Security and Compliance — page 2
Which of the following actions would a company take to "harden" the security of their IAM configuration? (Select TWO)
A company wants to ensure that their Amazon RDS database is only accessible from within their VPC and not from the public internet. Which VPC configuration achieves this?
Which of the following BEST describes the AWS "Shared Controls" category in the Shared Responsibility Model?
A company wants to automatically detect and alert on any new IAM user being created with administrator access. Which combination of services achieves this?
Which of the following is TRUE about S3 Bucket Policies compared to IAM Policies for controlling S3 access?
A company needs to provide temporary AWS credentials to a mobile application user authenticated via their Google account. Which AWS service issues temporary credentials for this federated identity use case?
Which of the following BEST describes a "security group rule" in AWS VPC?
A company wants to ensure all EC2 instances in their environment are tagged with an "Owner" tag. Which AWS service can automatically detect and report on EC2 instances missing this tag?
Which of the following is TRUE about AWS KMS key policies?
Which of the following is an example of a "detective control" in AWS security architecture?
A company wants to protect their web application running behind an Application Load Balancer from automated bot traffic and credential stuffing attacks. Which AWS service is BEST suited?
A company wants to implement real-time monitoring of their application logs to detect errors and trigger alerts automatically. Which combination of AWS services achieves this?
Which AWS service provides a visual dashboard showing all AWS resources in your account across all Regions, helping teams understand resource inventory and relationships?
A company is building a mobile application and needs a scalable backend that can handle user authentication, real-time data sync, and push notifications. Which AWS service provides a managed GraphQL API for this?
Which of the following BEST describes the use of Amazon CloudFront signed URLs and signed cookies?
A company wants to implement automated infrastructure compliance — for example, ensuring that every newly created S3 bucket has server-side encryption enabled and no public access. Which AWS service can detect and automatically remediate non-compliant resources?
Which of the following BEST describes how AWS charges for Amazon CloudFront?
A company's development team frequently creates EC2 instances for testing but often forgets to delete them. Which approach BEST automates cleanup to reduce costs?
Which of the following is TRUE about how AWS handles data transfer between Amazon EC2 and Amazon RDS in the same Availability Zone?
Which AWS service allows customers to view, accept, and manage legal agreements — such as the Business Associate Agreement (BAA) for HIPAA — required for regulated workloads?
Which of the following BEST describes the AWS Cloud's impact on "time to market" for new software features?
A company recently moved to AWS. Their operations team is surprised to find they no longer need to manage physical access controls for servers. According to the Shared Responsibility Model, which AWS responsibility covers this?
A company wants to enforce that all S3 objects uploaded to a specific bucket must be encrypted using SSE-KMS, and uploads without encryption should be rejected. Which S3 feature enforces this?
Which of the following BEST describes why creating IAM roles for EC2 instances is more secure than creating IAM users with access keys for the same purpose?
A company wants to detect when their S3 buckets are accessed from an unfamiliar AWS Region, potentially indicating data exfiltration. Which service detects this type of anomalous access pattern?
Which of the following is TRUE about the AWS root account and best practices?
A company wants to implement network-level access control between different application tiers in their VPC. They need rules that can DENY specific traffic. Which VPC feature supports explicit deny rules?
Which AWS service provides a centralized inventory of all AWS resources across multiple accounts and Regions, enabling compliance checks and change tracking?
A company needs to provide a vendor temporary read access to a specific DynamoDB table in their AWS account. The vendor uses a different AWS account. Which is the MOST secure approach?
Which of the following is TRUE about encryption for Amazon EBS volumes?
A company wants all traffic between their VPC and AWS services like S3 to stay within the AWS network without traversing the public internet. Which is the SIMPLEST way to achieve this for S3?
Which of the following describes a situation where both an S3 bucket policy AND an IAM policy apply to an S3 access request?
A company wants to ensure their developers cannot accidentally expose production data by creating publicly accessible S3 buckets. Which account-level setting prevents this with a single configuration?
Which AWS service provides a managed, scalable directory service that runs actual Microsoft Active Directory in the cloud, compatible with existing AD-aware workloads?
A company has a regulatory requirement that all encryption keys used for their financial data must be stored on hardware that they exclusively control. Which AWS encryption service meets this requirement?
Which of the following BEST describes "data sovereignty" in the context of AWS?
A company uses AWS Organizations and wants to prevent member accounts from launching any resources outside of a set of approved AWS Regions. Which feature enforces this?
Which of the following is an example of a "preventive" security control in AWS?
A company wants to protect against DDoS attacks and also wants visibility into attack traffic with detailed metrics and attack reports. Which AWS service provides both protection AND visibility?
A company wants to grant their mobile app users the ability to upload photos directly to Amazon S3 without going through their backend servers, to reduce bandwidth costs and improve performance. Which approach enables this?
Which AWS service enables teams to continuously monitor their applications and respond to operational issues by creating and managing operational items (OpsItems) from events across CloudWatch, Config, and GuardDuty?
A company wants to serve their web application to global users with the lowest possible latency and also protect it from DDoS attacks and web exploits in a single integrated solution. Which combination of AWS services achieves this?
Which of the following is a key benefit of AWS Organizations' "Service Control Policies" (SCPs) for a company with strict regulatory requirements?
A company wants to provide their security team with a real-time view of AWS compliance status across 30 accounts, showing which resources pass or fail security checks. Which service provides this consolidated, multi-account security posture view?
A company's CTO wants to move away from buying servers every 3–5 years based on projected growth. Which AWS pricing benefit BEST addresses this concern?
Under the Shared Responsibility Model, which of the following is the customer's responsibility when using AWS managed services like Amazon RDS?
A company has multiple IAM users who all need the same set of permissions. What is the MOST efficient way to manage this in IAM?
A company wants to prevent any future misconfiguration where an S3 bucket might be made public. Which is the MOST comprehensive preventive control?
Which AWS service provides automated, continuous scanning of Amazon ECR container images for known software vulnerabilities whenever a new image is pushed?
A company's security team wants a daily report showing all API calls made by users with administrator access in their AWS account. Which service provides the underlying data for this report?
Which of the following correctly describes how an IAM "Deny" statement interacts with "Allow" statements from other policies?
A company uses AWS Organizations and wants to ensure no account can ever disable AWS GuardDuty. Which is the MOST scalable control?
Which of the following is TRUE about Amazon VPC Security Groups and their default behavior?
A company wants to enable their developers to deploy to AWS but prevent them from modifying any security settings such as IAM policies, CloudTrail configurations, or security group rules. Which IAM approach achieves this?
Which of the following BEST describes the purpose of enabling "AWS CloudTrail Insights"?
A company wants to implement network-based access control that applies to all resources within a subnet, regardless of which security group is attached to each instance. Which VPC feature achieves this?
Which AWS service is used to store and manage short-lived, temporary SSH public keys for EC2 instances, enabling browser-based SSH access without maintaining permanent key pairs?
Which of the following BEST describes "AWS Artifact Reports" versus "AWS Artifact Agreements"?
A company wants to ensure that AWS Lambda functions they deploy can only access the specific DynamoDB tables and S3 buckets they need, and nothing else. Which AWS feature enforces this?
Which of the following AWS services encrypts all data at rest by default without any customer configuration required?
A company wants to audit whether specific configuration changes to their AWS resources (like a security group rule change) triggered a compliance violation. Which service provides resource configuration history and compliance evaluation?
Which of the following BEST describes how "AWS IAM Identity Center" (formerly SSO) differs from traditional IAM?
Which of the following BEST describes the purpose of "AWS Systems Manager Parameter Store"?
A company wants to ensure their developers stop terminated EC2 instances instead of terminating them, to avoid accidental data loss. Which IAM action should they be denied?
Which AWS pricing model is BEST for a startup that needs EC2 instances for a new project but has no idea how long the project will last or what capacity will be required?
A company wants to centrally view all AWS security findings and automate responses — such as isolating compromised EC2 instances — across 50 AWS accounts. Which service is the BEST foundation for this?
Under the Shared Responsibility Model, a company uses AWS Lambda. Which of the following remains the customer's responsibility?
A company wants to limit which AWS Regions their developers can create resources in to reduce risk and comply with data residency requirements. Which IAM feature allows this?
Which of the following BEST describes the security benefit of using AWS Organizations' Service Control Policies (SCPs) in combination with IAM policies?
A company discovers that their S3 bucket was accidentally made public for 2 hours. They want to determine exactly which objects were accessed during that time and by whom. Which service provides this access data?
Which of the following CORRECTLY describes what "Amazon GuardDuty" does when it detects a threat?
A company wants to enforce password complexity for IAM users — requiring a minimum of 14 characters, at least one number, and preventing password reuse. Which IAM feature configures this?
Which of the following BEST describes the difference between "authentication" and "authorization" as they apply to AWS IAM?
A company wants to ensure that CloudFormation cannot be used to create IAM roles with AdministratorAccess. Which approach prevents this?
Which of the following is TRUE about how Amazon Inspector v2 operates?
A company wants to implement a "zero standing access" model for production databases — where no engineer has permanent database credentials, and access is granted only when needed for a fixed duration. Which AWS service supports this?
Which of the following CORRECTLY describes the behavior of an AWS Security Group when no rules match incoming traffic?
A company stores highly sensitive research data in S3 and wants to receive an alert any time an object is downloaded outside of their normal business hours. Which combination of services achieves this?
Which of the following BEST describes the purpose of "AWS Directory Service AD Connector"?
A company's security audit finds that several IAM users have not logged in for over 180 days. Following the principle of least privilege, what should they do?
Which of the following BEST describes the purpose of "AWS Security Hub Standards"?
A company wants to protect their EC2-hosted web application from Layer 7 attacks including SQL injection and HTTP floods. Which combination of services provides this protection?
Which of the following is TRUE about Amazon Cognito's two main components?
A company wants to prevent their developers from deleting or modifying any resources tagged with "Environment: Production" while still allowing them to manage development resources. Which IAM approach achieves this?
Which of the following BEST describes the primary purpose of Amazon Elastic Load Balancing (ELB)?
Which of the following BEST describes Amazon CloudFront's "cache behavior"?
Which of the following BEST describes the purpose of "AWS License Manager"?
A company wants to ensure they are aware of upcoming AWS maintenance events that could impact their specific EC2 instances and RDS databases. Which service provides this personalized information?
A company uses Amazon S3 exclusively for storing data. Under the Shared Responsibility Model, which tasks does the customer remain responsible for? (Select TWO)
A company creates a new AWS account. What is the FIRST security action they should take?
Which of the following CORRECTLY describes the purpose of "AWS IAM Roles for Service Accounts" (IRSA) in the context of Amazon EKS?
A company wants to apply a consistent baseline security configuration to all new EC2 instances automatically — including installing security agents and configuring firewall rules — whenever an instance is launched. Which AWS service automates this?
A company wants to detect if their EC2 instances are running processes that are communicating with known malicious IP addresses or performing port scans. Which service detects this runtime behavior?
Which of the following describes a valid use case for "Amazon Cognito User Pools"?
A company wants to ensure that all IAM policies follow the principle of least privilege. They want a report showing which actions each IAM entity has actually used in the past 90 days versus what they are permitted to do. Which AWS feature provides this?
Which of the following is TRUE about how Amazon VPC "route tables" work?
A company wants to ensure that their AWS account never has access keys associated with the root account. Which AWS service checks for this automatically?
Which of the following BEST describes how "AWS Network Firewall" differs from "Security Groups" and "Network ACLs"?
A company stores medical records in Amazon S3 and must comply with HIPAA. Which step is required before they can use AWS for HIPAA-regulated data?
A company wants to allow their data analytics team to query S3 data using Athena, view CloudWatch dashboards, and read DynamoDB tables — but prevent them from modifying or deleting any resources. Which IAM approach achieves this?
Which of the following BEST describes "AWS Control Tower guardrails" and their two types?
A company wants to ensure that all data in transit between their application and Amazon RDS is encrypted, even within a VPC. Which approach achieves this?
Which of the following is an example of "security automation" in AWS?
A company wants to provide their security operations team with a single interface showing security alerts from GuardDuty, Inspector, Macie, and IAM Access Analyzer across 20 AWS accounts. Which service provides this unified view?
Which of the following BEST describes the purpose of "Amazon API Gateway usage plans"?
Which of the following BEST describes the purpose of "Amazon CloudWatch Contributor Insights"?
A company wants to notify their operations team via Slack whenever an EC2 instance is terminated. Which AWS architecture achieves this without custom servers?
A company wants to scan their application code repository for hardcoded secrets like API keys, passwords, and private keys before code is deployed. Which AWS service helps detect secrets in code?
Which of the following BEST describes the purpose of "AWS Service Catalog"?
A company receives an unexpected AWS bill. They determine that a single EC2 instance type (p3.16xlarge — a GPU instance) was launched and left running for 30 days. They want to prevent this type of incident. Which preventive control is MOST effective?
Under the AWS shared responsibility model, which of the following is ALWAYS the customer's responsibility, regardless of the service used?
Which of the following BEST describes the concept of "design for failure" in AWS architecture?
A security team wants to identify which users performed API calls that deleted S3 objects over the last 90 days. Which AWS service provides this information?
Under the shared responsibility model, who is responsible for encrypting data stored in Amazon S3?
Which AWS service allows you to centrally manage firewall rules across multiple AWS accounts and VPCs?
A developer accidentally committed AWS access keys to a public GitHub repo. Which is the FIRST action to take?
Which statement about the AWS root account is correct?
A company wants to ensure users can only log in to the AWS Management Console if they are on the corporate network. Which service helps enforce this?
Which AWS service can evaluate your AWS account against CIS Benchmarks and PCI DSS compliance standards automatically?
A company needs to store database credentials securely and automatically rotate them. Which service is purpose-built for this?
Which of the following is an example of the "principle of least privilege" being applied?
What is the primary purpose of AWS Artifact?
An attacker is flooding a company's web application with HTTP requests to exhaust server resources. Which AWS service provides AUTOMATIC protection against this type of Layer 7 attack?
Which of the following is managed by AWS under the shared responsibility model for Amazon RDS?
A company stores PII in AWS and needs to discover where sensitive data exists across S3 buckets. Which service automates this?
What type of AWS IAM policy is attached directly to an AWS resource (like an S3 bucket) rather than an IAM identity?
Which AWS service provides CENTRALIZED threat detection by analyzing VPC Flow Logs, CloudTrail logs, and DNS logs using machine learning?
A company needs to create an isolated virtual network in AWS and control inbound/outbound traffic to EC2 instances. Which services should they use? (Choose TWO)
What is the primary difference between a Security Group and a Network ACL in AWS?
Which of the following is an example of a managed service where AWS handles OS patching, backups, and replication?
What does Amazon CloudWatch primarily monitor?
A company needs to establish a private, dedicated network connection between its on-premises data center and AWS to ensure consistent network performance. Which service should they use?
What is the PRIMARY purpose of an Amazon VPC Internet Gateway?
A company's development team accidentally terminated a production database. Which AWS feature, if enabled, would have PREVENTED this?
A company wants to allow access to its S3 bucket from only a specific VPC endpoint. Which mechanism enforces this?
Which of the following represents the CORRECT way to grant an EC2 instance permission to access DynamoDB?
Which AWS service provides a searchable, queryable inventory of all AWS resources across accounts and Regions?
A company wants to ensure its AWS environment follows internal IT governance policies. AWS Organizations Service Control Policies (SCPs) are applied. What is the effect of an SCP on the root account of a MEMBER account?
Which of the following is NOT a valid use case for Amazon CloudFront?
A company needs to run a regulatory audit and must demonstrate that AWS data centers comply with ISO 27001. Where should they retrieve this documentation?
A company wants to enable "passwordless" access for applications running on AWS to access other AWS services. Which feature provides temporary, rotating credentials automatically?
What is the purpose of an Amazon VPC NAT Gateway?
Which AWS service provides machine learning-powered anomaly detection for AWS costs?
Which AWS service provides a way to manage and deploy software packages and artifacts, such as npm, Maven, and PyPI packages, within an organization?
Which AWS feature allows you to define a maximum permission boundary for what an IAM entity can do, regardless of its attached policies?
A company wants to ensure all new AWS accounts in their organization automatically comply with security policies. Which service provides guardrails for this?
Amazon Route 53's "failover routing policy" directs traffic to a secondary resource when the primary is unavailable. What must be configured to detect primary resource failure?
A company runs a multi-tier application with a web tier, app tier, and database tier on AWS. They want to prevent the database tier from being directly accessible from the internet. What is the BEST architecture?
A company's architect says: "We should design our AWS workload to be STATELESS wherever possible." Why?
A company uses AWS and discovers a publicly accessible S3 bucket containing customer PII. Under GDPR, they must report data breaches to their supervisory authority within 72 hours of discovery. Which AWS service helps them determine WHAT DATA was exposed and to WHOM?
A company wants to ensure that IAM policies in their organization NEVER contain wildcards in the Action field for production accounts. Which mechanism DETECTS this automatically?
Which AWS service provides CENTRALIZED VISIBILITY into software vulnerabilities across EC2 instances and container images — aggregating findings with severity ratings and remediation guidance?
A company has a STRICT COMPLIANCE REQUIREMENT: no data may leave the US. They use AWS and accidentally deploy an S3 bucket in eu-west-1. Which service detects this policy violation?
What is the PRIMARY SECURITY BENEFIT of using IAM ROLES for EC2 instances instead of IAM user access keys stored on the instance?
A company uses AWS Organizations. They want to ensure that NO MEMBER ACCOUNT can create RESOURCES OUTSIDE OF APPROVED REGIONS (us-east-1, us-west-2) and this restriction should be IMPOSSIBLE TO BYPASS even by account root users. Which control achieves this?
A company is preparing for a SOC 2 Type II audit. An auditor asks for evidence that AWS infrastructure meets security controls. Where does the company obtain AWS's SOC 2 report?
Which of the following BEST describes the AWS SHARED RESPONSIBILITY MODEL for AMAZON DynamoDB?
A company uses AWS and wants to AUTOMATICALLY QUARANTINE an EC2 instance when GuardDuty detects it's been compromised — moving it to an isolated security group with no inbound/outbound access. Which architecture achieves this automatically?
A company uses AWS and wants to enforce that all AMAZON EBS VOLUMES are ENCRYPTED — preventing any unencrypted volume from being created in their accounts. What is the MOST EFFECTIVE preventive control?
What is the key difference between AMAZON COGNITO USER POOLS and AWS IAM IDENTITY CENTER for managing user authentication?
A company uses AWS WAF. A security analyst notices a specific IP address is performing reconnaissance (scanning for vulnerabilities) against their application. They want to BLOCK this IP immediately. Which is the FASTEST method?
Which of the following statements about AWS KEY MANAGEMENT SERVICE (KMS) is CORRECT?
A company uses AWS and wants to ensure their LAMBDA FUNCTIONS cannot be invoked by any external service EXCEPT API GATEWAY from their account. Which mechanism enforces this?
A company conducts a PENETRATION TEST against their AWS infrastructure. The test reveals that an IAM role has more permissions than needed. What security principle does this violate and what should be done?
Which AWS service provides FULLY MANAGED SSL/TLS TERMINATION at the load balancer — offloading decryption from EC2 instances to the ALB?
A company stores data in AMAZON S3. They want to ANALYZE the access patterns to their S3 bucket — understanding which objects are accessed frequently and which are never accessed — to OPTIMIZE STORAGE CLASS SELECTION. Which S3 feature provides this?
A company uses AMAZON CLOUDFRONT. They notice that some users in a specific country are trying to access their application which is not licensed for that country. Which CloudFront feature addresses this?
A company uses AMAZON RDS. Their application queries are running slowly. An investigation reveals that a database query runs without an index — doing a full table scan on 100 million rows. This is an application-layer problem. Under the shared responsibility model, who is responsible for fixing this?
A company uses AWS and wants to TRACK ALL API CALLS made by a specific Lambda function to AWS services — for security auditing. Which service provides this specific traceability?
A company uses AMAZON AURORA POSTGRESQL. They want to accept DATABASE CONNECTIONS using IAM AUTHENTICATION instead of database passwords. Which Aurora feature enables this?
A company uses AWS and wants to detect when their AMAZON S3 BUCKET has objects with UNENCRYPTED STORAGE. Which AWS service provides this automated detection?
A company uses AMAZON EC2. They want to understand why their instance has HIGH CPU UTILIZATION — specifically which PROCESSES are consuming CPU. Which approach provides this visibility?
A company uses AMAZON VPC and wants to MONITOR ALL NETWORK TRAFFIC FLOWS between subnets — for security analysis and troubleshooting. Which AWS feature captures this data?
A company uses AMAZON CLOUDFRONT. Their application serves PERSONALIZED CONTENT for each logged-in user. They want CloudFront to cache PER-USER content — using the user's session cookie to create different cache keys. Which CloudFront configuration achieves this?
A company uses AWS ORGANIZATIONS. The management account has been granted DELEGATED ADMINISTRATOR status for Amazon Inspector. Which account's Inspector findings can the delegated admin see?
A company uses AWS and wants to provide TEMPORARY ELEVATED ACCESS to a contractor for one week to complete a specific project. What is the MOST SECURE approach?
A company uses AMAZON S3 and wants to ENSURE THAT DELETED OBJECTS CAN BE RECOVERED for up to 30 days after accidental deletion. Which feature enables this?
A company uses AMAZON API GATEWAY. They want to PROTECT THEIR BACKEND from BEING OVERWHELMED by API requests — limiting each API key to 100 requests per second. Which feature enforces this?
A company uses AMAZON CLOUDFRONT and wants to ADD SECURITY HEADERS (e.g., Strict-Transport-Security, X-Content-Type-Options) to ALL RESPONSES before they reach the user. Which feature adds headers with the LEAST LATENCY OVERHEAD?
A company uses AWS and wants to enable DEVELOPERS to provision APPROVED AWS RESOURCES SELF-SERVICE — without giving them direct IAM access to create arbitrary infrastructure. Which service provides this governed self-service?
A company uses AWS and deploys a new microservice. They want to GRADUALLY INTRODUCE IT to production traffic using a FEATURE FLAG — serving the new service to 5% of users while 95% continue using the old service. Which pattern achieves this at the NETWORK LEVEL?
A company uses AMAZON EC2. After a SECURITY INCIDENT, they need to CAPTURE ALL NETWORK TRAFFIC to/from a specific EC2 instance for forensic analysis. Which AWS feature enables this?
A company uses AWS and wants to implement CHAOS ENGINEERING to test application resilience. Which AWS-native approach supports CONTROLLED FAULT INJECTION?
A company completes all 12 sets of practice questions — 1,200 total. Their exam is tomorrow. Which action would MOST improve their probability of passing?
A company wants to GENERATE A REPORT showing all IAM users who have NOT LOGGED IN to the AWS console in the past 90 days. Which IAM feature provides this?
Under the AWS Shared Responsibility Model, which of the following is AWS's responsibility for AMAZON LAMBDA?
A company uses AWS WAF. They want to BLOCK IP ADDRESSES that are known malicious sources without manually maintaining an IP block list. Which AWS WAF feature automates this?
A company's security audit finds that their EC2 instances can SSH from ANY IP ADDRESS (0.0.0.0/0 on port 22). Which AWS SERVICE would have flagged this as a security finding AUTOMATICALLY?
A company uses AWS ORGANIZATIONS and applies an SCP that denies `ec2:RunInstances` for all member accounts. An IAM administrator in a member account creates an IAM policy that allows `ec2:RunInstances` and attaches it to a role. Can that role launch EC2 instances?
A company wants to enable SINGLE SIGN-ON (SSO) for their AWS accounts so employees use ONE set of corporate credentials to access multiple AWS accounts without re-entering passwords. Which service provides this?
Which of the following is an example of DATA CLASSIFICATION as a security best practice in AWS?
What is the purpose of AMAZON DETECTIVE?
A company stores HEALTHCARE DATA on AWS and needs to comply with HIPAA. What is the FIRST required step to use AWS for HIPAA-eligible workloads?
Which AWS SERVICE is used to DETECT, PREVENT, and PROTECT against LAYER 7 (application layer) attacks such as SQL INJECTION and CROSS-SITE SCRIPTING (XSS) targeting web applications?
Which of the following describes the purpose of AWS CERTIFICATE MANAGER (ACM)?
What is the KEY DIFFERENCE between AMAZON INSPECTOR and AMAZON MACIE?
A company uses AWS and a developer accidentally commits an IAM access key to a public GitHub repository. AWS detects this through its partner secret scanning program. What does AWS do AUTOMATICALLY?
Which of the following BEST describes "DEFENSE IN DEPTH" as applied to AWS security architecture?
A company uses AMAZON S3 and wants to ensure that ALL NEW BUCKETS and OBJECTS are NEVER publicly accessible by default — without having to configure each bucket individually. What is the MOST EFFICIENT approach?
What does AWS ELASTIC BEANSTALK automatically manage on behalf of the developer? (Choose TWO)
What is the difference between AMAZON EBS "SNAPSHOTS" and EBS "VOLUME ENCRYPTION"?
A company uses AWS SYSTEMS MANAGER PARAMETER STORE to store database connection strings. They want to ensure these values are encrypted and that only specific Lambda functions can access them. Which Parameter Store configuration and IAM approach achieves this?
What is the purpose of AWS SYSTEMS MANAGER SESSION MANAGER?
Which Amazon S3 feature ensures that DATA CANNOT BE DELETED OR OVERWRITTEN for a specified retention period — meeting SEC, FINRA, and CFTC compliance requirements for immutable records?
What is the purpose of AMAZON COGNITO's "USER POOL GROUPS"?
A company wants to MONITOR THEIR AWS ACCOUNT for UNUSUAL API ACTIVITY — specifically, an IAM user logging in from an unexpected geographic location at an unusual time. Which service provides this detection?
A company uses AMAZON S3 and wants to minimize costs for data that must be RETAINED FOR COMPLIANCE for 7 YEARS but will RARELY (almost never) be accessed after the first 30 days. Which is the MOST COST-EFFECTIVE S3 STORAGE CLASS for the 7-year retention period after 30 days?
A company uses MULTIPLE AWS ACCOUNTS and wants to SHARE VPC RESOURCES (subnets) across accounts so that EC2 instances in different accounts can communicate using private IP addresses without VPC peering. Which feature enables this?
A company uses AWS and wants to RESTRICT WHICH REGIONS their employees can deploy resources in — but also wants to ALLOW exceptions for specific teams that legitimately need access to additional Regions. What is the BEST ARCHITECTURE for this using AWS Organizations?
A company uses AWS and needs to ensure their APPLICATION CAN SURVIVE THE LOSS OF AN ENTIRE AWS AVAILABILITY ZONE. What is the MINIMUM architecture change required?
Which AWS service helps you IDENTIFY PATTERNS and correlate security events across your AWS account — for example, identifying that a specific IAM user made suspicious API calls, then an EC2 instance in the same account started communicating with external IPs 10 minutes later?
A company uses AMAZON ECS with FARGATE. Their containerized application needs to access secrets from AWS Secrets Manager at STARTUP. Which is the CORRECT, MOST SECURE way to configure this?
Which of the following CORRECTLY describes the purpose of an AMAZON VPC "INTERNET GATEWAY" (IGW)?
A company wants to track WHO CREATED or MODIFIED each AWS RESOURCE — for both auditing and cost allocation purposes. Which combination of AWS features achieves BOTH goals simultaneously?
A company uses AMAZON EC2 and wants to ensure that their PRODUCTION INSTANCES have the REQUIRED TAGS applied. If an instance is launched without the required tags, they want AUTOMATIC NOTIFICATION. What is the CORRECT setup?
What is the purpose of AMAZON WORKSPACES WEB?
A company wants to AUTOMATICALLY DISCOVER ALL APPLICATIONS AND SERVICES running in their AWS account and create a SERVICE MAP showing dependencies. Which AWS service provides this?
A company uses AWS and wants to ENSURE THAT ALL EC2 INSTANCES IN THEIR ACCOUNT HAVE THE SSM AGENT INSTALLED and are reachable by Systems Manager. Which AWS Config managed rule checks this?
What is AMAZON CONNECT and what category of service is it?
Which of the following CORRECTLY describes how AMAZON VPC NETWORK ACLs differ from SECURITY GROUPS?
A company wants to provide SECURE ACCESS to their INTERNAL WEB APPLICATIONS for remote employees using their personal devices — without deploying VPN infrastructure or requiring device management enrollment. Which AWS service addresses this?
A company wants to enable AUTOMATED THREAT DETECTION across all AWS accounts in their Organization from a CENTRAL ACCOUNT. Which service and configuration achieves this?
A company uses AMAZON SES to send transactional emails. They want to know when emails BOUNCE or generate SPAM COMPLAINTS so they can clean their email lists. Which SES feature provides this?
A company has completed studying all 10 sets of CLF-C02 practice questions (1,000 questions total). They are one day before the exam. What is the BEST final preparation strategy?
A company wants to validate whether their planned AWS architecture follows best practices BEFORE they build anything. Which AWS resource provides architecture reference examples and whitepapers for common use cases?
Which of the following is an example of "SERVERLESS" in the context of AWS — meaning the customer has ZERO infrastructure management responsibility?
A company uses AWS and stores data in Amazon S3. A compliance auditor asks: "How do we prove that our S3 data has never been accessed by unauthorized parties?" Which combination provides the STRONGEST EVIDENCE?
Which AWS feature allows you to REQUIRE that ALL API CALLS to your AWS account include MULTI-FACTOR AUTHENTICATION — blocking even administrator-level access without MFA?
A company uses Amazon EC2. An attacker exploits a vulnerability in the application running on the instance and gains OS-level access. Under the shared responsibility model, who is responsible for the security gap that allowed this?
Which of the following BEST describes the purpose of AWS SECURITY HUB's "FINDINGS"?
A developer needs to access AWS resources from their LOCAL MACHINE during development. What is the RECOMMENDED way to configure credentials?
What is the difference between AWS CONFIG's "MANAGED RULES" and "CUSTOM RULES"?
A company's security policy requires that ALL EC2 INSTANCES have the SSM agent installed and be registered with Systems Manager. Which AWS Config managed rule enforces this?
Which of the following is the MOST SIGNIFICANT security risk of using LONG-TERM IAM ACCESS KEYS compared to TEMPORARY CREDENTIALS?
A company has 20 developers who need read-only access to Amazon S3. What is the MOST EFFICIENT IAM approach that also follows best practices?
What is the AWS "SHARED SIGNALS AND EVENTS" concept introduced with Amazon Security Lake?
A company uses AWS WAF. They notice legitimate users being blocked by a rate-based rule. How should they address this WITHOUT removing the rate-based rule?
Which of the following is TRUE about the AWS NITRO ENCLAVES feature?
A company wants to AUTOMATICALLY ROTATE database passwords in Amazon RDS every 30 days without application downtime. Which service provides this with BUILT-IN RDS SUPPORT?
What is the key security benefit of AWS VERIFIED ACCESS compared to traditional VPN-based access?
Which of the following is the CORRECT way to restrict an IAM role so it can ONLY BE ASSUMED FROM WITHIN A SPECIFIC AWS ACCOUNT?
What is the DIFFERENCE between an Amazon RDS "AUTOMATED BACKUP" and an "RDS SNAPSHOT"?
A company wants to run WINDOWS VIRTUAL DESKTOPS for 500 remote employees, each needing persistent settings and files, accessible from personal devices. Which AWS service provides this?
Which AWS SERVICE HELPS IDENTIFY AND REMOVE UNUSED IAM ROLES, POLICIES, AND PERMISSIONS based on actual API usage over the past 90 days?
What is AMAZON COGNITO SYNC (now superseded by AWS AppSync)?
A company runs a MICROSERVICES architecture on AWS. They want to enable SERVICE MESH capabilities — mutual TLS between services, traffic management, and observability — without modifying application code. Which AWS service provides this?
A company uses AMAZON ECS ON FARGATE. They need containers to access secrets from AWS Secrets Manager. What is the MOST SECURE way to inject the secrets?
A company uses AMAZON KINESIS DATA STREAMS. They want to ensure messages are processed in ORDER and EACH RECORD IS PROCESSED EXACTLY ONCE per consumer. Which Kinesis feature addresses ordering?
A company uses AWS and wants to AUTOMATICALLY TAG ALL NEWLY CREATED RESOURCES with the creator's IAM user name and creation date. Which approach achieves this?
A company uses AWS and wants to RESTRICT which INSTANCE TYPES can be launched in their accounts to only cost-effective sizes. Which mechanism enforces this?
A company's team creates and destroys many EC2 instances for testing. Each instance uses an Elastic IP. What cost do they incur from the EIPs?
A company uses AWS ORGANIZATIONS and wants to PREVENT ACCOUNTS FROM LEAVING THE ORGANIZATION without management account approval. Which mechanism enforces this?
What is the MAXIMUM DURATION for which an IAM ROLE CAN BE ASSUMED using AWS STS AssumeRole?
Which AWS service enables AUTOMATIC DISCOVERY AND CLASSIFICATION OF SENSITIVE DATA across all S3 buckets in an AWS Organization from a SINGLE DELEGATED ADMINISTRATOR ACCOUNT?
What does AMAZON CONNECT'S "CONTACT LENS" feature provide?
A company uses AWS and wants to understand which SPECIFIC AWS ACTIONS their LAMBDA FUNCTION has performed over the last 30 days — for a security audit. Which service provides this?
What is the purpose of AWS BACKUP's "BACKUP VAULT LOCK"?
A company uses EC2 and regularly rotates ACCESS KEYS for IAM USERS. They want to DETECT WHEN ACCESS KEYS ARE MORE THAN 90 DAYS OLD. Which combination achieves automated detection and notification?
A company wants to HOST AN INTERNAL COMPANY WIKI accessible only to employees connected to their corporate VPN. The wiki will be on AWS. Which architecture achieves this with LEAST COMPLEXITY?
Which of the following is a VALID USE CASE for AMAZON MECHANICAL TURK (MTurk)?
A company completes all 7 sets of practice questions and is ready for the CLF-C02 exam. They ask: "What are the MOST IMPORTANT things to remember on exam day?" Which combination of strategies is BEST?
A company is concerned that moving to AWS will mean losing control over where their data physically resides. Which AWS feature directly addresses this concern?
Which AWS service continuously assesses EC2 instances and container images for software vulnerabilities and unintended network exposure?
A company wants to ensure that no S3 buckets in any account in their AWS Organization can ever be made public. What is the MOST effective control?
Which of the following tasks can ONLY be performed by the AWS account root user?
A company's security team requires that all API calls to AWS services be logged, including calls made by AWS services on the company's behalf. Which CloudTrail feature covers this?
AWS WAF can be attached to which of the following services? (Choose TWO)
What is the key difference between AWS KMS Customer Managed Keys (CMKs) and AWS Managed Keys?
A developer is assigned to a project temporarily and needs read access to specific S3 buckets for 8 hours. What is the MOST secure way to grant this?
Which AWS service provides a managed PKI (Public Key Infrastructure) to issue and manage SSL/TLS certificates for use with AWS services?
Which of the following is TRUE about AWS Shield Standard?
A company wants to implement single sign-on (SSO) so employees can use their existing corporate Active Directory credentials to access AWS. Which service enables this?
Under the AWS shared responsibility model, which of the following is the customer's responsibility when using AWS Lambda?
What is the purpose of AWS IAM Access Analyzer?
A company must ensure their AWS workloads comply with HIPAA. What must they FIRST establish with AWS?
Which AWS service uses BEHAVIORAL analysis to detect compromised EC2 instances that are communicating with known malicious IP addresses?
Which of the following CORRECTLY describes the relationship between AWS Organizations SCPs and IAM policies?
Which AWS service allows you to create a PRIVATE connection from a VPC to supported AWS services WITHOUT requiring an Internet Gateway, NAT device, VPN, or Direct Connect?
Which AWS service is used to centrally manage software inventory, patch management, and run commands on fleets of EC2 instances and on-premises servers?
What is the key benefit of using AWS Elastic Load Balancing in combination with Auto Scaling?
How does AWS calculate the cost of Amazon S3 storage?
A company wants to enforce that all EC2 instances in their account have a specific tag (e.g., `Environment: Production`). Which service can detect and alert on non-compliant resources?
What is Amazon Elastic Transcoder used for?
A company is hosting a static website on Amazon S3. To serve it over HTTPS with a custom domain, which combination of services is required?
What is the purpose of Amazon Cognito User Pools?
What is the main difference between AWS CloudTrail and Amazon CloudWatch?
A company wants to enable their development teams to deploy resources in AWS while ensuring they cannot create IAM users or access billing information. Which mechanism enforces this ACROSS ALL ACCOUNTS in an organization?
What is the function of an Amazon S3 "presigned URL"?
Which of the following is TRUE about AWS Direct Connect compared to AWS Site-to-Site VPN?
Which feature of Amazon CloudFront reduces latency for DYNAMIC content that cannot be cached?
An organization wants to give a third-party auditor read-only access to their AWS environment for a compliance review WITHOUT creating IAM users with long-lived credentials. What is the BEST approach?
A company's CTO claims: "Moving to AWS means we lose visibility into our infrastructure — AWS controls everything." Which statement MOST ACCURATELY refutes this?
A company's on-premises data center uses physical servers for peak demand but those servers are idle 70% of the time. Moving to AWS would allow them to right-size. Which TWO cloud advantages DIRECTLY address this waste?
A company's AWS account shows ROOT USER API CALLS in CloudTrail logs from an unexpected IP address. Which is the MOST IMPORTANT immediate action?
What is the key difference between AWS SHIELD STANDARD and AWS SHIELD ADVANCED?
A company uses AWS and wants to implement a "BREAK GLASS" procedure — allowing emergency admin access to an account ONLY when absolutely necessary, with all access logged. What is the BEST architecture?
Which of the following represents a CUSTOMER responsibility under the shared responsibility model for AMAZON S3?
A company uses IAM. A security review finds that several IAM roles have `"Resource": "*"` in their policies. Why is this a concern and what is the recommended fix?
Which statement about AMAZON GUARDDUTY is CORRECT?
A company wants to manage ENCRYPTION KEYS that they control — not AWS. They want to be able to rotate, audit, and restrict access to specific keys. Which service enables this?
A new employee joins an engineering team and needs the same AWS permissions as other team members. What is the MOST EFFICIENT IAM approach that also follows best practices?
What is the PRIMARY purpose of AMAZON COGNITO in a mobile application context?
A company uses AWS CLOUDTRAIL. They realize CloudTrail has been DISABLED in one Region for 2 weeks. Which additional service provides compensating detective controls for this gap?
Which of the following is an example of using IAM to implement the SECURITY PILLAR best practice of "applying security at all layers"?
What is the purpose of AWS AUDIT MANAGER?
A company is deploying a new FINANCIAL SERVICES application on AWS that processes credit card transactions. Which AWS compliance resource provides ATTESTATIONS that AWS infrastructure meets PCI DSS requirements?
Which AWS service continuously monitors NETWORK TRAFFIC entering and leaving AWS RESOURCES within a VPC and generates findings about potential threats such as port scanning or unusual traffic patterns?
A company discovers that several EC2 instances were LAUNCHED WITHOUT REQUIRED SECURITY TAGS, violating governance policy. Which TWO mechanisms should they implement to PREVENT this going forward?
Which of the following CORRECTLY describes AMAZON CLOUDFRONT's "PRICE CLASSES"?
A company uses AMAZON ECS. Their application tasks require access to DIFFERENT S3 BUCKETS based on the environment (dev tasks access dev-bucket, prod tasks access prod-bucket). How should they implement this?
A company wants to detect SECURITY VULNERABILITIES IN THEIR APPLICATION CODE before it's deployed. Which AWS service provides automated code security analysis?
What is the purpose of AWS SYSTEMS MANAGER PATCH MANAGER?
A company uses AMAZON VPC and needs to ALLOW TRAFFIC FROM THE INTERNET to reach EC2 instances in a PUBLIC SUBNET. Which TWO COMPONENTS must be in place?
A company uses AMAZON DYNAMODB. They experience throttling on their table during peak hours. Their access pattern shows one product (product_id = "BEST_SELLER_001") receives 80% of all reads. What is this problem called and what is the recommended solution?
Which Amazon EC2 PURCHASING OPTION allows a company to SPECIFY the EXACT PHYSICAL HOST they want their instances to run on — useful for software license compliance requiring per-socket or per-core licensing?
What is the purpose of AMAZON EVENTBRIDGE ARCHIVE AND REPLAY?
A company wants to MONITOR THEIR LAMBDA FUNCTIONS and receive ALERTS when the ERROR RATE exceeds 1% over a 5-minute window. Which configuration achieves this?
Which AWS service allows you to CREATE DASHBOARDS COMBINING DATA FROM MULTIPLE AWS ACCOUNTS AND SERVICES — including operational metrics, security findings, cost data, and custom application metrics — in a single customizable view?
A company uses AWS and a developer accidentally DELETES AN S3 BUCKET containing important data. The bucket had VERSIONING ENABLED and S3 OBJECT LOCK was NOT configured. Can the data be recovered?
A company wants to ensure COMPLIANCE ACROSS ALL AWS ACCOUNTS in their Organization — specifically checking that ALL S3 buckets have encryption enabled, all EC2 instances are within a VPC, and all IAM users have MFA. Which service aggregates Config compliance across all accounts?
Which of the following is TRUE about AWS DIRECT CONNECT compared to AWS SITE-TO-SITE VPN?
A company uses AMAZON S3 and wants to ensure that OBJECTS UPLOADED TO A BUCKET ARE ALWAYS STORED WITH AES-256 ENCRYPTION, regardless of what the uploader specifies. What is the SIMPLEST configuration?
Which of the following is the CORRECT way to provide an EC2 INSTANCE with permissions to READ FROM AN S3 BUCKET without storing credentials on the instance?
A company uses AWS and wants to ENCRYPT DATA BEFORE IT LEAVES THE APPLICATION — ensuring AWS never sees the plaintext, even for services like KMS. Which encryption approach achieves this?
A company uses AMAZON ECS ON FARGATE. Their containerized application is experiencing intermittent PERFORMANCE DEGRADATION. Which AWS service provides the REQUEST-LEVEL TRACE showing exactly where latency occurs within the application?
Which of the following BEST describes the purpose of AWS RESOURCE GROUPS?
What is the purpose of AMAZON REKOGNITION's "CONTENT MODERATION" feature?
A company uses AMAZON VPC FLOW LOGS. Where can these logs be delivered? (Choose TWO)
A company wants to AUTOMATICALLY STOP EC2 INSTANCES that have had ZERO CPU UTILIZATION for more than 48 CONSECUTIVE HOURS (zombie instances). What is the BEST automated approach?
A company is building a SERVERLESS BACKEND for a mobile app. They need: authentication, a database, file storage, and a REST API. What is the MOST COMPLETE purpose-built combination for this?
A company has been using AWS for 3 years. Their Chief Security Officer asks: "How do we CONTINUOUSLY DEMONSTRATE to auditors that our AWS environment meets our security standards?" Which COMBINATION of AWS services provides the most comprehensive ongoing compliance evidence?
A company discovers an EC2 instance in their account is mining cryptocurrency. They did not launch this instance. Which AWS service would have FIRST detected this anomalous behavior?
Under the shared responsibility model, which security task does AWS ALWAYS perform regardless of which services a customer uses?
A company wants to receive an automatic alert if anyone attempts to log in to the AWS root account. Which combination achieves this?
What is the difference between AWS Shield Advanced and AWS WAF?
A new employee in the finance department needs access to only the AWS Cost Explorer. Which IAM best practice should be followed?
Which AWS service continuously monitors and records CONFIGURATION CHANGES to AWS resources, enabling compliance auditing and governance?
Which of the following describes "detective controls" in the context of AWS security?
A company's security policy requires that no S3 bucket in their account can have public read access. Which AWS feature enforces this at the ACCOUNT LEVEL?
Which of the following is a CUSTOMER responsibility when using Amazon DynamoDB?
What is the purpose of an IAM "condition" in a policy statement?
A company wants to ensure that access keys for IAM users are rotated every 90 days. Which AWS tool can CHECK compliance with this requirement automatically?
Which statement about AWS KMS is CORRECT?
A company needs to comply with a regulation requiring them to maintain logs of all AWS API activity for 7 years and ensure those logs cannot be altered or deleted. Which combination achieves this?
Which of the following is an example of a PREVENTIVE security control in AWS?
Amazon Cognito Identity Pools (Federated Identities) are used to:
Which of the following features is UNIQUE to Application Load Balancer (ALB) compared to Network Load Balancer (NLB)?
Which AWS service would a company use to discover, protect, and manage sensitive data in S3 buckets using machine learning — specifically identifying data like passport numbers, driver's license numbers, and financial account numbers?
What is the purpose of an AWS Transit Gateway ATTACHMENT?
Which of the following is NOT a factor in AWS EC2 pricing?
A company runs a web application. During a DDoS attack, their AWS bill increases significantly due to Auto Scaling adding many EC2 instances. Which AWS service provides FINANCIAL PROTECTION against this?
A team wants to ensure every resource deployed in their AWS account has an "Owner" tag. If a resource is created without this tag, it should be flagged immediately. What is the MOST automated solution?
Which AWS service acts as a SINGLE PANE OF GLASS for managing security findings from GuardDuty, Inspector, Macie, and other services across multiple accounts?
A company wants to allow their mobile app users to access data in their DynamoDB table WITHOUT creating IAM users for each. What is the recommended approach?
A company wants to monitor their on-premises servers alongside their AWS resources in a SINGLE DASHBOARD. Which AWS service enables this?
What is the primary purpose of AWS Compute Optimizer?
Which of the following is a KEY DIFFERENCE between Amazon SQS and Amazon SNS?
What does Amazon Kendra provide?
Which statement about AWS Direct Connect is CORRECT?
A company's legal team asks whether AWS customers can choose which AWS Region their data is stored in to meet data sovereignty requirements. What is the CORRECT answer?
A startup with no existing infrastructure wants to launch a global web application within 24 hours. Which cloud characteristic makes this FEASIBLE in a way it would NOT be with traditional IT?
Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using AMAZON RDS?
A company wants to ensure that their IAM users CANNOT PERFORM ANY ACTION unless they are using MFA. They want this to apply organization-wide across all 30 AWS accounts. What is the MOST SCALABLE approach?
Which of the following is the PRIMARY purpose of AWS CLOUDTRAIL?
A company needs to store database credentials for their application. The credentials must be retrievable by the application at runtime and must be rotated automatically every 30 days. Which service is PURPOSE-BUILT for this?
A security engineer is reviewing an IAM policy. The policy has: ``` Effect: Allow, Action: s3:GetObject, Resource: arn:aws:s3:::company-data/* Effect: Deny, Action: s3:GetObject, Resource: arn:aws:s3:::company-data/confidential/* ``` What can a user with this policy do?
What does AWS ARTIFACT provide that AWS TRUSTED ADVISOR does NOT?
A company wants to CENTRALLY MANAGE FIREWALL RULES across all their AWS accounts in an Organization. Which service enables this?
Which of the following is TRUE about AMAZON COGNITO USER POOLS vs. IDENTITY POOLS?
A company discovers an EC2 instance sending large amounts of traffic to an unknown external IP address at 3 AM. Which AWS service would have GENERATED A FINDING for this suspicious behavior?
A company uses AWS and needs to ensure all data in transit between their application and their RDS database is ENCRYPTED. Which approach is CORRECT?
Which AWS service provides AUTOMATED SECURITY ASSESSMENTS of EC2 instances checking for unintended network exposure and software vulnerabilities?
A company must demonstrate to regulators that no one tampered with their CloudTrail logs. Which CloudTrail feature provides this guarantee?
Which of the following BEST describes the concept of "LEAST PRIVILEGE" as applied in IAM?
A company uses AWS Organizations. They want to PREVENT ALL MEMBER ACCOUNTS from creating resources in regions outside of us-east-1 and eu-west-1. Which mechanism achieves this?
Which of the following CORRECTLY describes the AWS IAM "root user" and best practices for its use?
A company wants to deploy a STATIC WEBSITE globally with the lowest possible latency for users worldwide, HTTPS support, and minimal operational overhead. Which combination is BEST?
What is the PRIMARY purpose of AMAZON ROUTE 53?
Which AWS service provides MANAGED NETWORK FIREWALL capabilities for VPCs — stateful inspection, intrusion prevention, and domain-based filtering — that goes beyond Security Groups and NACLs?
What is the difference between AMAZON EBS "gp2" and "gp3" volume types?
What is the purpose of AMAZON CLOUDFRONT's integration with AWS WAF?
Which of the following CORRECTLY describes the purpose of an AMAZON VPC SECURITY GROUP?
What is the PRIMARY purpose of AMAZON API GATEWAY?
Which of the following is TRUE about AMAZON DYNAMODB's global secondary indexes (GSIs)?
A company uses AWS and wants to MONITOR THE PERFORMANCE of their LAMBDA FUNCTIONS — tracking invocation count, duration, errors, and throttles over time. Which service provides these metrics AUTOMATICALLY without any configuration?
What is the difference between AMAZON EC2 "DEDICATED INSTANCES" and "DEDICATED HOSTS"?
A company wants to build a SERVERLESS API that returns product recommendations. The API must authenticate users via a CORPORATE ACTIVE DIRECTORY and only serve authenticated requests. Which combination achieves this?
A company's AMAZON S3 BUCKET accidentally became publicly accessible and sensitive data was exposed. After securing the bucket, they want to understand EXACTLY WHICH FILES were accessed and by WHOM during the exposure window. Which service provides this information?
A company uses AWS CLOUDFORMATION. After a deployment, they notice that someone manually changed an EC2 security group that CloudFormation manages. The security group no longer matches the template. What should they do to detect and correct this?
Which AWS service provides a VISUAL, INTERACTIVE DIAGRAM of your AWS resources and their DEPENDENCIES in a specific Region?
A company uses AMAZON VPC. They want EC2 instances in a PRIVATE SUBNET to access AWS services like S3 and DynamoDB WITHOUT routing traffic over the internet or through a NAT Gateway. What should they configure?
A company uses AMAZON ECS WITH FARGATE to run containerized microservices. Each service needs access to different AWS resources (one needs S3, another needs DynamoDB). What is the MOST SECURE way to grant these permissions?
A company wants to protect their AMAZON EC2 INSTANCES from ACCIDENTAL TERMINATION by developers using the console or CLI. Which feature prevents this?
What does the AWS HEALTH DASHBOARD (Personal Health Dashboard) provide that the AWS SERVICE HEALTH DASHBOARD does NOT?
A company uses AWS and wants to ensure ALL S3 OBJECTS are encrypted using CUSTOMER-MANAGED KMS KEYS. If an upload doesn't specify encryption, the upload should be REJECTED. What policy enforces this?
Which of the following is the CORRECT description of AWS CONTROL TOWER's "GUARDRAILS"?
A company runs a MULTI-TIER APPLICATION on AWS. The web tier, application tier, and database tier are all in separate subnets. They want to ensure that ONLY the application tier can directly communicate with the database tier. Which is the MOST EFFECTIVE control?
Which AWS service can AUTOMATICALLY DISCOVER AND CLASSIFY SENSITIVE DATA (PII, financial records, credentials) stored in AMAZON S3 buckets across an entire AWS Organization?
Which AWS service provides a UNIFIED DASHBOARD aggregating operational data from AWS Config, CloudTrail, GuardDuty, Inspector, Macie, and other services — enabling security teams to prioritize findings across their entire AWS environment?
A company uses AMAZON CLOUDWATCH LOGS. They want to receive an alert when the keyword "ERROR" appears more than 10 times per minute in their application logs. What is the CORRECT configuration?
Which AWS service allows you to SET UP A COMPLETE MULTI-ACCOUNT AWS ENVIRONMENT with pre-configured security baselines, centralized logging, SSO, and account vending — following AWS best practices automatically?
Which AWS service provides END-TO-END DISTRIBUTED TRACING of requests flowing through MICROSERVICES — showing which services were called, how long each took, and where errors occurred?
Which of the following CORRECTLY describes AMAZON S3 "BUCKET POLICIES" compared to "IAM POLICIES" for controlling S3 access?
A company wants to PREVENT IAM USERS FROM DISABLING CLOUDTRAIL in their AWS account. What is the BEST mechanism?
A company wants to TRACK ALL CHANGES to their AWS resource configurations over time and RECEIVE NOTIFICATIONS when a resource becomes non-compliant with their policies. Which service provides this?
A company runs a HYBRID ARCHITECTURE — some workloads on-premises, some on AWS. They want employees to securely connect FROM THEIR LAPTOPS directly to resources in the AWS VPC without requiring a full site-to-site VPN. Which service enables this?
A company is preparing for the CLF-C02 exam. They ask: "What does the exam ACTUALLY test?" Which answer MOST accurately describes CLF-C02?
A company wants to understand the DIFFERENCE between the AWS "Personal Health Dashboard" and the "AWS Service Health Dashboard." Which statement is CORRECT?
A multinational company needs to process data in Europe without it ever leaving the EU due to GDPR. Which AWS concept ensures this?
A company has 500 EC2 instances. They need to run a script on ALL instances simultaneously without SSH access. Which AWS service enables this?
Which statement about AWS ORGANIZATIONS and CONSOLIDATED BILLING is CORRECT regarding SERVICE CONTROL POLICIES?
A company wants to enforce MFA for all IAM users when they attempt to change their own passwords or generate new access keys. Which mechanism enforces this WITHOUT blocking other actions?
What is the difference between "authentication" and "authorization" in AWS IAM?
A company uses EC2 instances with an IAM role. A developer complains that the role's permissions aren't working. Investigation reveals the role has `AdministratorAccess` but an SCP is attached at the OU level. What could the SCP be doing?
A security incident response team needs to PRESERVE EVIDENCE from a compromised EC2 instance. Which is the CORRECT first forensic step?
Which AWS service provides BEHAVIORAL threat detection for AWS ACCOUNTS AND WORKLOADS by analyzing over a trillion events per day using machine learning?
A company's compliance team asks: "Does AWS meet FedRAMP, SOC 2, and ISO 27001 requirements?" Where should they find the OFFICIAL authoritative answer?
A company is using AWS and stores customer credit card data. Under the SHARED RESPONSIBILITY MODEL, which statement about PCI DSS compliance is MOST accurate?
Which of the following CORRECTLY describes an AWS IAM "Permission Boundary"?
A company discovers that an ex-employee's IAM access keys are still active 30 days after they left. Which AWS service could have AUTOMATICALLY DETECTED and ALERTED on this?
Which AWS feature allows you to RESTRICT access to AWS Management Console based on the USER'S IP ADDRESS without modifying every IAM policy?
What does "AWS RESPONSIBLE DISCLOSURE" mean in the context of security?
Which of the following represents a VALID use of AWS SECURITY TOKEN SERVICE (STS)?
A company wants to deploy a web application that automatically handles SSL termination, load balancing, capacity provisioning, and health monitoring — with the ability to deploy new versions by uploading a ZIP file. Which AWS service provides this?
Which of the following is the CORRECT description of how AMAZON VPC PEERING works?
A company uses Amazon CloudFront and wants to RESTRICT content so that only users who have PAID for a subscription can view premium videos. Which CloudFront feature enables this?
A company uses AWS and wants to ensure UNUSED ELASTIC IP ADDRESSES are identified and released to avoid unnecessary charges. Which service identifies these?
What is the primary function of AMAZON MACIE's "SENSITIVE DATA DISCOVERY" jobs?
What is the maximum NUMBER OF RULES in a single AWS WAF Web ACL?
A company wants to AUTOMATICALLY REMEDIATE non-compliant S3 buckets (public access enabled) detected by AWS Config. What is the RECOMMENDED architecture?
What is the purpose of AMAZON COGNITO "hosted UI"?
A company needs to MONITOR SSL/TLS CERTIFICATE EXPIRATION for their ALB listeners and receive alerts 30 days before expiry. Which combination achieves this?
Which of the following CORRECTLY describes Amazon ECS "task definitions"?
A company uses AWS CloudFormation. They want to REUSE COMMON INFRASTRUCTURE PATTERNS (e.g., VPC, security groups) across multiple CloudFormation stacks WITHOUT duplicating code. Which feature enables this?
Which AWS service provides AUTOMATIC CODE REVIEWS powered by machine learning — analyzing pull requests for code quality issues, security vulnerabilities, and best practice violations?
A company wants to VISUALIZE THEIR AWS ARCHITECTURE — showing relationships between resources — after they're deployed. Which AWS service can generate these diagrams?
What is the purpose of AMAZON DETECTIVE?
What is the purpose of the "AWS ABUSE TEAM" and how does a company contact them?
Which of the following is a UNIQUE ADVANTAGE of using AWS SYSTEMS MANAGER PARAMETER STORE over Amazon S3 for storing configuration data?
Which of the following is the MOST COMPLETE description of what happens when you "ENABLE VERSIONING" on an S3 bucket?
Which AWS service provides AUTOMATIC OPERATIONAL ANOMALY DETECTION for applications — identifying unusual behavior in metrics, logs, and traces without manual threshold configuration?
Which of the following describes the AWS SHARED RESPONSIBILITY MODEL for SERVERLESS architectures (Lambda + API Gateway + DynamoDB)?
Which of the following represents a VALID reason to use AWS OUTPOSTS rather than a standard AWS Region?
What is the DIFFERENCE between "ENCRYPTION AT REST" using SSE-S3, SSE-KMS, and SSE-C in Amazon S3?
A company's application tier needs to communicate with an RDS database. The RDS instance is in a different subnet than the application tier. Which security control DIRECTLY allows this traffic?
A company's IT director argues: "Cloud is just renting someone else's computers — we lose control." Which AWS feature MOST directly refutes the "loss of control" concern?
A penetration tester wants to test the security of their AWS infrastructure. What must they do BEFORE conducting penetration testing on their own AWS resources?
Which of the following statements about AWS IAM is CORRECT regarding policy evaluation for CROSS-ACCOUNT access?
A company uses Amazon S3 to host sensitive documents. They want to ensure that even if an AWS employee has physical access to the storage hardware, they CANNOT read the contents. Which approach achieves this?
Which AWS service provides AUTOMATED REASONING to mathematically prove that IAM policies grant ONLY the intended access — detecting both overly permissive policies and policies that accidentally block intended access?
A company wants to ensure that ALL objects uploaded to a specific S3 bucket are ALWAYS encrypted — and that any upload request WITHOUT encryption is REJECTED. How do they enforce this?
What is the difference between AWS Shield Standard and AWS Shield Advanced regarding LAYER 7 (application layer) DDoS protection?
A company wants to enforce that their developers CANNOT delete CloudTrail logs. They also want to prevent even root-account users in member accounts from disabling this requirement. What is the MOST appropriate mechanism?
Which of the following correctly describes the concept of "non-repudiation" in the context of AWS CloudTrail?
A security engineer notices that an IAM role has `"Effect": "Allow", "Action": "*", "Resource": "*"` in its policy. What is the risk and recommended action?
Which AWS service provides a HARDWARE ROOT OF TRUST to validate that EC2 instances boot from known-good firmware and software — protecting against rootkit attacks?
A company's compliance team requires that ALL AWS API activity be retained for 3 years and that NOBODY — including root — can delete the logs. Which S3 Object Lock mode achieves this?
When AWS describes "security at every layer," which of the following BEST illustrates this principle in a web application architecture?
A company uses AWS and wants to implement "zero trust networking." Which AWS services BEST support this model?
Which statement about AWS Config RULES is CORRECT?
A company discovers that someone used a stolen IAM access key to list S3 buckets in their account. Which is the CORRECT ORDER of immediate response actions?
What is the primary function of Amazon EC2 Instance Metadata Service (IMDS)?
What is IMDSv2 and why is it preferred over IMDSv1?
A company runs a microservices application using Amazon ECS. One service is a payment processor that should NEVER be taken offline by any scaling or deployment action. Which ECS feature protects running tasks?
Which Amazon VPC component acts as a ROUTER for traffic BETWEEN SUBNETS within a VPC and to external destinations?
What is the PRIMARY use case for Amazon ElastiCache for MEMCACHED compared to ElastiCache for REDIS?
A company needs a network connection between their on-premises data center and AWS that is FASTER TO PROVISION than Direct Connect but MORE RELIABLE than a standard internet connection. Which service provides this?
Which Amazon S3 feature generates a CSV or ORC inventory of all objects in a bucket — useful for audit, compliance, and large-scale batch operations?
A company wants to understand their S3 usage patterns and cost optimization opportunities ACROSS ALL ACCOUNTS AND REGIONS in their organization. Which service provides this organization-wide view?
Which AWS networking feature provides an IP ADDRESS RANGE that is AUTOMATICALLY UPDATED as AWS adds or removes service IPs — used in security group rules and route tables?
Which of the following CORRECTLY describes Amazon CloudFront's "behavior" configuration?
What does the `aws:RequestTag` IAM condition key enable?
What is the purpose of Amazon EventBridge PIPES?
A company has multiple AWS accounts and wants ONE S3 bucket to centralize CloudTrail logs from ALL accounts. What is the MOST appropriate configuration?
Which AWS service allows you to create PRIVATE HOSTED ZONES — DNS zones resolvable ONLY within a specific VPC?
A company wants to allow developers to assume an IAM role in a PRODUCTION account from their DEVELOPMENT account — without creating IAM users in the production account. What is required?
What does Amazon S3 "REPLICATION TIME CONTROL" (RTC) provide that standard S3 replication does NOT?
A company uses Amazon EKS. They want the Kubernetes pods to securely access AWS services (DynamoDB, S3) using IAM permissions WITHOUT embedding credentials. Which feature enables this?
What is the difference between Amazon SageMaker "Training Jobs" and "Processing Jobs"?
A company uses Amazon Kinesis Data Streams with 10 shards. Each shard supports up to 1 MB/s write and 2 MB/s read. The company's application writes at 8 MB/s and reads at 15 MB/s. What should they do?
A company wants to ensure their Amazon RDS instance is accessible ONLY from a specific EC2 instance — not from the internet or any other source. What is the MOST appropriate configuration?
A company wants to track and VISUALIZE the DEPENDENCIES between their AWS services — understanding the flow of requests through their distributed application. Which AWS service enables this?
Which of the following accurately describes the AWS SHARED RESPONSIBILITY MODEL for AMAZON ELASTIC KUBERNETES SERVICE (EKS)?
A company's S3 bucket is accidentally made public. AWS sends an alert to the customer. Which AWS SERVICE generates this type of finding?
Which of the following CORRECTLY describes the relationship between Amazon CloudFront and AWS WAF?
A company runs a SERVERLESS APPLICATION using API Gateway, Lambda, and DynamoDB. To monitor END-TO-END request tracing and identify which Lambda function is causing latency, which service should they use?
A company uses Amazon SQS and notices messages are not being processed even though there are consumers running. Investigation reveals messages in the queue but consumers receiving empty responses. What is the MOST LIKELY cause?
Which AWS feature allows you to EXTEND your on-premises Active Directory to AWS — without replacing it — so that EC2 instances can join the existing domain?
A company wants to detect DRIFT in their deployed CloudFormation stacks automatically and receive notifications. Which is the CORRECT approach?
Which of the following is the CORRECT description of "AWS Managed Policies" vs "Customer Managed Policies" in IAM?
What is the purpose of Amazon Elastic Container Registry (ECR) "image scanning"?
Which of the following MOST comprehensively describes what AWS means by "the cloud" in the phrase "security IN the cloud is the customer's responsibility"?
Which of the following is an example of "going global in minutes" as a benefit of AWS Cloud?
What does AWS mean by "undifferentiated heavy lifting"?
Which of the following is the MOST SECURE way to provide an external auditor with read-only access to specific AWS resources?
What is an AWS "Organizations Service Control Policy" (SCP) in Deny list mode vs. Allow list mode?
A company's security policy requires that EC2 instances in a private subnet can ONLY communicate with specific AWS services (S3 and DynamoDB) and nothing else on the internet. What is the MOST appropriate configuration?
Which AWS service provides AUTOMATED SECURITY ASSESSMENTS specifically for CONTAINER IMAGES stored in Amazon ECR?
A company uses AWS and needs to comply with GDPR's "right to erasure" (right to be forgotten). A user requests deletion of all their personal data. Which S3 feature could COMPLICATE this request?
What does "security by design" mean in AWS architecture?