Skip to content
R&D

Security and Compliance — page 6

You work for a company that created several production servers within Amazon's infrastructure, but costs are rising and your management has asked you to reduce the costs associated with your Amazon infrastructure. Which option below would be best?

Which of the following instance types supports Amazon EBS encryption and is within the memory optimized instance family?

You have been working for your company for over a year and you just started building several development EC2 instances. Your security department has asked you to start following AWS best practices as identified by the shared responsibility model. Which of the following is considered the customer's responsibility?

For which two situations will AWS Trusted Advisor recommend actions? (Choose two.)

You are responsible for understanding the shared responsibility model. You need to articulate the difference between the responsibilities of the customer and AWS. Under the shared responsibility model, which type of control is not considered a shared control?

You are asked by the development team in your company to help them find a way to further optimize their main web application. For this you need to know key details about requests served by the application. What will you use for this?

Which category in AWS Trusted Advisor provides you with a check to ensure that MFA is activated for the root account?

As your company's AWS Cloud administrator, you have just logged in as the root user for the first time. What should you do immediately as a security best practice?

Amazon's shared responsibility model for infrastructure services, including EC2, states that Amazon is responsible for which three security components?

The company you work for wants to cut monitoring costs down on all new EC2 instances. The goal is to display a CPU dashboard with metrics at one-minute intervals. You need to implement this request in the most efficient and cost-effective manner. Which two options would you select?

You are managing several different AWS environments. Two of your many responsibilities are to make sure that the AWS resources do not exceed their resource limits and at the same time demonstrate AWS best practices. You need a simple way of validating these service level limits to protect your systems so that they continually perform at their highest levels. What resource will allow you to accomplish this task?

As it relates to the shared responsibility model, which security option is the customer's responsibility?

You need to set up user access permissions on your AWS account based on security best practices. How would you implement the principle of least privilege?

You have created a VPC for your company's AWS deployment. You need to implement a way of controlling incoming and outgoing for your EC2 instance on the VPC. What would you use for this?

For which purpose would you use an IAM credentials report?

Which of the following statements is true regarding Elastic IP addresses (EIPs)?

Your company has asked to review its AWS Cloud deployment and find all the possible vulnerabilities that need to be addressed. Which two tasks are the responsibility of the company? (Choose two.)

When does Amazon DynamoDB encrypt data at rest?

You are a cloud technology consultant for a company that wants to expand its global operations using AWS Regions. What would you set as requirements for selecting the appropriate AWS Region for your business? (Select TWO.)

What Amazon resource implements security vulnerability assessments by improving the compliance and security of an application within an Amazon EC2 environment?

You need to find a way to seamlessly connect your on-premises applications to the AWS Cloud while maintaining compliance needs. Which of these would you use?

You are creating an IAM policy using the visual editor from the IAM console. Which two key components will you be prompted to provide?

Which of the following options are considered best practices when configuring IAM policies? (Choose all that apply.)

You need a way to connect with AWS employees for query resolution and find out key aspects of AWS best practices and compliance information. Which of these systems should you use in this scenario?

You need to find ways to ensure accountability across your AWS Cloud deployment. Which of these services will you use to check all user activity and API calls made on the AWS system?

Which Amazon resource allows you to create subnets, modify IP address ranges, change network gateways, configure route tables, and modify advanced security settings?

Which two functions can be performed using Amazon Route 53? (Choose two.)

What kind of strategy does Amazon offer for situations like that of a natural disaster or major system failure?

You need to use an AWS service that allows you to automate evidence collection and perform risk and compliance management. Which of these services should you use for this scenario?

Which of the following AWS technologies should you use for providing users with access to applications at low latency while meeting data residency needs?

What type of internal Amazon user can be created to mimic a service, application, or person that has access to AWS resources?

What is an Amazon solution for creating a logical private connection between a remote network and an Amazon VPC?

Which of the following is considered a security best practice for an operating system or application?

You are tasked with understanding the different sections of an IAM policy. Your boss wants to know what section of an IAM policy manages the behaviors, such as allow or deny. What should you tell him?

If you are traversing confidential data across a public network using an Amazon RDS MySQL or SQL Server EC2 instance, what form of protection would you use to protect the data in transit?

What security requirements does Amazon recommend for securing operating systems and applications related to AMIs?

You need a way for the development team to retrieve secrets such as credentials and passwords programmatically without the need to embed them in the application code. Which of the following services should you use for this?

Which AWS service provides protection against DDoS attacks for free and is a key component of the Reliability pillar within the AWS framework?

You work for a company that has several AWS resources, which consists of seven Amazon EC2 instances that support several back-end databases. You are under constant pressure from the security department to make sure that these EC2 instances comply with the company's best security practices and stay within the company's strict compliance rules. Which of the following Amazon resources would you use to meet this requirement?

You are asked to create user accounts and configure their access permissions for a corporate AWS deployment. Which of these are IAM best practices you will use?

You are a cloud technology consultant working for a US Government agency. You are running web applications using Elastic Compute Cloud (EC2) instances with attached Elastic Block Store (EBS) volumes for storing confidential user data like PII. You need to ensure security of both data-in-transit as well as data-at-rest for the instances and their EBS volumes. How will you do this most efficiently?

You need a way to connect with AWS employees for query resolution and find out key aspects of AWS best practices and compliance information. Which of the following systems should you use in this scenario?

You need to allow your development team to retrieve secrets such as credentials and passwords programmatically without the need to embed credentials into application code. Which of these services should you use for this?

Which of the following elements do you need to access an AWS account programmatically? (Choose two.)

What is a key capability of an Amazon S3 data lake architecture component?

You are supporting a production AWS EC2 instance. You are notified that your AWS instance has a corrupted EBS volume. What AWS resource would graphically identify the issue and allow you to create and configure forward-looking notifications across multiple channels?

Which AWS technology should you use for managing and exploring AWS resources and running AWS CLI commands from a web browser without downloading specific command-line tools?

You need to perform automatic enforcement of security policies across resources that are created and perform centralized deployment of baseline security groups for the protection of virtual private clouds (VPCs). Which of these AWS services should you use for this?

You want to perform modeling and provisioning for cloud resources needed by your applications across several AWS Regions using automation. You also need to be able to perform rollbacks in case of any issues. Which AWS system should you use for this?

Which AWS service would you use to improve communication with your users that are located far from your existing AWS Regions?

Which AWS technology will you use for managing and exploring AWS resources and running AWS CLI commands from a web browser without downloading specific command line tools?

What is the name of a Trojan or worm that has infiltrated a fleet of EC2 instances that can be controlled by an external or remote user with malicious intent?

Your company is evaluating the security implications of moving its data to AWS Cloud. As per the AWS shared responsibility model, which of these are the responsibility of AWS? (Choose two.)

Which of these AWS technologies will you need to use for providing users with access to applications at low latency while meeting data residency needs?

You need a way to automate the process of evidence collection so you can easily assess the effectiveness of controls like activities, procedures, and policies. Which of the following AWS services will you use for this?

You work for a networking app development firm that uses AWS Cloud to create network security programs. The development team needs to work with data encryption and digital certificates for various clients. You need a managed service that can alert you on issues like weak user policies. What action would you take for this?

What security option gives you the ability to manage permissions for several different users at one time while controlling access to specific AWS resources?

You work for a large hospital as a SysOps administrator. You need to grant an outside user temporary access to an EC2 instance that you created within your VPC environment. You need to restrict access to a specific user, aws_user_carl, and then you want to limit their access to AWS Certification Manager (ACM). Which type of policy would best meet this requirement?

You want to inventory all of the IT assets across your systems as per their usage and analyze infrastructure dependencies and application components. You also want to organize resources into logical application groups to better understand their relationships and dependencies. Which of the following technologies should you use for this?

You need to route traffic between two VPCs using private Ipv6 addresses so that any instances in either VPC can communicate with each other as if they are on the same VPC. What would you use to achieve this?

You are on a security team and you need to lock down an IAM user account. Which options would you select? (Choose all that apply.)

Which of the following is the primary purpose of AWS Identity and Access Management (IAM) service?

Which AWS services can be used to detect security groups that allow unrestricted inbound access (such as 0.0.0.0/0) to your resources? (Select TWO.)

What does MFA primarily provide to enhance security for AWS accounts and IAM users?

Which of the following strategies primarily focuses on minimizing potential threats and vulnerabilities during the migration to the AWS cloud?

Which AWS feature offers guidance to help customers recognize and address configurations that might result in an increased cost, underutilized resources, or security risks?

What is the primary purpose of the AWS Compliance component in relation to organizations operating on the AWS cloud?

Which of the following AWS services provides a centralized repository to manage sensitive data or information, such as the organization's API keys?

Which AWS service safeguards applications running on AWS from distributed denial of service (DDoS) attacks?

For compliance purposes, an AWS customer needs to provide detailed records of all security and configuration related actions taken by AWS users in their accounts. Which AWS service will enable them to collect actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs?

In the shared responsibility model, which control requires both AWS to patch flaws within its infrastructure and customers to update their guest operating systems and applications?

Which AWS service integrates with MFA to provide enhanced security for users accessing the AWS Management Console?

Ananya, a security officer at Dion Training, is tasked with ensuring compliance with data protection laws for the company's website which is hosted in the AWS Cloud. Which of the following is the customer's responsibility under the shared responsibility model?

A telecommunications company wants to ensure its critical applications can quickly recover and continue operating after a major outage impacting one AWS Region. Which AWS feature or strategy should they use to achieve this?

What action must you take if you receive an abuse report from the AWS Trust and Safety team?

A customer had deployed webservice APIs on AWS and is concerned about being protected against common DDoS attacks. How can they enable AWS Shield for transport layer DDoS protection?

When considering methods for accessing AWS services using scripting, automation, or programmatic access. Which of the following options should you utilize? (Select TWO)

Which AWS service detects software vulnerabilities and unintended network exposure in AWS Amazon EC2?

Which of the following tools are primarily utilized for governance and compliance monitoring purposes? (Select TWO.)

Which of the following AWS services provides detailed logs of API calls made on your account, making it an essential tool for security analysis?

A new AWS customer has teams of developers, business analysts, and security engineers who need AWS privileges that are unique to each team. Which combination of steps would simplify managing their permissions while following best security practices? (SELECT TWO.)

Alex, a System Administrator at Dion Training, wants to centralize and automate backup solutions which would incorporate various AWS services. Which of the following AWS services should they utilize?

A security engineer wants to grant their company's AWS accounts permission to read objects in an S3 bucket using a bucket policy. How can the engineer ensure that only the accounts in their AWS Organization are granted the permissions?

Which AWS service primarily focuses on inspecting web requests for matches to specified conditions and manages these requests, potentially blocking or allowing them?

What are some recommended best practices for the root user for an AWS Account? (SELECT TWO.)

Alex, a Web Developer at Dion Training, is seeking a service to distribute content globally with low latency and high data transfer speeds, which can work seamlessly with Amazon S3. Which AWS service should they opt for?

A computer hardware manufacturer is using multiple AWS accounts as part of an AWS organization with all features enabled. What feature can the security team use to ensure that access to all current and future S3 buckets in all current and future accounts only occurs using encrypted connections?

Which of the following AWS services offers a browser-based client to access virtual desktops?

Vanessa, a compliance officer at Dion Training, needs a service that will help her track user activity and API usage across AWS services for auditing purposes. Which AWS service should be utilized to accomplish this?

When you create a new AWS account, which of the following identities is created by default, has complete access to all AWS services and resources, and is recommended to be used with caution?

A transportation company's security team needs to stay updated on the latest AWS security best practices and announcements. What information source provides real-world solutions and includes the latest insights from AWS security specialists?

Riley, a multimedia designer at Dion Training, wants to convert text into lifelike speech to enhance user engagement. Which of the following AWS services should they utilize?

Which of the following controls in the AWS shared responsibility model are fully given to the customer from AWS?

Jamie, a Network Administrator at Dion Training, needs to create, maintain, and secure network tunnels between their network and AWS VPCs. Which AWS service should Jamie use?

Which AWS service continuously monitors for potential threats across your AWS environment?

Which of the following AWS services is used for protecting applications from common exploits like cross-site scripting (XSS), command injection, and SQL injections?

A medical device company needs to secure patient data that is sent from medical offices to Amazon S3. Which action will ensure the data is encrypted as it traverses the internet?

Which AWS service allows you to securely store and manage database credentials, and automatically rotate them on a schedule?

A retail company wants to automatically process orders placed on their website by triggering a Lambda function whenever a new order is added to a DynamoDB table. Which AWS service should they use to route these events to the Lambda function?

A retail company uses AWS for online order processing. The company needs to prepare for an audit to ensure they meet the Payment Card Industry Data Security Standard (PCI DSS). Which AWS service can they use to collect evidence of their compliance with the PCI DSS framework?

What security responsibility is handled by AWS when a customer chooses Amazon RDS for a database solution?

What management responsibility shifts from the customer to AWS when the customer migrates their on-premises file systems to Amazon EFS?

Which AWS service inspects your AWS environment and makes recommendations to save money, improve system availability and performance, and help close security gaps?

Which of the following AWS authentication methods provides enhanced security by requiring two or more forms of identification before granting access?

What is the main focus of AWS's responsibility \Security of the Cloud\"?"

In the AWS shared responsibility model, which term refers to AWS's obligation to safeguard the infrastructure, including hardware, software, and networking?

What are some ways AWS can improve cost efficiency and productivity through adopting automation? (Select TWO.)

Which of the following AWS services enables users to manage password policies that enforce complexity and rotation requirements?

In the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using Amazon RDS DB instances?

Which of the following AWS services would be most appropriate to securely store and retrieve sensitive information like database credentials?

Ahmed, a compliance officer at Dion Training, is verifying that the security measures are in place for their AWS setup. Which of the following would AWS be primarily responsible for under the shared responsibility model?

A developer has created an application that stores data in a MongoDB database. They need to choose whether to run the database on EC2 or to use the MongoDB-compatible service, Amazon DocumentDB. According to the shared responsibility model, which responsibility will the developer retain if they choose to use DocumentDB?

A global company has multiple VPCs across different AWS Regions, an on-premises data center connected via AWS Direct Connect, and branch offices connected through AWS Site-to-Site VPN. The company wants to implement a solution to centrally manage and monitor all network connections while reducing the complexity of maintaining multiple peering relationships. Which AWS service or feature can they use to meet the requirements?

Which of these is a virtual firewall to control incoming and outgoing traffic to/from AWS resources (EC2 instances, databases etc)?

How can you distribute data in Amazon RDS across multiple availability zones? (Select 2)

You need to store archives for 20 years for regulatory compliance. Which of these AWS services provides you storage at the LOWEST cost?

Which of these is used to control traffic in and out of a subnet?

Which of these allows you to connect VPCs from same or different AWS accounts (across regions) to enable private communication between the connected VPCs?

Which of these allow you to monitor network traffic and troubleshoot network connectivity issues (NACL and/or Security Groups misconfiguration)?

Which of these AWS services helps you to connect AWS with on-premises? (Select 2)

One of the IAM best practices is to provide users with the minimum access they would need to be able to perform their duties. Which of these represents this best practice?

Which of these IAM entities has credentials attached with it (username, password and/or access keys)?

Which of these represents the need for an IAM Role?

Which of these are NOT IAM Best Practices (Select 2)?

Which of these AWS services are used to manage keys used for encryption in AWS? (select 2)

Which of these AWS services integrates with storage and database services in AWS (Amazon S3, DynamoDB etc) to provide you with options to encrypt your data?

Which of these AWS services can be used to protect Amazon Route 53, CloudFront, EC2 instances and Elastic Load Balancers (ELB) from distributed denial of service (DDoS) attacks?

Which of these AWS services can be used to protect your web applications from Common Vulnerabilities and Exposures (CVE) - information-security vulnerabilities and exposures?

Which of these is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts?

Which of these AWS services enables you to assess, audit, and evaluate the configurations of your AWS resources?

Which of these AWS services helps you to automate deployment of AWS resources in a controlled, predictable way?

Your enterprise has multiple AWS accounts - one each for every business unit. However, you would want generate a consolidated bill for all your AWS accounts. Which of these AWS services helps you to generate consolidated bill for multiple AWS accounts?

Which of these will you use to authenticate yourselves to make programmatic calls against AWS Services using AWS CLI?

Which of these are shared responsibilities between AWS and customer under the Shared Responsibility Model? (Select 2)

Which of these are NOT shared responsibilities between AWS and customer under the Shared Responsibility Model? (Select 2)

Which of these AWS services allow you to automatically increase and decrease the number of EC2 instances based on the number of users using your application?

Which of these provides a consolidated view of your security status in AWS?

How can you increase security for your AWS users logging in through AWS Management Console?

Which of these AWS services is a dedicated, single-tenant managed service for managing your keys in AWS?

Which of these IAM entities can have policies attached with them?

Which of these acts as a stateless firewall at the subnet level (Stop traffic from entering the subnet)?

Which of these AWS services would you use to check for security groups having unrestricted access (0.0.0.0/0)?

Which of these are inherited controls (controls that a customer fully inherits from AWS) under the shared responsibility model?

Which of these AWS services helps you to track the CPU Utilization of an EC2 instance?

Which of these is a fully managed data security and privacy service that uses machine learning to identify sensitive data?

Which of these is a private dedicated network connection from AWS to on premises?

Which of these is self-service portal for on-demand access to AWS compliance reports, certifications, accreditations, and other third-party attestations?

Which of these sits between public subnet (VPC) resources and the internet (provides access to the internet to and from public subnet resources)?

Which of these AWS services helps you to generate a consolidated bill for multiple AWS accounts?

When deploying applications to Amazon EC2 instances, who is responsible for choosing the Guest OS and installing patches to it?

Which of these is the advantage of deploying applications to AWS?

Which of these AWS services can be used to protect your web applications from OWASP Top 10 exploits like SQL injection, cross-site scripting(XSS)?

Which of these AWS services gives you real-time guidance to help you provision your resources following AWS best practices?

Which of these is used to provide temporary access to resources in AWS?

Which of these are IAM Best Practices (Select 2)?

Which of these AWS services provides inventory of your AWS resources including resource history?

You do not want to allow HTTP calls into your EC2 instances. Which of these can you make use of?

Which of these allow you to create tunnels from VPC to on premises with encrypted communication over internet?

Which of these AWS services provides you with a dedicated hardware appliance for managing your keys in AWS?

Which of these AWS services can be used to protect your web applications from malicious requests from specific IP Addresses?

Which of these AWS services helps you to execute an Auto Scaling policy based on CPU utilization of an EC2 instance?

Which of these is NOT a principle under the Security pillar of AWS Well Architected Framework?

Your enterprise has multiple AWS accounts - one each for every business unit. However, you would want to generate a consolidated bill for all your AWS accounts. Which of these AWS services helps you to generate a consolidated bill for multiple AWS accounts?

Which of these provides you with an extra layer of protection on top of your user name and password for critical operations?

Which of these allows internet access from a private subnet?

Which of these Amazon RDS features helps you to replicate the database in multiple AZs (Select 2)?

Which of these helps you to investigate and quickly identify the root cause of potential security issues?

Which of these are attached to an IAM entity to provide it with permissions to access AWS resources?

Which of these AWS services provides you with Elasticity - the ability to increase and decrease EC2 instances based on demand?

Which of these provides you with on-demand access to AWS security and compliance reports and select online agreements?

Access keys (access key ID and secret access key) of an IAM user are used to:

Which of these provides a consistent network performance from AWS to on-premises on a private network?

Which of these AWS services provides you with checks to optimize your AWS infrastructure, increase security and performance, reduce your overall costs, and monitor service limits?

Which of these services automates the discovery of sensitive data at scale and lowers the cost of protecting your data in AWS?

Your compliance needs dictate that you have to run all your EC2 instances on dedicated physical servers. Which of these options would you recommend?

Which of these are used to manage permissions for a set of users in AWS?

Which of these helps you to private connectivity between AWS and your data center to reduce your network costs, increase bandwidth throughput, and provide a more consistent network experience?

Which of these AWS services inspects your AWS environment and makes recommendations for saving money, improving system performance, or closing security gaps?

Which of these AWS services helps you to act based on events on AWS services (For example: Call a AWS Lambda function or send an email when an EC2 instance starts)?

Which of these AWS services helps you to define Service control policies(SCP) to define cross account restrictions (Example: Require MFA to stop an Amazon EC2 instance)?

Which of these AWS services helps you to create loosely coupled applications in AWS (Select 2)?

Which of these AWS services is recommended to audit and monitor changes made to your AWS resources?

One of the IAM best practices is to perform an additional security check in addition to user id and password for IAM administrators. Which of these represents this best practice?

A public subnet has a route to:

Which of these is a pre-defined template that contains a software configuration (for example, an operating system, an application server, and applications) to launch an Amazon EC2 instance?

Which of these is used to make programmatic calls against AWS Services?

Which of these is used to continuously monitor AWS environment for suspicious activity by analyzing AWS CloudTrail events, VPC Flow Logs etc?

Which of these allows instances in a private subnet to download software patches while denying inbound traffic from internet?

Which of these AWS services provides predefined, customizable rules that are used to evaluate whether your AWS resources comply with common best practices?

Which of these can be used to audit the usage of your IAM Users?

Which of these AWS services can encrypt data in Amazon S3?

Which of these is networking connection between two VPCs that enables you to route traffic between them using private addresses?

Which of these AWS services can integrate with AWS Shield to protect you from Denial of Service (DDoS) attacks? (SELECT 2)

Which of these AWS services provides you with cost optimization, performance, security and fault tolerance recommendations in AWS?

Which of these are used to manage permissions for a collection of users at a single place in AWS?

Which of these recommendations does NOT fall under the reliability pillar of AWS Well Architected Framework?

Which of these AWS services is recommended to track changes made to your AWS resources?

Which of these AWS services is used to collect monitoring and operational data in the form of logs, metrics, and events?

A private subnet does not have a route to:

Which of these AWS services helps you to simplify management of multiple AWS accounts?

Because of compliance requirements, your applications can only be deployed in a single geographic location. Which of these options can you consider to increase availability of your application?

Which of these AWS services helps you to add authentication and authorization to your mobile and web apps?

Which of these is NOT a responsibility of AWS under the shared responsibility model?

Which of these devices are used to setup AWS Managed VPN connectivity between On-premises and AWS (Select 2)?

Which of these can be used to review, accept, and manage your agreements with AWS?

Security and Compliance in AWS is a:

Which of these AWS services helps you to trace requests across different components and AWS services?

Which of these AWS services can be used to protect your web applications from web attacks by filtering traffic from a specific geographic location?

Which tool can be used to provide real time guidance on provisioning resources following AWS best practices?

You would like to collect custom metrics from a production application every 1 minute. What type of monitoring should you use?

Which of the following security related activities are AWS customers responsible for? (Select TWO.)

Which AWS service lets you add user sign up, sign-in and access control to web and mobile apps?

Which service can be used to assign a policy to a group?

Which AWS service allows you to automate the evaluation of recorded configurations against desired configuration?

Which feature of AWS IAM enables you to identify unnecessary permissions that have been assigned to users?

What does an organization need to do in Amazon IAM to enable user access to services being launched in new region?

Which AWS service uses a highly secure hardware storage device to store encryption keys?

Which type of security control can be used to deny network access from a specific IP address?

Which service can be used to manage configuration versions?

Which aspects of security on AWS are customer responsibilities? (Select TWO.)

What can be assigned to an IAM user? (Select TWO.)

The AWS acceptable use policy for penetration testing allows?

Which type of connection should be used to connect an on-premises data center with the AWS cloud that is high speed, low latency and does not use the Internet?

Which statement is correct in relation to the AWS Shared Responsibility Model?

Which service can an organization use to track API activity within their account?

What tool provides real time guidance to help you provision your resources following best practices in the areas of cost optimization, performance, security and fault tolerance?

Which of the following statements are correct about the benefits of AWS Direct Connect? (Select TWO.)

When using Amazon IAM, what authentication methods are available to use? (Select TWO.)

Which AWS service provides on-demand downloads of AWS security and compliance reports?

Under the AWS shared responsibility model what is AWS responsible for? (Select TWO.)

Which AWS service is known as a "serverless" service and runs code as functions triggered by events?

Which IAM entity is associated with an access key ID and secret access key?

Which IAM entity can be used for assigning permissions to multiple users?

Which AWS services are associated with Edge Locations? (Select TWO.)

Which service can be used to easily create multiple accounts?

Which authentication method is used to authenticate programmatic calls to AWS services?

A security operations engineer needs to implement threat detection and monitoring for malicious or unauthorized behavior. Which service should be used?

How can an organization track resource inventory and configuration history for the purpose of security and regulatory compliance?

Which service allows an organization to view operational data from multiple AWS services through a unified user interface and automate operational tasks?

To ensure the security of your AWS account, what are two AWS best practices for managing access keys? (Select TWO.)

What are Edge locations used for?

Which AWS offering enables users to find, buy, and immediately start using software solutions in their AWS environment?

Which AWS networking service enables a company to create a virtual network within AWS?

Which of the following is an AWS responsibility under the AWS shared responsibility model?

How would a system administrator add an additional layer of login security to a user's AWS Management Console?

Which service can identify the user that made the API call when an Amazon EC2 instance is terminated?

Which service would be used to send alerts based on Amazon CloudWatch alarms?

Where can a user find information about prohibited actions on the AWS infrastructure?

A company wants to use an AWS networking solution to connect multiple VPCs. Which AWS service will meet this requirement?

An online gaming company hosts its gaming application on AWS. The company needs to decrease latency by sending internet traffic to the application through AWS infrastructure.

A company needs to ensure their AWS resources comply with specific security standards. Which service provides security assessments and compliance monitoring?

What is the primary benefit of using AWS Auto Scaling?

: Security and Compliance A security team uses AWS Identity and Access Management (IAM) Access Analyzer to review new IAM policies, identify unused or overly broad permissions, and adjust them before deployment. Which cloud security principle does this practice most directly support? Options:

: Security and Compliance Which TWO are credential management best practices that help avoid hardcoding long‑term AWS access keys in application code? (Select TWO.) Options:

: Security and Compliance A company’s security team recently noticed a spike in suspicious SSH connection attempts to its Amazon EC2 instances. They already collect VPC Flow Logs and AWS CloudTrail logs in Amazon S3 but have no automated threat analysis. Which AWS service should they enable to continuously detect and prioritize potential security threats from this activity? Options:

: Security and Compliance A company recently enabled AWS CloudTrail and VPC Flow Logs in a new AWS account. The security team wants to automatically analyze this telemetry to detect suspicious activity with minimal setup and without building custom analytics tools. Which action best meets these requirements? Options:

: Cloud Technology and Services A company hosts a web server on an Amazon EC2 instance in a public subnet of a VPC. Users on the internet can start connecting, but their browsers hang and then time out. The instance’s security group allows inbound HTTP from 0.0.0.0/0 and all outbound traffic. The subnet’s network ACL allows inbound HTTP but denies all outbound traffic. What should a network engineer do to resolve the issue while keeping the security group unchanged? Options:

: Cloud Technology and Services Which of the following statements about Amazon EC2 instance store and Amazon EBS is NOT correct? Options:

: Cloud Technology and Services A company runs its web servers for an order-processing application on Amazon EC2, but the application connects over a VPN to a database that remains in the company’s on-premises data center. When the data center loses power, users can no longer place orders and managers ask why a “cloud application” is affected by an on-premises outage. What should a Cloud Practitioner explain about this deployment model? Options:

: Cloud Technology and Services Which TWO statements correctly describe whether selected AWS services are global or Regional in scope? (Select TWO.) Options:

: Security and Compliance A company stores sensitive customer reports in Amazon S3 using server-side encryption with a customer-managed key. A new analytics application is failing with AccessDenied errors when trying to decrypt these objects. The security team wants a managed way to create, control, and adjust access to the encryption keys so the app can read the data. Which AWS service should they use? Options:

: Cloud Technology and Services A company is designing a new VPC and wants to use subnets to improve security by separating public-facing and internal resources. Which TWO subnet design choices should the network team AVOID because they weaken security or segmentation? (Select TWO.) Options:

: Security and Compliance A security analyst is choosing between key types for encrypting data in a new application. The team wants to minimize key configuration work, even if that means having less direct control over key settings. Based on the following table, which choice best meets this requirement? Key type Example Configuration effort Customer control AWS-managed KMS key aws/s3 Low (AWS configures and rotates) Limited (fewer settings to change) Customer-managed KMS key project-data-key Higher (customer defines policies, rotation) More (fine-grained settings) Which statement is most appropriate for the team’s goal? Options:

: Security and Compliance What is the primary purpose of AWS Artifact for customers? Options:

: Cloud Concepts Which of the following are ways that migrating IT workloads to the AWS Cloud can help an organization improve its environmental, social, and governance (ESG) performance? (Select TWO.) Options:

: Security and Compliance Which of the following is NOT an example of a security responsibility that AWS manages under the AWS shared responsibility model? Options:

: Security and Compliance Which of the following statements about AWS Identity and Access Management (IAM) users and federated identities is NOT correct? Options:

: Security and Compliance Which of the following statements about AWS access management approaches is NOT correct? Options:

: Security and Compliance A company runs a public-facing web application on AWS and wants to improve its security using managed AWS security services. Which of the following actions is NOT an appropriate security best practice? Options:

: Security and Compliance Which TWO of the following statements about the AWS shared responsibility model are INCORRECT and could lead to security gaps if believed? (Select TWO.) Options:

: Security and Compliance A company has just created a new AWS account. Several team members are discussing how to manage and use the AWS account root user. Which of the following actions related to the root user should the team AVOID? (Select TWO.) Options:

: Security and Compliance A company’s compliance team needs the latest AWS SOC audit reports and wants the ability to review and accept standard data protection agreements with AWS on demand. They consult an internal wiki page that summarizes several AWS tools: AWS tool Primary use AWS Artifact On-demand access to AWS compliance reports and certain security agreements AWS CloudTrail Record account API activity for security analysis and auditing AWS Security Hub Central view of security findings from multiple AWS services AWS IAM Manage users, groups, roles, and permissions for AWS resources Based on this information, which AWS service should the team use to download compliance reports and review standard agreements with AWS? Options:

: Security and Compliance A company is expanding its use of AWS and wants to build long-term, in-house security expertise across its security, operations, and development teams. Leaders want structured guidance on AWS security best practices plus hands-on labs led by AWS experts. Which option is the most appropriate way to meet this need? Options:

: Security and Compliance A healthcare startup is preparing for an upcoming compliance audit and begins using AWS Artifact. The security lead creates several plans for how the team will use the service. Which TWO actions are INCORRECT uses of AWS Artifact in this scenario? (Select TWO.) Options:

: Security and Compliance A company is training staff on the AWS shared responsibility model. They want an example of a security task where AWS and the customer each handle different layers of the same activity (a shared control). Which example best illustrates this? Options:

: Cloud Technology and Services A company runs a simple web application in a single subnet. The web server and its database are both in this subnet, and the subnet has a route to an internet gateway. The company wants to improve security by keeping the website publicly accessible while preventing direct internet access to the database. Which network design change best meets these goals? Options:

: Security and Compliance Which TWO of the following statements about AWS security and compliance services are INCORRECT? (Select TWO.) Options:

: Security and Compliance A financial services company is preparing for a security audit. The auditors require official, AWS-published guidance on how to configure encryption and identity and access management (IAM) according to AWS best practices, and the security team also wants documentation they can reference in future audits. Which option is the MOST appropriate primary resource for these needs? Options:

A company's security policy requires the company to keep a record of all changes that are made to Amazon EC2 security groups. The record must include information about who made the change and when the change was made. Which AWS service will provide this information?

Which AWS service is a fully managed service and allows access to applications through a virtual interface (VIF)?

A company wants to control the protection of its AWS resources. The company wants to block SQL injection attacks and cross-site scripting. Which AWS service or feature meets these requirements?

A company is running its application in the AWS Cloud and wants to protect against a DDoS attack. The company's security team wants near real-time visibility into DDoS attacks. Which AWS service or traffic filter will meet these requirements with the MOST features for DDoS protection?

Which AWS service provides inbound and outbound network ACLs to restrict connectivity to Amazon EC2 instances?

A company needs to use automated video analysis to identify employees who are accessing its offices. Which AWS service will meet this requirement?

A gaming company wants to move its on premises environment to AWS. The company needs its resources to be highly available. Which benefit does the AWS Cloud provide to meet this requirement?

Which combination of AWS services or features can a company use to encrypt data in transit and data at rest? (Select TWO.)

Which service should a company use to store block-level monthly snapshots for rapid data recovery if an encrypted volume is compromised?

Which option is a responsibility of AWS under the AWS shared responsibility model?

Which AWS service provisions AWS compute and storage resources in a consistent and repeatable way?

Which AWS service allows you to define your infrastructure as code so you can automate the provisioning of AWS resources in a consistent and repeatable way?

Where do you go in the AWS console to see your spending forecast?

Which AWS service is best suited for storing media files and backup archives?

Which AWS tool helps automate the setup of a secure, governed multi-account environment?

What AWS tool helps you prepare for audits by collecting evidence?

What is a key benefit of using AWS Organizations?

What does the AWS Compliance Center provide?

Which service is used to create policies that define access in AWS?

What is a key benefit of using IAM roles instead of IAM users for EC2 instance access?

Which of the following is a benefit of using the AWS Command Line Interface (CLI) with IAM?

Why is IAM considered foundational in AWS security?

What is the purpose of Amazon Inspector?

What is a zero-day exploit?

What is a key benefit of Amazon Route 53 for security?

What is the role of AWS Certificate Manager (ACM)?

What tool is most commonly used to write and manage infrastructure as code (IaC) in AWS?

What does AWS Fargate eliminate the need for?

What is a main benefit of AWS Direct Connect compared to Site-to-Site VPN?

Which service enables low-latency and high-throughput dedicated connectivity to AWS?

Which Amazon Simple Queue Service (SQS) feature ensures that messages are not lost if processing fails repeatedly?

What does AWS CodePipeline automate?

What does machine learning (ML) enable systems to do?

What is the purpose of a subnet in a VPC?

What is the primary use of AWS Site-to-Site VPN?

What is the purpose of an internet gateway in a VPC?

What is the primary function of Elastic Load Balancing (ELB)?

Which AWS service provides built-in distributed denial-of-service (DDoS) protection at Edge Locations?

Which AWS service uses a tiered caching structure, starting at Edge Locations and scaling up?

In AWS’s Shared Responsibility Model, what is AWS responsible for?

What is the function of AWS Web Application Firewall (WAF)?

What AWS service allows for centralized enforcement of firewall rules across accounts?

Which AWS service helps manage encryption keys used across services?

What is the primary function of AWS Security Hub?

What is the purpose of Identity and Access Management (IAM) in AWS?

Which IAM feature allows permission control based on job functions?

Which type of credential is recommended for short-term programmatic access?

What does the IAM Access Advisor help you do?

Which field in an IAM policy allows you to restrict access by IP address?

What is the primary purpose of governance in AWS?

Which compliance framework is focused on the US federal government cloud service standards?

What tool continuously tracks and evaluates AWS resource configurations?

Which service helps scan Elastic Compute Cloud (EC2) instances for misconfigurations or vulnerabilities?

What is the purpose of service control policies (SCPs) in AWS Organizations?

Why should you avoid using the AWS root user for daily tasks?

What is a key function of AWS Identity and Access Management (IAM)?

What is Amazon Elastic Compute Cloud (EC2) primarily used for?

Which AWS service logs all API calls and helps with security auditing?

The AWS Shared Responsibility Model illustrates how AWS itself (as opposed to its customers) is responsible for which aspects of the cloud environment?

How, using security best practices, should your organization’s team members access your AWS account resources?

Which of the following describes a methodology that protects your organization’s data when it’s on-site locally, in transit to AWS, and stored on AWS?

What authentication method will you use to access your AWS resources remotely through the AWS Command Line Interface (CLI)?

How does AWS describe an isolated networking environment into which you can launch compute resources while closely controlling network access?

What is Amazon Cognito?

On which of the following sites are you most likely to find information about encrypting your AWS resources?

Which of the following is the primary benefit of using CloudFront distributions?

What is the main purpose of Amazon Route 53?

According to the AWS Shared Responsibility Model, which of the following are responsi-bilities of AWS? (Select TWO.)

According to the AWS Shared Responsibility Model, what’s the best way to define the sta-tus of the software driving an AWS managed service?

What is the primary function of the AWS IAM service?

Which of the following are requirements you can include in an IAM password policy? (Select THREE.)

Which of the following should you do to secure your AWS root user? (Select TWO.)

How does multi-factor authentication work?

What’s the most efficient method for managing permissions for multiple IAM users?

What is an IAM role?

Which of the following are valid third-party federated identity standards? (Select TWO.)

What information does the IAM credential report provide?

Which of the following IAM policies is the best choice for the admin user you create in order to replace the root user for day-to-day administration tasks?

What will you need to provide for a new IAM user you’re creating who will use “program-matic access” to AWS resources?

What will IAM users with AWS Management Console access need to successfully log in?

Which of the following will encrypt your data while in transit between your office and Amazon S3?

Which of the following AWS resources cannot be encrypted using KMS?

What does KMS use to encrypt objects stored on your AWS account?

Which of the following standards governs AWS-based applications processing credit card transactions?

What is the purpose of the Service Organization Controls (SOC) reports found on AWS Artifact?

What role can the documents provided by AWS Artifact play in your application planning? (Select TWO.)

Which of the following credentials can you use to log into the AWS Management Console?

While looking at the EC2 service console in the AWS Management Console while logged in as the root user, you notice all of your instances are missing. What could be the reason?

Which of the following is required to use the AWS Command Line Interface (CLI)?

After installing the AWS Command Line Interface, what should you do before using it to securely manage your AWS resources?

Which of the following are true regarding CloudWatch Events? (Select TWO.)

Which of the following trigger an API action? (Select TWO.)

What’s the most cost-effective way to view and search only the last 60 days of management API events on your AWS account?

You want to log every object downloaded from an S3 bucket in a specific region. You want to retain these logs indefinitely and search them easily. What’s the most cost-effective way to do this? (Select TWO.)

What is a benefit of using CloudTrail log file integrity validation?

When describing EC2 instance types, what is the role played by the vCPU metric?

Which of the following describes an EBS volume?

Why might you want to use an instance store volume with your EC2 instance rather than a volume from the more common EBS service? (Select TWO.)

What methods can be used to grant anonymous access to an object in S3? (Select TWO.)

Which of the following are security features of AWS Snowball? (Select TWO.)

Which of the following is true of a new security group?

What’s the difference between a security group and a network access control list (NACL)? (Select TWO.)

Which of the following is true of a VPC peering connection?

What are two differences between a virtual private network (VPN) connection and a Direct Connect connection? (Select TWO.)

Which of the following are true about registering a domain name with Route 53? (Select TWO.)

Resources in a VPC need to be able to resolve internal IP addresses for other resources in the VPC. No one outside of the VPC should be able to resolve these addresses. Which of the following Route 53 resources can help you achieve this?

You want to provide private name resolution for two VPCs using the domain name company.pri. How many private hosted zones do you need to create?

You’re hosting a web application on two EC2 instances in an Auto Scaling group. The performance of the application is consistently acceptable. Which of the following can help maintain or improve performance efficiency? (Select TWO.)

Your organization is building a database-backed web application that will sit behind an application load balancer. You add an inbound security group rule to allow HTTP traffic on TCP port 80. Where should you apply this security group to allow users to access the application?

Which of the following is required to enable S3 static website hosting on a bucket?

Which of the following is true regarding static websites hosted in S3?

Which AWS service uses machine learning to continuously monitor AWS accounts and workloads for malicious activity?

Which AWS service collects metrics and logs to let you monitor resource performance in real time?

Which AWS service automates the setup of a secure, multi-account AWS environment based on best practices?

Which AWS service provides real-time recommendations across cost optimization, security, fault tolerance, and service limits?

Which AWS service continuously assesses, audits, and evaluates the configurations of your AWS resources?

Which AWS service provides managed protection against Distributed Denial of Service (DDoS) attacks?

Which AWS service lets you create rules that block common web exploits such as SQL injection and cross-site scripting (XSS)?

Which AWS service creates an encrypted tunnel between your on-premises network and your Amazon VPC over the public internet?

Which AWS service sets up a landing zone with guardrails to help you govern a multi-account AWS environment?

Which AWS service collects and tracks metrics, collects log files, and sets alarms across your AWS resources?

Which AWS service automatically scans EC2 instances and container images for software vulnerabilities?

Which AWS service lets you write custom rules to filter malicious HTTP/HTTPS requests to your web applications?

Which AWS service records API calls made in your account for governance, compliance, and auditing?

Which AWS service provides a dedicated private network connection with consistent bandwidth between your data center and AWS?

Which AWS service continuously records configuration changes to your AWS resources for compliance auditing?

Which AWS service provides real-time guidance to help you provision resources following AWS best practices?

Which AWS service continuously tracks configuration changes to your AWS resources for auditing and compliance?

Which AWS service uses machine learning and threat intelligence to detect malicious activity across your AWS accounts?

Which AWS service logs and records all API calls made within your AWS account for governance and auditing?

Which AWS service automates the setup of a secure, compliant multi-account AWS landing zone?

Which AWS service monitors AWS resources and applications, collecting metrics and logs in real time?

Which AWS service provides a dedicated, private, high-bandwidth network connection between your on-premises data center and AWS?

Which AWS service continuously monitors and records the configuration of your AWS resources for compliance auditing?

Which AWS service lets you create custom rules to filter and block malicious web traffic at the application layer?

Which AWS service uses machine learning to discover and protect sensitive data such as PII stored in S3?

Which AWS service lets you easily provision, manage, and deploy public and private SSL/TLS certificates?

Which AWS service provides user sign-up, sign-in, and access control for web and mobile applications?

Which AWS service aggregates, organizes, and prioritizes security findings from multiple AWS services in one place?

Which AWS service automatically scans workloads for software vulnerabilities and unintended network exposure?

Which AWS service lets you run Microsoft Active Directory in the AWS Cloud?

Which AWS service provides sign-up, sign-in, and access control features for web and mobile apps?

Which AWS service helps developers analyze and debug distributed applications by tracing requests as they travel through the system?

Which AWS service helps you securely store, retrieve, and automatically rotate database credentials and API keys?

Which AWS service uses machine learning to analyze historical utilization metrics and recommend optimal AWS resource configurations to reduce costs?

Which AWS service filters malicious HTTP requests such as SQL injection and cross-site scripting attacks?

Which AWS service monitors resource performance and lets you set alarms based on defined thresholds?

Which AWS service continuously monitors your AWS accounts and workloads for malicious or unauthorized activity using machine learning?

Which AWS service monitors resources and applications, collecting metrics, logs, and events in real time?

Which AWS service automatically scans EC2 instances and container images to identify software vulnerabilities and unintended network exposure?

Which AWS service provides on-demand access to AWS's compliance reports and select online agreements?

Which AWS service provides managed protection against Distributed Denial of Service (DDoS) attacks?

Which AWS service automates the setup of a secure, multi-account landing zone based on AWS best practices?

Which AWS service collects metrics, logs, and events to help you monitor your AWS resources and applications?

Which AWS service lets you provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services?

Which AWS service lets you create custom rules to filter malicious HTTP requests targeting your web applications?

Which AWS service continuously monitors AWS accounts and workloads using machine learning and threat intelligence to detect malicious activity?

Which AWS service continuously monitors and records your AWS resource configurations for compliance auditing?

Which AWS service provides a comprehensive view of your security posture by aggregating findings from multiple AWS security services?

Which AWS service provides on-demand access to compliance reports and agreements, such as SOC and PCI reports?

Which AWS service enables companies to run workloads that require compliance with local data processing laws by keeping data within a specific country?

Which of the following is TRUE about the AWS Shared Responsibility Model for Amazon EC2?

Which of the following correctly identifies a task that AWS performs as part of its security responsibilities?

A company wants to rotate access keys for IAM users automatically. Which service and feature supports automated credential rotation?

Which of the following describes the IAM policy evaluation order when there is a conflict?

A company wants to ensure that developers cannot delete production S3 buckets, even if they have administrator-level IAM permissions in a member account. What achieves this?

Which of the following AWS services provides a detailed report of all IAM users, their access keys, passwords, and MFA status in an account?

A company wants to block specific IP address ranges from accessing their web application hosted behind an Application Load Balancer. Which service should they use?

Which AWS service automatically remediates non-compliant AWS resources based on predefined rules, such as enabling encryption on unencrypted EBS volumes?

A company wants to ensure that any new AWS account created within their organization automatically has CloudTrail enabled. Which service enforces this?

Which of the following is an example of a "proactive" security control in AWS?

Which AWS service provides network traffic mirroring for deep packet inspection and security analysis?

A company wants to use AWS for HIPAA-compliant healthcare workloads. What must they first establish with AWS?

Which of the following correctly describes how AWS WAF protects applications?

A company needs to store API keys used by their application and ensure they are never exposed in code or logs. Which service is purpose-built for this?

Which of the following describes the purpose of AWS Config Rules?

Which AWS security service is specifically designed to protect against volumetric DDoS attacks at layers 3 and 4 automatically for all AWS customers?

A company wants to create a private, isolated network in AWS and control all inbound and outbound traffic. What is the foundational service for this?

Which of the following is an example of "encryption at rest" in AWS?

A company wants to connect their on-premises network to AWS using an encrypted tunnel over the public internet. Which service provides this?

Which AWS service provides monitoring and observability for containerized applications, collecting metrics, logs, and traces in a unified view?

A company running microservices wants visibility into how requests flow through their distributed system and where bottlenecks occur. Which AWS service provides this?

Which AWS service is used to build and deploy GraphQL and Pub/Sub APIs for mobile and web applications with real-time data synchronization?

A company notices their Trusted Advisor dashboard shows a red alert for "Security Groups — Unrestricted Access." What does this mean?

Which of the following is an example of "automation" as a best practice in AWS cloud operations?

Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using AWS Lambda?

A company wants to implement the "principle of least privilege" for their development team. Which approach BEST reflects this?

Which of the following is a best practice for securing the AWS root account?

A company stores sensitive customer data in S3. Which combination of controls provides defense in depth for this data? (Select TWO)

Which AWS service allows you to query AWS resource inventory, configuration history, and compliance status using SQL-like queries?

A security engineer wants to detect if any S3 bucket in their account has been made publicly accessible in the last 24 hours. Which service provides near-real-time detection of this?

Which of the following is TRUE about IAM roles for cross-account access?

A company wants to ensure that all API activity in their AWS account is logged, even in Regions they don't actively use, to detect any unauthorized activity. What should they configure?

Which AWS service provides managed threat intelligence feeds and uses ML to detect anomalous behavior in AWS CloudTrail, VPC Flow Logs, and DNS logs?

A company wants to use a Hardware Security Module (HSM) but needs it to be shared across multiple AWS services like RDS and Redshift. Which service is appropriate?

Which of the following correctly describes how Amazon Cognito User Pools work?

A company wants to ensure that their S3 data is encrypted and that they control the encryption keys on their own key management infrastructure. Which option achieves this?

Which AWS service provides continuous monitoring and assessment of EC2 instances, ECR container images, and Lambda functions for software vulnerabilities?

A company has enabled AWS Organizations and wants to prevent any account from disabling AWS CloudTrail organization trail. What is the most scalable enforcement approach?

Which of the following describes the "shared controls" category in the AWS Shared Responsibility Model?

A company wants all traffic between their EC2 instances and Amazon S3 to remain within the AWS network and not traverse the public internet. Which solution achieves this?

Which of the following is TRUE about AWS CloudTrail data events vs management events?

A company wants to establish a formal process for reviewing and accepting AWS's data processing addendum (DPA) for GDPR compliance. Where do they access this?

Which AWS service provides a managed container registry with image vulnerability scanning and lifecycle policies?

Which of the following is TRUE about the AWS Shared Responsibility Model when using Amazon EKS (Elastic Kubernetes Service)?

A company wants to apply the principle of least privilege to an application running on EC2 that only needs to read from one specific S3 bucket. What is the BEST approach?

Which AWS service provides a centralized place to view, manage, and respond to security findings from multiple AWS security services across multiple accounts?

A company's compliance team needs to verify that no S3 buckets in their AWS account have public access enabled. Which AWS feature provides a single control to block all public access to all buckets?

Which of the following correctly describes AWS Security Token Service (STS)?

A company wants to detect if their EC2 instances are communicating with known malware command-and-control servers. Which service identifies this threat?

Which of the following is an example of a "corrective control" in AWS security?

Which AWS service provides fully managed SSL/TLS certificate provisioning and renewal for use with CloudFront, ALB, and API Gateway at no cost?

A company wants to implement network segmentation in AWS by separating their web tier, application tier, and database tier. Which AWS networking feature achieves this?

Which of the following is TRUE about AWS KMS customer managed keys (CMKs)?

A company runs multiple AWS accounts and wants one centralized account to store all security logs (CloudTrail, VPC Flow Logs, Config). Which architecture pattern supports this?

Which AWS service provides network packet capture and traffic inspection capability at the VPC level for security analysis?

A company wants to detect and alert when an EC2 security group allows unrestricted inbound access on port 22 (SSH). Which service provides this check?

Which AWS service enables customers to receive security advisories from AWS about vulnerabilities affecting their specific AWS resources?

A company wants to federate their on-premises Microsoft Active Directory users with AWS so they can assume IAM roles using their existing credentials. Which service enables this?

Which of the following is an example of "data sovereignty" as it applies to AWS?

Which AWS networking feature allows you to define multiple routing domains within a single VPC for traffic isolation?

Which of the following is an AWS cost optimization strategy for development and test environments?