object Lock, not realizing that MFA Delete can be bypassed by the root user who controls the MFA device, whereas compliance mode enforces a legal hold that even the root user cannot override.

Why the other options are wrong

AWS Config records resource configuration changes, not API calls. It does not meet the requirement to record all AWS API calls for auditing.

Amazon GuardDuty detects threats but does not record all AWS API calls for auditing; its findings are not a complete audit trail of API activity, and MFA Delete alone does not prevent deletion by the root user or provide the immutability required for 7-year retention under HIPAA.

MFA Delete protects against accidental or unauthorized deletion but does not prevent modification of objects, nor does it enforce a retention period. HIPAA requires immutable logs for 7 years, which S3 Object Lock in compliance mode provides by preventing any deletion or modification, even by the root user.

Practice this question →

143

MCQmedium

A financial services company must comply with PCI DSS requirements that mandate the use of a dedicated hardware security module (HSM) to store encryption keys used to protect cardholder data. The company plans to use server-side encryption in Amazon S3 and needs to ensure that the encryption keys are stored in a dedicated HSM under the company's sole control. Which AWS service should the company use to meet this requirement?

A.AWS KMS with automatic key rotation

B.AWS Certificate Manager (ACM)

C.AWS CloudHSM

D.AWS Secrets Manager

AnswerC

CloudHSM provides a dedicated HSM appliance that runs in the customer's VPC. The customer has exclusive control over the HSM and the keys it contains, meeting the PCI DSS requirement for a dedicated HSM under sole control.

Why this answer

AWS CloudHSM provides dedicated hardware security modules (HSMs) that are under the customer's sole control, meeting PCI DSS requirements for storing encryption keys in a dedicated HSM. It allows you to generate and manage your own encryption keys within a single-tenant, FIPS 140-2 Level 3 validated device, ensuring compliance with the mandate for dedicated hardware.

Exam trap

The trap here is that candidates often confuse AWS KMS with a dedicated HSM solution, but KMS is a shared, multi-tenant service that does not provide the sole control required by PCI DSS for dedicated HSMs.

Why the other options are wrong

AWS KMS does not provide a dedicated HSM under the customer's sole control; it is a multi-tenant service where AWS manages the HSM infrastructure. PCI DSS requires a dedicated HSM for which the customer has exclusive control over the encryption keys.

AWS Certificate Manager (ACM) manages SSL/TLS certificates, not encryption keys for server-side encryption in S3. It does not provide a dedicated HSM under the customer's sole control, nor does it meet PCI DSS HSM requirements for key storage.

AWS Secrets Manager is designed to manage secrets like database credentials and API keys, not to provide dedicated HSM hardware under the customer's sole control. It does not meet PCI DSS requirements for a dedicated HSM for encryption key storage.

Practice this question →

144

MCQmedium

Which AWS service provides a centrally managed firewall policy that can be applied to multiple AWS accounts and VPCs across an organization?

A.AWS WAF

B.Amazon GuardDuty

C.AWS Firewall Manager

D.AWS Security Hub

AnswerC

AWS Firewall Manager is the correct answer because it provides a central place to configure and maintain firewall rules and web application protection policies across all accounts and resources within an AWS Organization. You can use it to govern AWS WAF rules, AWS Shield Advanced protections, security groups, and AWS Network Firewall policies, and it automatically enforces these policies on new and existing resources. This central management ensures consistent security baselines without needing to configure each account individually.

Why this answer

AWS Firewall Manager is the correct service because it provides a centralized firewall policy management across multiple accounts and VPCs within an AWS Organization. It allows you to deploy AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules consistently across your entire organization, ensuring a uniform security posture without manual per-account configuration.

Exam trap

The trap here is that candidates confuse AWS WAF (a per-resource firewall) with Firewall Manager (a multi-account policy management service), because both involve firewall rules, but Firewall Manager is specifically designed for centralized governance across an organization.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that protects individual resources like CloudFront, ALB, or API Gateway from common web exploits, but it does not centrally manage policies across multiple accounts or VPCs. Option B is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity using machine learning and threat intelligence, not a firewall policy management service. Option D is wrong because AWS Security Hub aggregates security findings and compliance checks from multiple AWS services into a single dashboard, but it does not deploy or manage firewall policies across accounts and VPCs.

Practice this question →

145

MCQmedium

A company has deployed multiple EC2 instances with different security groups. The compliance team wants to ensure that no security group allows unrestricted SSH access (0.0.0.0/0) and receive alerts if any such rule is created. Which AWS service can they use to continuously monitor and evaluate the security group configurations against this policy?

A.AWS CloudTrail

B.Amazon GuardDuty

C.AWS Config

D.AWS Security Hub

AnswerC

AWS Config continuously monitors and records AWS resource configurations and allows you to evaluate them against desired configurations using managed or custom rules. It can detect security groups with unrestricted SSH access and trigger notifications or automatic remediation.

Why this answer

AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. With a managed rule like `restricted-ssh`, AWS Config can automatically detect security groups that allow unrestricted SSH access (0.0.0.0/0) and trigger alerts or remediation actions. This meets the compliance team's requirement for ongoing, rule-based evaluation of security group configurations.

Exam trap

The trap here is that candidates confuse AWS CloudTrail (which logs API calls) with AWS Config (which evaluates resource configurations), or they mistakenly think Amazon GuardDuty can check static security group rules when it is designed for dynamic threat detection.

Why the other options are wrong

AWS CloudTrail records API activity but does not continuously evaluate security group configurations against a policy. It cannot alert on non-compliant rules; it only logs changes after they occur.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for continuous compliance monitoring of security group configurations against custom policies.

AWS Security Hub aggregates findings from multiple services and provides a comprehensive security posture view, but it does not continuously monitor and evaluate security group configurations against custom policies like 'no unrestricted SSH access'. That is the function of AWS Config rules.

Practice this question →

146

MCQmedium

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a policy that restricts SSH access (port 22) from the internet (0.0.0.0/0) in all VPCs across all accounts. The team wants to centrally define the allowed rules and automatically apply them to newly created VPCs and security groups, while also automatically remediating any existing non-compliant security groups. Which AWS service should the team use?

A.AWS Config

B.AWS Firewall Manager

C.Amazon GuardDuty

D.AWS Identity and Access Management (IAM)

AnswerB

AWS Firewall Manager is designed to centrally configure and manage firewall rules across accounts and resources in AWS Organizations. It can enforce a common security group policy, automatically apply it to new VPCs and security groups, and remediate existing non-compliant resources, meeting all the stated requirements.

Why this answer

AWS Firewall Manager is the correct service because it provides centralized management of firewall rules across all accounts in AWS Organizations. It can enforce a common security group rule to deny SSH access from 0.0.0.0/0, automatically apply this policy to new VPCs and security groups, and remediate non-compliant existing security groups by removing or replacing violating rules. This meets the requirement for both proactive enforcement and automated remediation at scale.

Exam trap

The trap here is that candidates often confuse AWS Config's detection capabilities with enforcement, assuming it can automatically fix non-compliant resources without additional automation, while Firewall Manager is the native service for centralized, automated security group policy enforcement across an organization.

Why the other options are wrong

AWS Config can detect non-compliant security groups but cannot centrally enforce policies across all accounts or automatically remediate newly created VPCs and security groups. It lacks the ability to define and apply a common security policy across an organization.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a policy enforcement or remediation service. It cannot centrally define or automatically apply security group rules across accounts.

IAM is used to manage user permissions and access to AWS services, not to centrally enforce network security group rules across multiple accounts and VPCs. It cannot automatically remediate non-compliant security groups or apply policies to newly created VPCs.

Practice this question →

147

MCQmedium

A company is expanding its AWS environment from a single account to multiple accounts using AWS Organizations. The security team wants to enforce a baseline set of permissions across all accounts, ensuring that users in any account cannot disable AWS CloudTrail or modify Amazon S3 bucket policies that prevent public access. Which feature of AWS Organizations should the security team use to achieve this control?

A.Consolidated Billing

B.Service Control Policies (SCPs)

C.AWS Config rules

D.IAM roles

AnswerB

SCPs allow you to define and enforce maximum permissions for all accounts in your AWS Organization. They act as a guardrail, ensuring that even if an account has permissive IAM policies, the effective permissions are limited by the SCP. This enables central enforcement of security baselines such as preventing the disabling of CloudTrail or modification of S3 bucket policies that block public access.

Why this answer

Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce baseline permissions across all accounts in an AWS Organization. SCPs act as a guardrail, restricting what actions users and roles in member accounts can perform, even if they have full administrative privileges within their own account. By creating an SCP that explicitly denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:PutBucketPolicy` actions (or similar), the security team can prevent disabling CloudTrail and modifying S3 bucket policies that block public access across the entire organization.

Exam trap

The trap here is that candidates often confuse AWS Config rules (detective) with SCPs (preventive), thinking that Config rules can block actions when they only alert on non-compliance after the fact.

Why the other options are wrong

AWS Config rules can detect noncompliant configurations but cannot prevent actions; they are detective, not preventive. The question requires enforcing a baseline that prevents users from disabling CloudTrail or modifying S3 bucket policies, which SCPs achieve by denying those actions.

IAM roles grant permissions to users or services within an account but cannot enforce a baseline set of permissions across all accounts in an AWS Organization. They are account-specific and do not provide centralized control to prevent disabling CloudTrail or modifying S3 bucket policies across multiple accounts.

Practice this question →

148

MCQmedium

A security engineer needs to apply network traffic filtering rules at the subnet level rather than the instance level. The solution must be stateless and must explicitly define both inbound and outbound rules, including allowing return traffic. Which AWS feature provides subnet-level stateless traffic control?

A.Security groups

B.Network Access Control Lists (NACLs)

C.AWS WAF

D.VPC route tables

AnswerB

NACLs are applied at the subnet level and are stateless — each packet is evaluated against the rules independently. Both inbound and outbound rules must explicitly allow traffic, including return traffic for connections initiated from inside the subnet.

Why this answer

Network Access Control Lists (NACLs) are the correct choice because they operate at the subnet level, are stateless (meaning they do not automatically allow return traffic), and require explicit inbound and outbound rules. This matches the requirement for stateless traffic filtering where both directions must be defined separately, including rules for return traffic.

Exam trap

The trap here is that candidates often confuse security groups (stateful, instance-level) with NACLs (stateless, subnet-level), forgetting that the stateless requirement explicitly demands separate inbound and outbound rules for return traffic.

How to eliminate wrong answers

Option A is wrong because security groups are stateful and operate at the instance level, not the subnet level; they automatically allow return traffic, which violates the stateless requirement. Option C is wrong because AWS WAF is a web application firewall that protects against web exploits at the application layer (HTTP/HTTPS), not a subnet-level network traffic filter. Option D is wrong because VPC route tables control the path of network traffic (routing) between subnets and gateways, not traffic filtering or access control.

Practice this question →

149

MCQmedium

A company manages 20 AWS accounts and wants employees to log in once with their corporate Active Directory credentials and then access any of their authorised AWS accounts without re-entering credentials for each account. Which AWS service provides this centralised single sign-on capability?

A.AWS Directory Service

B.Amazon Cognito

C.AWS IAM Identity Center

D.AWS Control Tower

AnswerC

IAM Identity Center provides a single sign-on portal where employees authenticate once with corporate credentials and then access any of their authorised AWS accounts. It integrates with Active Directory and other SAML 2.0 identity providers.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides centralized single sign-on (SSO) across multiple AWS accounts and business applications. It integrates with an external identity provider (IdP) such as Active Directory via SAML 2.0 or SCIM, allowing users to authenticate once with their corporate credentials and then access any authorized AWS account without re-entering credentials.

Exam trap

The trap here is that candidates often confuse AWS Directory Service (which provides the directory itself) with the SSO service that uses that directory for cross-account access, leading them to pick Option A instead of the correct IAM Identity Center.

How to eliminate wrong answers

Option A is wrong because AWS Directory Service provides managed Microsoft Active Directory in the cloud, but it does not natively offer SSO across multiple AWS accounts; it requires additional configuration with IAM Identity Center or a federation proxy. Option B is wrong because Amazon Cognito is designed for customer-facing identity and access management for web and mobile apps, not for workforce SSO across AWS accounts. Option D is wrong because AWS Control Tower is a governance and orchestration service for setting up and managing a multi-account AWS environment, but it does not provide SSO capabilities; it relies on IAM Identity Center for identity federation.

Practice this question →

150

MCQmedium

A company needs to ensure that all data transmitted between their on-premises servers and AWS is encrypted during transfer. Which AWS services provide encryption in transit? (Choose the most complete answer.)

A.AWS Direct Connect with dedicated link guarantees

B.AWS Site-to-Site VPN using IPsec encryption

C.Amazon S3 SSE-S3 encryption

D.AWS KMS key rotation

AnswerB

AWS Site-to-Site VPN is explicitly designed to create an encrypted tunnel between your on-premises gateway and a virtual private gateway (or transit gateway) in AWS. It uses IPsec in tunnel mode to provide confidentiality, integrity, and authenticity for all traffic traversing the public internet. With AES-256 or AES-128 encryption and IKE for key exchange, it ensures that data in transit is fully protected against eavesdropping and tampering. Therefore, this is the correct mechanism for achieving encryption in transit between on-premises and AWS.

Why this answer

AWS Site-to-Site VPN is the correct choice because it creates an encrypted tunnel between on-premises servers and AWS using IPsec (Internet Protocol Security) protocol suite. IPsec provides confidentiality, integrity, and authentication for all data packets traversing the public internet, ensuring encryption in transit as required by the question.

Exam trap

The trap here is that candidates confuse encryption in transit with encryption at rest, often selecting S3 SSE-S3 or KMS key rotation because they associate 'encryption' broadly with AWS security, without distinguishing the data state.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect provides a dedicated private network connection but does not inherently encrypt data in transit; encryption must be added separately (e.g., via IPsec over the Direct Connect link). Option C is wrong because Amazon S3 SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts data at rest, not during transfer; it protects data stored in S3, not data in transit between on-premises and AWS. Option D is wrong because AWS KMS key rotation manages the lifecycle of encryption keys but does not directly encrypt data in transit; it is a key management feature, not a transport encryption mechanism.

Practice this question →