Security and Compliance — page 7
Which of the following describes the AWS Trusted Advisor "Fault Tolerance" category check?
Which of the following describes a key benefit of using multiple AWS accounts within an organization?
Under the AWS Shared Responsibility Model, which of the following is ALWAYS the customer's responsibility regardless of service?
A company wants to implement a "break glass" procedure for emergency access to AWS resources. What is the recommended approach?
Which IAM feature allows you to set the maximum permissions that an IAM user or role can have, regardless of what policies are attached to them?
A company wants to ensure that their AWS account has no access keys created for the root account. Which tool checks for this automatically?
Which of the following correctly describes how AWS CloudTrail helps with security incident response?
A company wants to implement a Web Application Firewall to protect their Application Load Balancer from OWASP Top 10 vulnerabilities. Which AWS service provides managed rule groups for this?
Which AWS service provides a DNS firewall that filters outbound DNS queries from VPCs, blocking requests to known malicious domains?
A company needs to prove to their auditors that AWS S3 data is encrypted and that encryption keys are managed with proper access controls. Which combination of services supports this evidence?
Which of the following describes "data in transit" encryption in AWS?
A company wants to automatically discover and protect sensitive data (PII, financial data) stored across their S3 buckets. Which service should they enable?
Which of the following is the purpose of an AWS Organizations Organizational Unit (OU)?
A company's security team wants to receive an immediate alert if any IAM user attempts to log in to the AWS Console without MFA. Which combination achieves this?
Which AWS service enables you to manage, rotate, and audit the lifecycle of SSH keys, Windows passwords, and API keys used to access EC2 instances?
Which AWS service provides continuous compliance monitoring against frameworks like PCI DSS, HIPAA, and SOC 2, and generates audit-ready reports?
A company wants to prevent their developers from accidentally exposing database credentials in code committed to AWS CodeCommit. Which service can scan code repositories for secrets?
Which of the following correctly describes the difference between Amazon GuardDuty and AWS Security Hub?
Which AWS service collects metrics, logs, and traces from containerized applications and provides dashboards for monitoring ECS and EKS workloads?
A company wants to monitor the performance of their application by setting thresholds and receiving alerts when metrics like CPU or error rate exceed limits. Which service provides this?
Which AWS service coordinates multiple Lambda functions and AWS services into visual, auditable workflows with branching, parallel execution, and error handling?
Which of the following describes the purpose of AWS License Manager?
A company wants to know if they are approaching AWS service limits (quotas) before hitting them. Which service proactively monitors this?
A company is evaluating AWS for processing payment card data. Which AWS compliance framework is specifically relevant to this use case?
Which of the following is TRUE about AWS GovCloud (US) Regions?
A company wants to ensure that no one — including AWS — can read their data stored in S3. Which encryption approach achieves this?
Which AWS service provides a managed intrusion detection system (IDS) at the network level, inspecting traffic flowing in and out of VPCs?
A company wants to ensure that developers in their AWS account can only launch EC2 instances in us-east-1 and eu-west-1. Which IAM condition key enforces this?
Which of the following is an example of using AWS for "non-repudiation" in security?
A company wants to detect and alert when an EC2 instance is querying unusual external domains at high frequency, potentially indicating a DNS-based data exfiltration attack. Which service detects this?
Which AWS service provides a managed secrets store that integrates natively with Amazon RDS, Redshift, and DocumentDB for automatic password rotation?
A company wants to restrict which AWS services can be used based on the requesting IP address (e.g., only allow access from the corporate network). Which IAM condition key enables this?
Which AWS service provides a managed PKI (Public Key Infrastructure) service to create and manage private certificate authorities for internal applications?
A company uses AWS Config and discovers that 15 S3 buckets are non-compliant with their encryption policy. Which AWS Config feature can automatically fix these buckets?
Which of the following is TRUE about IAM policy conditions?
A company wants to automatically receive notifications when AWS publishes new security bulletins about vulnerabilities affecting their specific AWS resources. Which service provides this?
Which of the following describes the purpose of Amazon Cognito Identity Pools?
A company's security audit requires evidence that all data stored in RDS is encrypted. Which AWS service or feature provides this proof?
Which AWS feature allows you to specify that an IAM role can only be assumed by specific services (e.g., only EC2 can assume this role)?
A company wants to scan all container images pushed to Amazon ECR for known CVEs before they are deployed. Which service provides this automatically?
Which of the following best describes the "least privilege" access pattern for Lambda functions accessing multiple AWS services?
Which AWS service provides a managed, cloud-native CI/CD service that compiles source code, runs tests, and produces artifacts?
Which AWS service provides a unified dashboard showing operational data from multiple AWS services, helping teams view and act on operational issues across their AWS environment?
A company wants to implement FinOps practices on AWS. Which combination of tools helps them track, analyze, optimize, and forecast cloud spending? (Select TWO)
Which of the following is a cost associated with running an Application Load Balancer (ALB) on AWS?
Which of the following BEST describes the "shared responsibility model" as it relates to cloud economics?
Which AWS service provides a dedicated fiber optic connection between an on-premises data center and AWS, bypassing the public internet entirely?
Which of the following AWS services is considered "global" (not Region-specific)?
Under the AWS Shared Responsibility Model, which of the following shifts from customer responsibility to AWS responsibility when moving from EC2 to AWS Lambda?
A company wants to implement "zero standing privileges" — where no user has persistent access and all access is temporary and just-in-time. Which AWS approach achieves this?
Which AWS service provides automated, continuous security assessments of AWS account configurations, network settings, and installed applications?
A company wants to ensure that data stored in their RDS database is automatically encrypted and the encryption cannot be disabled by any IAM user. Which approach achieves this?
Which of the following is TRUE about AWS CloudTrail log file integrity validation?
A company's security team wants to implement a "just enough access" model for their EC2 instances to access DynamoDB. Which approach is MOST secure?
Which AWS service provides real-time, ML-powered anomaly detection for CloudWatch metrics, automatically establishing baselines and detecting deviations?
A company wants to ensure their S3 buckets are never accidentally made public, regardless of individual bucket settings. Which is the SIMPLEST account-level control?
Which of the following correctly describes the purpose of a VPC's "default security group"?
A company wants to implement centralized, automated security response playbooks that run when specific threats are detected by GuardDuty. Which combination achieves this?
Which of the following is an example of an "identity-based policy" in AWS IAM?
A company wants to detect if root account credentials are being used for routine operations (a security anti-pattern). Which service detects root account usage?
Which of the following AWS services encrypts data at rest by default without requiring any customer configuration?
A company is concerned about "supply chain attacks" on their software. Which AWS service helps verify the integrity and provenance of software packages used in their CI/CD pipeline?
Which of the following describes the AWS "penetration testing" policy?
Which AWS service provides a fully managed directory service using Microsoft Active Directory in the cloud without requiring EC2 instances for domain controllers?
A company wants to apply a consistent set of security baseline guardrails across all new AWS accounts created in their organization automatically. Which service provides this?
Which of the following is a detective control that helps identify resources that are no longer being used and may pose a security risk if they still have access permissions?
Which AWS ML service provides pre-trained models for detecting personally identifiable information (PII) in text and can redact it automatically?
A company wants to implement observability for their microservices using distributed tracing, metrics, and logs in a unified view. Which AWS service provides this end-to-end observability?
Which of the following describes the pricing model for Amazon CloudFront?
Which AWS service helps identify underutilized resources, security vulnerabilities, and service limit risks through automated checks across five categories?
Which of the following is an example of a cost optimization best practice recommended by AWS Trusted Advisor?
A company using AWS Organizations wants to prevent all member accounts from launching any resources in the ap-southeast-1 Region. Which is the most scalable way to enforce this?
Under the AWS Shared Responsibility Model, which of the following is AWS responsible for across ALL service types?
A company wants to ensure that developers can only launch t3 family EC2 instances and cannot launch any other instance type. Which approach BEST enforces this?
Which AWS service provides a managed directory that enables EC2 instances joined to the domain to use Active Directory credentials for authentication?
A company wants to identify all S3 buckets in their account that have public read access enabled. Which service provides this check automatically?
Which of the following is TRUE about IAM policies and their evaluation when multiple policies apply to a request?
A company wants to monitor their AWS environment for unusual API activity such as large-scale data deletion or disabling of security controls. Which service is BEST suited?
Which of the following describes the purpose of enabling S3 Versioning?
Which AWS service provides hardware-based key storage with FIPS 140-2 Level 3 validated HSMs dedicated to a single customer?
A company wants to enforce a policy that all new EC2 instances must have a specific "Environment" tag applied. Which service can detect and alert on non-compliant instances?
Which type of AWS credential is used for programmatic access to AWS services via the CLI or SDK?
A company wants to share an S3 bucket's objects with a specific IAM role in another AWS account. Which IAM feature enables cross-account access?
Which of the following BEST describes the purpose of Amazon Macie?
A company operates in the European Union and must ensure that all customer data remains within EU borders. Which AWS feature directly supports this requirement?
Which AWS service enables customers to view and accept legal agreements such as the HIPAA Business Associate Addendum (BAA) required for healthcare workloads?
A company wants to protect their Application Load Balancer from common web exploits like cross-site scripting and SQL injection. Which AWS service should they attach to the ALB?
Which of the following is a preventive security control in AWS?
A company wants to automatically rotate their RDS database password every 30 days without any downtime or application changes. Which service handles this natively?
Which of the following describes the principle of "defense in depth" as implemented in AWS?
A company wants to connect their on-premises network to AWS using a private, dedicated fiber connection that bypasses the public internet for consistent performance. Which service provides this?
Which of the following correctly describes the purpose of Amazon CloudWatch?
Which of the following correctly describes what AWS Trusted Advisor checks in its "Performance" category?
Which AWS service provides a pre-built cloud environment with guardrails and a landing zone to help organizations quickly set up a secure, multi-account AWS environment following best practices?
According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using Amazon RDS?
A company wants to ensure that all programmatic access to their AWS account requires both an access key and an MFA token. Which IAM feature enforces this?
Which of the following actions is ONLY possible using the AWS root account and cannot be performed by any IAM user regardless of permissions?
A company wants to automatically detect and alert when an S3 bucket's ACL is changed to make it publicly accessible. Which combination of services achieves this in near real time?
Which AWS service continuously monitors network traffic, DNS logs, and CloudTrail events to detect threats such as port scanning, brute force attacks, and communication with malicious IPs?
A company stores sensitive financial data in S3. They want to ensure the data cannot be read even if someone gains unauthorized access to the S3 bucket. Which control achieves this?
Which of the following BEST describes the difference between an IAM User and an IAM Role?
A company wants to apply consistent security policies across all 20 of their AWS accounts to prevent any account from disabling CloudTrail. Which is the most efficient approach?
Which of the following is TRUE about Network ACLs (NACLs) in AWS VPC?
A company wants to store API keys and database passwords used by their applications and have them automatically rotated every 30 days. Which AWS service is purpose-built for this?
Which AWS service scans EC2 instances and container images in ECR for known Common Vulnerabilities and Exposures (CVEs)?
A company's compliance team needs a report showing all IAM users, their last login date, whether they have MFA enabled, and whether they have active access keys. Which AWS feature provides this?
Which of the following BEST describes how AWS Shield Standard protects AWS customers?
A company wants to restrict which AWS services their developers can use, limiting them to only EC2, S3, and RDS. Which AWS feature enforces this at the account level within an organization?
Which of the following is an example of "encryption at rest" on AWS?
A company wants to investigate the blast radius of a potential security incident — understanding which resources an IAM role can access across their AWS account. Which tool helps analyze these permissions?
Which of the following describes a "resource-based policy" in AWS?
A company wants to ensure their EC2 instances can only communicate with specific IP ranges and cannot communicate with any other destination. Which AWS feature enforces this at the instance level?
A company wants to receive automatic email notifications when their EC2 instance's CPU utilization exceeds 85% for 5 minutes. Which combination of services achieves this?
Which AWS networking service allows a company to create a secure, encrypted tunnel over the public internet between their on-premises data center and their AWS VPC?
A company's CTO argues that running their own data center gives them more control and is therefore more secure than the cloud. Which statement BEST counters this argument from an AWS perspective?
Which AWS Well-Architected pillar includes recommendations such as "understand your workload's compliance requirements" and "identify and validate goals for sustainability"?
A company uses Amazon EC2 instances. Under the Shared Responsibility Model, which of the following is the customer's responsibility?
Which of the following is the MOST secure way to allow an application running on EC2 to read from DynamoDB?
A company's security team wants to ensure that all objects uploaded to their S3 bucket are automatically encrypted. Which S3 feature enforces this?
Which of the following correctly describes the purpose of AWS CloudTrail?
A company wants to identify all external access to their AWS resources that may be unintentionally shared — such as S3 buckets or IAM roles accessible from outside the account. Which service analyzes this?
Which of the following BEST describes the difference between Amazon GuardDuty and Amazon Inspector?
A company wants to prevent unauthorized users from accessing their S3 bucket even if someone gets hold of a direct S3 URL. Which controls prevent this? (Select TWO)
Which AWS service provides managed DDoS protection with 24/7 access to the AWS DDoS Response Team and cost protection against DDoS-related scaling charges?
A company has 50 AWS accounts in their organization. They want to ensure CloudTrail is enabled in every account and cannot be disabled. Which is the MOST scalable solution?
Which of the following IAM best practices helps minimize the impact of a compromised IAM user account?
Which AWS service provides a centralized view and automated remediation for security findings across multiple AWS accounts and Regions?
A company processes credit card payments and needs to prove their AWS environment meets PCI DSS requirements. Which AWS service provides the compliance documentation?
A company wants to ensure that their developers can create EC2 instances but cannot delete any production RDS databases. Which IAM approach enforces this?
Which of the following describes the use of temporary security credentials in AWS?
A company wants to detect if any user in their AWS account is accessing data from an unusual geographic location, potentially indicating account compromise. Which service detects this?
Which of the following is TRUE about S3 Object Lock?
A company wants to grant a third-party company access to specific resources in their AWS account without creating permanent IAM users. What is the recommended approach?
A company wants to automatically scan all Docker images pushed to their ECR repository for known security vulnerabilities before deployment. Which service provides this?
Which AWS service enables companies to quickly build, test, and deploy mobile and web applications with a managed backend including authentication, APIs, storage, and hosting?
Which of the following BEST describes Amazon VPC peering?
A company wants to ensure they are within AWS service quotas before launching a large-scale workload. Which AWS service shows current quota usage and allows requesting increases?
Which of the following is an example of an AWS cost optimization recommendation that Trusted Advisor provides in its "Cost Optimization" category?
A company's IT manager says "We can't move to the cloud because we'll lose visibility into our infrastructure." Which AWS capability BEST addresses this concern?
A healthcare startup wants to launch a new application globally in multiple countries on the first day without any physical infrastructure investment. Which cloud benefits make this possible? (Select TWO)
Under the Shared Responsibility Model, when a company uses AWS Lambda, which responsibility does AWS take that the customer would manage if using EC2?
A company's security policy requires that no IAM user should have both S3 full access and EC2 full access simultaneously. Which approach enforces this?
Which of the following is the recommended way to provide AWS credentials to applications running on AWS services rather than storing static credentials?
A company wants to audit which IAM users and roles accessed specific S3 objects over the past 90 days. Which service provides this data?
Which of the following BEST describes Amazon Macie's primary function?
A company uses AWS Organizations with 10 member accounts. They want to prevent all accounts from purchasing Reserved Instances without approval. Which control achieves this?
Which of the following correctly describes how AWS WAF rules work?
A company wants to ensure that all new S3 buckets created in their account are private by default and can never be accidentally made public. Which single account-level setting achieves this?
Which AWS service provides an integrated view across AWS accounts showing compliance status against security standards like CIS AWS Foundations Benchmark?
A company wants to create a forensic-quality audit trail showing every action taken in their AWS account that can be used as evidence in a legal proceeding. Which service and feature ensures log integrity?
Which of the following is an example of a "compensating control" when direct prevention is not possible?
A company wants to federate their on-premises users so they can access the AWS Console using their existing corporate credentials without creating separate IAM users. Which service enables this?
Which of the following correctly describes how Security Groups handle return traffic?
A company wants to implement network micro-segmentation in AWS so that each application tier (web, app, database) can only communicate with adjacent tiers. Which AWS feature achieves this?
Which of the following is TRUE about AWS Key Management Service (KMS) key rotation?
A company's application running on EC2 needs to call the AWS DynamoDB API. Which is the MOST secure and operationally efficient approach for providing the necessary permissions?
Which AWS service enables a company to create and enforce custom firewall rules that inspect and filter traffic at the VPC perimeter, supporting stateful and stateless inspection?
A company has multiple development teams sharing an AWS account. They want to ensure each team can only access and modify resources they own without affecting other teams' resources. Which AWS feature enables resource-level isolation?
Which AWS networking service allows resources in a private VPC subnet to access AWS services like S3 and DynamoDB without requiring an Internet Gateway, NAT Gateway, or VPN?
Which of the following BEST describes the purpose of Amazon Route 53 health checks?
A company wants to know which of their EC2 instances have been running for more than 7 days with under 10% CPU utilization so they can be stopped to save money. Which service identifies this?
A company wants to centrally manage license usage for their Microsoft SQL Server and Oracle licenses across EC2 and RDS to ensure compliance. Which AWS service helps manage and track these licenses?
Which of the following BEST explains why a company might choose to deploy their application in multiple AWS Regions?
A company is moving from on-premises to AWS. Their security team is concerned about losing control of their data. Under the Shared Responsibility Model, which statement is TRUE?
A company wants to set up a new AWS account and follow security best practices from the start. Which of the following should they do FIRST?
Which of the following BEST describes the difference between AWS Config and AWS CloudTrail?
A company wants to encrypt data stored in their Amazon EBS volumes using keys they manage in AWS. Which service manages these encryption keys?
Which AWS service detects when sensitive data such as credit card numbers or social security numbers is stored in S3 buckets and alerts the security team?
A company wants to ensure users authenticate with both a password and a hardware token when logging into the AWS Management Console. Which AWS feature provides this?
Which of the following describes how AWS WAF protects web applications from common attacks?
A company's compliance requirement states that all database passwords must be automatically changed every 60 days with zero application downtime. Which AWS service handles this natively?
Which of the following BEST describes the purpose of AWS Artifact?
A company wants to prevent any developer from accidentally terminating an EC2 instance tagged as "Environment: Production". Which IAM condition enforces this?
A company uses multiple AWS accounts and wants to enable Amazon GuardDuty across all accounts with findings aggregated in a central security account. Which approach achieves this?
Which of the following is TRUE about IAM Groups?
Which of the following is an example of a "proactive" security measure in AWS?
A company wants to ensure their web application is protected from large-scale DDoS attacks and wants access to DDoS cost protection. Which AWS service provides this?
Which of the following describes a use case for Amazon Cognito?
A company wants to ensure their S3 bucket in us-east-1 cannot be deleted by any user, including the bucket owner, for 90 days to meet a compliance requirement. Which S3 feature achieves this?
Which of the following BEST describes how Amazon CloudWatch Alarms work?
Which AWS service provides an automated, managed code review service that uses ML to identify code defects, security vulnerabilities, and resource leaks in Java and Python?
Which AWS service provides a managed, cloud-native application performance monitoring solution that collects traces from distributed applications to identify bottlenecks?
A company wants to be alerted when any new IAM user is created in their account, as part of their security monitoring. Which combination of services achieves this?
Under the Shared Responsibility Model, which of the following security tasks is ALWAYS AWS's responsibility, regardless of which service a customer uses?
A company wants to implement a "least privilege" access model for their S3 buckets. By default, when a new S3 bucket is created, who has access?
Which AWS feature allows a company to require that API calls to specific services must originate from within their corporate network IP range?
A company wants to understand which IAM roles in their account have access to sensitive S3 buckets that contain financial data, and whether any of these are accessible from outside the account. Which service provides this analysis?
Which of the following BEST describes the purpose of enabling "multi-factor authentication" (MFA) for IAM users?
A company's security team wants to detect when an EC2 instance launches a process that starts making unusual external network connections — a potential sign of malware. Which service detects this type of runtime threat?
Which of the following actions should a company take immediately when an employee with AWS access leaves the organization?
A company stores backups in Amazon S3 and wants to ensure that even administrators cannot delete these objects for a minimum of 365 days to meet compliance requirements. Which S3 feature should they use?
Which of the following BEST describes the relationship between AWS Organizations, SCPs, and IAM policies?
Which AWS service provides automatic, managed detection of threats in Amazon EKS (Kubernetes) environments, including suspicious container activity?
A company wants to rotate their application's database password stored in AWS Secrets Manager. Which statement about Secrets Manager rotation is TRUE?
Which of the following BEST describes the purpose of a "VPC private subnet"?
A company wants to log and monitor all changes to their AWS infrastructure — such as who modified a security group rule, when, and from which IP address. Which service provides this?
Which of the following is TRUE about AWS Certificate Manager (ACM)?
A company wants to prevent any EC2 instance in their entire organization from using instance types with more than 32 vCPUs. Which control MOST efficiently enforces this across all accounts?
Which of the following correctly describes "AWS Shared Controls" in the Shared Responsibility Model?
A company wants to ensure all traffic between their application servers and their RDS database is encrypted in transit. Which approach achieves this?
Which AWS service provides a managed container registry that stores Docker images, supports vulnerability scanning, and integrates with ECS and EKS for deployment?
Which of the following BEST describes the purpose of AWS Systems Manager Session Manager?
A company wants to visualize real-time operational metrics for their AWS infrastructure — CPU, memory, network, and custom application metrics — in a unified dashboard. Which AWS service should they use?
A company wants to ensure their AWS usage never exceeds service limits that would cause application failures during peak traffic. Which service allows them to view and proactively request increases to service quotas?
Under the Shared Responsibility Model, which of the following describes the "security IN the cloud" — the customer's responsibilities?
A company wants to create an IAM policy that allows developers to read S3 objects but only from buckets tagged with "Team: Engineering". Which IAM feature makes this possible?
Which of the following is TRUE about the AWS root account after initial account setup?
A company wants to integrate their existing corporate SAML 2.0 identity provider (IdP) with AWS so employees can use their existing credentials to access the AWS Management Console. Which AWS service enables this?
Which of the following BEST describes the purpose of Amazon Inspector in the context of security?
A company uses hundreds of EC2 instances and wants to ensure all of them have the latest security patches applied automatically on a schedule. Which AWS service manages this?
Which of the following correctly describes how AWS CloudTrail helps with compliance?
A company wants to protect their API Gateway endpoints from being called by more than 1,000 requests per second from any single IP address. Which service enables this throttling based on IP?
Which of the following BEST describes AWS CloudHSM compared to AWS KMS?
A company stores highly sensitive data in Amazon S3 and wants to ensure that even AWS employees cannot read the data. Which encryption approach provides the strongest protection against unauthorized access?
Which of the following is TRUE about AWS Security Groups?
A company wants to receive an automated alert whenever the AWS root account is used to make any API call. Which combination achieves this?
Which of the following BEST describes the purpose of AWS Control Tower?
Which of the following describes a "guardrail" in the context of AWS Control Tower?
A company wants to ensure that all Amazon EBS volumes created in their account are encrypted by default without requiring users to select encryption at volume creation. Which setting achieves this?
Which of the following is an example of "identity federation" in AWS?
A company is concerned about a scenario where an attacker exploits a vulnerability in their web application's dependencies. Which security layer specifically addresses application-level attacks?
A company needs to transfer 100 TB of data from their on-premises data center to AWS as quickly as possible. Their internet connection would take weeks. They cannot use physical devices. Which service provides the fastest network-based transfer?
A company wants to centrally manage and enforce operational best practices — including automatically patching EC2 instances, running scripts, and collecting inventory — across all their accounts. Which service provides this at scale?
Which of the following BEST describes the "Reliability" pillar's focus on "managing change in automation"?
A company is migrating from on-premises to AWS. Their CISO wants to know who is responsible for ensuring data stored in Amazon S3 is encrypted. Which statement is CORRECT?
Which of the following BEST describes the principle of "least privilege" as it applies to IAM?
A company wants to detect unusual patterns in user behavior — such as a user downloading an unusually large amount of data at 3 AM — as a potential indicator of insider threat or account compromise. Which AWS service provides this behavioral analysis?
Which of the following is the MOST important reason to never store AWS access keys in application source code?
A company wants to implement centralized logging across 20 AWS accounts so all CloudTrail logs are stored in a single, dedicated security account. Which approach achieves this?
A company wants to ensure their EC2-based web servers can only receive HTTP and HTTPS traffic from the internet and all other inbound traffic is blocked. Which AWS feature enforces this at the instance level?
Which AWS service provides a managed platform for receiving, routing, and responding to security alerts from multiple AWS security services through a single interface with built-in automation?
A company wants to encrypt data stored in their Amazon DynamoDB tables using a key they control and can revoke access to if needed. Which encryption option achieves this?
Which of the following describes a use case for AWS IAM Identity Center (formerly AWS SSO)?
A company wants to implement network segmentation so that their database servers cannot directly communicate with the internet but can communicate with application servers. Which VPC configuration achieves this?
Which of the following is TRUE about how Network ACLs process traffic?
A company wants to ensure their IAM policies follow the principle of least privilege. Which AWS tool analyzes IAM policies and identifies permissions that have not been used in the last 90 days?
A company stores customer PII data in Amazon S3. They want automated discovery of which buckets contain PII and receive alerts if unprotected PII is detected. Which service provides this?
Which of the following BEST describes how AWS Shield Standard differs from AWS Shield Advanced?
A company wants to prevent developers from deleting log files stored in CloudTrail's S3 bucket, even if they have S3 full-access permissions. Which S3 feature provides the strongest protection?
Which of the following BEST describes the purpose of AWS Service Control Policies (SCPs) within AWS Organizations?
A company wants to ensure that all API calls made using the root account are immediately flagged and investigated. Which combination of services provides real-time detection?
Which AWS networking service allows you to connect your on-premises network to AWS using BGP routing over a dedicated, private 1 Gbps or 10 Gbps fiber connection?
A company wants to ensure they receive a weekly summary of AWS cost optimization opportunities, security risks, and performance improvements without setting up any alerts manually. Which service provides automated recommendations?
A company wants to understand which specific Lambda functions and EBS volumes are oversized and receive specific downsizing recommendations. Which service provides this ML-powered analysis?
A company's AWS account receives an email from AWS Trust and Safety about unusual activity. Which team within AWS handles abuse reports related to AWS resources being used for spam, malware, or illegal activity?
A company moves from self-managed servers to Amazon EC2. Which security task is now AWS's responsibility that was previously the customer's?
A company wants to enforce that all EC2 instances they launch must have a specific AMI from an approved list. Which IAM feature enables this conditional enforcement?
Which of the following BEST describes why enabling MFA for AWS IAM users is important even if passwords are complex and unique?
A company has 50 EC2 instances. They want to verify which instances are running outdated software versions with known CVEs. Which service performs this assessment automatically?
Which of the following CORRECTLY describes how Amazon GuardDuty collects threat intelligence?
A company stores API keys for third-party services in their application code. Their security team flags this as a high risk. What is the RECOMMENDED approach to fix this?
Which of the following BEST describes what a "Service Control Policy" (SCP) in AWS Organizations does NOT do?
A company wants to ensure that their Amazon S3 data is protected against ransomware attacks — specifically that an attacker cannot encrypt and delete the original objects. Which S3 features provide this protection? (Select TWO)
Which of the following BEST describes the purpose of "AWS IAM Access Analyzer"?
A company wants to configure their VPC so that web servers can receive internet traffic but database servers cannot be reached directly from the internet. Which is the correct VPC design?
Which of the following services helps ensure AWS API requests are signed and authenticated, preventing man-in-the-middle attacks?
A company wants to give a business partner read access to a specific S3 prefix within their bucket without creating IAM users. What is the RECOMMENDED approach?
Which of the following is TRUE about how AWS Key Management Service (KMS) integrates with Amazon S3?
A company's compliance framework requires that all AWS resource configuration changes be recorded and stored for 7 years. Which combination achieves this?
Which of the following BEST describes a "penetration test" in the context of AWS?
A company uses multiple AWS accounts and wants to ensure that security findings from all accounts are visible in a single "security account." Which AWS service enables this cross-account aggregation?
Which of the following CORRECTLY describes how S3 "pre-signed URLs" work?
A company wants to monitor network traffic flowing in and out of their VPC and analyze it for security threats, without deploying any agents or modifying applications. Which AWS service captures this metadata?
A company wants to store all their application logs in a centralized place where they can be searched, analyzed, and set up to trigger alarms. Which AWS service handles this?
Which of the following BEST describes Amazon Route 53's "health checks"?
A company wants to send a single "order completed" event that simultaneously triggers an inventory update Lambda, an email notification via SES, and a record in an audit SQS queue. Which AWS service achieves this fan-out?
Which of the following BEST describes the AWS "Shared Controls" for patch management under the Shared Responsibility Model?
A company has just received a $50,000 AWS bill they weren't expecting. AWS investigation shows a developer accidentally exposed access keys on GitHub and an attacker provisioned thousands of EC2 instances. Which TWO measures would have PREVENTED this? (Select TWO)
Which AWS service provides a self-service portal where customers can download compliance reports and manage legal agreements without contacting AWS Support?
Which of the following best explains "high availability" in AWS?
A company wants to move to AWS to improve their ability to deploy to new countries quickly. Which cloud benefit does this represent?
Which AWS service helps organizations assess their cloud readiness and provides recommendations for improvement?
A company uses Amazon S3 to store customer data. According to the Shared Responsibility Model, who is responsible for configuring bucket policies?
Which of the following is an AWS responsibility under the Shared Responsibility Model?
A company uses AWS Lambda. Compared to EC2, which additional responsibility shifts to AWS?
Which of the following supports compliance with data sovereignty requirements?
An employee leaves the company. What is the IAM best practice to immediately revoke their access?
Which AWS service would you use to define and enforce password complexity rules for IAM users?
Which AWS service tracks changes to AWS resource configurations over time?
A company wants to detect if an S3 bucket becomes publicly accessible. Which service can trigger an alert for this?
Which service manages SSL/TLS certificates for AWS services like CloudFront and ALB?
What is the purpose of an IAM role compared to an IAM user?
Which type of access control in AWS is evaluated BEFORE security groups when traffic enters a subnet?
A company wants to protect their web application from SQL injection attacks. Which service should they use?
Which AWS service provides hardware security modules (HSMs) for cryptographic key management with dedicated hardware?
Which of the following is a benefit of enabling MFA on the AWS root account?
A company needs to generate compliance reports showing who accessed what AWS resources and when. Which service provides this data?
Which AWS service aggregates findings from GuardDuty, Inspector, and Macie into one dashboard?
Security groups in AWS are considered:
Which AWS service is used to investigate the root cause of security findings by analyzing logs and relationships between resources?
Which of the following connectivity options provides the MOST consistent network performance for AWS connectivity?
The AWS Health Dashboard provides:
Under the Shared Responsibility Model, which of the following is TRUE when using AWS Lambda compared to Amazon EC2?
A company wants to ensure that when they rotate IAM access keys, the old key is completely invalidated. Which is the CORRECT procedure for safe key rotation?
Which AWS service provides automated assessment of EC2 instances against security benchmarks and best practices — checking for things like open network ports, unencrypted volumes, and outdated packages?
A company wants to implement a "clean room" data environment where analysts can query sensitive data using Athena without ever seeing the raw underlying data. Which AWS security approach enables this?
Which of the following CORRECTLY describes how "SCPs" and "IAM policies" work together to determine effective permissions?
A company's security team receives a GuardDuty finding: "UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS." What does this finding indicate?
Which of the following BEST describes the security principle of "least privilege" as it applies to S3 bucket policies?
A company wants to implement "just-in-time" access where engineers request temporary elevated permissions, get approved, use the access for a limited time, and have it revoked automatically. Which AWS service facilitates this?
Which of the following is TRUE about how "AWS Config Rules" evaluate compliance?
A company discovered that an S3 bucket containing employee PII was publicly accessible for 3 days. Which TWO services would help them understand the full impact? (Select TWO)
Which of the following CORRECTLY describes the purpose of "IAM Permission Boundaries"?
A company wants to ensure their web application is protected from the OWASP Top 10 vulnerabilities without writing custom security rules. Which AWS feature provides pre-built rule groups for this?
Which of the following BEST describes the security purpose of "Amazon VPC endpoints" (both Gateway and Interface)?
A company wants to run security penetration tests on their AWS environment to find vulnerabilities before attackers do. What does AWS allow regarding penetration testing?
Which of the following is TRUE about "Amazon GuardDuty" and its data sources?
A company stores encryption keys in AWS KMS and wants to ensure that even in the event of a region-wide disaster, they can still decrypt their data in a secondary Region. Which KMS feature supports this?
Which of the following BEST describes the security benefit of using "AWS PrivateLink" for service connectivity?
A company wants all CloudTrail logs delivered to a central S3 bucket in a security account to be protected from modification or deletion — even by administrators of that account. Which combination achieves this?
Which of the following BEST describes the purpose of "Amazon CloudFront Origin Shield"?
A company wants to use Amazon S3 as the foundation for a data lake. Which combination of AWS services allows them to catalog the data, transform it, and analyze it with SQL? (Select TWO)
Which AWS service enables developers to trace and debug distributed applications by showing how requests travel through microservices, Lambda functions, and databases — identifying where latency is introduced?
A company's application receives a sudden burst of 10,000 concurrent API requests. Their backend Lambda functions can handle up to 1,000 concurrent executions. What AWS feature helps protect the backend while queuing excess requests?
A company receives a report showing their EC2 Reserved Instance utilization is only 45% — meaning they're paying for capacity they're not using. Which TWO actions would improve this? (Select TWO)
A company stores sensitive data in Amazon S3. Which combination correctly applies the Shared Responsibility Model?
Which principle ensures that users and services are only granted the minimum access required to perform their tasks?
An administrator wants to allow an EC2 instance to access an S3 bucket without storing credentials on the instance. What is the best approach?
Which AWS service enables federated identity, allowing users to log in with Google or Facebook credentials to access AWS resources?
Which of the following is TRUE about AWS CloudTrail?
A company wants to ensure their AWS environment stays compliant with internal security policies over time. Which service continuously evaluates resource configurations against desired settings?
Which of the following correctly describes the difference between GuardDuty and Inspector?
Which AWS service is specifically designed to protect against large-scale DDoS attacks with 24/7 support from the AWS DDoS Response Team?
Which of the following IAM components is used to group users and apply policies collectively?
What happens to security group rules by default when a new security group is created?
A company must comply with GDPR and needs proof of AWS compliance certifications. Where do they find this?
Which service helps protect sensitive cardholder data and is commonly referenced in PCI DSS compliance on AWS?
Which of the following correctly describes access keys in AWS IAM?
A company wants to prevent any EC2 instance in a subnet from accessing the internet, regardless of security group settings. Which control achieves this?
Which of the following is a feature of AWS Key Management Service (KMS)?
A company needs to archive compliance records for 10 years with the lowest possible cost and retrieval time of 12 hours is acceptable. Which S3 storage class fits best?
A company wants to ensure their AWS environment follows industry best practices. Which AWS service lets them run automated checks and get a detailed report?
A company needs to comply with a regulation that requires all data to remain within a specific country. Which AWS feature directly supports this?
Under the Shared Responsibility Model, which of the following is ALWAYS an AWS responsibility regardless of the service used?
A company uses Amazon ECS on AWS Fargate. Compared to EC2, which additional responsibility shifts to AWS?
Which AWS service should a company use to get a single sign-on experience across all their AWS accounts and business applications?
A company wants to enforce MFA for all IAM users accessing the AWS Console. Which approach achieves this?
Which of the following describes a security group rule limitation?
Which AWS service monitors for and notifies you about changes to your AWS account's root login activity?
Which of the following is TRUE about multi-factor authentication (MFA) in AWS?
A company wants to ensure that objects stored in S3 cannot be deleted for 7 years to meet regulatory requirements. Which feature should they use?
Which AWS service helps identify and remediate publicly accessible resources and security risks across your AWS environment?
A company needs to manage encryption keys for their application and requires that the key material never leaves their on-premises HSM. Which solution supports this?
Which of the following correctly describes the purpose of an IAM permissions boundary?
A company is running workloads in three AWS accounts and wants a centralized way to detect security threats across all accounts. Which approach is recommended?
Which of the following is a use case for AWS Certificate Manager (ACM)?
Which AWS service can automatically quarantine an EC2 instance that is identified as compromised?
Which of the following is TRUE about Service Control Policies (SCPs) in AWS Organizations?
A company wants to receive a notification whenever an IAM policy is changed in their AWS account. Which combination achieves this?
Which AWS service provides managed DDoS protection that is automatically included at no extra charge for all AWS customers?
A company wants to store application secrets like API keys and database passwords with automatic rotation. Which service is purpose-built for this?
Which AWS service helps developers find and fix code quality issues, security vulnerabilities, and performance problems during code reviews?
Which AWS service helps trace requests as they travel through distributed microservices applications to identify bottlenecks?
Which of the following best describes the concept of "scalability" in AWS?
A company uses Amazon DynamoDB. Which of the following is the customer's responsibility?
Which of the following is the MOST secure way to provide AWS credentials to an application running on an EC2 instance?
A security team wants to receive an automated alert whenever a new IAM user is created in their AWS account. Which services should they use?
Which AWS service allows you to evaluate the security posture of your AWS account against CIS AWS Foundations Benchmark?
A company wants to prevent accidental deletion of critical S3 objects. Which two features should they enable? (Select TWO)
Which of the following correctly describes how IAM policies are evaluated when a user has both an identity-based policy and a resource-based policy?
A company's security team wants to ensure no EC2 instance in any account can have a public IP address. Which is the most scalable enforcement mechanism?
Which AWS service provides automatic security assessments of EC2 instances and container images for software vulnerabilities and network exposure?
Which of the following is a detective control in AWS security?
A company wants to enforce that all new EBS volumes created in their account are encrypted. Which service can enforce this automatically?
Which of the following describes the purpose of AWS Resource Access Manager (RAM)?
A company recently suffered a data breach and needs to investigate which user accessed sensitive data and from where. Which service provides this forensic data?
Which of the following is a preventive control in AWS?
Which AWS service provides compliance reports such as ISO 27001, SOC 1, SOC 2, and PCI DSS certifications on demand?
A company wants to ensure their application's SSL/TLS certificate is automatically renewed before expiration. Which service handles this?
A company wants to block traffic from specific countries from reaching their web application. Which service supports geo-blocking?
Which AWS feature enables you to define and enforce policies that automatically start, stop, or delete EC2 instances and EBS snapshots based on schedules?
A company wants to use their existing Microsoft Active Directory to control access to AWS resources. Which service integrates with AD?
Which AWS service provides a content delivery network that can also protect against DDoS attacks and apply WAF rules at the edge?
Which AWS service allows you to run applications that require Windows licensing on dedicated physical servers to meet compliance requirements?
A company runs workloads entirely on AWS Lambda. According to the Shared Responsibility Model, which of the following is the customer's responsibility?
A company wants to grant an external auditor temporary read-only access to their AWS account without creating permanent credentials. Which approach is BEST?
Which of the following is the MOST important reason to enable AWS CloudTrail in all Regions?
A company discovers that an IAM user's access keys have been compromised. What should they do FIRST?
Which AWS service provides a single pane of glass to aggregate, organize, and prioritize security findings from services like GuardDuty, Inspector, and Macie?
A company wants to detect if any EC2 instance in their account is communicating with a known cryptocurrency mining pool. Which service identifies this?
Which of the following correctly describes the purpose of AWS Key Management Service (KMS)?
A company must ensure that all data stored in Amazon RDS is encrypted and they want AWS to manage the encryption keys. Which option achieves this?
Which AWS service monitors and records configuration changes to AWS resources and can evaluate them against desired configuration rules?
A company needs to ensure their VPC resources cannot be reached from the internet under any circumstances. Which action achieves this?
Which IAM feature allows administrators to define the maximum permissions a developer's IAM role can ever have, regardless of what policies are attached?
A company wants to receive an automated notification whenever an AWS root account login is detected. Which combination of services achieves this?
Which of the following is the BEST description of "encryption in transit" in AWS?
A company wants to use AWS WAF to protect their web application. Which of the following threats can AWS WAF help mitigate?
Which AWS service automatically assesses EC2 instances and container images for software vulnerabilities and unintended network exposure?
A financial company needs to demonstrate AWS compliance with SOC 2 standards to their customers. Where do they obtain the official SOC 2 report?
Which of the following correctly describes how Security Groups differ from Network ACLs?
A company wants to centrally manage and automate patching of their EC2 fleet across multiple AWS accounts. Which service provides this capability?
A company needs to store 100 TB of infrequently accessed compliance records for 7 years at the lowest possible cost. They can tolerate retrieval times of up to 12 hours. Which S3 storage class is most cost-effective?
A company wants to deploy applications in multiple geographic locations to reduce latency for global users. Which AWS concept supports this?
In the AWS Shared Responsibility Model, who is responsible for patching the operating system of an Amazon EC2 instance?
A customer is using Amazon RDS. Which of the following is AWS responsible for in this managed service?
Which AWS service allows customers to download AWS security and compliance documents like SOC reports?
Which IAM best practice helps limit the potential damage if credentials are compromised?
Which tasks can ONLY be performed by the AWS root user account? (Select TWO)
Which AWS service continuously monitors AWS accounts and workloads for malicious activity?
Which service records all API calls made in an AWS account for auditing purposes?
A company needs to store and automatically rotate database credentials. Which service should they use?
Which AWS service provides protection against Distributed Denial of Service (DDoS) attacks?
A company wants to allow employees to sign in to multiple AWS accounts using their corporate credentials. Which service enables this?
Which encryption option protects data while it is being transmitted between services?
Which AWS service scans EC2 instances for software vulnerabilities and unintended network exposure?
A healthcare company needs to identify where sensitive PII data is stored in Amazon S3. Which service helps?
Which AWS service acts as a web application firewall to filter HTTP/HTTPS traffic?
Which of the following is a customer responsibility in the Shared Responsibility Model for AWS Lambda?
Network ACLs in a VPC operate at which level?
Which AWS service provides a centralized view of security alerts across multiple AWS accounts?
A company needs a dedicated, private network connection from their data center to AWS. Which service provides this?
Which service provides automated recommendations across cost, performance, security, fault tolerance, and service limits?
Which AWS service helps identify underutilized EC2 instances and provides cost-saving recommendations?
What does "geo-redundancy" mean in the context of AWS?
Which of the following is TRUE about the AWS root account?
A developer accidentally commits AWS access keys to a public GitHub repository. What should be done FIRST?
Which IAM policy type is attached directly to an AWS resource such as an S3 bucket?
Which AWS service provides centralized governance and compliance across multiple AWS accounts using guardrails?
A company uses AWS Organizations and wants to prevent member accounts from launching resources in specific Regions. Which feature enforces this?
Which of the following correctly describes the difference between CloudWatch and CloudTrail?
A company wants to receive an alert when CPU utilization on an EC2 instance exceeds 80%. Which service should they use?
Which encryption approach protects data stored on an EBS volume?
Which AWS service is used to create a private certificate authority (CA) to issue private SSL/TLS certificates?
Which of the following is an example of identity federation in AWS?
A company wants to ensure that no S3 buckets in their account are ever made public. Which service can automatically detect and alert on this misconfiguration?
Which AWS service would you use to establish a private connection between your VPC and AWS services without traffic going over the public internet?
Which of the following correctly describes a managed policy in IAM vs an inline policy?
Which AWS service helps protect against account compromise by analyzing user behavior and detecting anomalous activity?
A company wants to restrict which AWS services their developers can use in a sandbox account. Which IAM feature achieves this at the account level within AWS Organizations?
Which of the following is TRUE about encryption using AWS KMS?
Which S3 feature prevents objects from being deleted or overwritten for a defined period to meet compliance requirements?
Which AWS service automatically detects and classifies sensitive data stored in Amazon S3?
A company wants to use infrastructure as code to provision AWS resources in a repeatable and automated way. Which service should they use?
Which AWS service provides a visual interface for automating operational tasks across AWS resources, such as patching and running scripts?
Which AWS tool provides automated checks across five categories: cost optimization, performance, security, fault tolerance, and service limits?
What is the primary purpose of AWS Service Quotas (formerly Service Limits)?
A customer stores objects in Amazon S3. According to the Shared Responsibility Model, which task is the customer's responsibility?
Which AWS feature helps ensure that IAM users are not creating resources in unauthorized Regions?
A company wants to allow an external auditor read-only access to their AWS account for a limited time. What is the recommended approach?
Which of the following is TRUE about IAM access keys?
A company wants to log all S3 object-level access (GET, PUT, DELETE) for auditing. Which feature should they enable?
Which AWS service helps you understand the relationship between security findings — for example, which EC2 instance communicated with a known malicious IP?
Which of the following is the recommended way to grant an AWS Lambda function access to an S3 bucket?
Which AWS service provides pre-built security and compliance frameworks and automates evidence collection for audits?
A company notices unusual API calls being made from an unfamiliar IP address in their AWS account. Which service would have detected and alerted on this?
Which of the following correctly describes the difference between a Network ACL and a Security Group?
A company must ensure that all data stored in AWS is encrypted. Which AWS service manages and stores the encryption keys used by services like S3, EBS, and RDS?
Which of the following is an example of "defense in depth" on AWS?
A company wants to be notified if any root account login occurs in their AWS account. Which combination achieves this?
Which AWS compliance program is relevant for organizations processing credit card payments?
A company wants to provide third-party vendors access to specific AWS resources without creating IAM users for them. What is the best approach?
Which AWS service provides network-level protection by inspecting and filtering traffic at the VPC perimeter?
Which of the following is a feature of Amazon Cognito?
A company wants to automate their software release process from code commit to production deployment. Which set of services supports a complete CI/CD pipeline?
Which AWS service provides a managed artifact repository for storing and sharing software packages like Maven, npm, and PyPI?
A company needs to replicate S3 objects automatically to another Region for compliance. Which S3 feature enables this?
A company wants to build a dashboard showing real-time metrics for their AWS resources including CPU, network, and custom application metrics. Which service should they use?
Which AWS service helps developers trace requests through distributed applications to identify performance bottlenecks and errors?
Which AWS service enables event-driven automation — for example, automatically stopping EC2 instances when they are tagged with a specific key?
Which of the following is NOT a feature of AWS Organizations?
A company runs Amazon Aurora. Which of the following is AWS responsible for under the Shared Responsibility Model?
Which of the following actions can ONLY be performed by the AWS account root user?
A company wants to ensure that when an IAM user is deleted, their access is revoked across all AWS services immediately. Which is TRUE about this process?
Which type of IAM policy is managed and updated by AWS and covers common use cases like read-only access to specific services?
A company wants to ensure that EC2 instances in a private subnet cannot communicate with the internet under any circumstances. What configuration achieves this?
Which AWS service enables you to centrally manage and automate security findings remediation across multiple accounts?
A company needs to demonstrate to customers that AWS meets ISO 27001 standards. Where do they find the official certification documents?
A company wants a simple way to check whether their AWS account follows security best practices like enabling MFA on root and not having open S3 buckets. Which service provides this at no additional cost?
A security engineer wants to ensure all CloudTrail logs are tamper-proof. Which feature should they enable?
Which AWS service is used to detect unusual spending patterns that may indicate a compromised account making unauthorized API calls to provision resources?
A company wants to restrict which AWS services developers can use in sandbox accounts while allowing full access in production. Which is the best approach?
Which of the following correctly describes the "allow list" (whitelist) approach in NACLs?
A company wants to use hardware-based cryptographic operations with keys that never leave their hardware boundary. Which AWS service provides dedicated HSMs?
Which of the following is an example of data classification in AWS security?
Which AWS service helps maintain compliance by continuously recording configuration changes and evaluating them against desired rules?
A company wants to give a third-party security vendor read-only access to their AWS environment for a penetration test. What is the recommended approach?
Which AWS service is used to centrally manage configuration of EC2 instances at scale, including running commands and applying patches?
Which of the following describes the purpose of an Elastic IP address in AWS?
Which AWS service enables you to add authentication and authorization to web and mobile apps, supporting social identity providers like Google and Facebook?
Which AWS service helps developers debug and optimize serverless and distributed applications by providing end-to-end tracing?
A company wants to understand which IAM users have not logged in for 90+ days to reduce security risk. Which service provides this?
A company wants to know the maximum number of EC2 instances they can launch in a Region. Which AWS service or feature provides this information?
Which of the following describes the "stop guessing capacity" benefit of AWS?
A company runs workloads on AWS and on-premises. Under the Shared Responsibility Model, which layer does AWS always own regardless of the service?
A company wants to enforce that all IAM users use MFA when accessing the AWS Management Console. What is the best way to enforce this?
Which AWS service provides a managed directory service that allows AWS workloads to use Active Directory without deploying and managing AD servers?
A company wants to monitor failed SSH login attempts on EC2 instances and trigger alerts. Which AWS services are most appropriate?
Which of the following correctly explains the difference between authentication and authorization in AWS?
Which AWS service continuously monitors AWS accounts for threats like cryptocurrency mining, unauthorized access, and data exfiltration using ML and threat intelligence?
A company is required by regulators to retain all AWS API activity logs for 7 years. Which combination ensures durable, long-term storage of CloudTrail logs?
Which of the following is the purpose of enabling AWS CloudTrail in all Regions?
A company wants to prevent users in their AWS account from disabling CloudTrail. Which control should they apply?
Which of the following describes an "implicit deny" in AWS IAM policy evaluation?
A company wants to assess their AWS environment against the NIST Cybersecurity Framework. Which service provides pre-built frameworks for this?
Which of the following is TRUE about VPC security groups and NACLs working together?
A company needs to sign all API requests to AWS services for security. Which AWS feature handles request signing automatically when using the AWS SDK or CLI?
Which AWS service scans container images in Amazon ECR for known software vulnerabilities?
A company wants to rotate their database password automatically every 30 days. Which AWS service handles this natively?
Which of the following describes the purpose of AWS Artifact agreements?