Easy practice exam 1

Explanation

Answer: C. AWS maintains a large portfolio of certifications and attestations covering the infrastructure and services it operates. Customers inherit those controls and can evidence them to auditors using the reports in AWS Artifact instead of building and assessing an equivalent control set themselves.

• A. AWS recommends encrypting data in transit and at rest as a defense-in-depth measure, and many regulations require it regardless of network ownership.
• B. Access control over customer content is a core customer responsibility in every AWS service, and one of the most common causes of real incidents.
• D. Legal and regulatory accountability stays with the organization that collects and processes the data. AWS provides evidence about its own controls.

Explanation

Answer: D. A policy is a JSON document containing statements that specify an effect, actions, resources, and optional conditions. Attaching it to a user, group, or role makes it an identity-based policy; attaching it to a resource such as an Amazon S3 bucket makes it a resource-based policy.

• A. Credentials such as passwords and access keys prove who is making a request. A policy decides what that requester is allowed to do once identified.
• B. IAM groups collect users for permission management, not for billing. Cost separation is achieved with accounts, tags, and AWS Organizations.
• C. The record of API calls is produced by AWS CloudTrail, which is a separate service from IAM.

Explanation

Answer: C. IAM identities and policies are account-wide and are not tied to a Region. A role or user created once can be used against service endpoints in any Region the account has access to, which is why the IAM console does not present a Region selector.

• A. IAM itself is offered at no additional charge. Customers pay for the AWS resources their identities use.
• B. There is nothing to enable. IAM exists as soon as the account does, and the root user is present from account creation.
• D. Consumer sign-in for a company's own application is what Amazon Cognito provides. IAM governs access to AWS resources.

Explanation

Answer: A. A password policy sets account-wide rules for the console passwords of IAM users in that account, covering length, required character types, whether users may change their own password, whether passwords expire, and whether previous passwords may be reused.

• B. MFA is configured per identity and can be required through a policy condition. It is not part of the password policy.
• C. Storing and rotating application secrets is the role of AWS Secrets Manager, not of the IAM password policy.
• D. Access keys are long-term programmatic credentials with no automatic expiry. Rotating them is an operational task guided by last-used information.

Explanation

Answer: A. An instance profile delivers temporary security credentials for the attached role to the instance, and the AWS SDKs retrieve and refresh them automatically. Nothing durable is stored on disk, so there is no key to leak in an image, a backup, or a source repository, and no rotation task.

• B. Cognito identity pools issue temporary AWS credentials to the end users of a web or mobile application, not to server-side workloads running on EC2.
• C. Long-term access keys on an instance are exactly the pattern roles exist to eliminate. They persist in snapshots and images and must be rotated manually.
• D. Root access keys give unrestricted access to the entire account and AWS advises against creating them at all, let alone deploying them to a server.

Explanation

Answer: D and E. Both practices attack the same weakness, which is a credential that can be stolen and reused. MFA means a captured password alone is not enough to sign in, and temporary credentials, obtained by assuming a role or through federation, expire on their own so a leaked credential has a short life.

• A. Credentials in source code are among the most common causes of exposure, since they spread through repositories, forks, and build artifacts.
• B. AWS advises against using the root user for routine work. Daily administration should be performed with IAM roles or IAM Identity Center users that carry only the permissions needed.
• C. A shared identity destroys accountability, since the logs cannot show which person acted, and it makes removing one person's access impossible without disrupting everyone.

Explanation

Answer: D. A security group is a virtual firewall attached to an elastic network interface. Because it is stateful, allowing an inbound request means the response is allowed out regardless of the outbound rules, which is why security groups need only describe the traffic a workload should accept.

• A. A network ACL operates at the subnet boundary and is stateless, so return traffic must be allowed explicitly by a rule in the opposite direction.
• B. AWS WAF inspects the content of HTTP and HTTPS requests at the application layer rather than filtering by address and port at the instance.
• C. AWS Shield Standard automatically mitigates common network and transport layer DDoS attacks. It is not a configurable per-instance firewall.

Explanation

Answer: C. AWS Marketplace is a curated digital catalog where independent software vendors publish security products as machine images, container images, SaaS subscriptions, and professional services. Purchases flow through the customer's AWS account and appear on the same AWS invoice.

• A. AWS Service Catalog lets an organization publish and govern its own approved product portfolio for internal users, rather than offering third-party products for purchase.
• B. AWS Artifact distributes AWS compliance reports and agreements. It sells no software.
• D. AWS Trusted Advisor evaluates an account against best-practice checks and makes recommendations. It is not a procurement channel.

Explanation

Answer: B. AWS Security Bulletins are the official channel for security notices about AWS services, including relevant CVE identifiers and any customer action required. They are published on the AWS security pages and are available as an RSS feed, alongside the AWS Security Blog for deeper technical guidance.

• A. AWS Service Catalog manages an organization's approved internal product portfolio and has no security notification role.
• C. AWS Artifact holds audit reports and agreements. It is not used to announce vulnerabilities or remediation guidance.
• D. Amazon Inspector reports vulnerabilities found in the customer's own workloads. It does not publish AWS service-level security notices.

Explanation

Answer: B. AWS Certificate Manager issues and manages the TLS certificates that enable encryption in transit. Public certificates for use with integrated AWS services such as Elastic Load Balancing, Amazon CloudFront, and Amazon API Gateway are provided at no cost, and ACM renews the certificates it issued before they expire.

• A. AWS compliance reports are obtained from AWS Artifact.
• C. Creating and controlling keys for data at rest is the role of AWS Key Management Service.
• D. Storing and rotating credentials is the role of AWS Secrets Manager.