Security and Compliance practice questions

Answer: A) AWS Artifact

• AAWS Artifact is the self-service portal for downloading AWS compliance reports and accepting agreements.
• BAWS Config records resource configuration changes; it does not distribute AWS audit reports.
• CInspector performs automated security assessments of workloads, not report distribution.
• DTrusted Advisor gives best-practice checks, not downloadable compliance attestations.

Answer: A) AWS Artifact

• AAWS Artifact is the self-service portal for downloading AWS's security and compliance reports (SOC, ISO, PCI, and more) and reviewing agreements.
• BTrusted Advisor inspects your account for best-practice issues; it does not host AWS's audit reports.
• CInspector scans workloads for vulnerabilities; it is not a compliance-document repository.
• DAWS Config records resource configuration changes; it does not provide AWS's third-party audit reports.

Answer: A) The request is denied — an explicit deny always overrides any allow

• AIAM evaluation logic: an explicit deny in any applicable policy (identity, resource, SCP, boundary) takes precedence over all allows.
• BPolicy evaluation is not order- or recency-based; explicit deny wins regardless.
• CA single allow is not enough when an explicit deny is present.
• DIAM evaluation is deterministic and automatic; there is no prompt.

Answer: A) An encrypted IPsec tunnel over the public internet between the on-premises network and the VPC

• ASite-to-Site VPN establishes encrypted IPsec tunnels across the internet, protecting traffic between the customer network and AWS in transit.
• BThat describes AWS Direct Connect; a VPN runs over the shared public internet.
• CA VPN secures data in transit; encryption at rest is configured separately on storage services.
• DThat is Amazon CloudFront, unrelated to a site-to-site VPN.

Answer: A) AWS creates and updates AWS managed policies, which you can't edit; you create customer managed policies and can edit them

AWS managed policies are created and maintained by AWS and can't be edited. Customer managed policies are created by you and can be tailored and updated. Both are standalone policies that can be attached to many identities, unlike inline policies.

• ACorrect. AWS managed policies are standalone policies created and administered by AWS. You can't change their permissions, and AWS updates them over time. Customer managed policies are standalone policies that you create and can change as often as you like.
• BIncorrect. The difference is who creates and maintains the policy, not which effects it can use. AWS managed policies such as ReadOnlyAccess grant (Allow) permissions.
• CIncorrect. This describes inline policies. Customer managed policies are standalone policies with their own ARN and can be attached to many users, groups, and roles.
• DIncorrect. Neither type grants permissions until you attach it to a user, group, or role. AWS managed policies are not applied automatically.

Answer: A) A role can be assumed by trusted principals such as IAM users, applications, or AWS services.; C) An EC2 instance can use a role so its applications get temporary credentials automatically.

IAM roles have no long-term credentials. Trusted principals, including users in other accounts, AWS services, and federated users, assume them to get temporary credentials. This lets workloads such as EC2 instances call AWS APIs without embedded access keys.

• ACorrect. A role is meant to be assumable by anyone who needs it. IAM users, other roles, AWS service principals, and federated users can assume a role if its trust policy allows them.
• BA role has no standard long-term credentials such as a password or access keys. Assuming it provides temporary security credentials for the role session.
• CCorrect. AWS delivers a role's temporary credentials to compute resources such as EC2, and AWS SDKs find them automatically. You don't need to put long-term access keys on the instance.
• DRoles are the main way to grant cross-account access, and AWS services and federated users can assume them too. This restriction doesn't exist.
• EUnlike an IAM user, a role isn't uniquely associated with one person. It is meant to be assumable by any trusted principal who needs it.

Answer: A) To define which actions on which resources an identity is allowed or denied to perform

• AIAM policies are JSON documents that specify permissions and are evaluated on every request.
• BResource metrics come from CloudWatch, not IAM.
• CNetwork filtering is handled by security groups and network ACLs.
• DSecret storage is Secrets Manager or Parameter Store, not IAM policies.

Answer: A) AWS Control Tower

• AControl Tower automates setup of a well-architected multi-account environment with preventive and detective guardrails.
• BCognito handles end-user sign-up and sign-in for applications, not AWS account governance.
• CAWS Batch runs batch computing jobs; it has nothing to do with account governance.
• DDetective helps investigate security findings; it does not build multi-account landing zones.

Answer: A) AWS Certificate Manager (ACM)

• AACM issues and manages public and private TLS certificates and handles renewal for certificates deployed to supported AWS services.
• BKMS manages encryption keys for data at rest; it doesn't issue TLS certificates.
• CSecrets Manager stores and rotates secrets such as database credentials, not TLS certificates for AWS services.
• DIAM manages identities and permissions, not certificates.

Answer: A) Defense in depth

• ADefense in depth layers multiple, independent security controls so an attacker must defeat several to succeed, and a single misconfiguration isn't catastrophic.
• BThat's a design weakness, not a security principle to apply.
• CLeast privilege (granting only necessary permissions) is a related but different principle.
• DRelying on secrecy of design is discouraged and is not what layered controls describe.