Courseiva

CCNA Security and Compliance Questions

32 questions · Security and Compliance · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

A company uses AWS CodeBuild to build and test code. The build jobs need to access a private S3 bucket to download dependencies. Which THREE steps are required to securely grant access?

Select 3 answers
A.Configure the S3 bucket policy to allow access from the CodeBuild service principal
B.Set up a VPC endpoint for S3
C.Create an IAM role with a policy that allows s3:GetObject on the bucket
D.Create a KMS key and grant CodeBuild access to it
E.Attach the IAM role to the CodeBuild project in the service role field
AnswersA, C, E

The bucket policy must explicitly allow the role to access the bucket, unless the role has cross-account permissions.

Why this answer

To grant CodeBuild access to an S3 bucket, you need an IAM role that allows the required actions, attach it to the CodeBuild project, and also ensure the bucket policy allows the role. KMS key is not required if SSE-S3 is used. VPC endpoint is optional.

Practice this question →
2
MCQeasy

A DevOps engineer needs to ensure that all API calls made to AWS are logged for compliance. The logs must be stored in S3 for at least 7 years. Which AWS service should they use?

A.VPC Flow Logs
B.AWS Config
C.Amazon CloudWatch Logs
D.AWS CloudTrail
AnswerD

CloudTrail records all AWS API calls and can deliver logs to S3 for long-term retention.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity, source IP, and timestamp, and can deliver log files to an S3 bucket for long-term retention. The requirement to store logs for at least 7 years aligns with CloudTrail's ability to integrate with S3 lifecycle policies for archival or deletion after a specified period.

Exam trap

The trap here is that candidates often confuse CloudTrail with CloudWatch Logs or AWS Config, thinking that any logging service can capture API calls, but only CloudTrail is designed specifically for auditing AWS API activity.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) for VPCs, not API calls to AWS services. Option B is wrong because AWS Config records resource configuration changes and evaluates compliance rules, but it does not log API calls. Option C is wrong because Amazon CloudWatch Logs is designed for real-time monitoring and log storage from applications and AWS services, but it is not the primary service for auditing AWS API calls; CloudTrail is the dedicated service for that purpose.

Practice this question →
3
MCQmedium

A company wants to centralize IAM user management across multiple AWS accounts. The company currently uses individual IAM users in each account. What is the BEST practice for centralized access control?

A.Use AWS Organizations and AWS IAM Identity Center (AWS SSO) to manage users centrally.
B.Create the same IAM users in each account with identical permissions.
C.Create IAM roles in each account and allow cross-account access from a central account.
D.Use IAM federation with an external identity provider and assign permissions based on SAML attributes.
AnswerA

AWS IAM Identity Center (formerly AWS SSO) integrates natively with AWS Organizations, providing a single place to manage users and groups and then assign them access across multiple AWS accounts. It uses permission sets to define IAM policies that are applied consistently to accounts, and it issues short-term AWS credentials, eliminating the need to create and rotate IAM users. This is the only option that genuinely centralizes user management while preserving fine-grained, auditable access control.

Why this answer

AWS Organizations with IAM Identity Center (AWS SSO) enables centralized user management and single sign-on across multiple AWS accounts, eliminating the need to manage individual IAM users in each account. Option B is incorrect because creating the same IAM users in each account leads to duplication and inconsistent permissions. Option C is incorrect because cross-account roles still require local IAM users or federated identities to assume those roles, and do not provide centralized user management.

Option D is incorrect because IAM federation with an external IdP centralizes authentication but does not inherently manage users across accounts unless combined with AWS Organizations and IAM Identity Center.

Practice this question →
4
Multi-Selecthard

A company has an IAM policy that allows users to manage their own passwords and MFA devices. The policy includes a condition that requires MFA for all API operations except for changing passwords and MFA. Which THREE statements are true about this policy? (Choose THREE.)

Select 3 answers
A.The policy creates an IAM role for MFA enforcement.
B.The policy applies to the AWS account root user.
C.The policy uses NotAction to exclude password and MFA actions.
D.The policy uses the aws:MultiFactorAuthPresent condition key.
E.The policy must be attached to IAM users or groups.
AnswersC, D, E

NotAction allows those actions without MFA.

Why this answer

Options C, D, and E are correct. The policy uses NotAction to exclude password and MFA actions from the MFA requirement, and uses the aws:MultiFactorAuthPresent condition key to require MFA for all other actions. The policy must be attached to IAM users or groups to take effect.

Option A is incorrect because the policy is an identity-based policy, not a role. Option B is incorrect because IAM policies do not apply to the root user.

Practice this question →
5
Multi-Selecteasy

Which TWO are best practices for securing an Amazon RDS database? (Choose 2)

Select 2 answers
A.Enable public accessibility for easy management.
B.Use a single Availability Zone to reduce complexity.
C.Launch the RDS instance in a private subnet.
D.Enable encryption at rest using AWS KMS.
E.Grant direct IAM user access to the database.
AnswersC, D

Launching the RDS instance in a private subnet that has no route to an internet gateway prevents any direct inbound connection from the public internet, including attempts to exploit database vulnerabilities. Only resources inside the VPC, such as application servers in private subnets or a bastion host, can reach the database, and those connections can be further restricted by security groups and NACLs. This is a core network security control that reduces the attack surface and is a mandatory requirement for many compliance frameworks.

Why this answer

(launch RDS in a private subnet) and Option D (enable encryption at rest using AWS KMS) are correct best practices for securing an Amazon RDS database. Launching in a private subnet ensures the database is not directly accessible from the internet, enhancing security. Encryption at rest protects data stored on disk.

Option A is incorrect because enabling public accessibility increases exposure to attacks. Option B is incorrect because using a single Availability Zone does not enhance security and may reduce availability. Option E is incorrect because direct IAM user access to the database is not a standard practice; RDS uses database authentication, though IAM database authentication can be used, it's not a direct IAM user access and is not a best practice for all scenarios.

Practice this question →
6
Multi-Selecteasy

Which TWO AWS services can be used to manage and rotate database credentials automatically? (Select TWO.)

Select 2 answers
A.AWS Systems Manager Parameter Store
B.AWS Secrets Manager
C.AWS CloudFormation
D.AWS KMS
E.AWS IAM
AnswersA, B

AWS Systems Manager Parameter Store is a central, hierarchical store for configuration data and secrets. It supports SecureString parameters encrypted with AWS KMS, and it can be used to store database credentials or API keys. While Parameter Store does not provide native rotation, you can build a scheduled AWS Lambda function triggered by EventBridge to update the parameter value, thereby managing and rotating secrets on a schedule.

Why this answer

Options A and B are correct. AWS Systems Manager Parameter Store can store database credentials as SecureString parameters, and you can implement automatic rotation using a custom AWS Lambda function. AWS Secrets Manager provides built-in automatic rotation for supported databases (e.g., Amazon RDS, Amazon Redshift) without requiring custom code.

Option C (AWS CloudFormation) is an infrastructure-as-code service and does not manage or rotate credentials. Option D (AWS KMS) is a key management service that encrypts data but does not handle credential rotation. Option E (AWS IAM) manages access permissions and roles, not database credentials.

Practice this question →
7
MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic to the ALB must be encrypted (HTTPS) and that the ALB must only accept traffic from CloudFront. The DevOps engineer has configured CloudFront with an origin pointing to the ALB, and the ALB has a listener on port 443 with a valid SSL certificate. The engineer also added a security group rule to the ALB that allows HTTPS traffic only from CloudFront's IP ranges. However, users are reporting intermittent 503 errors. The engineer checks CloudFront logs and sees that some requests are failing with 'Origin Connect Error'. What is the most likely cause?

A.The ALB has a Web Application Firewall (WAF) that is blocking requests from CloudFront.
B.The security group rule is using an outdated list of CloudFront IP ranges, and CloudFront has added new IP ranges that are being blocked.
C.The SSL certificate on the ALB is not trusted by CloudFront, causing handshake failures.
D.The ALB idle timeout is set too low, causing CloudFront to close connections prematurely.
AnswerB

Correct. The security group rule using an outdated list of CloudFront IP ranges can cause intermittent 503 errors when CloudFront adds new IPs that are blocked.

Why this answer

The most likely cause is that the security group rule is using an outdated list of CloudFront IP ranges. CloudFront's IP ranges are dynamic and change over time; AWS publishes these ranges but they are not static. When a new range is added that is not in the security group rule, requests from those IPs are blocked, leading to 'Origin Connect Error' and intermittent 503 errors.

The correct approach is to use a custom header (e.g., X-Origin-Verify) from CloudFront and validate it at the ALB, rather than relying on IP-based security groups. Option A (WAF blocking) would typically result in 403 Forbidden, not 503. Option C (SSL certificate) would cause handshake failures with a different error.

Option D (idle timeout) would cause consistent timeout errors, not intermittent ones.

Practice this question →
8
MCQeasy

A DevOps engineer needs to grant cross-account access to an S3 bucket. The source account is 111111111111 and the destination account is 222222222222. Which policy should be attached to the S3 bucket?

A.Attach an IAM policy to the user in account 111111111111 allowing s3:GetObject.
B.Set the bucket ACL to grant full control to account 222222222222.
C.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}
D.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}
AnswerC

Bucket policy grants cross-account access to objects.

Why this answer

It uses a bucket policy to grant cross-account access to the S3 bucket. The policy specifies the destination account (222222222222) as the principal, allowing s3:GetObject on the bucket's objects. This is the standard AWS approach for cross-account S3 access, as bucket policies can grant permissions to principals in other AWS accounts.

Exam trap

The trap here is that candidates often confuse which account's ARN to use in the Principal field, mistakenly using the source account (111111111111) instead of the destination account (222222222222), or they incorrectly assume an IAM policy in the source account can grant cross-account access.

How to eliminate wrong answers

Option A is wrong because attaching an IAM policy to a user in the source account (111111111111) does not grant access to the destination account; it only grants permissions to that specific user within the source account. Option B is wrong because bucket ACLs are legacy and do not support granting cross-account access to objects in a bucket that has S3 Object Ownership enabled (default since April 2023), and they are less secure and flexible than bucket policies. Option D is wrong because it specifies the source account (111111111111) as the principal, which would only grant access to the source account itself, not the destination account (222222222222).

Practice this question →
9
MCQhard

A company is running a critical application on an Amazon EC2 instance that needs to access an S3 bucket. The application must use temporary credentials that automatically rotate. The DevOps engineer must ensure that the credentials are never stored on disk. Which approach meets these requirements?

A.Store the credentials in AWS Secrets Manager and retrieve them at application startup.
B.Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.
C.Use AWS Systems Manager Parameter Store to store the credentials and retrieve them using the EC2 instance's IAM role.
D.Generate an access key and secret key for an IAM user and store them in a configuration file on the EC2 instance.
AnswerB

The best practice is to attach an IAM role to the EC2 instance; the instance profile exposes temporary security credentials via the Instance Metadata Service (IMDSv2), which the AWS SDKs automatically load and refresh. These credentials are short-lived, rotated automatically, and never written to disk, so no secret material is present in the file system, environment variables, or configuration files. This eliminates the need to manage access keys manually and reduces the risk of exposure if the instance is compromised.

Why this answer

Attaching an IAM role to the EC2 instance and using the instance profile allows the application to obtain temporary credentials from the EC2 instance metadata service (IMDS). These credentials are automatically rotated by AWS before they expire, and they are never stored on disk—they are fetched on-demand from the metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/). This satisfies both the requirement for automatic rotation and the prohibition against disk storage.

Exam trap

The trap here is that candidates may confuse AWS Secrets Manager or Parameter Store with a solution for automatic credential rotation, not realizing that those services store static secrets unless explicitly configured with rotation via Lambda, whereas an IAM instance profile inherently provides automatically rotating temporary credentials without any disk storage.

How to eliminate wrong answers

Option A is wrong because while AWS Secrets Manager can store and rotate credentials, the application would still need to retrieve and hold them in memory, and the credentials stored there are long-term IAM user keys or secrets, not automatically rotating temporary credentials from an instance profile. Option C is wrong because AWS Systems Manager Parameter Store can store credentials, but it does not inherently rotate them; the stored credentials would be static unless manually updated, and the application would still need to handle them in memory, not leveraging the automatic rotation of instance metadata service credentials. Option D is wrong because storing access keys and secret keys in a configuration file on disk directly violates the requirement that credentials never be stored on disk, and these static credentials do not automatically rotate.

Practice this question →
10
MCQeasy

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?

A.Use an SCP to deny the creation of unencrypted EBS volumes and use AWS Config to detect noncompliant volumes.
B.Use a service control policy (SCP) to deny the ability to disable the AWS Config rule and use a custom AWS Config rule that evaluates EBS encryption.
C.Use an AWS Config aggregator in the management account to monitor compliance across accounts.
D.Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.
AnswerD

AWS CloudFormation StackSets let you define a stack containing the AWS Config rule once and deploy it to specified accounts across the organization. With service-managed StackSets, you can enable automatic deployment so that any new account added to the organization is automatically provisioned with the stack, ensuring the Config rule exists in every account. This centrally manages the rule's lifecycle and avoids needing per-account manual setup, making it the appropriate solution.

Why this answer

AWS CloudFormation StackSets can deploy a stack containing the AWS Config rule across all accounts in the organization, and with automatic deployment enabled, new accounts automatically receive the stack. This centrally manages the rule with minimal operational overhead. Option B is incorrect because SCPs only deny API actions and cannot deploy a Config rule; they would need a separate mechanism to deploy the rule initially.

Exam trap

The trap is that candidates may believe an SCP can be used to enforce a Config rule, but SCPs only deny or allow actions; they don't deploy configurations. The correct approach uses StackSets or organization-level Config rules for automatic deployment.

How to eliminate wrong answers

Option A is wrong because an SCP that denies the creation of unencrypted EBS volumes does not enforce an AWS Config rule; it only prevents creation but does not detect or remediate existing noncompliant volumes, and it does not automatically deploy the Config rule to new accounts. Option C is wrong because an AWS Config aggregator only provides a centralized view of compliance across accounts but does not enforce or deploy the Config rule to new accounts. Option D is wrong because CloudFormation StackSets require manual setup and ongoing management to deploy to new accounts as they are added, which introduces higher operational overhead compared to using organization-level AWS Config rules or SCPs.

Practice this question →
11
MCQmedium

A company has a multi-account AWS environment using AWS Organizations. They want to centrally manage user access to all accounts using single sign-on (SSO) and enforce multi-factor authentication (MFA). Which service should they use?

A.Use AWS Secrets Manager to store and rotate IAM user credentials.
B.Create IAM users in each account and share the credentials securely.
C.Use Amazon Cognito user pools with an identity broker.
D.Use AWS IAM Identity Center (AWS SSO) to manage access and enforce MFA.
AnswerD

AWS IAM Identity Center centralizes workforce identity and builds on AWS Organizations to give users SSO access to all accounts via permission sets, which define granular IAM role permissions. It enforces MFA with policy settings such as requiring MFA for all users or context-dependent MFA, and supports both its built-in directory and external identity providers. Users sign in once at the portal or via the CLI, and IAM Identity Center automatically creates temporary credentials for each account.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user access and permissions across all AWS accounts in an AWS Organization. It natively supports enforcing multi-factor authentication (MFA) through an identity source (e.g., the built-in identity store or an external IdP) and integrates directly with AWS Organizations to grant single sign-on access without needing to create IAM users in each account.

Exam trap

The trap here is that candidates often confuse Amazon Cognito (a customer identity service) with workforce identity management, or assume that storing credentials in Secrets Manager or creating per-account IAM users is a viable centralized solution, when in fact AWS IAM Identity Center is the only service designed for multi-account SSO with MFA enforcement in an AWS Organizations context.

How to eliminate wrong answers

Option A is wrong because AWS Secrets Manager is designed to securely store and rotate secrets (like database credentials or API keys), not to manage user identities or enforce MFA for SSO access. Option B is wrong because creating IAM users in each account and sharing credentials manually violates the principle of least privilege, creates a massive administrative overhead, and does not provide centralized SSO or consistent MFA enforcement across accounts. Option C is wrong because Amazon Cognito user pools are intended for customer-facing identity and access management for web and mobile applications, not for managing workforce access to AWS accounts via SSO with MFA enforcement across an AWS Organization.

Practice this question →
12
MCQhard

A company's security policy requires that all EC2 instances must be launched with an IAM role that provides least privilege access. A DevOps engineer needs to enforce this across the organization. Which approach is MOST effective?

A.Create an SCP that denies ec2:RunInstances if the specified IAM role is not the approved role
B.Create a service control policy (SCP) that denies the ec2:RunInstances action unless an instance profile is attached
C.Use AWS Config to detect instances without the required role and terminate them via Lambda
D.Create an IAM policy that denies ec2:RunInstances unless the instance is launched with the required IAM role, and attach it to all users
AnswerD

IAM policies can use condition keys like iam:PassedToService to enforce specific roles.

Why this answer

Attaching an IAM policy to all users that denies ec2:RunInstances unless the instance is launched with the required IAM role directly enforces the requirement. Option A (SCP denying if not the approved role) is incorrect because SCPs cannot check for a specific role attachment at launch time; they only control permissions at the account level. Option B (SCP denying unless instance profile attached) only requires any instance profile, not specifically the approved one.

Option C (AWS Config + Lambda) is reactive and can have delays, so it is less effective than a preventive IAM policy.

Practice this question →
13
MCQeasy

A DevOps engineer is designing a CI/CD pipeline that deploys code to an EC2 instance. The engineer needs to securely store and retrieve database credentials used by the application. Which AWS service should be used?

A.Amazon S3 with server-side encryption
B.AWS Systems Manager Parameter Store
C.AWS Secrets Manager
D.AWS Key Management Service (KMS)
AnswerC

Secrets Manager provides secure storage and automatic rotation of secrets.

Why this answer

WS Secrets Manager (Option C) because it is specifically designed for securely storing, managing, and automatically rotating database credentials and other secrets. Amazon S3 with server-side encryption (Option A) is an object storage service and not intended for secret management; it lacks automatic rotation and fine-grained access control for secrets. AWS Systems Manager Parameter Store (Option B) can store secrets but does not natively support automatic rotation, which is a key requirement for database credentials.

AWS Key Management Service (Option D) manages encryption keys, not secrets themselves, and is used for encryption, not secret storage.

Practice this question →
14
MCQeasy

A company needs to ensure that all API calls made to AWS are encrypted in transit. Which of the following is the correct way to enforce this?

A.Use an IAM policy with a condition that denies access unless the request uses HTTPS.
B.Configure security groups to allow only HTTPS traffic.
C.Use AWS Key Management Service (KMS) to create a key and require encryption.
D.Enable AWS CloudTrail to log all API calls.
AnswerA

An IAM policy is evaluated for every AWS API request, and the global condition key `aws:SecureTransport` returns `false` when the request was not sent over TLS/HTTPS. By attaching a policy that explicitly denies access when `aws:SecureTransport` is `false`, you enforce that all API calls must use HTTPS at the authorization layer. This is the correct, service-agnostic mechanism because IAM conditions apply uniformly to any supported AWS service, making it impossible to bypass via a non-HTTPS client.

Why this answer

All AWS API endpoints support HTTPS (TLS) by default. To enforce that all API calls are encrypted in transit, you can use an IAM policy with a condition that denies access unless the request uses HTTPS. Specifically, you can use the `aws:SecureTransport` condition key to require encrypted connections.

Option A is correct. Option B is incorrect because security groups control network traffic at the instance level but do not enforce encryption for API calls. Option C is incorrect because AWS KMS is used for managing encryption keys, not for enforcing HTTPS.

Option D is incorrect because AWS CloudTrail logs API activity but does not enforce encryption.

Practice this question →
15
MCQmedium

A company is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The security team requires that all artifacts be encrypted at rest and in transit. Which configuration ensures encryption for all stages?

A.Enable AWS KMS encryption on the CodePipeline artifact bucket and use SSH for CodeCommit.
B.Use an AWS Certificate Manager (ACM) certificate for CodeBuild and CodeDeploy endpoints.
C.Enable default encryption on the S3 artifact bucket and ensure all connections use HTTPS.
D.Encrypt the CodePipeline artifact using the pipeline's built-in encryption feature.
AnswerC

Ensures encryption at rest and in transit.

Why this answer

Enabling default encryption on the S3 artifact bucket ensures that all artifacts stored in the bucket are encrypted at rest. Additionally, ensuring all connections use HTTPS provides encryption in transit for all communications between pipeline stages (e.g., CodeBuild downloading from S3, CodeDeploy pulling artifacts). Option A is incorrect because enabling KMS encryption on the artifact bucket is not automatic with CodePipeline; you must configure it.

Moreover, SSH is not used for CodeCommit; HTTPS is the primary method. Option B is incorrect because ACM certificates are used for securing custom domain endpoints, not for encrypting pipeline artifacts at rest or in transit by default. Option D is incorrect because CodePipeline does not have a built-in encryption feature; encryption must be configured on the S3 bucket.

Practice this question →
16
MCQhard

A company is using AWS CloudFormation to deploy infrastructure. They need to ensure that all resources created by CloudFormation are tagged with a 'CostCenter' tag. The tag must be applied automatically to all resources in the stack. What should they do?

A.Use AWS Service Catalog to enforce tagging on all products.
B.Create an AWS Config rule to detect untagged resources and trigger auto-remediation.
C.Specify the tag in the CloudFormation stack's Tags parameter, which applies the tag to all resources in the stack.
D.Use a custom Lambda function as a CloudFormation hook to tag resources after creation.
AnswerC

When you specify a tag in the Tags parameter of the AWS CloudFormation stack, CloudFormation automatically applies that tag to every resource in the stack that supports tagging during stack creation and update operations. This is a native cloudformation capability that propagates the tag at launch time, ensuring the CostCenter tag is consistently applied without custom code or post-creation processing. Resources that do not support tagging are the only exceptions, but the tag is applied to all taggable resources as part of the stack lifecycle.

Why this answer

CloudFormation allows you to specify stack-level tags in the Tags parameter when creating or updating a stack. These tags are automatically propagated to all resources that support tagging within the stack, ensuring consistent cost allocation without additional custom logic or post-creation remediation.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing a reactive or custom approach (like AWS Config rules or Lambda hooks) when CloudFormation provides a built-in, declarative mechanism to apply tags automatically at stack creation time.

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog is a service for creating and managing a catalog of approved products, not for enforcing tags on CloudFormation stacks directly; it can apply tags to provisioned products but does not automatically tag all resources within a stack. Option B is wrong because AWS Config rules are reactive—they detect non-compliant resources after creation and can trigger auto-remediation, but they do not prevent the initial creation of untagged resources and add latency and complexity. Option D is wrong because using a custom Lambda function as a CloudFormation hook to tag resources after creation is an unnecessary workaround; CloudFormation natively supports stack-level tags that are applied at creation time, making a custom hook redundant and less efficient.

Practice this question →
17
MCQmedium

A DevOps engineer needs to ensure that EC2 instances can access an S3 bucket without storing AWS credentials on the instances. Which solution meets this requirement?

A.Use an S3 bucket policy that grants access to the EC2 instance's public IP.
B.Store access keys in the EC2 user data script.
C.Create an IAM user and embed credentials in the application code.
D.Attach an IAM role to the EC2 instance with an S3 access policy.
AnswerD

The IAM role provides temporary credentials via the instance metadata service.

Why this answer

Attaching an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS STS service via the instance metadata service (IMDS). The EC2 instance can then use these credentials to access the S3 bucket without any long-term AWS credentials being stored on the instance. This is the AWS-recommended best practice for granting permissions to AWS services running on EC2.

Exam trap

The trap here is that candidates may think storing credentials in user data or application code is acceptable, but the DOP-C02 exam specifically tests the principle of using IAM roles to avoid long-term credential storage on EC2 instances.

How to eliminate wrong answers

Option A is wrong because an S3 bucket policy that grants access based on an EC2 instance's public IP is not a secure or reliable method; public IPs can change (unless using an Elastic IP) and do not authenticate the identity of the requester, making it vulnerable to spoofing and not a substitute for AWS credentials. Option B is wrong because storing access keys in the EC2 user data script exposes long-term credentials in plaintext within the instance's metadata and logs, violating the requirement to avoid storing credentials on the instance. Option C is wrong because embedding IAM user credentials in application code stores long-term access keys directly on the instance, which is insecure and contradicts the principle of using temporary credentials via IAM roles.

Practice this question →
18
MCQmedium

A DevOps team is deploying a web application on EC2 instances behind an ALB. The application must authenticate users using an external identity provider (IdP) that supports SAML 2.0. Which solution provides the simplest integration with the ALB?

A.Use Amazon Cognito user pools with SAML federation and integrate with ALB
B.Use AWS CloudFront with Lambda@Edge to validate SAML tokens
C.Install a SAML service provider library on each EC2 instance
D.Configure the ALB to use an SAML identity provider for authentication
AnswerD

Configuring the ALB to use an SAML identity provider lets the load balancer act as the relying party, terminating the SAML exchange at the edge of the AWS network. When an unauthenticated user requests a protected target group, the ALB redirects to the IdP, validates the returned assertion, sets an encrypted session cookie, and forwards the authenticated session details to the backend as HTTP headers. This makes authentication transparent to the EC2 instances, so no code changes are required and security is centralized at one access point.

Why this answer

The Application Load Balancer (ALB) natively supports SAML 2.0 identity provider (IdP) authentication. This allows the ALB to offload user authentication at the edge, validating SAML assertions directly and forwarding authenticated requests to the target EC2 instances without any application-level changes. This is the simplest integration as it requires no additional infrastructure or code on the EC2 instances.

Exam trap

The trap here is that candidates often overcomplicate the solution by assuming they need a separate identity service like Cognito or custom code, when the ALB itself can directly integrate with any SAML 2.0 IdP, making it the simplest and most AWS-native choice.

How to eliminate wrong answers

Option A is wrong because Amazon Cognito user pools with SAML federation require additional configuration and management of a Cognito user pool, adding unnecessary complexity when the ALB can directly authenticate against the external SAML IdP. Option B is wrong because AWS CloudFront with Lambda@Edge to validate SAML tokens is overly complex and not designed for SAML token validation; Lambda@Edge is better suited for lightweight request/response transformations, not full SAML assertion parsing and validation. Option C is wrong because installing a SAML service provider library on each EC2 instance requires application-level changes, certificate management, and session handling, which is more complex and less scalable than using the ALB's built-in SAML authentication.

Practice this question →
19
Multi-Selectmedium

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. What should be done? (Choose TWO.)

Select 2 answers
A.Attach a security group to the KMS key.
B.Modify the KMS key policy to include a condition that requires the kms:ViaService to be from the VPC endpoint.
C.Configure the S3 bucket policy to allow only requests from the VPC.
D.Create a service control policy (SCP) that denies KMS operations from outside the VPC.
E.Create a VPC endpoint for AWS KMS.
AnswersB, E

This condition restricts use of the key to requests coming through the VPC endpoint.

Why this answer

Options B and E are correct. To restrict KMS key usage to within the VPC, you first create a VPC endpoint for AWS KMS (Option E) to allow private connectivity. Then, you modify the KMS key policy to include a condition that requires the request to originate from that VPC endpoint, using the kms:ViaService condition key (Option B).

Option A is wrong because security groups do not apply to KMS keys; they are used for EC2 instances and network interfaces. Option C is wrong because S3 bucket policies cannot restrict which KMS key is used for encryption; they can only restrict S3 actions. Option D is wrong because service control policies (SCPs) apply at the organizational level and cannot restrict KMS key usage to a specific VPC; key policies are the correct mechanism.

Practice this question →
20
Multi-Selecthard

A DevOps team is designing a solution to encrypt data at rest for an Amazon RDS for MySQL database. Which TWO actions should the team take? (Choose TWO.)

Select 2 answers
A.Enable encryption after creating the RDS instance by modifying the instance
B.Enable SSL/TLS for the RDS instance
C.Use AWS KMS to create a customer managed key and assign it to the RDS instance
D.Enable encryption at rest when creating the RDS DB instance
E.Store the database files in an encrypted S3 bucket
AnswersC, D

You can use AWS KMS to create a customer managed key and assign it to the RDS instance during creation to encrypt data at rest.

Why this answer

To encrypt data at rest for Amazon RDS for MySQL, encryption must be enabled when creating the DB instance (Option D) and a customer managed key from AWS KMS can be used (Option C). Option A is incorrect because you cannot enable encryption on an existing unencrypted RDS instance; it must be done at creation time. Option B is incorrect because SSL/TLS encrypts data in transit, not at rest.

Option E is incorrect because storing database files in an encrypted S3 bucket does not encrypt the RDS instance; RDS encryption is managed by AWS KMS and is enabled at the instance level.

Practice this question →
21
MCQmedium

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The pipeline must scan container images for vulnerabilities before deploying to Amazon ECS. Which service should the engineer use to perform the vulnerability scan?

A.AWS WAF
B.Amazon ECR image scanning
C.AWS Config
D.Amazon GuardDuty
AnswerB

Amazon ECR image scanning automatically checks container images for known vulnerabilities (CVEs) by integrating with Amazon Inspector. In a CI/CD pipeline, you can invoke a scan after pushing an image to ECR, then retrieve findings via an API and block the deployment if critical vulnerabilities exist. This directly satisfies the requirement to identify known security vulnerabilities in images before they are deployed.

Why this answer

Amazon ECR can scan images for vulnerabilities. Option A is wrong because AWS WAF is a web application firewall. Option C is wrong because AWS Config is for compliance and resource inventory.

Option D is wrong because Amazon GuardDuty is a threat detection service for workloads.

Practice this question →
22
Multi-Selecthard

A security team wants to automatically detect and remediate S3 buckets that are publicly accessible across multiple AWS accounts. Which solution is MOST efficient and scalable? (Choose THREE.)

Select 3 answers
A.Use AWS Trusted Advisor to check for open S3 buckets and send alerts.
B.Apply a service control policy (SCP) to deny s3:PutBucketAcl that makes buckets public.
C.Manually review each account's S3 bucket permissions weekly.
D.Use AWS Config with a managed rule to detect publicly accessible S3 buckets.
E.Use Amazon CloudWatch Events to trigger a Lambda function that remediates non-compliant buckets.
AnswersB, D, E

An SCP attached at the AWS Organizations root or an OU can deny the specific IAM actions that grant public access, such as s3:PutBucketAcl with a condition like s3:x-amz-acl=public-read or s3:PutBucketPolicy. Because SCPs act as a governance boundary across all accounts in the organization, they proactively prevent a bucket from ever becoming public, but they do not remediate existing buckets that are already public, so this is a preventive, not detective, control.

Why this answer

Options B, D, and E are correct. An SCP can centrally deny s3:PutBucketAcl actions that make buckets public, preventing public access across all accounts (B). AWS Config with the managed rule 's3-bucket-public-read-prohibited' can detect publicly accessible buckets across accounts when using an aggregator (D).

CloudWatch Events (now Amazon EventBridge) can trigger a Lambda function to automatically remediate non-compliant buckets, such as applying a bucket policy or ACL change (E). Option A (Trusted Advisor) is per-account and only alerts, not remediates; Option C (manual review) is not scalable for multiple accounts.

Practice this question →
23
MCQmedium

A DevOps engineer needs to securely store database credentials for an application running on EC2. The credentials must be rotated automatically every 30 days. Which solution meets these requirements?

A.Use AWS Secrets Manager to store the credentials and configure automatic rotation with the RDS rotation Lambda blueprint.
B.Store credentials in AWS Systems Manager Parameter Store and use a Lambda function to rotate them.
C.Store credentials in an S3 bucket encrypted with KMS and use S3 Lifecycle policies to rotate the objects.
D.Use IAM roles to grant the EC2 instance access to the database, eliminating the need for credentials.
AnswerA

AWS Secrets Manager is designed for managing database credentials and provides native automatic rotation. Its RDS rotation Lambda blueprint creates a Lambda function that updates the secret and the database user password on a defined schedule, without application changes. The service also tracks secret versions and supports KMS encryption, making it the secure, fully managed choice for this requirement.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It provides a built-in RDS rotation Lambda blueprint that can be configured to rotate credentials every 30 days without custom code. This fully managed rotation capability meets the requirement for automatic, scheduled rotation with minimal operational overhead.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store's ability to store secrets (with SecureString) with the automatic rotation capability, but Parameter Store lacks built-in rotation scheduling and requires custom Lambda code, making Secrets Manager the only fully managed solution for automatic credential rotation.

How to eliminate wrong answers

Option B is wrong because AWS Systems Manager Parameter Store does not natively support automatic rotation of credentials; while you can use a Lambda function to rotate them, this requires custom development and lacks the built-in rotation scheduling and integration with RDS that Secrets Manager provides. Option C is wrong because S3 Lifecycle policies are designed for object expiration and transition, not for rotating credential values; they cannot update the content of an object or trigger a credential change. Option D is wrong because IAM roles grant permissions to AWS services, not to databases; while IAM database authentication is supported for RDS (using an auth token), it eliminates the need for static credentials but does not involve rotating stored credentials every 30 days, and the question explicitly requires storing and rotating credentials.

Practice this question →
24
MCQmedium

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. What is the most likely cause?

A.The Lambda function's execution role lacks the required IAM permissions.
B.The Lambda function is not configured to access the VPC where the RDS instance resides.
C.The secret rotation schedule is set to less than 24 hours.
D.The Lambda function does not have permission to access the S3 bucket.
AnswerB

For the rotation function to update credentials on RDS, it must be deployed inside the same VPC or have a route to it; if the Lambda function lacks VPC configuration, its ENI never gets a private IP in the RDS subnet. Each invocation then tries to open a socket to the database but has no network path, so it consumes the entire configured timeout and Secrets Manager reports rotation as failed. Merely granting IAM permissions for secretsmanager and RDS does not create network connectivity, so this is the root cause when the error is consistently a timeout rather than an access-denied.

Why this answer

The most likely cause of the timeout error is that the Lambda function is not configured to access the VPC where the RDS instance resides. When Secrets Manager rotates a secret for an RDS database, the rotation Lambda function must connect to the database to update the credentials. If the Lambda function is not attached to the same VPC (or a VPC with proper routing and security group rules), it cannot reach the RDS instance, causing network connection attempts to hang until the function times out.

Exam trap

The trap here is that candidates often confuse IAM permission errors (which produce immediate failures) with network connectivity issues (which cause timeouts), leading them to incorrectly select the IAM role option when the symptom is a timeout rather than an access denied error.

How to eliminate wrong answers

Option A is wrong because IAM permission issues typically result in an access denied error, not a timeout; the Lambda function would fail immediately with a 403 or similar, not hang until the timeout limit. Option C is wrong because the rotation schedule (e.g., every 24 hours or less) does not cause individual rotation executions to timeout; the schedule only controls how often rotation is triggered, not the duration of the Lambda invocation. Option D is wrong because Secrets Manager rotation for RDS does not require S3 bucket access; the Lambda function only needs network connectivity to the database and permissions to call Secrets Manager APIs, not S3.

Practice this question →
25
MCQeasy

A developer wants to grant an EC2 instance read-only access to a specific S3 bucket. Which AWS mechanism should they use to securely provide credentials to the instance?

A.Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the AMI.
B.Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.
C.Store AWS access keys in the EC2 user data script.
D.Retrieve the credentials from AWS Systems Manager Parameter Store using a custom script.
AnswerB

An IAM role attached as an instance profile is the AWS-recommended mechanism because the EC2 instance automatically assumes the role through the instance metadata service (IMDS), receiving temporary credentials from AWS STS that are valid for a limited duration and refreshed automatically by the SDK or CLI. This eliminates the need to store or manage long-lived access keys while letting you scope the role with a narrowly defined read-only policy, such as allowing only s3:GetObject or ec2:DescribeActions. The instance profile acts as the container for the role, and the per-instance trust policy ensures only instances with that profile can use the role, giving centralized control, easy revocation, and cross-account access when needed.

Why this answer

IAM roles with instance profiles provide temporary, automatically rotated credentials to EC2 instances via the AWS STS service. This eliminates the need to hardcode or store long-term access keys on the instance, adhering to the principle of least privilege and improving security posture.

Exam trap

The trap here is that candidates may think storing credentials in user data or an AMI is acceptable for automation, but the exam emphasizes that any static, long-term credentials on an instance are insecure and violate AWS best practices, whereas IAM roles provide secure, temporary, and automatically rotated credentials.

How to eliminate wrong answers

Option A is wrong because embedding AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in an AMI creates static, long-term credentials that are difficult to rotate, can be exposed if the AMI is shared or copied, and violate security best practices. Option C is wrong because storing access keys in EC2 user data is insecure—user data is visible to anyone with access to the instance metadata (e.g., via http://169.254.169.254/latest/user-data) and keys are not automatically rotated. Option D is wrong because while Systems Manager Parameter Store can store credentials, it requires the instance to have an IAM role or static keys to retrieve them, and it does not natively provide automatic credential rotation or direct integration with EC2's credential provider chain; a custom script adds complexity and potential security gaps.

Practice this question →
26
MCQeasy

A company wants to centrally manage user access to multiple AWS accounts using federated identity. Which AWS service should be used to create a single sign-on (SSO) solution?

A.AWS IAM Identity Center (AWS SSO)
B.AWS Organizations
C.AWS Directory Service for Microsoft Active Directory
D.Amazon Cognito
AnswerA

AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is purpose-built to centrally manage workforce user access and single sign-on across multiple AWS accounts, business applications, and SAML 2.0-enabled apps. It lets you define permission sets that map users or groups to IAM roles in different accounts, and it integrates with identity providers like Active Directory or Okta. This directly addresses the requirement to centrally manage user access to multiple AWS accounts with SSO.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is purpose-built to centrally manage user access and permissions across multiple AWS accounts and applications from a single place. It allows you to create or connect your existing identity source (e.g., Active Directory, Okta, Azure AD) and then define fine-grained permission sets that map users or groups to specific roles in each account, enabling a true single sign-on (SSO) experience without needing to create IAM users in every account.

Exam trap

The trap here is that candidates often confuse AWS Organizations (which manages accounts and policies) with IAM Identity Center (which manages user identities and SSO), or they think that Directory Service alone provides SSO across accounts, when in fact it only provides the directory backend and requires an additional federation service like IAM Identity Center to bridge authentication to multiple AWS accounts.

How to eliminate wrong answers

Option B (AWS Organizations) is wrong because it provides centralized governance and policy management for multiple AWS accounts (e.g., via Service Control Policies), but it does not handle user authentication or SSO; it is a prerequisite for using IAM Identity Center but not the SSO solution itself. Option C (AWS Directory Service for Microsoft Active Directory) is wrong because it is a managed Microsoft AD directory service that can serve as an identity source, but it does not natively provide the multi-account permission management or SSO portal; you would still need IAM Identity Center to federate access across accounts. Option D (Amazon Cognito) is wrong because it is designed for customer-facing identity and access management for web and mobile applications, not for managing workforce access to AWS accounts or providing SSO across multiple AWS accounts.

Practice this question →
27
MCQhard

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every 365 days. Which type of KMS key should be used?

A.AWS owned key
B.Custom key store backed by CloudHSM
C.Customer managed key (CMK)
D.AWS managed key (aws/s3)
AnswerC

Customer managed keys allow you to enable automatic rotation with a customizable period (default 365 days).

Why this answer

AWS managed keys (aws/s3) are automatically rotated every year (365 days). Customer managed keys allow you to set a custom rotation period (any length between 90 days and 10 years) but require enabling rotation. The key is that aws/s3 keys rotate automatically without any configuration.

However, the question says 'all encryption keys' and 'every 365 days' - both options can achieve that, but aws/s3 keys are automatically rotated, while customer managed keys need rotation enabled. The best practice is to use the most appropriate. But note: customer managed keys can be rotated automatically if you enable it.

The question might be ambiguous, but typical exam scenario: use customer managed keys for more control. However, the security team requires automatic rotation; both can do it. The nuance: customer managed keys have a rotation period that you can set, but the default is 365 days when you enable rotation.

So both work. But the question says 'which type' - likely they want customer managed because it allows you to control the policy. However, aws/s3 keys are automatically rotated and cannot be customized.

Since the requirement is 'every 365 days', which is the default for both, but aws/s3 keys are already rotated on that schedule. I think the answer is 'Customer managed key' because it's a key you own and have control over the rotation policy. Actually, aws/s3 keys are rotated annually, but you cannot view or manage them.

For compliance, you might need to control the key. So I'll go with customer managed key.

Practice this question →
28
MCQeasy

Refer to the exhibit. This S3 bucket policy allows the root user of account 111122223333 to perform which actions?

A.Change the bucket policy
B.Delete objects from the bucket
C.Read and write objects in the bucket
D.List objects in the bucket
AnswerC

This policy grants the root principal s3:GetObject and s3:PutObject actions on the arn:aws:s3:::bucket/* resource. s3:GetObject allows downloading an object's data and metadata, while s3:PutObject allows uploading a new object or overwriting an existing one. Together, these actions explicitly authorize reading and writing objects inside the bucket, which is exactly what the question asks — making this the correct option.

Why this answer

The policy grants s3:GetObject and s3:PutObject to the root user of the specified account. It does not grant other actions. The resource is objects under my-bucket.

The principal is the root user of the other account.

Practice this question →
29
MCQmedium

A company is deploying a web application on AWS and needs to ensure that all traffic to the application is encrypted in transit. The application runs behind an Application Load Balancer (ALB). Which configuration should be used to enforce HTTPS-only access?

A.Configure the web server on the EC2 instances to only respond to HTTPS requests.
B.Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.
C.Configure the security group of the ALB to only allow inbound HTTPS traffic.
D.Use AWS CloudFront with a custom SSL certificate and set the viewer protocol policy to Redirect HTTP to HTTPS.
AnswerB

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS. This is the correct pattern because ALB listeners combine a protocol/port with rule actions: the HTTP (port 80) listener can have a rule that returns a 301/302 redirect to the same path on the HTTPS listener (port 443). This enforces HTTPS at the access point, automatically upgrades clients, and leaves web servers free to handle only HTTP/HTTPS as needed, typically with TLS terminated at the ALB.

Why this answer

An ALB can be configured with an HTTPS listener and a redirect rule that sends HTTP traffic to HTTPS, enforcing encrypted transit at the load balancer level. Option A is incorrect because configuring the web server to only respond to HTTPS does not prevent HTTP traffic from reaching the ALB; the ALB would still accept HTTP. Option C is incorrect because security groups filter traffic based on ports and IP addresses but cannot redirect HTTP to HTTPS; they only allow or deny traffic.

Option D is incorrect because while CloudFront can redirect HTTP to HTTPS, the question asks for a configuration on the ALB itself, not an additional service.

Practice this question →
30
MCQmedium

A company requires that all access to their S3 buckets be encrypted in transit. Which configuration achieves this?

A.Use CloudFront with the bucket as origin and enforce HTTPS only between viewer and CloudFront.
B.Enable default encryption on the bucket.
C.Use a bucket policy that denies requests when aws:SecureTransport is false.
D.Set the bucket policy to require SSE-KMS.
AnswerC

Correctly enforces HTTPS by denying non-secure transport.

Why this answer

Using a bucket policy with a condition that denies requests when `aws:SecureTransport` is `false` explicitly enforces encryption in transit for all access to the S3 bucket. This policy ensures that any HTTP (non-TLS) request is denied, while HTTPS requests are allowed, meeting the requirement that all access be encrypted in transit.

Exam trap

The trap here is confusing encryption in transit with encryption at rest; candidates often pick options like default encryption or SSE-KMS, which only address data at rest, not the requirement for HTTPS enforcement.

How to eliminate wrong answers

Option A is wrong because it only enforces HTTPS between the viewer and CloudFront, but the connection between CloudFront and the S3 origin can still be HTTP unless an additional policy or setting enforces HTTPS there, leaving a gap in transit encryption. Option B is wrong because default encryption on the bucket only encrypts data at rest (server-side encryption), not in transit; it does not enforce HTTPS for client connections. Option D is wrong because requiring SSE-KMS enforces encryption at rest using AWS KMS keys, but it does not control whether the data is transmitted over HTTPS or HTTP; transit encryption is a separate concern.

Practice this question →
31
MCQeasy

A DevOps engineer must ensure that all API calls in an AWS account are logged for compliance. The logs should be stored in an S3 bucket with server-side encryption enabled. Which two services should be used together to meet these requirements?

A.AWS CloudTrail and Amazon CloudWatch Logs
B.AWS CloudTrail and Amazon S3
C.Amazon VPC Flow Logs and Amazon S3
D.AWS Config and AWS CloudTrail
AnswerB

CloudTrail logs API calls and delivers to S3, which supports server-side encryption.

Why this answer

AWS CloudTrail logs all API calls in the account and can deliver these logs to an S3 bucket, where server-side encryption (SSE) can be enabled for compliance. Option A (AWS CloudTrail and Amazon CloudWatch Logs) can capture API calls, but the requirement is to store logs in an S3 bucket with encryption, not CloudWatch Logs. Option C (Amazon VPC Flow Logs and Amazon S3) captures network traffic, not API calls.

Option D (AWS Config and AWS CloudTrail) includes AWS Config, which tracks resource configuration changes, not API calls; CloudTrail alone suffices for API logging, but Config is not needed for this requirement.

Practice this question →
32
Multi-Selecthard

A security audit reveals that an S3 bucket contains objects that are publicly accessible. The DevOps engineer must prevent any future public access to the bucket and all objects within it. Which THREE actions should the engineer take? (Choose THREE.)

Select 3 answers
A.Enable Block Public Access settings on the bucket.
B.Disable object ACLs on the bucket.
C.Remove any bucket policy that grants public read access.
D.Apply an SCP that denies s3:PutBucketPolicy that would make objects public.
E.Enable S3 server access logging.
AnswersA, C, D

Enabling Block Public Access (BPA) on the bucket is the correct immediate remediation because it applies four distinct settings—BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets—that override all existing and future public access grants, including those from object ACLs, bucket policies, and access point policies. This is the most direct and comprehensive way to seal the bucket at the resource level until a full audit can be completed, and it prevents accidental re-publication through any subsequent misconfiguration.

Why this answer

Enabling block public access settings on the bucket prevents any future public access, including through ACLs or bucket policies. Option C is correct because removing any bucket policy that grants public read access eliminates one potential vector for public access. Option D is correct because applying an SCP that denies s3:PutBucketPolicy actions that would make objects public ensures that no account in the organization can create a policy that grants public access.

Option B is incorrect because disabling object ACLs only removes one method of granting public access; bucket policies can still allow public access. Option E is incorrect because enabling server access logging helps with auditing but does not prevent public access.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Security and Compliance questions.

Start 20-question session