Courseiva

CCNA Security and Compliance Questions

42 questions · Security and Compliance · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

A SysOps administrator needs to restrict access to an S3 bucket so that only users from the corporate network IP range (203.0.113.0/24) can read objects. Which TWO elements are required to implement this? (Choose two.)

Select 2 answers
A.An IAM policy that allows s3:GetObject from the corporate IP
B.Amazon CloudFront distribution with an origin access identity
C.The S3 endpoint URL (s3.amazonaws.com) accessible from the corporate network
D.An S3 bucket policy with a condition that uses aws:SourceIp
E.A VPC gateway endpoint for S3
AnswersC, D

For a bucket policy with an aws:SourceIp condition to take effect, the S3 REST endpoint (s3.amazonaws.com) must be reachable from the corporate network. If outbound firewall rules, proxy settings, or DNS resolution prevent access to this endpoint, the request will never reach S3, and the policy condition will never be evaluated. Ensuring endpoint connectivity is therefore a necessary prerequisite for the IP-based access restriction to work as intended.

Why this answer

To restrict access to an S3 bucket based on IP range, two elements are required: an S3 bucket policy with a condition using aws:SourceIp to allow s3:GetObject only from the corporate IP range (203.0.113.0/24), and the S3 endpoint (s3.amazonaws.com) must be reachable from the corporate network (typically over the internet). Option A is incorrect because an IAM policy by itself does not restrict bucket-level access; a bucket policy is needed. Option B is not required as CloudFront is not necessary for IP-based restrictions.

Option E is incorrect because a VPC endpoint is used for private connectivity within a VPC, not for restricting access from an external IP range.

Practice this question →
2
MCQeasy

A company stores sensitive data in an RDS database. Which AWS service should be used to encrypt the database at rest?

A.AWS Certificate Manager (ACM)
B.AWS Identity and Access Management (IAM)
C.AWS Key Management Service (KMS)
D.AWS CloudHSM
AnswerC

AWS Key Management Service (KMS) is a managed service for creating and controlling customer master keys (CMKs) that encrypt data at rest across AWS services, including Amazon RDS. When you enable encryption on an RDS instance, RDS uses a KMS CMK to encrypt the underlying EBS storage, automated backups, snapshots, and read replicas, with encryption handled transparently by the service. KMS is the only service among these options that natively integrates with RDS for at-rest encryption, making it the correct choice.

Why this answer

AWS Key Management Service (KMS) provides encryption keys that can be used to enable encryption at rest for Amazon RDS databases. Option A is incorrect because AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates, not for encryption at rest. Option B is incorrect because AWS Identity and Access Management (IAM) manages user identities and permissions, not encryption keys.

Option D is incorrect because AWS CloudHSM provides hardware security modules but is not the primary service used for RDS encryption; KMS is the simpler and recommended service for RDS encryption.

Practice this question →
3
MCQmedium

A company requires that all users in an AWS account must authenticate with multi-factor authentication (MFA) before they can perform any actions on Amazon EC2 instances. The SysOps administrator needs to implement this requirement using IAM policies. Which IAM policy condition key should be used to enforce MFA?

A.aws:SourceIp
B.aws:MultiFactorAuthPresent
C.aws:RequestedRegion
D.iam:PassedToService
AnswerB

This condition key checks if the requester authenticated with an MFA device. It can be used to require MFA for specific actions.

Why this answer

The `aws:MultiFactorAuthPresent` condition key checks whether the user authenticated using a valid MFA device before making the API request. By setting this condition to `true` in an IAM policy, you can enforce that all actions on EC2 instances require MFA authentication, meeting the company's requirement.

Exam trap

The trap here is that candidates often confuse `aws:MultiFactorAuthPresent` with `aws:SourceIp` or `iam:PassedToService`, thinking IP-based or role-passing conditions can enforce MFA, but only the MFA-specific condition key directly checks authentication strength.

How to eliminate wrong answers

Option A is wrong because `aws:SourceIp` restricts access based on the source IP address, not MFA status. Option C is wrong because `aws:RequestedRegion` limits actions to specific AWS regions, not MFA enforcement. Option D is wrong because `iam:PassedToService` controls which roles can be passed to AWS services, not MFA authentication.

Practice this question →
4
Multi-Selecteasy

A company wants to ensure that their Amazon S3 bucket policy only allows access from a specific VPC endpoint. Which TWO condition keys can be used in the bucket policy? (Choose TWO.)

Select 2 answers
A.s3:SourceVpce
B.aws:SourceIp
C.aws:SourceVpc
D.ec2:Vpc
E.aws:SourceVpce
AnswersC, E

aws:SourceVpc is the correct condition key because it allows S3 bucket policies to restrict access to requests originating from a specific VPC by using the VPC ID (e.g., vpc-0abc123). It ensures that only EC2 instances, Lambda functions, or other resources within that VPC can access the bucket, without needing to know the individual IP addresses.

Why this answer

The correct condition keys are 'aws:SourceVpc' (option C) and 'aws:SourceVpce' (option E). 'aws:SourceVpc' restricts access to all VPC endpoints within a specified VPC, while 'aws:SourceVpce' restricts access to a specific VPC endpoint. Option A 's3:SourceVpce' is not a valid condition key. Option B 'aws:SourceIp' is used for IP address restrictions, not VPC endpoints.

Option D 'ec2:Vpc' is not applicable in S3 bucket policies.

Practice this question →
5
MCQeasy

A company wants to securely store secrets such as database credentials and API keys used by applications running on Amazon EC2. Which AWS service should be used to manage and rotate these secrets automatically?

A.AWS Identity and Access Management (IAM)
B.AWS Secrets Manager
C.AWS Key Management Service (KMS)
D.AWS Systems Manager Parameter Store
AnswerB

AWS Secrets Manager is a purpose-built service for securely storing and managing database credentials, API keys, and other secrets throughout their lifecycle. It natively supports automatic rotation, either through built-in integration with AWS services like RDS, Redshift, and DocumentDB, or via custom AWS Lambda rotations. Unlike generic parameter storage, Secrets Manager enforces fine-grained IAM access policies and provides audit trails via AWS CloudTrail, making it the recommended choice for production secrets that require rotation and regulated access.

Why this answer

AWS Secrets Manager is designed to manage secrets, including automatic rotation. Option A is wrong because IAM is for AWS user credentials and permissions, not for storing application secrets. Option C is wrong because AWS KMS is for encryption keys, not secrets management.

Option D is wrong because AWS Systems Manager Parameter Store can store secrets but does not support automatic rotation natively (requires custom Lambda).

Practice this question →
6
Multi-Selecthard

A company's security team requires that all API calls to AWS services are encrypted in transit using TLS 1.2 or higher. Which TWO actions should be taken to enforce this?

Select 2 answers
A.Enable AWS CloudTrail to log all API calls.
B.Configure EC2 security groups to only allow HTTPS traffic.
C.Use AWS CloudTrail to monitor for API calls using TLS 1.0 and generate alerts.
D.Create an IAM policy that denies access unless the request uses TLS 1.2.
E.Create an SCP that denies AWS API calls using protocols lower than TLS 1.2.
AnswersC, E

CloudTrail can log TLS version; monitoring and alerting can detect non-compliance.

Why this answer

Options C and E are correct. Using AWS CloudTrail to monitor for API calls using TLS 1.0 allows the security team to detect non-compliant requests and generate alerts. Creating an SCP that denies AWS API calls using protocols lower than TLS 1.2 enforces encryption in transit at the organizational level.

Option A is incorrect because CloudTrail logging alone does not enforce encryption; it only records events. Option B is incorrect because EC2 security groups control network traffic to instances, not API calls to AWS services. Option D is incorrect because IAM policies can require HTTPS via the aws:SecureTransport condition, but cannot enforce a specific TLS version like 1.2.

Practice this question →
7
Multi-Selectmedium

A company needs to restrict access to an S3 bucket so that only users from a specific VPC can read objects. Which THREE configurations are required?

Select 3 answers
A.Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.
B.Update the route table in the VPC to route S3 traffic through the VPC endpoint.
C.Create IAM users and assign them permissions to access the bucket.
D.Create a VPC endpoint for S3 in the specified VPC.
E.Attach a security group to the S3 bucket.
AnswersA, B, D

This bucket policy explicitly denies all S3 access unless the vpc:SourceVpce condition matches the specified VPC endpoint (e.g., vpce-12345678). You must include both an Allow statement for the principal (such as the account root) and a Deny statement with StringNotEquals to prevent all other network paths. Requests from the VPC endpoint will carry the vpcSourceVpce value automatically, so only traffic routed through that endpoint is permitted.

Why this answer

Options A, B, and D are correct. A bucket policy with a condition for vpc:SourceVpce, a VPC endpoint for S3, and route table updates are required. Option C is wrong because IAM users alone do not restrict access by VPC; a bucket policy with a VPC condition is needed.

Option E is wrong because security groups cannot be attached to S3 buckets as they are not network interfaces.

Practice this question →
8
Multi-Selecthard

A company is using AWS KMS to encrypt data. The security team wants to ensure that a specific IAM role can use a KMS key, but only when the request comes from a specific VPC. Which THREE conditions should be included in the KMS key policy? (Choose three.)

Select 2 answers
A.aws:SourceSubnet equals the subnet ID.
B.aws:SourceArn equals the IAM role ARN.
C.aws:SourceVpc equals the VPC ID.
D.aws:SourceIp equals the VPC CIDR.
E.aws:SourceVpce equals the VPC endpoint ID.
AnswersC, E

Restricts to VPC.

Why this answer

The aws:SourceArn condition key is used to restrict access based on the ARN of the resource that is the source of the request, such as an S3 bucket or Lambda function; it is not appropriate for restricting access to a specific IAM role ARN. Therefore, option B is incorrect. Option C is correct: aws:SourceVpc restricts use to requests originating from a specific VPC.

Option E is correct: aws:SourceVpce restricts use to requests coming through a specific VPC endpoint. Option A is incorrect because aws:SourceSubnet is not a valid condition key. Option D is incorrect because aws:SourceIp restricts based on IP address, which does not reliably correspond to a VPC (for example, traffic through a NAT gateway would appear from the NAT’s IP).

Practice this question →
9
Drag & Dropmedium

Drag and drop the steps to create an Amazon CloudWatch alarm that sends an email notification when CPU utilization exceeds 90% into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First set up the SNS topic, then create the alarm selecting the metric, define the condition, and finally add the notification action.

Practice this question →
10
MCQmedium

A SysOps administrator notices that an EC2 instance running a web server is receiving unexpected traffic from an IP address that is known to be malicious. The administrator wants to block this IP address at the instance level. Which solution should be used?

A.Modify the network ACL to deny traffic from that IP.
B.Use AWS WAF to block the IP address.
C.Install a third-party firewall on the instance.
D.Update the security group to deny traffic from that IP.
AnswerC

A third-party firewall installed on the instance, such as iptables or a host-based security agent, can filter inbound traffic based on source IP at the operating system level before the application processes it. This is the only option that fulfills the 'instance level' requirement, as it controls traffic directly on that specific EC2 instance regardless of the surrounding subnet or VPC configuration. Security groups cannot explicitly deny, making a host-based firewall the correct solution.

Why this answer

A host-based firewall (such as a third-party firewall installed on the instance) can block traffic from a specific IP address at the instance level. Option A is incorrect because network ACLs operate at the subnet level, not the instance level. Option B is incorrect because AWS WAF is designed to filter web requests at the application layer and is typically associated with load balancers or CloudFront, not directly with an individual EC2 instance.

Option D is incorrect because security groups do not support deny rules; they only allow traffic, so they cannot be used to block specific IPs.

Exam trap

The question specifies 'at the instance level,' which disqualifies subnet-level solutions like network ACLs. Candidates often overlook this detail and choose NACLs because they support explicit deny.

Practice this question →
11
MCQmedium

Account A owns an S3 bucket containing shared artifacts. Account B needs to read objects from the bucket. The Account A team wants to grant access without creating IAM users, sharing access keys, or creating a role in Account A that Account B assumes. How should the bucket be configured to allow Account B's IAM roles to read objects?

A.Add an S3 bucket policy on Account A's bucket with Principal set to Account B's account ID and s3:GetObject permission; ensure Account B's roles have s3:GetObject in their identity policies
B.Create an IAM role in Account A with s3:GetObject permission and a trust policy allowing Account B's roles to assume it
C.Generate a presigned URL for each object in Account A and share the URLs with Account B's services
D.Enable S3 Access Points on the bucket and create an access point that allows Account B's VPC to connect via PrivateLink
AnswerA

Cross-account S3 access requires both a resource-based policy (bucket policy) that grants Account B access, and identity-based policies in Account B that allow the action. The bucket policy's Principal field specifies Account B's account root ARN or specific role ARNs. When both sides allow, the call succeeds without any role chaining or credential sharing.

Why this answer

It uses an S3 bucket policy with a Principal set to Account B's account ID, which grants cross-account access to all IAM principals (users and roles) in Account B. Account B's IAM roles must also have an identity policy that allows s3:GetObject, ensuring that the effective permissions require both the bucket policy and the role's policy to allow the action. This approach avoids creating IAM users, sharing access keys, or setting up a role in Account A for Account B to assume.

Exam trap

The SOA-C02 exam often tests the misconception that a bucket policy with a cross-account Principal automatically grants access to all IAM roles in that account, but candidates forget that the roles must also have an explicit allow in their identity policies for the action to succeed.

How to eliminate wrong answers

Option B is wrong because it requires creating a role in Account A that Account B assumes, which violates the requirement to avoid such a setup. Option C is wrong because presigned URLs grant temporary access but require generating and sharing a URL for each object, which is not a scalable or secure method for ongoing access by IAM roles, and it does not leverage IAM policies for authorization. Option D is wrong because S3 Access Points with VPC PrivateLink restrict access to a specific VPC, but they do not inherently grant cross-account access to IAM roles in Account B without additional bucket policies or resource policies, and the question does not specify VPC-based access.

Practice this question →
12
Multi-Selecthard

A SysOps administrator needs to audit all changes to IAM resources in their AWS account. Which THREE AWS services can be used together to achieve this? (Choose THREE.)

Select 3 answers
A.AWS CloudTrail
B.Amazon GuardDuty
C.AWS Config
D.AWS Trusted Advisor
E.Amazon CloudWatch Logs
AnswersA, C, E

Records IAM API calls.

Why this answer

AWS CloudTrail records all IAM API calls, providing a detailed audit trail of changes. Option C is correct because AWS Config tracks changes to IAM resource configurations and can evaluate them against rules. Option E is correct because Amazon CloudWatch Logs can store and monitor CloudTrail logs, enabling alerting on specific IAM changes.

Option B is wrong because Amazon GuardDuty is for threat detection, not auditing configuration changes. Option D is wrong because AWS Trusted Advisor provides best-practice checks but does not log or track changes to IAM resources.

Practice this question →
13
MCQhard

A company uses AWS Organizations and wants to restrict access to S3 buckets based on project tags. The security policy requires that users in the 'DataScientists' group can only access S3 buckets that have the tag 'Project: DataEngineering'. Which IAM policy condition key should the SysOps administrator use in a customer managed policy to enforce this restriction?

A.aws:ResourceTag
B.s3:ExistingObjectTag
C.s3:ResourceTag
D.iam:ResourceTag
AnswerA

The aws:ResourceTag condition key allows you to control access based on tags attached to the resource being accessed (e.g., S3 bucket tag). You can use it in the 'Condition' element of an IAM policy to enforce the tag requirement.

Why this answer

The `aws:ResourceTag` condition key is used in IAM policies to control access based on the tags attached to the AWS resource (in this case, an S3 bucket). By specifying `aws:ResourceTag/Project` with a value of `DataEngineering`, the policy ensures that only S3 buckets with that exact tag are accessible to the 'DataScientists' group. This key is evaluated against the resource's tags at the time of the request, making it the appropriate choice for tag-based resource restrictions.

Exam trap

The trap here is that candidates often confuse `aws:ResourceTag` with service-specific keys like `s3:ExistingObjectTag`, mistakenly applying object-level conditions to bucket-level restrictions, or they assume `s3:ResourceTag` exists as a valid key when it does not.

How to eliminate wrong answers

Option B is wrong because `s3:ExistingObjectTag` is used to condition access based on tags on individual objects within an S3 bucket, not on the bucket itself, and thus cannot restrict access to buckets based on bucket-level tags. Option C is wrong because `s3:ResourceTag` is not a valid IAM condition key; AWS uses `aws:ResourceTag` for resource-level tags across services, and S3-specific condition keys like `s3:ExistingObjectTag` or `s3:RequestObjectTag` are for object-level operations. Option D is wrong because `iam:ResourceTag` is specific to IAM resources (such as users, roles, or policies) and cannot be used to restrict access to S3 buckets based on bucket tags.

Practice this question →
14
MCQmedium

A company uses AWS Key Management Service (KMS) to encrypt data in Amazon S3. They want to ensure that the KMS key can only be used from within a specific VPC. How can this be accomplished?

A.Add a condition in the S3 bucket policy to allow only requests from the VPC.
B.Add a condition in the KMS key policy using 'aws:SourceVpc' to restrict usage to the VPC.
C.Use an IAM policy with a condition that requires the request to come from the VPC.
D.Configure a network ACL that blocks all traffic to KMS except from the VPC.
AnswerB

KMS key policy supports 'aws:SourceVpc' condition.

Why this answer

A KMS key policy can use the 'aws:SourceVpc' condition key to restrict usage of the key to requests originating from a specific VPC. Option A is incorrect because S3 bucket policies cannot directly restrict KMS key usage; they can only control access to S3 objects. Option C is incorrect because IAM policies can include conditions based on source VPC for certain services, but for KMS actions, the condition must be in the key policy itself, not an IAM policy.

Option D is incorrect because network ACLs operate at the subnet level and control network traffic, not API calls to KMS; they cannot restrict access to the KMS service.

Practice this question →
15
MCQmedium

A company's security policy requires that all Amazon S3 buckets must be encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). A SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and automatically apply SSE-S3 encryption. The solution should leverage AWS managed services and minimize custom code. Which combination of AWS services should be used?

A.AWS Config and AWS Lambda
B.Amazon GuardDuty and AWS Lambda
C.AWS CloudTrail and Amazon EventBridge
D.Amazon Macie and AWS Step Functions
AnswerA

AWS Config continuously evaluates S3 buckets against the managed rule for encryption. Non-compliant buckets can trigger a remediation action via an AWS Lambda function that applies SSE-S3 configuration. This minimizes custom code and uses managed services.

Why this answer

AWS Config can evaluate S3 bucket configurations against a managed rule (s3-bucket-server-side-encryption-enabled) to detect non-compliant buckets. When a non-compliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule or a custom remediation action to automatically enable SSE-S3 encryption on the bucket. This combination uses managed services and minimizes custom code, meeting the security policy requirement.

Exam trap

The trap here is that candidates may confuse AWS Config's compliance evaluation with GuardDuty's threat detection or Macie's data classification, leading them to choose a service that cannot detect or remediate encryption settings.

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for checking or enforcing S3 bucket encryption configurations. Option C is wrong because AWS CloudTrail records API activity but does not evaluate resource compliance or trigger automated remediation; Amazon EventBridge can route events but requires a separate service like AWS Config to detect non-compliance. Option D is wrong because Amazon Macie is a data discovery and protection service that uses machine learning to identify sensitive data, not to detect or enforce encryption settings; AWS Step Functions is an orchestration service that would require custom code to implement the detection logic.

Practice this question →
16
MCQhard

A company uses IAM roles to grant EC2 instances access to S3 buckets. After a recent security audit, the SysOps administrator must ensure that only instances with a specific tag (Environment=Production) can assume the role. How can this be achieved?

A.Create a new IAM role for each instance and attach the tag.
B.Use a service control policy (SCP) to deny the ec2:AssumeRole action for instances without the required tag.
C.Modify the instance profile to include the tag requirement.
D.Add a condition in the role's trust policy that checks for the instance's tag using the aws:ResourceTag condition key.
AnswerD

The trust policy can evaluate the instance's tags at the time of AssumeRole.

Why this answer

IAM role trust policies can use the aws:ResourceTag condition key to restrict which EC2 instances (based on their tags) can assume the role. Option A is wrong because tags are not automatically included in the session; the trust policy must explicitly check tags. Option B is wrong because SCPs apply to accounts, not instances.

Option C is wrong because instance profiles cannot be modified to check tags.

Practice this question →
17
MCQmedium

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

A.AWS Config with a custom rule and AWS Lambda
B.AWS CloudTrail and Amazon CloudWatch Events
C.AWS Service Catalog and AWS Organizations
D.Amazon Inspector and AWS Systems Manager
AnswerA

A custom AWS Config rule can evaluate EC2 instances when they are created (configuration change trigger) and invoke an AWS Lambda function to terminate instances lacking the required tag or having an invalid value. This provides continuous compliance enforcement.

Why this answer

AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Exam trap

The trap here is that candidates may think CloudTrail and CloudWatch Events alone can enforce tag compliance, but they lack the evaluation logic and automated remediation that AWS Config with a custom Lambda rule provides.

How to eliminate wrong answers

Option B is wrong because AWS CloudTrail records API calls and CloudWatch Events can trigger on those events, but they lack native tag validation logic; you would still need a Lambda function to evaluate tag values and terminate instances, making this an incomplete solution. Option C is wrong because AWS Service Catalog enforces compliance at provisioning time through predefined products, but it cannot retroactively terminate instances launched outside the catalog or enforce tag compliance on existing instances. Option D is wrong because Amazon Inspector is a vulnerability assessment service and AWS Systems Manager is for operational management; neither service has the capability to evaluate tags or terminate instances based on tag compliance.

Practice this question →
18
MCQeasy

Developers are allowed to create IAM roles for their Lambda functions. However, the security team is concerned that developers could create roles with Administrator access, granting Lambda functions more permissions than the developers themselves have. What IAM feature prevents privilege escalation in this scenario?

A.Attach a permission boundary to each developer IAM user that limits them to creating roles with only the permissions they are allowed to grant
B.Enable IAM Access Analyzer to detect when developers create overly permissive roles
C.Require MFA for all IAM API calls so developers must re-authenticate before creating roles
D.Enable CloudTrail logging for all IAM API calls and set up a CloudWatch alarm for iam:CreateRole events
AnswerA

The permission boundary on the developer prevents them from passing permissions they do not have (iam:PassRole with a role whose boundary exceeds their own). When combined with an IAM policy that requires any role they create to have the same boundary attached, privilege escalation is prevented systematically.

Why this answer

Permission boundaries are an IAM feature that allow you to set the maximum permissions that an identity-based policy can grant to a principal. By attaching a permission boundary to each developer IAM user that restricts them to creating roles with only the permissions they are allowed to grant, you prevent the developer from creating a Lambda execution role with AdministratorAccess or any other policy that exceeds the boundary. This directly addresses the privilege escalation concern because the boundary acts as a ceiling on the permissions the developer can delegate to the role.

Exam trap

The trap here is that candidates often confuse detective controls (like Access Analyzer, CloudTrail, or alarms) with preventive controls, thinking that monitoring or alerting can stop the action, when only a preventive mechanism like a permission boundary can block the creation of an overly permissive role at the time of the API call.

How to eliminate wrong answers

Option B is wrong because IAM Access Analyzer is a post-creation analysis tool that identifies resources shared with external principals; it does not prevent a developer from creating an overly permissive role in the first place. Option C is wrong because requiring MFA for IAM API calls adds an authentication step but does not restrict the permissions that can be assigned to a role; a developer with valid MFA could still create an AdministratorAccess role. Option D is wrong because CloudTrail logging and CloudWatch alarms are detective controls that only alert after the role has been created; they do not prevent the privilege escalation from occurring.

Practice this question →
19
MCQeasy

A company uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. Which configuration step is required?

A.Configure the ALB listener to use HTTPS with a security policy.
B.Configure the target group to use HTTPS protocol and install SSL/TLS certificates on the instances.
C.Place the instances in a private subnet and use a NAT gateway for outbound traffic.
D.Create a security group rule that allows only HTTPS traffic from the ALB to the instances.
AnswerB

This ensures traffic from ALB to instances is encrypted over HTTPS.

Why this answer

Configuring the target group to use the HTTPS protocol ensures that the ALB encrypts traffic to the instances using SSL/TLS. The instances must have valid certificates installed to terminate the HTTPS connection. Option A is incorrect because the ALB listener handles encryption between clients and the ALB, not between the ALB and instances.

Option C is incorrect because placing instances in a private subnet and using a NAT gateway affects outbound internet access, not encryption between the ALB and instances. Option D is incorrect because a security group rule can allow only HTTPS traffic, but it does not enforce encryption; the traffic protocol must also be HTTPS.

Practice this question →
20
Drag & Dropmedium

Drag and drop the steps to configure an Amazon Route 53 failover routing policy into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Create health checks first, then create primary and secondary records with failover types, then test.

Practice this question →
21
MCQhard

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. Which combination of services should the SysOps administrator use to meet this requirement?

A.CloudWatch Logs Insights query on CloudTrail logs with an alarm
B.An AWS Config rule that checks for new access keys and sends an SNS notification
C.A CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification
D.S3 event notifications to an SNS topic
AnswerC

Amazon EventBridge (formerly CloudWatch Events) can consume CloudTrail events as a built-in event source, so a rule with an event pattern tailored to `AWS API Call via CloudTrail` and `eventName` `CreateAccessKey` fires whenever that API is invoked. The rule can target an SNS topic as the action, delivering a near-real-time notification that includes the full event detail such as the IAM user, source IP, and user agent. This is the direct, native mechanism for alerting on specific API calls.

Why this answer

CloudWatch Events (now Amazon EventBridge) can match CloudTrail events (like CreateAccessKey) and trigger an SNS notification. Option A is wrong because CloudWatch Logs Insights is a query tool for analyzing logs, not a real-time alerting mechanism; although metric filters and alarms can be set up, CloudWatch Events provides a more direct solution. Option B is wrong because AWS Config rules evaluate resource configurations and compliance, not real-time API calls.

Option D is wrong because S3 event notifications trigger on object-level events in S3 buckets, not on specific API calls within CloudTrail logs.

Practice this question →
22
MCQmedium

A company uses S3 to store sensitive data. To meet compliance requirements, all S3 buckets must be encrypted at rest. The security team notices that some objects in a bucket are not encrypted. What is the MOST efficient way to enforce encryption for all future objects?

A.Use AWS Config managed rule to identify unencrypted objects and re-upload them manually
B.Use S3 Inventory to list unencrypted objects and apply encryption via S3 Batch Operations
C.Enable default encryption on the bucket using AES-256
D.Create an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption header is not present
AnswerD

Bucket policy enforces encryption at upload time, rejecting unencrypted requests.

Why this answer

A bucket policy that denies PutObject unless the `x-amz-server-side-encryption` header is present enforces encryption at the API level, preventing any unencrypted object from being uploaded. This is the most efficient approach as it proactively blocks non-compliant uploads without requiring post-upload remediation or manual intervention.

Exam trap

The trap here is that candidates confuse default encryption (which is a bucket-level setting that can be overridden by the client) with a bucket policy (which enforces encryption at the request level and cannot be bypassed by the uploader).

How to eliminate wrong answers

Option A is wrong because AWS Config managed rules can detect unencrypted objects but cannot re-upload them; manual re-upload is inefficient and does not prevent future violations. Option B is wrong because S3 Inventory lists objects but S3 Batch Operations apply encryption to existing objects, not to future uploads, and this is a reactive, not proactive, solution. Option C is wrong because enabling default encryption on the bucket applies server-side encryption only when the upload request does not specify encryption headers; a client can still override or omit the header and upload unencrypted objects, bypassing the default.

Practice this question →
23
MCQhard

A company operates a web application behind an Application Load Balancer (ALB). The SysOps administrator needs to block incoming requests from specific geographic locations (countries X and Y) and also enforce a rate limit of 100 requests per IP address per 5-minute window to mitigate DDoS attacks. The solution must be centrally configured and apply to all requests handled by the ALB. Which AWS service should be used to implement these requirements?

A.AWS WAF
B.Amazon CloudFront geo restriction
C.AWS Shield Advanced
D.Security Groups
AnswerA

AWS WAF offers both geo-match conditions to block requests from specific countries and rate-based rules to limit request rates from an IP address. It integrates directly with ALB and provides a single, centrally managed solution.

Why this answer

AWS WAF is the correct service because it provides both geographic (geo-match) blocking and rate-based rules that can be associated directly with an Application Load Balancer. Geo-match conditions allow you to block requests from specific countries (X and Y), while rate-based rules can limit requests to 100 per 5-minute window per source IP. This solution is centrally configured at the ALB level, applying to all incoming requests without requiring additional infrastructure.

Exam trap

The trap here is that candidates often confuse AWS WAF with CloudFront geo restriction or AWS Shield Advanced, not realizing that only WAF provides both geo-blocking and rate-based rules that can be directly associated with an ALB without requiring CloudFront.

How to eliminate wrong answers

Option B (Amazon CloudFront geo restriction) is wrong because CloudFront geo restriction only works when CloudFront is the front-end service, not directly with an ALB; it cannot be applied to an ALB alone and does not support rate limiting. Option C (AWS Shield Advanced) is wrong because while it provides enhanced DDoS protection and cost protection, it does not offer granular geo-blocking or configurable rate-based rules; it is a managed threat protection service, not a web application firewall. Option D (Security Groups) is wrong because security groups operate at the network layer (Layer 3/4) and cannot inspect application-layer attributes like geographic origin or enforce rate limits based on HTTP request counts.

Practice this question →
24
MCQmedium

A company requires that all Amazon S3 buckets in its AWS account must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to detect any bucket that does not have KMS encryption enabled and automatically remediate it by enabling encryption. Which AWS service should be used to implement this automated compliance enforcement?

A.AWS Config
B.AWS CloudTrail
C.Amazon GuardDuty
D.AWS Trusted Advisor
AnswerA

AWS Config can continuously monitor and evaluate S3 bucket configurations. With a managed rule for server-side encryption, it can detect non-compliant buckets. Combined with automatic remediation actions, AWS Config can enable encryption on non-compliant buckets without manual intervention.

Why this answer

AWS Config is the correct service because it can continuously monitor S3 bucket configurations against a desired encryption state using managed rules like 's3-bucket-server-side-encryption-enabled' or custom Lambda rules. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-KMS encryption, enforcing compliance without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Config's detective and remediation capabilities with CloudTrail's logging or Trusted Advisor's advisory-only checks, assuming any 'security' service can enforce compliance, but only AWS Config provides automated remediation via rules and Systems Manager.

How to eliminate wrong answers

Option B is wrong because AWS CloudTrail is a service for auditing API calls and logging activity, not for detecting or remediating configuration drift in real time. Option C is wrong because Amazon GuardDuty is a threat detection service that analyzes DNS, VPC flow logs, and CloudTrail events for malicious activity, not for enforcing encryption policies on S3 buckets. Option D is wrong because AWS Trusted Advisor provides best-practice recommendations and checks for cost optimization, security, and performance, but it cannot automatically remediate non-compliant resources; it only reports findings.

Practice this question →
25
MCQeasy

A company's security policy requires that all IAM user passwords must be at least 12 characters long. The SysOps administrator needs to enforce this requirement across the AWS account. Which action should the administrator take?

A.Create an AWS Config rule to check password length and auto-remediate.
B.Update the IAM account password policy to require a minimum length of 12 characters.
C.Enable AWS CloudTrail to monitor for password changes and alert the administrator.
D.Attach a service control policy (SCP) that denies IAM user creation if the password is less than 12 characters.
AnswerB

The IAM account password policy is the native, preventative control that enforces password requirements at the account level for all IAM users. When you set a minimum length of 12 characters, IAM rejects any password creation or change that does not meet this threshold, ensuring compliance before the password is ever stored. This is the intended mechanism that directly satisfies the security policy requirement.

Why this answer

The IAM account password policy is the native AWS mechanism for enforcing password requirements across all IAM users in an account. By updating this policy to require a minimum length of 12 characters, the administrator ensures that any new or changed password must comply, and existing passwords are not affected until the next change. This is a direct, account-wide setting that requires no additional services or custom logic.

Exam trap

The trap here is that candidates confuse AWS Config (which can detect but not enforce password length at creation time) with the IAM password policy (which is the correct, built-in enforcement mechanism), or they mistakenly think SCPs can inspect password content when they only control API actions at a high level.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can detect noncompliant passwords but cannot directly enforce password length at the point of creation or change; auto-remediation would require a custom Lambda function to modify the password policy, which is unnecessary when the native IAM password policy already exists. Option C is wrong because CloudTrail logs API calls but does not enforce password requirements; it only provides auditing after the fact, which does not prevent users from setting short passwords. Option D is wrong because service control policies (SCPs) apply to AWS Organizations and can restrict IAM user creation actions, but they cannot evaluate or enforce password length at the time of password creation or change; SCPs operate at the API level and lack the granularity to inspect password content.

Practice this question →
26
MCQeasy

A company wants to provide temporary credentials to an application running on an on-premises server so it can access AWS resources. The credentials must be rotated automatically. Which IAM feature should be used?

A.Use an EC2 instance profile and attach it to the on-premises server.
B.Configure a SAML 2.0 identity provider and federate the application.
C.Create an IAM user with programmatic access and share the access key.
D.Use IAM Roles Anywhere with a certificate authority to issue temporary credentials.
AnswerD

IAM Roles Anywhere enables on-premises applications to safely obtain temporary AWS credentials by presenting an X.509 certificate issued by a trusted certificate authority (CA). The service uses the certificate's subject and issuer information to match the workload to an IAM role, then calls AWS STS to return temporary credentials that automatically expire after a configurable duration. This approach eliminates the need for long-term access keys and is the recommended pattern for non-AWS servers or hybrid workloads. It is the only option listed that directly satisfies the company's need for temporary credentials for an on-premises application.

Why this answer

IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers, to assume IAM roles and obtain temporary credentials using X.509 certificates. The credentials are automatically rotated by the service. Option A is wrong because an EC2 instance profile can only be used for EC2 instances, not on-premises servers.

Option B is wrong: SAML 2.0 federation is typically used for federating user identities (e.g., SSO), not for application or machine identities. Option C is wrong because IAM users with programmatic access have long-term access keys that do not rotate automatically.

Practice this question →
27
MCQmedium

A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?

A.Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning
B.Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning
C.Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action
D.Use AWS Service Catalog to enforce versioning on all buckets provisioned through it
AnswerA

AWS Config's s3-bucket-versioning-enabled managed rule continuously evaluates every bucket in the account, including both existing resources and newly created ones. When a bucket is found noncompliant—whether it never had versioning or had it disabled—an automatic remediation action invokes an AWS Systems Manager Automation document (such as AWS-EnableS3BucketVersioning) to enable versioning immediately. This closed-loop approach ensures ongoing compliance without manual effort, and it covers all buckets regardless of how they were created or modified. AWS Config evaluates configuration changes in near real time, making this a truly detective and corrective control.

Why this answer

AWS Config with the managed rule `s3-bucket-versioning-enabled` continuously evaluates S3 buckets against the desired configuration. When a noncompliant bucket is detected, an automatic remediation action can be configured to invoke an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven remediation without manual intervention, ensuring all buckets—including those created outside of AWS Config's initial evaluation—are brought into compliance.

Exam trap

The trap here is that candidates often choose CloudWatch Events + Lambda (Option B) thinking it provides real-time remediation, but they overlook that it only catches new buckets and fails to remediate existing noncompliant buckets or buckets that have versioning disabled after creation, whereas AWS Config provides continuous compliance monitoring and automatic remediation for both new and existing resources.

How to eliminate wrong answers

Option B is wrong because Amazon CloudWatch Events (now Amazon EventBridge) can detect `CreateBucket` API calls, but triggering a Lambda function to enable versioning only remediates buckets at creation time; it does not detect or fix buckets that were created before the rule was enabled or buckets that have versioning disabled after creation. Option C is wrong because AWS CloudTrail monitoring and sending an alert requires manual action by the SysOps administrator, which is not an automatic remediation and does not meet the requirement to automatically remediate. Option D is wrong because AWS Service Catalog only enforces versioning on buckets provisioned through it; buckets created directly via the S3 console, CLI, or SDK bypass Service Catalog and remain noncompliant.

Practice this question →
28
MCQmedium

Refer to the exhibit. An IAM user has this policy attached. What is the effect when the user attempts to get an object from my-bucket from an IP address in the range 198.51.100.0/24?

A.Allowed because the Deny condition does not match
B.Denied because there is no explicit Allow for that IP range
C.Allowed because there is an Allow statement
D.Denied because the Deny statement applies
AnswerD

The Deny statement explicitly denies access from IPs not in the range.

Why this answer

The policy includes an Allow statement that grants s3:GetObject only from the IP range 192.0.2.0/24. It also includes a Deny statement that denies s3:GetObject from any IP address not in that range (using the NotIpAddress condition). The user's request comes from an IP in the 198.51.100.0/24 range, which is not included in the allowed range.

Therefore, the Deny condition matches, and the Deny statement applies. In AWS IAM, an explicit Deny overrides any Allow, so the request is denied. Option D is correct.

Option A is incorrect because the Deny does match. Option B is incorrect because there is an explicit Allow for a different IP range, but the Deny overrides it. Option C is incorrect because the Allow only applies to the specified range, and the Deny overrides it.

Practice this question →
29
MCQmedium

The CISO asks for a centralized dashboard showing security findings from GuardDuty, Macie, Inspector, and Firewall Manager across 30 AWS accounts. Findings must be normalized into a single format so they can be prioritized by severity without switching between services. Which AWS service provides this capability?

A.Enable AWS Security Hub with an administrator account in the organization; integrate GuardDuty, Macie, Inspector, and Firewall Manager as finding providers
B.Deploy a custom Lambda function that polls each service's API and writes findings to a DynamoDB table for a custom dashboard
C.Enable Amazon Detective to investigate and correlate security findings across all accounts
D.Configure AWS Config conformance packs to evaluate security compliance checks across all accounts and report to an aggregator account
AnswerA

Security Hub's organization integration automatically enables member accounts and routes their findings to the designated administrator account. All findings — regardless of source service — are normalized to ASFF with a consistent severity schema. The security team sees one consolidated dashboard instead of five separate consoles.

Why this answer

AWS Security Hub is designed to aggregate, normalize, and prioritize security findings from multiple AWS services (GuardDuty, Macie, Inspector, Firewall Manager) and third-party tools across accounts. By designating an administrator account in AWS Organizations, you can centrally view all findings in a single dashboard, with a standardized findings format (AWS Security Finding Format, ASFF) that includes severity, resource, and remediation fields. This directly meets the CISO's requirement for a centralized, normalized, severity-prioritized view without switching between services.

Exam trap

The trap here is that candidates often confuse Amazon Detective (a visualization/investigation tool) with Security Hub (a centralized finding aggregation and prioritization service), or they assume a custom Lambda solution is acceptable despite the exam's emphasis on managed, scalable services that reduce operational burden.

How to eliminate wrong answers

Option B is wrong because deploying a custom Lambda function to poll APIs and write to DynamoDB is a manual, brittle approach that does not provide the native normalization, cross-account aggregation, or built-in severity prioritization that Security Hub offers out of the box; it also introduces operational overhead and potential latency. Option C is wrong because Amazon Detective is a service for investigating and visualizing security data (e.g., VPC Flow Logs, GuardDuty findings) but it does not aggregate findings from multiple services into a single normalized dashboard for prioritization; it focuses on root-cause analysis after an alert. Option D is wrong because AWS Config conformance packs evaluate resource compliance against rules (e.g., PCI DSS, CIS benchmarks) and report compliance status, but they do not ingest or normalize security findings from GuardDuty, Macie, Inspector, or Firewall Manager; they are for configuration compliance, not security finding aggregation.

Practice this question →
30
MCQhard

Refer to the exhibit. An IAM policy is attached to a user. Which statement about the user's access is correct?

A.The user can get objects over HTTP.
B.The user can list objects in the bucket over HTTP.
C.The user can list objects only over HTTPS.
D.The user can get objects only over HTTPS.
AnswerD

GetObject requires SecureTransport true.

Why this answer

The GetObject action has a condition requiring SecureTransport to be true, meaning only HTTPS is allowed. Option A is incorrect because HTTP is not allowed for GetObject. Option B is incorrect because ListBucket does not have the SecureTransport condition, so HTTP is allowed for listing objects.

Option C is incorrect because listing objects is allowed over HTTP.

Practice this question →
31
MCQmedium

A company's security policy requires that all Amazon S3 buckets must have server-side encryption with AWS Key Management Service (SSE-KMS) enabled. The SysOps administrator needs to automatically detect any existing or new S3 bucket that does not have SSE-KMS enabled and automatically apply the encryption configuration. The solution must use managed AWS services with minimal custom code. Which combination of AWS services should be used?

A.Use AWS Config with a custom rule backed by an AWS Lambda function that checks if the S3 bucket has default SSE-KMS encryption enabled, and auto-remediates by enabling SSE-KMS default encryption (e.g., calling the PutBucketEncryption API).
B.Enable default encryption on the AWS account's S3 buckets using an S3 account-level setting in the S3 console, which automatically applies SSE-KMS to all new buckets.
C.Create an AWS CloudTrail event that triggers an AWS Lambda function when a bucket is created, and the Lambda applies SSE-KMS encryption. Use AWS Config to periodically scan existing buckets and apply encryption.
D.Use AWS Identity and Access Management (IAM) with a Service Control Policy (SCP) that denies any S3 bucket creation without SSE-KMS enabled, and use AWS Config to detect and notify on non-compliance.
AnswerA

This uses AWS Config for detection and Lambda for remediation, which is a standard pattern. Bucket policy approach prevents future unencrypted uploads but does not encrypt existing objects; however, the requirement is to apply encryption configuration, which can be done via put-bucket-encryption API. The Lambda can call that API. This is a valid solution with managed services and minimal custom code (only the Lambda).

Why this answer

It uses AWS Config with a custom Lambda-backed rule to detect non-compliant S3 buckets (those missing SSE-KMS) and auto-remediate by calling the PutBucketEncryption API to enable default SSE-KMS encryption on the bucket. This satisfies the requirement for minimal custom code (only the Lambda function) and uses managed AWS services (AWS Config, Lambda, S3) to automatically detect and fix both existing and new buckets, ensuring that all S3 buckets have SSE-KMS enabled as per the security policy.

Exam trap

The trap here is that candidates often confuse S3 default encryption settings (which apply to objects, not buckets) with bucket policies or AWS Config rules, leading them to choose Option B or D, which cannot automatically remediate existing non-compliant buckets.

How to eliminate wrong answers

Option B is wrong because S3 account-level default encryption settings apply only to new objects uploaded to existing buckets, not to new buckets themselves, and cannot retroactively enforce encryption on existing buckets or detect non-compliant buckets. Option C is wrong because it requires creating a CloudTrail event trigger and a separate AWS Config periodic scan, which introduces more custom code and complexity than necessary, and the CloudTrail approach only catches bucket creation events, not modifications to existing buckets. Option D is wrong because IAM Service Control Policies (SCPs) can only deny bucket creation based on tags or conditions at creation time, but they cannot detect or remediate existing buckets that lack SSE-KMS, and AWS Config alone without a remediation action cannot automatically apply encryption.

Practice this question →
32
MCQmedium

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts have encryption enabled. What is the most efficient way to enforce this policy?

A.Apply a service control policy (SCP) to the root organizational unit that denies S3 actions without encryption.
B.Configure an IAM role in the master account to enforce encryption via cross-account access.
C.Create an IAM policy in each account that denies s3:PutObject without encryption.
D.Use AWS CloudFormation StackSets to deploy a bucket policy to each account.
AnswerA

Applying an SCP at the root organizational unit is the correct centralized method because SCPs act as guardrails that restrict the maximum permissions available to all IAM principals in every account under that OU, including the account root user. An SCP can, for example, use a condition like `s3:x-amz-server-side-encryption` or `aws:SecureTransport` to deny `s3:PutObject` calls that do not include encryption parameters, and because SCPs cannot be overridden by individual account administrators, this enforces encryption uniformly across the entire organization.

Why this answer

A service control policy (SCP) applied to the root organizational unit in AWS Organizations can centrally enforce encryption requirements for all S3 buckets across every member account. By denying S3 actions (such as s3:PutObject) unless the request includes encryption parameters (e.g., x-amz-server-side-encryption), the SCP acts as a guardrail that cannot be overridden by account-level IAM policies, ensuring compliance without per-account configuration.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, assuming that IAM policies in each account are sufficient, but SCPs provide centralized, unoverridable enforcement across all accounts in an organization.

How to eliminate wrong answers

Option B is wrong because an IAM role in the master account cannot enforce encryption on S3 actions performed by principals in other accounts; cross-account access via roles requires explicit trust and does not prevent unencrypted operations initiated by users in member accounts. Option C is wrong because creating an IAM policy in each account is not the most efficient approach—it requires manual deployment and maintenance across potentially hundreds of accounts, and IAM policies can be overridden by account administrators. Option D is wrong because CloudFormation StackSets deploy resources (like bucket policies) but cannot enforce encryption on existing buckets or future actions across all accounts without additional mechanisms; bucket policies also apply only to specific buckets, not globally.

Practice this question →
33
MCQhard

A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS with a specific customer managed key. Which bucket policy condition should be used to enforce this?

A."Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}
B."Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms", "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
C."Condition": {"StringEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
D."Condition": {"Null": {"s3:x-amz-server-side-encryption": "false"}}
AnswerB

Combines both conditions to enforce KMS encryption and the specific customer managed key, meeting the requirement.

Why this answer

It uses both conditions: 's3:x-amz-server-side-encryption' set to 'aws:kms' ensures that objects are encrypted with SSE-KMS, and 's3:x-amz-server-side-encryption-aws-kms-key-id' set to the specific key ARN ensures that only the designated customer managed key is used. Option A enforces KMS encryption but does not restrict which KMS key, allowing any managed key. Option C enforces a specific key ARN but does not require the encryption header to be present, which could allow objects without encryption if the key ID header is omitted (though in practice, the key ID is only valid with SSE-KMS, the condition alone is not sufficient to guarantee encryption).

Option D uses a 'Null' condition incorrectly and would not properly enforce encryption.

Practice this question →
34
MCQmedium

A company's security policy requires that all Amazon RDS for PostgreSQL instances be encrypted at rest using AWS Key Management Service (KMS) customer managed keys and have automated backups enabled with a retention period of at least 30 days. A SysOps administrator needs to use AWS Config to automatically detect any RDS instance that is non-compliant with either requirement and automatically remediate it. Which combination of AWS Config managed rules and remediation actions should be used?

A.Use two AWS Config managed rules: 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure each rule with an automatic remediation action that triggers an Amazon CloudWatch alarm, which then invokes an AWS Lambda function to enable encryption and backups.
B.Create custom AWS Config rules as AWS Lambda functions that evaluate the RDS instance configuration. In the Lambda function, if a resource is non-compliant, call the RDS API to enable encryption and modify backup settings.
C.Use the AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure automatic remediation for each rule using the corresponding AWS Systems Manager Automation runbook: 'AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup'.
D.Use a single custom AWS Config rule that checks both encryption and backup settings. If non-compliant, trigger an AWS Lambda function that uses the RDS API to configure both settings.
AnswerC

This is the correct approach. Managed rules evaluate compliance, and automatic remediation using Systems Manager Automation runbooks applies the fix without custom code. The runbooks perform the necessary API calls to enable encryption and backups, meeting the policy requirements.

Why this answer

AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled' natively evaluate encryption and backup compliance. The corresponding AWS Systems Manager Automation runbooks ('AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup') provide built-in, automatic remediation without custom code, aligning with the requirement to use managed rules and automatic remediation.

Exam trap

The trap here is that candidates may assume custom Lambda functions are required for complex remediation, but AWS provides pre-built Systems Manager Automation runbooks that integrate directly with AWS Config managed rules for common RDS compliance issues, making custom code unnecessary.

How to eliminate wrong answers

Option A is wrong because triggering a CloudWatch alarm to invoke a Lambda function is an indirect, custom remediation path; AWS Config supports direct automatic remediation via Systems Manager Automation runbooks, making this approach unnecessarily complex and not leveraging native capabilities. Option B is wrong because creating custom AWS Config rules as Lambda functions violates the requirement to use AWS Config managed rules; the question explicitly asks for managed rules, not custom ones. Option D is wrong because using a single custom rule that checks both encryption and backups is not a managed rule, and it requires custom Lambda code for remediation, which contradicts the directive to use managed rules and automatic remediation actions.

Practice this question →
35
MCQmedium

A SysOps administrator is troubleshooting an issue where an IAM user can launch EC2 instances but cannot terminate them. The user's permissions are based on an IAM group policy. Which action should the administrator take to resolve this?

A.Attach a managed policy that includes ec2:TerminateInstances directly to the user
B.Add the user to a different IAM group that has the required permissions
C.Check the user's permissions boundary for any restrictions
D.Review and modify the IAM group policy to include ec2:TerminateInstances action
AnswerD

The most likely root cause is that the IAM group policy attached to the user's group does not include an ec2:TerminateInstances action, so modifying that policy to allow the API call resolves the issue for every member of the group. Use a statement with "Effect": "Allow" for ec2:TerminateInstances on the appropriate resource, then test with the IAM policy simulator to verify effective access.

Why this answer

The administrator should review the group policy to ensure it includes ec2:TerminateInstances. The issue is likely a missing action in the policy, not a service control policy (SCP) or session policy issue, and simply adding the user to a new group won't fix the underlying policy gap.

Practice this question →
36
Multi-Selecteasy

A company needs to comply with PCI DSS requirements for its AWS environment. Which TWO services should the SysOps administrator use to automate compliance checks and generate reports? (Choose TWO.)

Select 2 answers
A.Amazon CloudWatch
B.AWS Config
C.AWS CloudTrail
D.AWS Trusted Advisor
E.AWS Audit Manager
AnswersB, E

AWS Config continuously records the configuration state of supported AWS resources and evaluates those configurations against AWS-managed or custom rules. For PCI DSS, you can use the managed rule pack to check for requirements like encrypted storage, restricted security group rules, and MFA on root accounts, then view the overall compliance snapshot over time. It generates a compliance timeline and aligned findings, making it the core service for automated configuration compliance.

Why this answer

(AWS Config) is correct because AWS Config provides managed rules that evaluate resource configurations against compliance standards like PCI DSS, and can trigger auto-remediation or generate compliance reports via AWS Config conformance packs. Option E (AWS Audit Manager) is correct because it helps continuously audit your AWS usage, automate evidence collection, and generate compliance reports for PCI DSS. Option A (Amazon CloudWatch) is incorrect because it is focused on monitoring metrics and logs, not on compliance checks or automated reporting.

Option C (AWS CloudTrail) is incorrect because it records API activity for auditing but does not perform compliance checks or generate compliance reports. Option D (AWS Trusted Advisor) is incorrect because it provides best-practice recommendations but does not automate compliance checks or generate detailed compliance reports required by PCI DSS.

Practice this question →
37
MCQhard

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

A.AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.
B.AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.
C.AWS Trusted Advisor to check S3 bucket encryption and send notifications.
D.Amazon Macie to discover sensitive data and then manually encrypt buckets.
AnswerA

AWS Config's managed rule s3-bucket-server-side-encryption-enabled continuously evaluates whether every S3 bucket has default encryption configured. When a bucket is found non-compliant, Config's automatic remediation feature can invoke an AWS Systems Manager Automation document (e.g., AWS-EnableS3BucketEncryption) to apply SSE-KMS to that bucket. Because Config is state-based, it detects both pre-existing non-compliant buckets and buckets that drift after creation. With AWS Organizations, you can deploy the rule and remediation across all accounts using CloudFormation StackSets, and aggregators centralize compliance visibility.

Why this answer

AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Exam trap

The trap here is that candidates often confuse detection-only services (like Trusted Advisor or CloudTrail) with services that can both detect and automatically remediate, or they mistakenly think Macie handles encryption compliance when it actually focuses on data classification.

How to eliminate wrong answers

Option B is wrong because AWS CloudTrail with a metric filter and CloudWatch alarm only detects API calls (e.g., PutBucketEncryption) after they occur; it cannot proactively detect non-compliant buckets or automatically remediate them without a custom Lambda function, and it does not provide continuous compliance evaluation across all accounts. Option C is wrong because AWS Trusted Advisor checks S3 bucket encryption only for the root account or linked accounts in a support plan, but it does not support automatic remediation—it only sends notifications, and it cannot enforce encryption across all accounts in an organization. Option D is wrong because Amazon Macie is designed to discover sensitive data (e.g., PII) in S3 buckets, not to check or enforce encryption settings; it requires manual intervention to encrypt buckets and does not provide automated detection or remediation of non-compliant encryption.

Practice this question →
38
MCQmedium

A company stores sensitive data in an S3 bucket. The security team requires that all objects uploaded to the bucket be encrypted at rest using an AWS KMS customer-managed key. Which S3 bucket policy statement should be added to enforce this requirement?

A.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}
B.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}
C.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}
D.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}
AnswerC

This denies uploads that do not use SSE-KMS and also ensures the KMS key ID is present (though not specific key). However, to enforce a specific key, a condition on the key ID is needed. This statement is a common baseline.

Why this answer

It denies any PutObject request that does not use KMS encryption (s3:x-amz-server-side-encryption != 'aws:kms') OR that does not include a KMS key ID (s3:x-amz-server-side-encryption-aws-kms-key-id is null). This enforces that objects are encrypted with a KMS customer-managed key. Option A is incorrect because it denies only if encryption is not KMS, but allows KMS without requiring a key ID, which could permit using the default AWS-managed KMS key rather than a customer-managed key.

Option B is incorrect because it denies only if no encryption header is present, but allows any encryption type including SSE-S3 or SSE-KMS without a key ID. Option D is incorrect because it denies encryption that is not AES256, which is SSE-S3, and would incorrectly allow SSE-KMS.

Practice this question →
39
MCQhard

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to restrict access to a specific AWS service (Amazon EC2) in all accounts except for the 'production' account. The SysOps administrator needs to implement this restriction centrally. Which approach should the administrator use?

A.Create an IAM policy that denies Amazon EC2 actions and attach it to all users and roles in non-production accounts.
B.Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.
C.Use AWS Config to create a rule that detects EC2 usage in non-production accounts and automatically terminates instances.
D.Create a resource-based policy on each EC2 instance that denies access from non-production accounts.
AnswerB

SCPs are a centralized way to set permission boundaries for all accounts in the organization. By denying EC2 actions via SCP on non-production OUs, the restriction is enforced even for the root user of those accounts, and it applies to all IAM principals.

Why this answer

Service control policies (SCPs) are the correct mechanism for centrally restricting permissions across accounts in AWS Organizations. By attaching an SCP that denies EC2 actions to the organization root or to the OUs containing non-production accounts, the security team can enforce this restriction at the account level, overriding any IAM policies within those accounts. This approach ensures that even if a user or role in a non-production account has an IAM policy granting EC2 access, the SCP will block it.

Exam trap

The trap here is that candidates often confuse IAM policies (which are identity-based and account-specific) with SCPs (which are account-wide and centrally managed), leading them to choose Option A because they think attaching a deny policy to users is sufficient, but they overlook that SCPs provide the only centralized, preventive control across multiple accounts in AWS Organizations.

How to eliminate wrong answers

Option A is wrong because IAM policies attached to users and roles are not centrally managed across multiple accounts; they must be applied individually in each account, which is not a centralized solution and can be bypassed by local administrators. Option C is wrong because AWS Config is a detective service that can detect and react to EC2 usage (e.g., via auto-remediation), but it does not prevent the initial creation or use of EC2 resources; it only responds after the fact, which is not a preventive restriction. Option D is wrong because resource-based policies on EC2 instances control access to the instance itself (e.g., who can start/stop it), not the ability to launch or manage EC2 services in an account; they are also not centrally managed across accounts.

Practice this question →
40
MCQhard

An application stores its RDS PostgreSQL credentials in AWS Secrets Manager. The security policy requires credentials to be rotated every 30 days automatically. During rotation, the application must continue to serve traffic with zero downtime. The application retrieves credentials by calling GetSecretValue at the start of each database connection. What must be configured to satisfy all requirements?

A.Enable automatic rotation in Secrets Manager with a 30-day schedule; use the AWS-provided Lambda rotation function for RDS PostgreSQL; ensure the application calls GetSecretValue per connection rather than caching credentials
B.Rotate credentials manually every 30 days by updating the secret value in the console and restarting the application
C.Create an EventBridge scheduled rule every 30 days that triggers a Lambda to generate a new RDS password and update both the database and the secret
D.Store credentials in an environment variable on the application's EC2 instance and rotate by updating the environment variable and reloading the application
AnswerA

The AWS-provided rotation Lambda handles the full four-step lifecycle. The 30-day rotation schedule triggers the Lambda automatically. Because the application fetches credentials fresh per connection, it starts using the new credentials immediately after AWSCURRENT switches, with no restart needed. Secrets Manager's rotation is designed for zero downtime — the new password is validated on the database before the old version is retired.

Why this answer

AWS Secrets Manager's automatic rotation, combined with the AWS-provided Lambda rotation function for RDS PostgreSQL, ensures credentials are rotated every 30 days without manual intervention. The application's practice of calling GetSecretValue at the start of each database connection guarantees it always retrieves the current secret, avoiding stale credentials and achieving zero downtime during rotation.

Exam trap

The trap here is that candidates may think any automated rotation (like EventBridge + Lambda) suffices, but the question specifically tests the integration of Secrets Manager's native rotation with its versioning and staging labels to achieve zero downtime.

How to eliminate wrong answers

Option B is wrong because manual rotation every 30 days with a console update and application restart violates the zero-downtime requirement; restarting the application causes service interruption. Option C is wrong because while it implements rotation via EventBridge and Lambda, it does not use Secrets Manager's built-in rotation mechanism, missing the automatic version management and staging labels (AWSCURRENT, AWSPREVIOUS) that ensure seamless credential transition. Option D is wrong because storing credentials in an environment variable on EC2 and rotating by updating the variable and reloading the application introduces downtime and bypasses Secrets Manager's secure storage, auditing, and rotation capabilities.

Practice this question →
41
MCQhard

A company's security team notices that an IAM user has been making unauthorized API calls from an IP address outside the company's VPN. The team wants to immediately block all API calls from that specific IP address for all users. Which action should be taken?

A.Create a new IAM policy that denies access from the IP address and attach it to all users.
B.Create an IAM policy that denies access from the IP address and attach it to the organization root.
C.Create a service control policy (SCP) that denies access from the IP address and attach it to the root organizational unit.
D.Create a service control policy (SCP) that denies access from the IP address and attach it to the IAM user.
AnswerC

This is correct. A service control policy (SCP) attached to the root organizational unit applies to all accounts in the organization, effectively blocking API calls from the specified IP for all IAM users and role sessions across all accounts.

Why this answer

A service control policy (SCP) attached to the root organizational unit (OU) applies to all accounts in the organization, effectively blocking API calls from the specified IP for all IAM users and roles across those accounts. Option A is incorrect because attaching an IAM policy to all users only affects the current account and is not scalable for organization-wide enforcement. Option B is incorrect because IAM policies cannot be attached to an organization root; only SCPs can be applied at that level.

Option D is incorrect because SCPs cannot be attached directly to IAM users; they apply to OUs or accounts.

Practice this question →
42
MCQeasy

An organization wants to ensure that no Amazon S3 bucket in the entire AWS Organization can be made public. The security team requires a preventive control that cannot be overridden by individual account administrators. Which AWS service or feature should be used?

A.Create a Service Control Policy (SCP) in AWS Organizations that denies permissions to modify S3 bucket public access settings.
B.Enable AWS Config rules in each account to detect public S3 buckets and automatically remediate them using AWS Lambda.
C.Use an IAM policy attached to all IAM users in each account that denies s3:PutBucketPolicy.
D.Apply Amazon S3 Block Public Access at the account level in each individual AWS account.
AnswerA

A Service Control Policy (SCP) attached at the organization root or an organizational unit (OU) is inherited by every AWS account underneath, and it operates as an allow-list or denial of AWS API actions at the account level. Because SCPs are evaluated by AWS Organizations before IAM policies, even an account root user with full administrative rights cannot override an explicit deny of s3:PutBucketPolicy, s3:PutBucketAcl, or s3:PutBucketPublicAccessBlock, making it a true preventative guardrail across the entire organization. This is why the correct answer is to use SCPs rather than account-local controls.

Why this answer

A Service Control Policy (SCP) in AWS Organizations is a preventive guard that applies to all accounts within the organization. It can explicitly deny actions like s3:PutBucketPublicAccessBlock, s3:PutBucketPolicy, and s3:PutObjectAcl, preventing any principal (including root users) from making S3 buckets public. Unlike detective or account-level controls, SCPs cannot be overridden by individual account administrators, meeting the requirement for a non-overridable preventive control.

Exam trap

The trap here is that candidates often choose account-level S3 Block Public Access (Option D) because it seems like a direct preventive control, but they overlook that it can be overridden by account administrators, whereas an SCP is a centralized, non-overridable guardrail that applies across the entire AWS Organization.

How to eliminate wrong answers

Option B is wrong because AWS Config rules are detective and reactive, not preventive; they detect public buckets after the fact and can auto-remediate, but they do not block the initial action and can be overridden by account administrators. Option C is wrong because IAM policies attached to users do not apply to the root user or to services running with assumed roles, and they can be modified by account administrators, so they are not a non-overridable preventive control across the entire organization. Option D is wrong because S3 Block Public Access at the account level can be disabled or modified by any user with the necessary permissions (including account administrators), so it does not provide a centrally enforced, non-overridable control.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Security and Compliance questions.

Start 20-question session