Easy practice exam 1

Explanation

Answer: B. AWS Shield Standard is built into the AWS services a customer already uses, with no subscription, commitment, or additional charge. It defends against the common and most frequently occurring network and transport layer, meaning layer 3 and layer 4, DDoS events such as SYN floods and reflection attacks.

• A. AWS Firewall Manager centrally administers firewall policies across accounts. It manages other services' protections rather than mitigating attacks itself.
• C. AWS WAF inspects HTTP and HTTPS requests at the application layer. It is a chargeable service, is not automatically applied, and does not address layer 3 or layer 4 attacks.
• D. Amazon GuardDuty detects threats by analyzing account, network, and DNS activity. It raises findings but does not block or absorb attack traffic.

Explanation

Answer: A. AWS WAF is a web application firewall that operates at layer 7. A web ACL of rules evaluates each request and allows it, blocks it with an HTTP 403, or returns a custom response. Managed rule groups maintained by AWS and by AWS Marketplace sellers cover common exploits including SQL injection and cross-site scripting, and are updated as new threats emerge.

• B. AWS Shield Standard mitigates volumetric network and transport layer attacks. It does not parse the content of an HTTP request.
• C. A network ACL filters on IP addresses, protocols, and ports at the subnet boundary. It cannot see whether a request body contains an injection attempt.
• D. Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure. It reports risks rather than filtering live traffic.

Explanation

Answer: D. AWS divides the model into security OF the cloud, which AWS performs, and security IN the cloud, which the customer performs. Everything the customer can configure through the AWS APIs and console sits on the customer side, and deciding which identities may act on a resource is one of the clearest examples.

• A. The network fabric connecting Availability Zones is AWS-owned global infrastructure and is entirely AWS's responsibility.
• B. The hypervisor and the host firmware beneath it are part of the virtualization layer AWS maintains. Customers have no access to that layer.
• C. Hardware maintenance inside AWS facilities is part of the infrastructure AWS operates. Customers never see or touch the physical devices.

Explanation

Answer: A and B. Both sit in the layer AWS calls security OF the cloud: the hardware, software, networking, and facilities that run AWS Cloud services. The customer can neither see nor configure the service software behind a managed service, nor enter an AWS data center, so neither task can be delegated back to them.

• C. Credentials belonging to the customer's application are customer content. AWS offers services that help manage and rotate them but does not own them.
• D. Amazon S3 now encrypts every new object with SSE-S3 automatically, but the customer still chooses which encryption method protects its content and, for SSE-KMS, which key and key policy govern it. Those choices, and the data they protect, remain customer responsibilities.
• E. Network architecture inside a VPC is built entirely by the customer using AWS-provided constructs, and is a core security IN the cloud task.

Explanation

Answer: A. Amazon S3 is an abstracted service: AWS operates the infrastructure, the operating system, and the platform, and the customer interacts only with endpoints. What remains with the customer is the content itself, its classification, its encryption choices, and the permissions that decide who may reach it.

• B. Storage hardware is AWS infrastructure. Its maintenance, replacement, and eventual secure destruction are AWS responsibilities.
• C. The software implementing the service is operated by AWS. Customers have no ability to patch it and no visibility into it.
• D. Durability is an attribute of the service that AWS engineers and operates, achieved by redundancy that AWS manages internally.

Explanation

Answer: D. Fargate is a serverless compute engine, so AWS provisions, patches, and maintains the underlying compute capacity and its operating system. The customer never chooses an instance type or logs into a host, which is exactly the operational surface that moves to AWS.

• A. Network access controls for a task are configured by the customer. AWS provides the security group construct; the rules inside it are a customer decision.
• B. Permissions granted to a task are defined by the customer in an IAM role. Fargate changes where the container runs, not who decides what it may do.
• C. The container image, its base layers, and its dependencies are software the customer supplies. Their security remains the customer's responsibility on any compute platform.

Explanation

Answer: D. Amazon CloudWatch Logs centralizes logs from instances, containers, Lambda functions, and AWS services into log groups and log streams, where they can be searched with CloudWatch Logs Insights, filtered into metrics, and used to trigger alarms. It is the destination for logs the customer's own software writes.

• A. AWS CloudTrail records AWS API activity, meaning which principal called which AWS service. It does not collect the logs an application writes inside an instance.
• B. AWS Artifact is a portal for AWS compliance reports and agreements and holds no customer telemetry at all.
• C. AWS Config records the configuration state of AWS resources and evaluates it against rules. It is not a log aggregation service.

Explanation

Answer: D. Encryption in transit protects data on the wire, so that anyone able to observe the network sees only ciphertext. On AWS this is implemented with TLS, which every AWS service endpoint supports and which the customer also applies between their own tiers.

• A. Key material inside AWS KMS is protected by the hardware security modules AWS operates. That protection is part of the service, not what the term in transit describes.
• B. Protecting stored data is encryption at rest, a separate control implemented with features such as Amazon EBS volume encryption or Amazon S3 server-side encryption.
• C. Archived objects are stored data, so they are covered by encryption at rest. They are in transit only while being uploaded or retrieved.

Explanation

Answer: A. AWS KMS is the managed key service integrated with most AWS services that encrypt data at rest. Keys are created and used inside hardware security modules AWS operates, access is governed by a key policy plus IAM, and every use of a key can be recorded in AWS CloudTrail.

• B. AWS Artifact distributes AWS compliance documentation and has no cryptographic function.
• C. AWS Certificate Manager provisions and renews the TLS certificates that protect data in transit. It manages certificates, not the keys that encrypt stored data.
• D. AWS Secrets Manager stores and rotates secrets such as database credentials. It uses KMS keys to protect those secrets rather than being the key service itself.

Explanation

Answer: C. A flow log records details about accepted and rejected traffic at the network interface, subnet, or VPC level, including source and destination addresses and ports, protocol, packet and byte counts, and the action taken. It is collected outside the traffic path, so it does not affect throughput or latency, and can be delivered to CloudWatch Logs, Amazon S3, or Amazon Data Firehose.

• A. Vulnerability discovery is the role of Amazon Inspector. Flow logs report connections, not the software running on an instance.
• B. Configuration state over time is what AWS Config records. Flow logs say nothing about how a resource is configured.
• D. API activity is recorded by AWS CloudTrail. Flow logs describe packets on the network rather than calls to AWS services.