Security & Compliance

What is the AWS Shared Responsibility Model?

• AAWS and customers share the cost of cloud infrastructure equally
• BAWS is responsible for security of the cloud; customers are responsible for security in the cloud✓
• CCustomers are fully responsible for all security aspects of AWS services
• DAWS handles all security so customers have no security responsibilities

Answer: The Shared Responsibility Model divides security: AWS is responsible for security 'of' the cloud (hardware, software, networking, facilities), while customers are responsible for security 'in' the cloud (data, IAM, OS configuration, etc.).

Which AWS service is used to manage user access and permissions to AWS resources?

• AAmazon Cognito
• BAWS Shield
• CAWS IAM✓
• DAWS Organizations

Answer: AWS Identity and Access Management (IAM) enables you to manage access to AWS services and resources securely by creating users, groups, roles, and defining permissions through policies.

What is the purpose of AWS CloudTrail?

• AMonitor application performance metrics
• BRecord API calls and user activity across your AWS account✓
• CDistribute traffic across multiple EC2 instances
• DDeploy infrastructure using code templates

Answer: AWS CloudTrail records API calls and user activity across your AWS account, providing governance, compliance, operational auditing, and risk auditing capabilities by logging who did what and when.

Which IAM best practice helps protect the AWS account root user?

• AShare root credentials with trusted administrators
• BEnable multi-factor authentication (MFA) on the root account✓
• CUse root credentials for daily administrative tasks
• DCreate only one IAM user and assign all permissions to it

Answer: AWS strongly recommends enabling MFA on the root account to add an extra layer of protection. The root account should be used minimally and only for tasks that specifically require it.

What is the principle of least privilege in AWS IAM?

• AGrant all users administrator access to simplify management
• BGrant only the minimum permissions required to perform a task✓
• CUse a single IAM role for all services
• DDeny all permissions by default and never grant access

Answer: The principle of least privilege means granting users, groups, and roles only the permissions needed to perform their specific tasks, reducing the attack surface and potential impact of credential compromise.

Which AWS service provides DDoS protection for applications running on AWS?

• AAWS WAF
• BAWS Shield✓
• CAmazon GuardDuty
• DAWS Firewall Manager

Answer: AWS Shield is a managed DDoS protection service. Shield Standard is included at no extra cost for all AWS customers, while Shield Advanced provides enhanced protections and 24/7 access to the AWS DDoS Response Team.

What is AWS Organizations used for?

• AOrganizing EC2 instances into Auto Scaling groups
• BCentrally managing and governing multiple AWS accounts✓
• CScheduling automated tasks across AWS services
• DMonitoring cloud infrastructure performance

Answer: AWS Organizations lets you centrally manage billing, access control, compliance, security, and resource sharing across multiple AWS accounts, applying Service Control Policies (SCPs) to manage permissions.

What is the purpose of an IAM role?

• ATo create a permanent set of credentials for a specific user
• BTo delegate access to AWS services or resources without sharing long-term credentials✓
• CTo define network access rules for EC2 instances
• DTo encrypt data stored in S3 buckets

Answer: IAM roles provide temporary security credentials and allow AWS services, applications, or users to assume permissions without sharing long-term access keys, following the principle of least privilege.

Which AWS service continuously monitors your AWS environment for security threats and malicious activity?

• AAWS Config
• BAWS Inspector
• CAmazon GuardDuty✓
• DAWS Security Hub

Answer: Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity using machine learning, anomaly detection, and integrated threat intelligence.

What does Amazon Inspector do?

• AMonitors network traffic for security threats
• BAutomatically assesses applications for vulnerabilities and deviations from best practices✓
• CManages SSL/TLS certificates
• DProvides DDoS protection

Answer: Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS by checking for vulnerabilities and unintended network exposure.

Which AWS service is used to store and manage secrets like database passwords and API keys?

• AAWS KMS
• BAWS Secrets Manager✓
• CAWS Certificate Manager
• DAWS Systems Manager Parameter Store

Answer: AWS Secrets Manager helps protect access to applications, services, and IT resources by enabling you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.

What is the purpose of AWS Identity and Access Management (IAM) policies?

• ADefine network security rules for VPC subnets
• BSpecify permissions that allow or deny actions on AWS resources✓
• CConfigure multi-factor authentication for user accounts
• DManage encryption keys for AWS services

Answer: IAM policies are JSON documents that define permissions, specifying which actions are allowed or denied on which AWS resources, and are attached to IAM users, groups, or roles to grant access.