Easy practice exam 1

Explanation

Answer: D. AWS describes its half of the model as security OF the cloud: the hardware, software, networking, and facilities that run AWS Cloud services, including Regions, Availability Zones, and edge locations. Anything the customer cannot physically reach or configure sits on the AWS side of the line.

• A. Identity and access management for the customer's own users and resources is squarely a customer responsibility; AWS provides IAM but never decides who in the customer's organization gets access.
• B. Guest operating system patching on EC2 is explicitly named as a customer responsibility. AWS patches the underlying infrastructure, not the guest OS the customer launched.
• C. Security groups are the AWS-provided firewall that the customer configures. AWS supplies the capability; deciding which ports and sources are allowed is security IN the cloud and belongs to the customer.

Explanation

Answer: D. Amazon EC2 is categorized as Infrastructure as a Service, so the customer performs the security configuration and management tasks above the hypervisor. AWS states that customers who deploy an EC2 instance are responsible for management of the guest operating system, including updates and security patches, plus any software they install and the security group configuration.

• A. The source of the Amazon Machine Image does not change the boundary. AWS may publish an image, but once the instance is launched, keeping its operating system patched is the customer's job.
• B. AWS maintains the software that runs the cloud infrastructure itself, such as the virtualization layer and the AWS service software, not the operating system inside a customer's instance.
• C. The hypervisor isolates instances from one another; it does not reach inside a running instance to update its operating system packages.

Explanation

Answer: A and B. Both fall inside security IN the cloud. The customer decides who may reach their data, which is expressed through resource-based policies such as S3 bucket policies and through identity and access management. AWS supplies the mechanisms, but configuring them correctly is never delegated back to AWS.

• C. Physical and environmental security of AWS facilities is an inherited control, entirely on the AWS side of the model.
• D. Media decommissioning is an AWS responsibility. AWS uses documented destruction processes for storage devices so that customer data cannot be recovered from retired hardware.
• E. The hypervisor is part of the infrastructure AWS operates. Customers have no access to it and no ability to patch it.

Explanation

Answer: A. AWS Artifact is the self-service portal for AWS security and compliance documentation. It supplies third-party audit artifacts such as SOC 1, SOC 2, SOC 3, ISO, and PCI DSS reports, and it also holds agreements a customer may need to accept with AWS. AWS provides these documents free of charge.

• B. AWS Config records and evaluates the configuration of a customer's own resources over time. It reports on the customer's compliance posture, not on AWS's audit attestations.
• C. AWS Trusted Advisor inspects a customer's account against best-practice checks. It does not distribute AWS audit reports.
• D. AWS CloudTrail records API activity in the customer's account for auditing and governance. It produces the customer's own audit trail rather than AWS's certifications.

Explanation

Answer: B. AWS CloudTrail enables operational and risk auditing, governance, and compliance by recording actions taken in an account as events. Each event captures the identity that made the request, the time, the source IP address, and the parameters, which is exactly the who-did-what record an investigation needs.

• A. AWS Config records what a resource's configuration is and how it has changed. It answers what changed, while CloudTrail answers who changed it.
• C. Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It does not log API activity.
• D. Amazon CloudWatch collects metrics, logs, and alarms about resource and application performance. It reports on how systems are behaving rather than which principal invoked an API.

Explanation

Answer: A. Data moving across a network needs encryption in transit, which on AWS means TLS. AWS Certificate Manager provisions the public certificate at no charge, deploys it to integrated services such as Amazon CloudFront and Amazon API Gateway, and renews it automatically before it expires. A certificate used with CloudFront must be requested in the US East (N. Virginia) Region.

• B. Amazon EBS encryption protects data at rest on the volume. It does nothing for traffic crossing the network to reach the distribution.
• C. Encrypting the log bucket protects stored log files at rest. The user's request has already traversed the internet by the time a log entry is written.
• D. Encryption at rest on Amazon RDS protects the stored database. The requirement described concerns the browser-to-load-balancer path, which is a different segment entirely.

Explanation

Answer: D. Least privilege is about the scope of each grant rather than the number of people who hold one. It means granting only the actions, resources, and conditions a task genuinely requires. AWS notes that a team may begin with broader permissions while it learns what a workload needs, then reduce them over time, using signals such as IAM last accessed information to remove permissions that were never used.

• A. Restricting root user use is a separate and valid best practice, but least privilege applies to every identity in the account, not only the root user.
• B. Limiting headcount is not the same idea. Ten people with correctly scoped permissions is a better security posture than two people who each hold administrator access.
• C. Consolidating everyone into a single group forces one permission set on people with different jobs, which is the opposite of least privilege.

Explanation

Answer: B. Multi-factor authentication requires something the user knows, their password, plus something they have, an authenticator device. AWS supports passkeys and FIDO security keys, virtual authenticator applications, and hardware time-based one-time password tokens, and an identity can register up to eight MFA devices.

• A. A password policy strengthens the first factor. A longer, more complex password is still a single factor, so a stolen password still grants access.
• C. A resource-based policy governs what a principal is authorized to do once identified. It plays no part in proving who the principal is.
• D. Access keys are long-term credentials for programmatic access through the AWS CLI and SDKs. They are an alternative credential type, not a second factor for console sign-in.

Explanation

Answer: D. AWS states that a role does not have standard long-term credentials such as a password or access keys. When an identity assumes a role it receives temporary security credentials for that role session, which expire automatically. This is why roles are the recommended way to grant access to applications, AWS services, and federated users.

• A. An IAM group is a container used to attach permissions to a collection of users. It is not an identity, cannot be signed in to, and cannot be named as a principal in a policy.
• B. An IAM user is an identity with long-term credentials, which may include a console password and access keys. Those credentials persist until someone rotates or deletes them.
• C. The root user has long-term credentials, specifically the account email address and password, and holds unrestricted access to the account.

Explanation

Answer: A and E. The root user holds unrestricted access that cannot be limited by an identity-based policy, so protection focuses on making the credentials hard to misuse and rarely needed. AWS strongly recommends enabling MFA, and recommends against creating root access keys because programmatic access with unrestricted permissions is a severe risk if the keys leak. MFA is now required for the root user across all AWS account types.

• B. Sharing credentials destroys accountability, since CloudTrail can only record that the root user acted and not which person did so. AWS instead suggests controls such as multi-person approval, where no single person holds both the password and the MFA device.
• C. Identity-based policies cannot restrict the root user, which is why AWS focuses on credential protection and on centralized root access management in AWS Organizations rather than on limiting root with a policy.
• D. AWS advises not to access the root user unless a task genuinely requires it, and to perform daily work with IAM roles or IAM Identity Center workforce users.