Security and Compliance — page 3
Which IAM policy type is applied directly to an AWS resource (like an SQS queue or KMS key) and specifies WHO can access it and what they can do?
A company wants to use AWS services that have been independently validated to comply with FedRAMP requirements. Where can they find the list of FedRAMP-authorized AWS services?
Which of the following is an example of a "compensating control" in AWS security?
A large organization has 50 AWS accounts. They want a SINGLE dashboard showing security findings and compliance status across ALL accounts. Which service provides this?
Which of the following statements about Amazon GuardDuty is CORRECT?
A company accidentally exposed an S3 bucket containing customer data for 2 hours before blocking access. Under the shared responsibility model, who is responsible for this breach?
Which AWS feature enables you to CREATE TEMPORARY AWS CONSOLE ACCESS URLs for IAM users without requiring them to have a password?
What is the primary purpose of VPC Flow Logs?
A company uses AWS Organizations and wants to ensure that a specific member account can ONLY use services in the eu-west-1 and eu-central-1 Regions. How do they enforce this?
Which of the following is the CORRECT description of Amazon CloudFront's "Origin Shield"?
Which AWS service allows you to define and enforce network traffic policies across multiple VPCs and accounts using a MANAGED FIREWALL that operates at scale?
What is the AWS service that enables PRIVATE CONNECTIVITY between VPCs and on-premises networks at LAYER 2 (Ethernet) level?
A company uses Amazon ECS. When tasks are launched, they need to retrieve database passwords securely. Which is the MOST SECURE approach?
A company uses Amazon CloudFront. Their origin is an Application Load Balancer. They want to ensure that direct requests to the ALB (bypassing CloudFront) are BLOCKED. How can they achieve this?
What is the key difference between AWS CloudTrail "Management Events" and "Data Events"?
Which AWS service helps you CREATE AND MANAGE a multi-account AWS environment with guardrails, landing zones, and account vending automatically?
A company wants to implement a CI/CD pipeline entirely on AWS. Which combination of services provides CODE REPOSITORY, BUILD, TEST, and DEPLOY capabilities?
A company's application writes logs to CloudWatch Logs. They want to automatically TRIGGER AN ALERT when the error rate exceeds 5 errors per minute. What is the CORRECT configuration?
What is the purpose of an "AWS Landing Zone"?
Which AWS service provides a MANAGED DESKTOP-AS-A-SERVICE (DaaS) solution where users get a full Windows or Linux desktop in the cloud accessible from any device?
A company wants to use AWS but must ensure their data never leaves a specific geographic area (e.g., Germany) due to data sovereignty laws. Which AWS feature DIRECTLY supports this requirement?
Which of the following describes the "Principle of Defense in Depth" applied to AWS architectures?
A company has users in 50 countries. They want to ensure API requests are AUTHENTICATED using their existing corporate identity provider (IdP) without creating IAM users for everyone. Which service enables this?
What is the primary purpose of AWS PrivateLink?
A company's compliance requirement states that ALL API activity in their AWS account must be logged and retained for 5 years. What is the MOST complete solution?
A company wants to detect when their CloudFormation stack's deployed resources differ from the template definition (someone manually changed an S3 bucket policy outside of CloudFormation). Which feature identifies this?
What is the purpose of AWS CodeStar?
Which AWS service enables APPLICATION-LEVEL monitoring — tracking custom metrics like business KPIs (orders per minute, revenue per hour) alongside infrastructure metrics?
Which of the following AWS services is used to CREATE AND MANAGE SSL/TLS PRIVATE CERTIFICATE AUTHORITY for issuing private certificates within an organization?
A company is reviewing their AWS bill and sees charges for "EC2-Other." What does this typically include?
Which AWS CAF perspective is MOST focused on managing risk, maintaining compliance, and overseeing licenses?
A new employee needs access to specific S3 buckets and DynamoDB tables. What is the AWS BEST PRACTICE?
A security analyst sees 95% of malicious traffic from one country. Which WAF rule MOST efficiently blocks this?
Which task is ALWAYS the customer's responsibility under the Shared Responsibility Model — regardless of EC2, Lambda, RDS, or DynamoDB?
A company wants CloudTrail logs that CANNOT be deleted by any IAM user including administrators. Which combination achieves this?
A partner company needs access to a specific S3 bucket without creating IAM users in your account. They have their own AWS account. Which is MOST SECURE?
GuardDuty generates finding: UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B. What does this indicate?
A company requires MFA for ALL CLI API calls. How does a developer configure this?
What is the PRIMARY SECURITY PURPOSE of enabling VPC Flow Logs?
A company stores sensitive financial documents in S3. They want a SECOND SECURITY LAYER — protection even if bucket access controls are misconfigured. Which approach provides defense in depth?
How can a company audit which SCPs are applied to a member account and understand effective permissions?
An ACM-managed certificate is approaching expiry. What happens?
A company wants to detect when any IAM user creates access keys in near real-time. Which configuration achieves this?
Secrets Manager has automatic rotation enabled for an RDS password. What happens to the application during rotation?
Which CORRECTLY describes least privilege as applied to S3 bucket policies?
How can a company ensure ENCRYPTED COMMUNICATION between microservices in Amazon ECS?
Which AWS service provides VPC-level stateful firewall with domain filtering and IPS rules — going beyond Security Groups and NACLs?
How can a company PREVENT ACCIDENTAL DELETION of a production CloudFormation stack?
A company wants to ARCHIVE historical CloudWatch Logs to S3 for compliance. Which approach exports historical logs to S3?
A company wants to authenticate users AT THE EDGE — validating JWT tokens before requests reach the origin. Which CloudFront feature enables this?
A company wants ALL new S3 buckets in their account to be blocked from public access without per-bucket configuration. Which setting achieves this?
Developers frequently create and forget test EC2 instances. Which service IDENTIFIES idle and unused resources?
A company uses Amplify for their web app and wants MFA for CUSTOMER-FACING users (not AWS console users). Which service manages this?
A company wants a CUSTOM METRIC counting active user sessions to scale based on actual user load. Which approach publishes this to CloudWatch?
A company runs Fargate tasks that process sensitive data. They want CONTAINER EPHEMERAL STORAGE encrypted at rest. Which feature provides this?
A misconfigured public S3 bucket exposed 10,000 sensitive files for 3 days. Under GDPR, which TWO tools help determine what was accessed and from where?
After CodePipeline deploys to production, the team wants a SLACK NOTIFICATION. Which configuration achieves this?
Dev VPC (10.0.0.0/16) and Prod VPC (10.1.0.0/16) are in the same account. Developers need limited read-only access to Prod. What is the MOST SECURE approach?
When ALB returns a 503 error, CloudFront should show a CUSTOM ERROR PAGE instead of the raw ALB error. Which configuration achieves this?
A company wants to AUTOMATICALLY APPLY WAF rules to ALL API GATEWAY APIs across their ORGANIZATION without per-API configuration. Which service centralizes this?
Security team requires ALL TRAFFIC between EC2 and RDS MySQL to be ENCRYPTED in transit. Which approach ensures this?
A company studying for CLF-C02 wants to know which services are EXPLICITLY OUT-OF-SCOPE per the official exam guide appendix — so they don't waste study time.
A financial services firm asks: "What guarantees does AWS provide that our data won't be accessed by AWS employees?" Which concept BEST addresses this?
Which AWS service monitors network traffic flowing INTO and OUT OF your VPC and uses machine learning to identify potentially malicious activity?
A company requires that ALL data in transit between their application and AWS services be encrypted. Which protocol should they enforce?
An IAM policy has both an explicit ALLOW for `s3:GetObject` and an explicit DENY for `s3:GetObject` on the same resource. What is the result?
Which of the following is TRUE about AWS multi-factor authentication (MFA)?
A company wants to ensure that newly created IAM users in their organization CANNOT perform any actions until an administrator explicitly grants them permissions. What is the default behavior of a NEW IAM user?
Which feature of AWS Organizations allows you to DELEGATE administrative access for specific AWS services (like GuardDuty or Security Hub) to a member account instead of the management account?
A security audit reveals that several EC2 instances have security groups allowing inbound traffic from `0.0.0.0/0` on port 22 (SSH). Which AWS service can DETECT this misconfiguration automatically?
What is the difference between "encryption at rest" and "encryption in transit"?
An attacker attempts to execute a SQL injection attack against a web application hosted on an Application Load Balancer. Which AWS service is DESIGNED to detect and block this attack?
Which of the following scenarios demonstrates the CORRECT use of IAM roles vs. IAM users?
A company needs to demonstrate to regulators that no unauthorized changes were made to their AWS environment in the past 12 months. Which service provides this evidence?
Which AWS service provides HARDWARE SECURITY MODULE (HSM) capabilities with dedicated, single-tenant HSM hardware for highest-security key management requirements?
What is the purpose of an AWS "Service Last Accessed" report in IAM?
Which of the following best describes AWS "Macie's" integration with Amazon S3?
A company wants to use a THIRD-PARTY FIREWALL APPLIANCE (like Palo Alto or Fortinet) in their AWS VPC for deep packet inspection. Which service is DESIGNED for this use case?
What is the purpose of Amazon S3 Object Lock?
A company wants to give their mobile app users the ability to upload files directly to S3 without routing through their application servers. Which approach maintains security while reducing server load?
What does Amazon Route 53 "ALIAS record" provide that a standard CNAME does NOT?
A company uses AWS Lambda for image processing. When a Lambda function processes a large image, it occasionally runs out of memory. What should they adjust?
Which AWS service provides CENTRALIZED logging for AWS CloudTrail events, VPC Flow Logs, and Route 53 query logs across an entire AWS Organization?
A company uses AWS Organizations and wants to prevent any account from launching EC2 instances in unapproved Regions. What is the MOST effective mechanism?
A company stores patient medical records. HIPAA requires that all audit logs be retained for 7 years and be tamper-evident. Which combination BEST satisfies this?
Which feature of Amazon CloudFront allows you to run code at edge locations to customize HTTP requests and responses WITHOUT managing servers?
What is the PRIMARY advantage of using AWS Graviton processors (ARM-based) compared to Intel/AMD x86 instances?
A company uses AWS Config and discovers a non-compliant resource. They want to AUTOMATICALLY REMEDIATE the issue. What feature enables this?
A company wants to STREAM DESKTOP APPLICATIONS to users' browsers without requiring software installation on user devices. Which service enables this?
Which AWS service manages the LIFECYCLE of SSL/TLS certificates, including automatic renewal, for use with AWS services?
Which of the following correctly describes the "Whisperer" capability now integrated into Amazon Q Developer?
A company uses AWS and wants to understand which services are available in each AWS Region before deploying a new architecture. Where should they look?
A company migrates to AWS and their CIO asks: "Who is responsible if an AWS data center is physically broken into?" Under the shared responsibility model, who is responsible for this?
A company needs to migrate several TB of data from an on-premises NAS device to Amazon FSx. Which service can the company use to migrate the data over a VPN connection?
Which service has built-in Distributed Denial of Service (DDoS) protection?
What is a key cost advantage of moving to the AWS Cloud?
According to the AWS Shared Responsibility model, who is responsible for operating system patching for Amazon EC2 instances?
According to the AWS Shared Responsibility model, who is responsible for configuring server-side encryption for Amazon S3?
Which tool can be used to find compliance information that relates to the AWS Cloud platform?
What is AWS' policy regarding penetration testing?
Which service can assist with protecting against common web-based exploits?
Which service is involved with encryption?
According to the AWS Shared Responsibility model, who is responsible for data center security?
Which service uses a hardware security module to protect encryption keys in the cloud?
Which service can be used to find reports on Payment Card Industry (PCI) compliance of the AWS cloud?
Which service can be used to record information about API activity in your AWS account?
Which service can be used for alerting if the CPU is heavily loaded on an EC2 instance?
Does Amazon CloudTrail permanently record all API activity in your account by default?
Which type of firewall operates at the instance level?
Which AWS-managed network service can be used to enable Internet connectivity for EC2 instances in private subnets?
A company needs a network connection to the AWS cloud with predictable performance. What should they use?
What type of information does VPC peering use to route traffic from one VPC to another?
Which IAM entity is associated with an access key ID and secret access key?
Which service can be used to easily create multiple accounts?
What does an organization need to do to move to another AWS region?
What can you use to quickly connect your office securely to your Amazon VPC?
Under the AWS shared responsibility model what is the customer responsible for? (choose 2)
Which feature of Amazon Rekognition can assist with saving time?
A company would like to maximize their potential volume and RI discounts across multiple accounts and also apply service control policies on member accounts. Which service or tool can they use to gain these benefits?
Which items can be configured from within the VPC management console? (choose 2)
Which feature can you use to grant read/write access to an Amazon S3 bucket?
Under the shared responsibility model, what are examples of shared controls? (choose 2)
What benefits are provided by Amazon CloudFront? (choose 2)
Which service can be used to track the CPU usage of an EC2 instance?
Which service records API activity on your account and delivers log files to an Amazon S3 bucket?
Which AWS service is used to enable multi-factor authentication?
Which services are integrated with KMS encryption? (choose 2)
The IAM service can be used to manage which objects? (choose 2)
Which service can be used to help you to migrate databases to AWS quickly and securely?
What type of template is used by Amazon EC2 Auto Scaling to define instance family, AMI key pair, and security groups?
A company needs an interactive dashboard for business intelligence. What should they use?
Which of the following is true about AWS Organizations? Using AWS Organizations you can:
Implementing Security Groups, NACLs, KMS, or CloudTrail reflects which Well-Architected Framework Pillar?
Which network security tool can you use to control traffic in and out of EC2 Instances?
Under the Shared Responsibility Model, who is responsible for operating-system patches and updates on EC2 Instances?
A company would like to use their on-premises Microsoft Active Directory to connect to its AWS resources. Which service can it use?
which AWS service allows you to create temporary, limited-privilege credentials for your AWS resources?
A company just created a new mobile application and wants to add a simple and secure user sign-up, sign-in, and access control. Which AWS service can it use?
A company would like to centrally manage access to multiple AWS accounts and business applications. Which service can it use?
Data sitting on an RDS instance would be referred to as?
According to the Shared Responsibility Model, who is responsible for firewall and network configuration for EC2 Instances?
Which of the following services can you use to discover and protect your sensitive data in AWS?
Which AWS service lets you quickly find the root of potential security issues to take faster actions?
A company would like to protect its web applications from common web exploits that may affect availability, compromise security, or consume excessive resources. Which AWS service should they use?
Where can you find on-demand access to AWS compliance documentation and AWS agreements?
You can perform any kind of penetration testing on any AWS service without prior approval.
You want to record configurations and changes over time. Which service allows you to do this?
A company would like to secure network communications using SSL & TLS certificates. Which AWS service can it use?
According to the Shared Responsibility Model, who is responsible for Patch Management?
You want to centrally automate security checks across several AWS accounts. Which AWS service can you use?
Which of the following services is managed by AWS and is used to manage encryption keys?
A company would like to automate security on EC2 instances to assess security and vulnerabilities in these instances. Which AWS service should it use?
Which of the following actions does NOT require the root user?
According to the Shared Responsibility Model, who is responsible for protecting hardware?
Which AWS service's ONLY role is to safeguard running applications from DDoS attacks?
Which service is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads?
Which of the following options is NOT a situation where you should contact the AWS Abuse team?
Which AWS service is an immutable ledger database?
Which AWS service helps developers analyze and debug production as well as distributed applications?
Which AWS service provides alerts and remediation guidance when AWS is experiencing events that may impact you?
You need to set up metrics monitoring for every service in AWS. Which service would you use?
Which service allows you to inspect, audit, and record events and API calls made within your AWS account?
How would you describe Amazon CloudWatch Logs?
If a resource is deleted in AWS, which service should you use to investigate first?
Which of the following allows you to centrally manage all users and roles permissions in your AWS Organization?
You would like to automatically set up and govern a secure multi-account AWS environment with best practices for your organization. Which AWS tool can you use?
A company would like recommendations regarding its performance, security, and fault tolerance. What can it use?
Your private subnets need to connect to the Internet while still remaining private. Which AWS-managed VPC component allows you to do this?
Which type of firewall has both ALLOW and DENY rules and operates at the subnet level?
You would like to connect hundreds of VPCs and your on-premises data centers together. Which AWS service allows you to do link all these together efficiently?
A company needs to have a private, secure, and fast connection between its on-premises data centers and the AWS Cloud. Which connection should they use?
Your VPC needs to connect with the Internet. Which VPC component can help?
A hybrid company would like to provision desktops to their employees so they can access securely both the AWS Cloud and their data centers. Which AWS service can help?
Which service can be used to automate image management processes?
Which of the following services can a developer use to store code dependencies?
What does AWS CloudFront use to improve read performance?
Which features are available with Route 53?
With which services does CloudFront integrate to protect against web attacks?
Which AWS service offers easy horizontal scaling of compute capacity?
What hybrid AWS service is used to allow on-premises servers to seamlessly use the AWS Cloud at the storage layer?
What are Objects NOT composed of?
A financial services company wants to ensure that its AWS account activity meets the governance, compliance and auditing norms. As a Cloud Practitioner, which AWS service would you recommend for this use-case?
A silicon valley based healthcare startup stores anonymized patient health data on Amazon S3. The CTO further wants to ensure that any sensitive data on S3 is discovered and identified to prevent any sensitive data leaks. As a Cloud Practitioner, which AWS service would you recommend addressing this use-case?
Due to regulatory and compliance reasons, an organization is supposed to use a hardware device for any data encryption operations in the cloud. Which AWS service can be used to meet this compliance requirement?
A company's flagship application runs on a fleet of Amazon Elastic Compute Cloud (Amazon EC2) instances. As per the new policies, the system administrators are looking for the best way to provide secure shell access to Amazon Elastic Compute Cloud (Amazon EC2) instances without opening new ports or using public IP addresses. Which tool/service will help you achieve this requirement?
Which service gives a personalized view of the status of the AWS services that are part of your Cloud architecture so that you can quickly assess the impact on your business when AWS service(s) are experiencing issues?
Which of the following AWS services are always free to use (Select two)?
A medical device company is looking for a durable and cost-effective way of storing their historic data. Due to compliance requirements, the data must be stored for 10 years. Which AWS Storage solution will you suggest?
A financial services enterprise plans to enable Multi-Factor Authentication (MFA) for its employees. For ease of travel, they prefer not to use any physical devices to implement Multi-Factor Authentication (MFA). Which of the below options is best suited for this use case?
A cyber-security agency uses AWS Cloud and wants to carry out security assessments on its own AWS infrastructure without any prior approval from AWS. Which of the following describes/facilitates this practice?
Which of the following are correct statements regarding the AWS Shared Responsibility Model? (Select two)
Which of the following AWS services have data encryption automatically enabled? (Select two)?
Which AWS service can help you analyze your infrastructure to identify unattached or underutilized Amazon EBS Elastic Volumes?
Which of the following AWS authentication mechanisms supports an AWS Multi-Factor Authentication (AWS MFA) device that you can plug into a USB port on your computer?
AWS Organizations provides which of the following benefits? (Select two)
Which of the following are the best practices when using AWS Organizations? (Select TWO)
A Cloud Practitioner would like to get operational insights of its resources to quickly identify any issues that might impact applications using those resources. Which AWS service can help with this task?
Which of the following options is NOT a feature of Amazon Inspector?
A Cloud Practitioner would like to deploy identical resources across all AWS regions and accounts using templates while estimating costs. Which AWS service can assist with this task?
A corporation would like to simplify access management to multiple AWS accounts as well as facilitate AWS Single Sign-On (AWS SSO) access to its AWS accounts. As a Cloud Practitioner, which AWS service would you use for this task?
Which of the following options is NOT a point of consideration when choosing an AWS Region?
Which of the following services has a global scope?
What defines the distribution of responsibilities for security in the AWS Cloud?
What is a proper definition of IAM Roles?
Which of the following is an IAM best practice?
Under the shared responsibility model, what is the customer responsible for in IAM?
Which principle should you apply regarding IAM Permissions?
What should you do to increase your root account security?
Which AWS service helps to distribute incoming traffic across multiple targets?
Who is responsible for securing customer data in AWS under the Shared Responsibility Model?
Which AWS service allows secure connections between on-premises networks and AWS over the internet?
Which AWS service is used to manage user permissions and access?
Which AWS service is used for monitoring resource metrics like CPU utilization?
What is the main purpose of AWS Organizations?
Which AWS service helps to protect applications from DDoS attacks?
Which AWS service forms the foundation for controlling who can access AWS resources and what actions they are allowed to perform?
An AWS customer wants an automated way to continuously evaluate their deployed resources against AWS-recommended guidelines for cost efficiency, security posture, performance, and reliability, and receive actionable improvement guidance. Which AWS offering best fits this requirement?
A company running customer-facing workloads on virtual servers wants an automated way to scan those workloads for security weaknesses and configuration issues that do not align with AWS-recommended practices. Which AWS service is best suited for this requirement?
A company runs a latency-sensitive application that must respond quickly to users across multiple continents. The solution must route traffic through AWS’s private backbone network and automatically direct users to the closest healthy regional endpoint. Which AWS service best fulfills this requirement?
A financial firm migrating sensitive workloads to AWS must satisfy a compliance mandate that all cryptographic operations are performed using dedicated physical hardware rather than software-only key management. Which AWS service best fulfills this requirement?
A solutions architect is reviewing how network components are scoped across Availability Zones within an AWS Region. Which statement accurately describes how isolation and reach are designed at different networking levels?
An online platform exposes a public-facing website and wants inline protection against Layer 7 attacks, including malicious input injections and script-based exploits. Which AWS service is purpose-built for this requirement?
A video-based application wants to ensure that viewers from selected countries are prevented from accessing its web content. Which AWS solution enables filtering and blocking incoming requests based on the geographic origin of users?
Which AWS offering provides a public, real-time view of operational status and outages for AWS services across all Regions, without requiring account-specific context?
Which statement correctly describes how Amazon EBS Elastic Volumes are associated with Availability Zones?
Under the AWS Shared Responsibility Model, some security and operational tasks are divided between AWS and the customer at different layers of the environment.Which of the following represents a responsibility that is shared between both parties?
An organization wants a dedicated, private network link from its physical data centers to AWS that delivers reliable high throughput and low latency, without relying on the public internet. As an AWS Cloud Practitioner, which solution should you suggest?
A startup wants to reduce its cloud compute expenses while maintaining application reliability.Which of the following strategies is most effective for lowering compute costs?
An engineering team wants to deliberately introduce controlled failures into their cloud workload to identify hidden weaknesses and validate how well the system recovers under stress. The goal is to practice chaos engineering with minimal setup and operational overhead.Which AWS service best fulfills this requirement?
In Amazon Web Services, which feature helps you examine what permissions an individual IAM user has been granted and whether those permissions have actually been used?
An application developer wants to implement built-in functionality for end users to create accounts, log in securely, and have their access permissions managed without building a custom authentication system from scratch. Which AWS service best fulfills this requirement for customer-facing web and mobile apps?
Which AWS offering is designed to let customers create, control, and operate cryptographic keys using dedicated hardware within the AWS environment?
A solutions architect wants to loosely couple different parts of an application so they can exchange messages reliably, even when one component is temporarily unavailable. Which AWS service best fulfills this requirement?
A company wants to allow verified users to access its AWS environment without assigning permanent access keys. The access should automatically expire after a short period. Which AWS service should be used to issue such credentials?
An entry-level cloud professional wants a single place to monitor, control, and run operational tasks on compute resources so problems affecting workloads can be detected and fixed quickly. Which AWS service best fits this requirement?
Within the AWS Shared Responsibility Model, which action must be performed by the customer?
A business wants to attribute AWS spending to individual departments so finance can track and report costs accurately. What is the most straightforward way to do this?
Which scenario best describes the main purpose of Amazon GuardDuty?
Which of the following capabilities is provided by Amazon CloudWatch?
A company plans to connect its on-premises network to AWS using an AWS-managed Site-to-Site VPN solution. Which component must be created and configured on the company’s own network side to enable this connection?
According to the cloud provider’s shared responsibility framework, which activity is handled by the provider itself from a security and compliance standpoint?
An organization wants to define its cloud resources once and then automatically deploy the exact same setup into several AWS accounts across different Regions without manual repetition. Which AWS service should be used to achieve this?
Which of the following statements correctly reflects responsibility boundaries in the AWS Shared Responsibility Model?
During non-production phases, a company expects a predictable level of infrastructure activity. Recently, automation scripts have been quietly creating extra cloud resources through management APIs, pushing usage well beyond historical norms. The operations team wants a mechanism that learns typical API behavior and flags spikes automatically when activity strays from that learned pattern.Which AWS service is the most appropriate choice?
An organization wants a desktop-based graphical application that lets staff configure, unlock, monitor, and move data on physical AWS data transfer devices without using CLI commands or REST APIs. Which option best meets this requirement?
A security auditor is validating whether sensitive data is automatically protected without any manual encryption configuration when stored or handled by AWS services. The goal is to identify services that apply encryption by default to meet compliance requirements.Which option lists only AWS services that encrypt data by default with no customer action required?
An organization wants to protect its web applications and APIs from common exploits such as SQL injection and cross-site scripting by using AWS Web Application Firewall (AWS WAF). Which of the following combinations represents valid services where AWS WAF can be directly associated?
Which AWS service is provided at no additional charge, with costs applying only to the AWS resources it supports?
Under the AWS Shared Responsibility Model, which service requires the customer to handle operating system maintenance, patching, and instance-level security controls?
An organization notices that firewall rules controlling inbound and outbound traffic were modified in their AWS environment. The security lead wants to identify which IAM identity performed this change and when it happened. Which AWS service should be consulted to obtain this information?
A DevOps team wants a managed AWS solution that centrally stores software packages and works seamlessly with popular language-specific dependency managers so developers can pull approved libraries during builds. Which AWS service best fits this requirement?
An organization is planning to deploy workloads on AWS and must decide on an appropriate Region. Which of the following factors should be evaluated when making this decision?
A cloud administrator wants to reduce the risk of unauthorized access and credential misuse in an AWS account. Which of the following actions directly helps achieve this goal?
A security team is reviewing how administrators authenticate when accessing the AWS Management Console. To align with AWS security recommendations for interactive console access, which authentication element should be used?
Amazon Detective builds security investigations by ingesting and correlating telemetry from specific AWS sources. Which combination below represents the datasets it actually uses to uncover suspicious activity?
Which of the following statements correctly describe how AWS Elastic Beanstalk basic health reporting works?
You want to enable encryption for AWS services so that data is protected only within your own AWS account, and you want the simplest, lowest-maintenance approach using AWS Key Management Service. Which option best meets this requirement?
An organization wants an AWS-native capability that automatically and continuously detects suspicious activity and unauthorized actions across its accounts and running workloads, without deploying any agents or infrastructure. Which service best meets this requirement?
When using a fully managed event-driven compute service on AWS, which task is explicitly handled by the customer under the shared responsibility model?
After defining a workload and responding to a structured set of review questions, which no-cost AWS console feature evaluates your architecture and measures it against current AWS best-practice guidance?
An organization wants centralized governance over multiple AWS accounts while ensuring permission boundaries are enforced consistently. Which of the following statements accurately reflects how this is achieved?
Which option provides a stateful, instance-level firewall that lets you define rules to allow or block inbound traffic before it reaches a virtual server?
During a security review of your network logs, you discover repeated port-scanning attempts originating from IP ranges that belong to Amazon. What is the most appropriate AWS contact to address and stop this activity?
A regulated enterprise must preserve historical records for a decade to satisfy audit and compliance mandates. The data will almost never be accessed, so keeping storage costs as low as possible is the top priority. Which AWS storage option best meets this requirement?
An organization is evaluating its compliance obligations after adopting AWS-managed services. Which responsibility is always handled by AWS, regardless of the services a customer chooses?
Which AWS offerings can be reached from a VPC using a Gateway VPC Endpoint, allowing traffic to stay entirely within the AWS network? (Choose two)
An organization uses Amazon Aurora to avoid managing infrastructure components manually. Which party is in charge of applying security updates and patches to the operating system that supports the Aurora database?
An organization requires full authority to create, configure, rotate, and control encryption keys used to protect data across AWS services. Which option best fulfills this requirement?
A solutions architect is designing a loosely coupled microservices architecture on AWS. Which two AWS services are best suited to enable asynchronous communication and reduce direct dependencies between application components? (Select two)
A developer wants to authenticate an application so it can make API calls to AWS without human interaction. Which approach aligns with AWS best practices for enabling this type of access?
Within the AWS Shared Responsibility Model, which activity requires participation from both AWS and the customer?
An organization is preparing to shift its applications and data from a locally hosted environment to AWS. The leadership team wants direct, expert involvement to help define the architecture, reduce migration risks, and complete the move faster. Which option BEST fulfills this need?
An organization experiences unexpected spikes in inbound network requests that cause temporary service outages for its AWS-hosted applications. The organization wants AWS to handle these disruptions automatically at the infrastructure level without deploying additional security rules or monitoring systems. Which AWS service fulfills this requirement?
A cloud operations team transfers 1.2 TB of system backups from a virtual machine to an object storage service, with both resources deployed in the same AWS Region. How will AWS handle the data transfer charges for this activity?
A newly founded company is planning to migrate its workloads to AWS. Before committing, the finance team wants a forward-looking estimate of what their monthly cloud spending might be based on the resources they expect to deploy. Which AWS offering should be recommended to meet this requirement?
An organization administrator is planning to detach a member AWS account so it can function independently. Which condition must be satisfied before this action is allowed?
An investment firm must maintain a verifiable record of every action performed in its AWS environment so that internal auditors can review user activity and API calls during compliance checks. Which AWS service should be chosen to meet this requirement?
A U.S.-based medical technology company keeps large volumes of de-identified clinical records in cloud object storage. The leadership team wants an automated way to continuously scan that stored data, recognize patterns like personal or regulated information, and alert the team before any accidental exposure occurs. As a Cloud Practitioner, which AWS service best fits this requirement?
A security monitoring group observes that traffic originating from IP ranges owned by AWS is being used to conduct harmful online activity. Since this violates acceptable use policies, what is the most appropriate action to take?
An application developer needs a way to call AWS services directly from their code while using libraries that match the syntax and conventions of their programming language. Which AWS offering enables this capability?
Under the AWS Shared Responsibility Model, which tasks are handled by AWS itself rather than the customer? (Select two)
An organization preparing for formal assurance reviews needs a centralized place to obtain AWS-issued compliance attestations, audit reports, and contractual documents related to security and governance. Which AWS offering fulfills this requirement?
A company wants an AWS-managed solution that is purpose-built for running high-performance analytics and reporting on extremely large, structured datasets. Which AWS service fulfills this role?
An organization is looking for an AWS service that can analyze how its workloads are running and suggest better resource sizing so that infrastructure costs are lowered while application performance improves. Which AWS service directly fulfills this requirement?
Which AWS offering automatically provides baseline protection against common network-level attacks for every AWS account, without requiring activation or extra payment?
Which AWS offering automatically applies encryption to its stored data without requiring any manual configuration?
A startup operates a Linux-based workload across multiple virtual servers in AWS. The security team wants an automated way to periodically scan those servers for missing patches and known operating system vulnerabilities without manual intervention. As a Cloud Practitioner, which AWS service best fits this requirement?
Which AWS resource is explicitly supported by AWS Shield Advanced for enhanced protection against large-scale DDoS attacks on internet-facing applications?
An organization uploads application data to object storage in AWS. Due to strict compliance requirements, the data must be encrypted on the client side before it leaves the application, not after it reaches AWS.Which approach best satisfies this requirement?
A system administrator improves the performance of an application by upgrading the processor speed and increasing the memory of the same machine on which it runs. Which architectural approach does this describe?
Under the AWS Shared Responsibility Model, some security tasks remain the customer’s obligation.Which of the following represents a responsibility that belongs to the customer?
An application needs to retrieve database login credentials securely at runtime. The solution must eliminate hard-coded passwords and support automated credential rotation with minimal operational effort. Which AWS service best fits this requirement?
A company is implementing AWS Organizations to centrally manage multiple AWS accounts.Which of the following represents a recommended practice for governing accounts at scale?
An analytics firm is concerned that confidential information may be unintentionally stored in its cloud-based object storage. Leadership wants a native AWS solution that can automatically scan stored data, recognize sensitive content patterns, and provide ongoing visibility without custom scripts or manual reviews. Which AWS service is purpose-built for this requirement?
Which AWS offering continuously evaluates your AWS environment and suggests improvements related to cost efficiency, performance tuning, service quotas, and security posture?
Which capability is not provided by a service that evaluates workloads for security weaknesses and exposure risks?
A cloud engineer is building an application layer that must handle sudden increases in traffic while also defending against common web-based threats—without requiring manual scaling or intervention.Which of the following represents a key benefit of this AWS capability?
A company operates several AWS accounts for different departments. The security team wants one centralized service that allows employees to authenticate once and then access only the AWS accounts they are authorized to use. As an AWS Cloud Practitioner, which service should you choose to implement this access model?
A compliance team wants automatic visibility when any AWS resource setting is modified so they can track changes for audits and security reviews. Which AWS service is best suited for this requirement?
A large engineering organization maintains hundreds of independently deployed microservices. To raise overall engineering standards, the team wants an automated solution that reviews source code and flags quality issues and potential defects without manual intervention. Which AWS service best meets this need?
A security team needs a way to record and review detailed activity performed against a cloud-based object storage bucket, including requester details and request timing, to support compliance checks. Which AWS capability best fulfills this requirement?
When using an AWS-managed relational database, which responsibility still belongs to the customer under the AWS Shared Responsibility Model?
A company wants to ensure continuous availability of its internet-facing applications during sudden spikes of malicious traffic by leveraging AWS-managed networking and protection features.Which AWS services would directly support this goal? (Select THREE)
Which ONE statement correctly reflects a security best practice for the Amazon Web Services root user account?
An organization wants to automatically track CPU usage of its virtual servers in AWS and notify the administrator via email whenever usage crosses a defined limit. Which option represents the most appropriate AWS-based solution?
Which statement below does NOT accurately describe the capabilities of AWS Auto Scaling?
Which statement accurately describes how traffic filtering works within an AWS VPC environment?
A company operates a tightly coupled cloud environment with many interdependent components. The security team needs a way to continuously record and review how individual AWS resource settings have changed over time to support audits and compliance checks. Which AWS service best meets this requirement?
Which AWS offerings do not have a standalone usage charge and are provided at no additional cost to your account? (Choose two)
A solutions architect wants a way to manage AWS resources either through a graphical interface or by running commands from a terminal for automation purposes. Which of the following options satisfy this requirement? (Select two)
A small company runs live workloads on AWS and wants round-the-clock phone access to technical experts while keeping support costs as low as possible. Which AWS option best fits this requirement?
A solutions architect wants a customized, account-specific view that highlights how ongoing AWS service events might affect their deployed resources and business workloads. Which AWS offering delivers this level of personalized operational visibility?
Under the AWS Shared Responsibility Model, which activity is handled by AWS as part of its security and compliance obligations?
In AWS, when you generate an Access Key ID and Secret Access Key for long-term programmatic access, which identity are these credentials directly associated with?
An online gaming company wants to deploy parts of its infrastructure very close to players in major cities to minimize network delay and maintain smooth, real-time gameplay. The solution must still integrate seamlessly with core AWS Regions while prioritizing ultra-low latency for nearby users.Which AWS option is the MOST appropriate for this use case?
An organization needs to establish network connectivity between its on-premises infrastructure and the AWS Cloud. Which TWO AWS solutions are designed specifically for this purpose?
Which official AWS document explicitly lists activities that users are forbidden from performing while using AWS services or accessing AWS online resources?
When operating virtual servers in the cloud, which activity is the customer’s responsibility according to the Shared Responsibility Model, specifically for security and compliance?
A security team wants administrators to log in to virtual servers running in AWS without exposing SSH ports, assigning public IPs, or managing key pairs. The solution must allow controlled, auditable access while keeping the instances private.Which AWS service best fulfills this requirement?
A company wants a highly personalized AWS support experience that includes proactive guidance and a single point of contact who understands its workloads and business goals. Which AWS offering fulfills this requirement?
An AWS learner is reviewing how IP address ranges can be defined using CIDR notation in different AWS configurations. Which AWS component allows administrators to specify IP ranges in CIDR format?
A cloud administrator wants to review how AWS resources in an account have changed over the last 14 days, including configuration history and relationships between resources. Which AWS service is best suited for this requirement?
A security engineer needs to generate an immediate notification whenever the root user signs in to an AWS account.Which AWS service is essential for detecting this login activity?
A retail company has purchased long-term compute capacity to reduce infrastructure costs. The finance team wants to be notified automatically if the utilization of their Amazon EC2 Reserved Instances falls below a predefined percentage. Which AWS service is best suited to configure such alerts?
A data analytics firm runs its core platform on virtual servers that are provisioned in two separate AWS Regions. The setup is designed so that traffic can still be served even if one Region becomes unavailable. What is the primary architectural benefit of this design?
A company wants to route traffic from resources inside its private network directly to a managed message queue without using the public internet. Which AWS feature allows this private connectivity from a VPC to an Amazon SQS queue?
AWS Trusted Advisor reviews AWS environments and identifies potential security risks.Which of the following situations would be reported as a security best practice concern?
A regulated enterprise is storing sensitive customer records in a cloud-based data lake and must guarantee that no data can ever be exposed publicly, even if users misconfigure permissions. What is the most efficient way to enforce this requirement?
A retail organization has fully shifted its workloads from its own servers to the AWS Cloud. Under the AWS shared responsibility model, which expense must the organization continue to pay for after migration?
A workload running on a virtual machine needs to interact with a cloud-based key–value data store. The solution must avoid embedding permanent credentials inside the machine and should follow best practices for secure, short-term authorization. Which option best satisfies this requirement?
Which of the following AWS resources can be protected using AWS Shield Advanced to help defend internet-facing applications from large-scale DDoS attacks?
A retail platform operating on AWS needs to access official compliance documentation related to PCI standards for audit and review purposes. Which AWS resource best fulfills this requirement?
An enterprise operates independent AWS network environments for different teams, with each team using its own VPC. Two of these teams must exchange data securely and internally, without exposing traffic to the public internet or introducing unnecessary infrastructure. What is the most efficient solution to meet this requirement?
A company in the banking sector is planning a move from its physical servers to AWS. Before committing, they want a way to estimate and compare what their existing on-premises setup would cost versus running equivalent resources on AWS. Which AWS service should they use for this analysis?
An AWS security team needs a single file that can be downloaded to review every IAM user in the account and verify whether their login passwords, access keys, and MFA configurations are enabled or outdated. Which AWS capability fulfills this requirement?
A company needs to safeguard its web applications against common application-layer threats and limit suspicious traffic without maintaining its own security infrastructure.Which of the following is a core capability of AWS WAF?
In the context of the AWS Shared Responsibility Model, which activity related to access management falls under the customer’s control?
An AWS account administrator wants to enforce multi-factor authentication using a physical device that connects directly to a computer and confirms identity through a simple user interaction, without entering numeric codes. Which option supports this authentication approach?
An AWS account owner wants to strengthen protection around the account’s highest-privilege credentials.Which of the following is a recommended security practice for safeguarding these credentials?
A team stores critical files in an Amazon S3 bucket and wants a safeguard that allows them to recover objects if someone mistakenly deletes or overwrites them. Which solution best meets this requirement?
A multinational organization plans to relocate its complete cloud setup—including applications and stored data—from an AWS Region located in North America to a Region in Europe. What is the most appropriate approach to accomplish this requirement?
An organization wants workloads inside a VPC to access Amazon S3 without traversing the public internet and without assigning public IP addresses. Which AWS feature enables this private connectivity?
Which cloud characteristic primarily supports rapid experimentation, frequent changes, and faster delivery of new software features?
A healthcare analytics firm must preserve legacy device records to meet regulatory audits. The data will rarely be accessed, but retention is mandatory for a full decade. The company wants the lowest possible storage cost while still meeting compliance needs. Which AWS storage option best fits this requirement?
A global enterprise runs its mission-critical workloads on virtual compute servers deployed across multiple geographic locations, each governed by local regulatory requirements. For audit purposes, the company must periodically produce evidence showing how resource settings looked in the past and how they changed over time. Which AWS service best fulfills this need?
A company reports that its publicly hosted website cannot be opened in a browser, even though all the HTML files have already been uploaded and static website hosting has been turned on. You are asked to review the setup and recommend the most likely fix.Which action would best resolve the problem?
A physical issue within AWS infrastructure has caused disruption to one of your block storage resources. You need a service that proactively notifies you about impacted components in your account and also suggests steps to address the issue. Which AWS service fulfills this requirement?
Under the AWS Shared Responsibility Model, some security protections are fully operated by AWS without any customer configuration. Which option below represents a security service that is entirely managed by AWS and automatically applied?
A regulated enterprise is required to retain redundant copies of its critical datasets in physically separated geographic locations to satisfy audit and compliance standards. The organization already relies on Amazon Simple Storage Service (Amazon S3) for object storage.Which approach delivers this requirement with the least operational overhead and highest efficiency?
Under the AWS Shared Responsibility Model, certain duties remain with the customer rather than AWS.Which of the following represents a responsibility handled by the customer?
Some AWS services are deployed and operate within a single selected Region, while others are global in scope.Which of the following services is Regional rather than global?
Which AWS offering continuously analyzes activity across your AWS environment to identify suspicious behavior and potential security threats?
An organization responsible for cyber defense operates entirely on AWS and needs to actively probe its own cloud resources for security weaknesses. The activity must be allowed without requesting advance permission from AWS. Which option best represents this capability?
An organization wants to reduce storage costs for files that are rarely accessed but must still remain immediately available when required for compliance checks or reviews. Which scenario best matches this requirement?
A startup runs a read-only marketing website from object storage in an AWS Region located in Asia. As the business expands, visitors from Europe and North America report slow page load times. Which approach would best reduce latency for users worldwide?
An AWS advisory service evaluates deployed resources and compares them against established best practices to enhance operational quality.Which of the following assessment categories is included in this type of review?
A retail company runs two isolated workloads—one for testing features and another for live customer traffic—on AWS. Finance wants distinct monthly bills for each workload. As an AWS Cloud Practitioner, what should you advise?
A banking organization wants to enforce an additional authentication factor for employee sign-ins. Because staff members frequently travel, the company wants a solution that does not rely on carrying any dedicated physical device. Which option best satisfies this requirement?
A company is improving its authentication controls to better protect accounts from unauthorized access.Which of the following actions reflects a strong identity protection measure?
Which statement best reflects how AWS Shield Advanced affects customer billing?
Some AWS services automatically encrypt data without requiring customers to enable encryption during setup.Which of the following services provides encryption by default?
Under the AWS Shared Responsibility Model, certain operational and security tasks remain the customer’s obligation.Which of the following represents a responsibility handled by the customer?
A company has deployed applications on Amazon EC2 instances. The company needs to assess application vulnerabilities and must identify infrastructure deployments that do not meet best practices.Which AWS service can the company use to meet these requirements?
A company wants to run a NoSQL database on Amazon EC2 instances.Which task is the responsibility of AWS in this scenario?
A company is storing sensitive customer data in an Amazon S3 bucket. The company wants to protect the data from accidental deletion or overwriting.Which S3 feature should the company use to meet these requirements?
A company has an AWS account. The company wants to audit its password and access key rotation details for compliance purposes.Which AWS service or tool will meet this requirement?
A financial services company wants to ensure that its AWS account activity meets the governance, compliance and auditing norms. As a Cloud Practitioner, which AWS service would you recommend for this use-case?
A silicon valley based healthcare startup stores anonymized patient health data on Amazon S3. The CTO further wants to ensure that any sensitive data on S3 is discovered and identified. As a Cloud Practitioner, which AWS service would you recommend addressing this use-case?
A multi-national company has just moved its infrastructure from its on-premises data center to AWS Cloud. As part of the shared responsibility model, AWS is responsible for which of the following?
Which of the following statements are CORRECT regarding the AWS VPC service? (Select two)
Which of the following is CORRECT regarding removing an AWS account from AWS Organizations?
As per AWS shared responsibility model, which of the following is a responsibility of the customer from a security and compliance point of view?
Which AWS Service can be used to mitigate a Distributed Denial of Service (DDoS) attack?
Which of the following is a recommended way to provide programmatic access to AWS resources?
A medical research startup wants to understand the compliance of AWS services concerning HIPAA guidelines. Which AWS service can be used to review the HIPAA compliance and governance-related documents on AWS?
A company wants to have control over creating and using its own keys for encryption on AWS services. Which of the following can be used for this use-case?
A company runs an application on a fleet of EC2 instances. The company wants to automate the traditional maintenance job of running timely assessments and checking for OS vulnerabilities. As a Cloud Practitioner, which service will you suggest for this use case?
Under the AWS Shared Responsibility Model, which of the following is a shared responsibility of both AWS and the customer?
Which of the following AWS services manages account privileges?
Which of the following AWS services has encryption enabled by default?
AWS Shield Advanced provides expanded DDoS attack protection for web applications running on which of the following resources? (Select two)
According to the AWS Shared Responsibility Model, which of the following are responsibilities of AWS? (Select two)
Which security service of AWS is enabled for all AWS customers, by default, at no additional cost?
AWS Web Application Firewall (WAF) offers protection from common web exploits at which layer?
Which of the following AWS services is essential for implementing security of resources in AWS Cloud?
Which tool will help you review your workloads against current AWS best practices for cost optimization, security, and performance improvement and then obtain advice to architect them better?
The engineering team at an IT company wants to monitor the CPU utilization for its fleet of EC2 instances and send an email to the administrator if the utilization exceeds 80%. As a Cloud Practitioner, which AWS services would you recommend to build this solution? (Select two)
Which of the following solutions can you use to connect your on-premises network with AWS Cloud (Select two).
As per the AWS shared responsibility model, which of the following is a responsibility of AWS from a security and compliance point of view?
An organization is planning to move its infrastructure from the on-premises datacenter to AWS Cloud. As a Cloud Practioner, which options would you recommend so that the organization can identify the right AWS services to build solutions on AWS Cloud (Select two)?
Access Key ID and Secret Access Key are tied to which of the following AWS Identity and Access Management entities?
Due to regulatory and compliance reasons, an organization is supposed to use a hardware device for any data encryption operations in the cloud. Which AWS service can be used to meet this compliance requirement?
Which AWS service can be used to review the compliance and governance-related documents on AWS?
Which AWS service enables users to find, buy, and immediately start using software solutions in their AWS environment?
Which service gives a personalized view of the status of the AWS services that are part of your Cloud architecture so that you can quickly assess the impact on your business when AWS service(s) are experiencing issues?
Which of the following AWS services are always free to use (Select two)?
Which AWS service helps you define your infrastructure as code?
An organization has a complex IT architecture involving a lot of system dependencies and it wants to track the history of changes to each resource. Which AWS service will help the organization track the history of configuration changes for all the resources?
An e-commerce company wants to assess its applications for vulnerabilities and deviations from AWS best practices. Which AWS service can be used to facilitate this?
A social media company wants to protect its web application from common web exploits such as SQL injection and cross-site scripting. Which of the following AWS services can be used to address this use-case?
Which of the following AWS services can be used to prevent Distributed Denial-of-Service (DDoS) attack? (Select three)
As per the AWS shared responsibility model, which of the following is a responsibility of the customer from a security and compliance point of view?
An online gaming company wants to block users from certain geographies from accessing its content. Which AWS services can be used to accomplish this task? (Select two)
Which of the following statement is correct for a Security Group and a Network Access Control List?
Which of the following AWS services are global in scope? (Select two)
Which of the following statements are correct about the AWS account root user (Select two)
Which of the following statements is INCORRECT about AWS Auto Scaling?
Which of the following options can be used to access AWS services (Select three)?
Due to regulatory and compliance reasons, an organization has deployed its entire IT infrastructure on its on-premises data center. How would you classify this deployment model?
Which of the following is correct regarding the AWS Shield Advanced pricing?
As per the Shared Responsibility Model, Security and Compliance is a shared responsibility between AWS and the customer. Which of the following security services falls under the purview of AWS?
As per the AWS Shared Responsibility Model, which of the following is a responsibility of AWS from a security and compliance point of view?
Which of the following are recommended security best practices for the AWS account root user? (Select two)
Which AWS services can be used together to send alerts whenever the AWS account root user signs in? (Select two)
Which of the following AWS entities lists all users in your account and the status of their various account aspects such as passwords, access keys, and MFA devices?
According to the AWS Shared Responsibility Model, which of the following are responsibilities of the customer for IAM? (Select two)
Which AWS service can help you analyze your infrastructure to identify unattached or underutilized EBS volumes?
AWS Organizations provides which of the following benefits? (Select two)
Which of the following AWS authentication mechanisms supports a Multi-Factor Authentication (MFA) device that you can plug into a USB port on your computer?
Which of the following entities should be used for an Amazon EC2 Instance to access a DynamoDB table?
Threat detection is of paramount importance for security in the Cloud. Which AWS service offers this key feature?
AWS Shield Advanced provides expanded DDoS attack protection for web applications running on which of the following resources? (Select two)
Which of the following are benefits of the AWS Web Application Firewall (WAF)? (Select two)
AWS Trusted Advisor can provide alerts on which of the following common security misconfigurations? (Select two)?
A financial services company wants to ensure that all customer data uploaded on its data lake on Amazon S3 always stays private. Which of the following is the MOST efficient solution to address this compliance requirement?
A company wants to establish a private, dedicated connection between AWS and its on-premises datacenter. Which AWS service is the right choice for this requirement?
Which of the following AWS services will help provision a logically isolated network for your AWS resources?
Which of the following data sources are used by Amazon Detective to analyze events and identify potential security issues?
Which of the following AWS services can be used to continuously monitor both malicious activities as well as unauthorized behavior to protect your AWS accounts and workloads?
By default, which of the following events are logged by AWS CloudTrail?
Which of the following are security best practices suggested by AWS for Identity and Access Management (IAM)? (Select two)
AWS Web Application Firewall (AWS WAF) can be deployed on which of the following services?
An e-commerce company has its on-premises data storage on an NFS file system that is accessed in parallel by multiple applications. The company is looking at moving the applications and data stores to AWS Cloud. Which storage service should the company use to move their files to AWS Cloud seamlessly if the application is hosted on Amazon EC2 instances?
A Security Group has been changed in an AWS account and the manager of the account has asked you to find out the details of the user who changed it. As a Cloud Practitioner, which AWS service will you use to fetch the necessary information?
Per the AWS Shared Responsibility Model, management of which of the following AWS services is the responsibility of the customer?
Which of the following statements are true about AWS Shared Responsibility Model? (Select two)
Which of the following will help you control the incoming traffic to an Amazon EC2 instance?
Which service will help you track and monitor the health of an Amazon EC2 instance, as well as raise an alarm if the instance is in an unhealthy state?
Which of the following statements are true about AWS Regions and Availability Zones (AZs)? (Select two)
A financial services company needs to retain its data for 10 years to meet the compliance norms. Which Amazon S3 storage class is the best fit for this use-case considering that the data has to be stored at minimal cost?
Due to regulatory guidelines, a company needs to encrypt data as it passes through the different layers of its AWS architecture. The company is reviewing the capabilities of the various AWS services and their encryption options. Which of the below services are encrypted by default and need no user intervention to enable encryption?
Which of the following is the least effort way to encrypt data for AWS services only in your AWS account using AWS Key Management Service (KMS)?
A company needs to submit AWS’ security and compliance reports for the upcoming audit. Which service/tool will help the company to fetch the required reports?
A telecom company uses Amazon S3 buckets for storing user sensitive data. The company wants to protect this data against unusual activities like a heavy download of sensitive data, an IP address submitting too many requests for sensitive data, or any other pattern of data access that is suspicious. Which AWS service/tool will help achieve this goal?
A team manager needs data about the changes that have taken place for AWS resources in his account during the past two weeks. Which AWS service can help get this data?
To meet the compliance norms, a consulting company is expected to store its data for three years. The company needs a tamper-proof technology/feature to keep the data protected and prevent any overwriting or data manipulation during the three-year duration. As a Cloud Practitioner, which service/functionality will you suggest to keep the data safe?
A company has defined a baseline that mentions the number of AWS resources to be used for different stages of application testing. However, the company realized that employees are not adhering to the guidelines and provisioning additional resources via API calls, resulting in higher testing costs. Which AWS service will help the company raise alarms whenever the baseline resource numbers are crossed?
Which of the following actions require the root user access credentials? (Select three)
Which of the following statements are correct regarding the AWS Control Tower and Service Control Policies? (Select two)
Which of the following points have to be considered when choosing an AWS Region for a service? (Select two)
Which of the following is a repository service that helps in maintaining application dependencies via integration with commonly used package managers and build tools like Maven, Gradle, npm, etc?
Which of the following AWS services are offered free of cost? (Select two)
What AWS service is used to create and manage virtual private networks (VPNs) in the cloud?
What is the primary purpose of AWS Identity and Access Management (IAM)?
Which AWS service is used to automate infrastructure using templates?
Which cloud resource can be automatically scaled based on demand?
Which AWS service can automatically trigger actions based on alarms?
Which AWS service helps detect unusual activity and potential security threats using machine learning?
Which AWS service helps enforce compliance by continuously evaluating resource configurations?
What is the primary benefit of using IAM Roles instead of IAM Users for EC2 instances?
Which AWS service provides centralized logging and analysis of application request traces?
A company wants to run a NoSQL database on Amazon EC2 instances. Which task is the responsibility of AWS in this scenario?
Which of the following are bene+ts of using AWS Trusted Advisor? (Choose two.)
Which tasks are customer responsibilities, according to the AWS shared responsibility model? (Choose two.)
Which AWS service or feature identi+es whether an Amazon S3 bucket or an IAM role has been shared with an external entity?
What is a customer responsibility when using AWS Lambda according to the AWS shared responsibility model?
Which AWS service provides users with AWS issued reports, certi+cations, accreditations, and third-party attestations?
A company runs an on-premises contact center for customers. The company needs to migrate to a cloud-based solution that can deliver arti+cial intelligence features to improve user experience. Which AWS service will meet these requirements?
A company plans to migrate its custom marketing application and order-processing application to AWS. The company needs to deploy the applications on different types of instances with various con+gurations of CPU, memory, storage, and networking capacity. Which AWS service should the company use to meet these requirements?
Which option is AWS responsible for under the AWS shared responsibility model?
Which AWS tool or feature acts as a VPC +rewall at the subnet level?
Which AWS service can be used to send alerts when a speci+c Amazon CloudWatch alarm is invoked?
Which AWS service or feature provides a +rewall at the subnet level within a VPC?
A company wants to use automated video analysis to identify employees that are accessing its oXces. Which AWS service will meet this requirement?
A company is hosting a web application on Amazon EC2 instances. The company wants to implement custom conditions to +lter and control inbound web traffic. Which AWS service will meet these requirements?
A company needs a +rewall that will control network connections to and from a single Amazon EC2 instance. This +rewall will not control network connections to and from other instances that are in the same subnet. Which AWS service or feature can the company use to meet these requirements?
Which of the following actions are controlled with AWS Identity and Access Management (IAM)? (Choose two.)
Which VPC component can a company use to set up a virtual +rewall at the Amazon EC2 instance level?
A company's compliance oXcer wants to review the AWS Service Organization Control (SOC) reports. Which AWS service or feature should the compliance oXcer use to complete this task?
A company has a compliance requirement to record and evaluate con+guration changes, as well as perform remediation actions on AWS resources. Which AWS service should the company use?
Which of the following services can be used to block network traffic to an instance? (Choose two.)
A company wants to monitor for miscon+gured security groups that are allowing unrestricted access to speci+c ports. Which AWS service will meet this requirement?
Which AWS service is used to provide encryption for Amazon EBS?
Which task is the customer’s responsibility, according to the AWS shared responsibility model?
What is the best resource for a user to +nd compliance-related information and reports about AWS?
Which AWS service or tool can be used to set up a +rewall to control traffic going into and coming out of an Amazon VPC subnet?
A company wants to design a centralized storage system to manage the con+guration data and passwords for its critical business applications. Which AWS service or capability will meet these requirements MOST cost-effectively?
Which AWS service or feature allows users to create new AWS accounts, group multiple accounts to organize workiows, and apply policies to groups of accounts?
A company wants to block SQL injection attacks. Which AWS service or feature should the company use to meet this requirement?
A company wants a uni+ed tool to provide a consistent method to interact with AWS services. Which AWS service or tool will meet this requirement?
A company needs to evaluate its AWS environment and provide best practice recommendations in +ve categories: cost, performance, service limits, fault tolerance and security. Which AWS service can the company use to meet these requirements?
Which task is a customer’s responsibility, according to the AWS shared responsibility model?
Which security service automatically recognizes and classi+es sensitive data or intellectual property on AWS?
Which AWS service can be used to retrieve compliance reports on demand?
Which AWS service enables users to check for vulnerabilities on Amazon EC2 instances by using prede+ned assessment templates?
Which AWS service or feature can a company use to apply security rules to speci+c Amazon EC2 instances?
A company hosts an application on multiple Amazon EC2 instances. The application uses Amazon Simple Notification Service (Amazon SNS) to send messages. Which AWS service or feature will give the application permission to access required AWS services?
A company needs to centrally con+gure and manage Amazon VPC security groups across multiple AWS accounts within an organization in AWS Organizations. Which AWS service should the company use to meet these requirements?
Which AWS service or resource can be used to identify services that have been used by a user within a speci+ed date range?
Which of the following acts as an instance-level +rewall to control inbound and outbound access?