Security & Compliance

Which statement BEST describes the difference between AWS Shield Standard and AWS Shield Advanced?

1. A.Shield Standard costs extra; Shield Advanced is free.
2. B.Shield Standard is free for all AWS customers and protects against common Layer 3/4 DDoS attacks. Shield Advanced ($3,000/month) adds 24/7 DRT support, cost protection, and advanced attack mitigation.✓ Correct
3. C.Both are identical.
4. D.Shield Advanced replaces all firewalls.

Which AWS service is a Web Application Firewall (WAF) that protects against application-layer (Layer 7) attacks like SQL injection and XSS?

1. A.AWS WAF✓ Correct
2. B.AWS Shield
3. C.AWS Firewall Manager
4. D.Amazon GuardDuty

Which AWS service uses ML to detect malicious or unauthorized activity in your AWS account by analyzing CloudTrail logs, VPC flow logs, and DNS logs?

1. A.Amazon GuardDuty✓ Correct
2. B.AWS Shield
3. C.Amazon Macie
4. D.AWS WAF

Which AWS service uses ML to discover and protect sensitive data (PII, credit cards, etc.) in S3 buckets?

1. A.Amazon Macie✓ Correct
2. B.Amazon GuardDuty
3. C.Amazon Inspector
4. D.AWS Shield

Which AWS service is BEST for managing encryption keys used to encrypt data at rest and in transit?

1. A.AWS KMS (Key Management Service)✓ Correct
2. B.AWS Secrets Manager
3. C.AWS CloudHSM
4. D.AWS IAM

Which AWS service stores secrets (DB passwords, API keys) and provides automatic rotation?

1. A.AWS Secrets Manager✓ Correct
2. B.AWS Systems Manager Parameter Store
3. C.AWS KMS
4. D.AWS IAM

Which AWS service issues and manages free public SSL/TLS certificates for use with AWS resources?

1. A.AWS Certificate Manager (ACM)✓ Correct
2. B.AWS KMS
3. C.AWS IAM
4. D.AWS Shield

Under the Shared Responsibility Model, who is responsible for patching the operating system on an Amazon EC2 instance?

1. A.AWS
2. B.The customer✓ Correct
3. C.Both equally
4. D.It's automated for free

Which AWS service is a managed compliance/audit reporting service that provides on-demand access to AWS compliance reports (SOC, PCI, ISO, FedRAMP)?

1. A.AWS Artifact✓ Correct
2. B.AWS Audit Manager
3. C.AWS Config
4. D.AWS CloudTrail

Which AWS service helps continuously audit your AWS usage to assess compliance with regulations and industry standards?

1. A.AWS Audit Manager✓ Correct
2. B.AWS Artifact
3. C.AWS Config
4. D.Amazon Inspector

Which AWS service provides centralized configuration of WAF rules, Shield Advanced, and security groups across multiple accounts in AWS Organizations?

1. A.AWS Firewall Manager✓ Correct
2. B.AWS WAF
3. C.AWS Shield
4. D.AWS Security Hub

Which AWS service is a managed Hardware Security Module (HSM) for FIPS 140-2 Level 3 compliance, single-tenant?

1. A.AWS CloudHSM✓ Correct
2. B.AWS KMS
3. C.AWS Secrets Manager
4. D.AWS Certificate Manager

Which compliance certification does AWS hold that proves IT general controls?

1. A.SOC 1
2. B.SOC 2
3. C.SOC 3
4. D.All of the above✓ Correct

What does AWS Inspector do?

1. A.Continuously scans EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and unintended network exposure.✓ Correct
2. B.Logs all API calls.
3. C.Manages encryption keys.
4. D.Provides DNS service.

Which AWS service consolidates security findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and partner tools?

1. A.AWS Security Hub✓ Correct
2. B.Amazon GuardDuty alone
3. C.AWS Config alone
4. D.AWS Trusted Advisor

Which is true about encryption in transit and at rest in AWS?

1. A.AWS does not support encryption.
2. B.AWS supports encryption in transit (TLS) and at rest (AES-256) for nearly all services — sometimes by default, sometimes via configuration.✓ Correct
3. C.Only paid tiers support encryption.
4. D.Only on-premises encryption is supported.

Which feature of AWS WAF lets you block specific IP addresses from accessing your application?

1. A.IP set / IP-based rules
2. B.Geo-match conditions
3. C.Rate-based rules
4. D.All of the above✓ Correct

Under the Shared Responsibility Model, what is AWS responsible for?

1. A.Customer data and applications.
2. B.Security OF the cloud — the global infrastructure (data centers, hardware, host OS, hypervisor, networking).✓ Correct
3. C.OS-level patching for all customers.
4. D.Customer IAM policies.

Under the Shared Responsibility Model, what is the customer responsible for?

1. A.Physical security of data centers.
2. B.Security IN the cloud — customer data, IAM (identities/roles/policies), OS patching (for IaaS), application logic, encryption, networking config.✓ Correct
3. C.AWS service availability.
4. D.Hypervisor patching.

Which service helps you find S3 buckets that are publicly accessible across an AWS Organization?

1. A.IAM Access Analyzer
2. B.AWS Config
3. C.AWS Trusted Advisor
4. D.All of the above can help✓ Correct

Which is the BEST practice for protecting the AWS account root user?

1. A.Use it for daily admin tasks.
2. B.Enable MFA, lock away credentials, do NOT use it for daily work, and create separate IAM users with appropriate permissions.✓ Correct
3. C.Share the password with all admins.
4. D.Disable the root user.

Which AWS service is an integrated dashboard that shows the current security posture and compliance with security standards?

1. A.AWS Security Hub✓ Correct
2. B.AWS Trusted Advisor
3. C.AWS Config
4. D.Amazon GuardDuty

Which AWS service helps you respond to and recover from security incidents using automated playbooks?

1. A.AWS Detective + Security Hub + EventBridge + Lambda runbooks✓ Correct
2. B.AWS Trusted Advisor
3. C.AWS CloudTrail alone
4. D.Amazon Macie alone

Which service helps investigate the root cause of security findings using a graph model of users, resources, and activities?

1. A.Amazon Detective✓ Correct
2. B.Amazon GuardDuty
3. C.AWS CloudTrail
4. D.AWS Config

Which AWS service helps you find unintended public access to AWS resources (S3 buckets, IAM roles, KMS keys, Lambda)?

1. A.IAM Access Analyzer✓ Correct
2. B.AWS Trusted Advisor
3. C.AWS WAF
4. D.AWS Shield

Which of the following is NOT a resource that AWS WAF can be attached to?

1. A.Amazon CloudFront distribution
2. B.Application Load Balancer (ALB)
3. C.Amazon API Gateway
4. D.An EC2 instance directly (via its ENI)✓ Correct

You have 50 AWS accounts in an AWS Organization and want to deploy and enforce a single set of WAF rules across all of them — including new accounts that join later. Which AWS service is BEST suited to do this?

1. A.AWS WAF (configured manually in each account)
2. B.AWS Firewall Manager✓ Correct
3. C.AWS Shield Advanced
4. D.AWS Config

Your auditor needs continuous evidence that your AWS workload meets SOC 2 controls. Which AWS service should you use to automate evidence collection and produce an assessment report?

1. A.AWS Artifact
2. B.AWS Audit Manager✓ Correct
3. C.AWS Trusted Advisor
4. D.AWS Security Hub