An external auditor asks a company to identify a security control that it fully inherits from AWS and therefore does not need to test itself. Which control fits that description?
Hard · Choose one
Explanation
Answer: A. AWS defines inherited controls as those a customer fully inherits from AWS, and names physical and environmental controls as the example. The customer performs no part of the control and can evidence it to an auditor using the AWS third-party attestation reports rather than testing it directly.
B. Awareness and training is a shared control. AWS trains AWS employees; the customer must train its own, so this half is not inherited.
C. Patch management is a shared control. AWS patches the infrastructure, but the customer half named here, the guest operating systems, is performed by the customer and must be tested.
D. Configuration management is a shared control. AWS maintains the configuration of its infrastructure devices, while the customer configures its own operating systems, databases, and applications.
32
A company stores regulated data in Amazon S3 and enables server-side encryption with an AWS KMS customer managed key. Under the shared responsibility model, which task remains the company's responsibility?
Hard · Choose one
Explanation
Answer: B. Encryption changes how data is protected, not who decides who may reach it. Data classification and the access controls around the key, meaning the key policy plus the IAM permissions of the callers, stay with the customer. A correctly encrypted object is still exposed if the key policy grants the wrong principal.
A. Storage classes such as S3 Standard redundantly store objects across a minimum of three Availability Zones as part of the service AWS operates; the customer does not arrange this.
C. AWS KMS keys are generated and used inside hardware security modules that AWS operates and that are validated under FIPS 140-3 Security Level 3. Customers never operate that hardware.
D. Media destruction is performed by AWS as part of its infrastructure responsibilities and is an inherited control for the customer.
33
A security analyst opens CloudTrail Event history in the AWS Management Console and cannot find a management event that occurred eight months ago. What is the most likely explanation?
Hard · Choose one
Explanation
Answer: D. CloudTrail Event history provides a viewable, searchable, downloadable, and immutable record of the past 90 days of management events in an AWS Region, at no charge. To keep events beyond that window, a customer creates a trail that delivers events to Amazon S3 or configures a CloudTrail Lake event data store with a longer retention period.
A. Event history is available in every account and Region. Organization-wide aggregation is a feature of organization trails, not a limitation on the console view.
B. Events are an immutable record of the API activity itself. Deleting the resource does not remove the history of calls made against it.
C. The relationship is the reverse. Management events are recorded by default, while data events are high-volume and must be explicitly enabled, usually with additional cost.
34
A company enables Amazon GuardDuty. Which data sources does GuardDuty use as its foundational data sources, requiring no additional protection plan to be analyzed?
Hard · Choose one
Explanation
Answer: C. These three are GuardDuty's foundational data sources. AWS states that nothing else needs to be enabled for GuardDuty to start analyzing and processing them, and that GuardDuty accesses them at no additional cost from AWS CloudTrail, Amazon VPC, and Route 53, so the customer does not have to activate or pay for those logs separately. GuardDuty's own foundational charges are based on the volume of events and logs it analyzes.
A. AWS Config records resource configuration state and is not a GuardDuty data source. GuardDuty is a threat detection service driven by activity logs.
B. CloudWatch metrics and agent-collected application logs are monitoring telemetry. GuardDuty draws on account, network, and DNS activity instead.
D. Amazon S3 data events are not a foundational data source. They are analyzed by the S3 Protection plan, which is one of several protection plans billed separately from the foundational sources, although GuardDuty does turn S3 Protection on automatically when it is first enabled in a Region.
35
A security team wants one place to view findings produced by Amazon GuardDuty, Amazon Inspector, and Amazon Macie, and to measure the environment against the AWS Foundational Security Best Practices standard. Which service is designed for this?
Hard · Choose one
Explanation
Answer: C. This capability is delivered today as AWS Security Hub CSPM, which gives a comprehensive view of security state in AWS, receives findings from services such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie, and assesses the environment against standards including AWS Foundational Security Best Practices, CIS, PCI DSS, and NIST. AWS split the original service in 2025: what was previously known as Security Hub is now Security Hub CSPM, while a newer AWS Security Hub correlates those findings into prioritized exposures. The certification's in-scope services list still names it AWS Security Hub.
A. Amazon CloudWatch collects metrics, logs, and alarms for operational monitoring, not consolidated security findings and compliance standard scores.
B. AWS Config evaluates resource configurations against rules and conformance packs. It does not ingest findings from GuardDuty, Inspector, or Macie.
D. Amazon Detective analyzes and investigates findings to identify root cause. It works on findings after they exist rather than aggregating them and scoring the environment against standards.
36
Amazon GuardDuty raises a finding that an Amazon EC2 instance is communicating with a known command-and-control server. The team must now determine the root cause by examining related API activity and how the affected resources behaved over the preceding weeks. Which service is purpose-built for this investigation?
Hard · Choose one
Explanation
Answer: B. Amazon Detective helps analyze, investigate, and quickly identify the root cause of security findings or suspicious activity. It builds a behavior graph from CloudTrail management events, VPC Flow Logs, EKS audit logs, and GuardDuty findings, and applies machine learning, statistical analysis, and graph theory to visualize how resources interacted over time.
A. Amazon Macie discovers sensitive data in Amazon S3. It has no role in reconstructing the activity behind a threat finding.
C. Amazon Inspector is a vulnerability management service. It reports which software flaws and network exposures exist, not how an incident unfolded.
D. AWS Certificate Manager provisions and renews TLS certificates. It performs no security investigation function.
37
Which TWO tasks require the account root user credentials in a standalone AWS account that is not part of an organization? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: A and C. AWS publishes a short list of tasks that only the root user can perform. Closing the account is on it, and for a standalone account so is changing the root user email address, root password, or root access keys. The common thread is that these actions concern the account itself rather than resources inside it.
B. Enabling CloudTrail or creating a trail in another Region requires CloudTrail permissions, which can be granted to an IAM identity like any other service permission.
D. Creating IAM roles is a standard administrative action available to any principal holding the relevant IAM permissions, and it should not be performed as the root user.
E. This is a frequently repeated but outdated answer. AWS documentation now states that changing the support plan requires IAM permissions, and the task no longer appears on the list of root-only actions.
38
A company uses AWS Organizations and wants to delete the root user credentials in its member accounts entirely, so that no one can sign in as the root user in those accounts. Which capability supports this?
Hard · Choose one
Explanation
Answer: D. With centralized root access management enabled, the management account or a delegated administrator can remove the root user password, access keys, signing certificates, and MFA from member accounts. Those accounts can then neither sign in as root nor perform root password recovery, and newly created member accounts have no root credentials by default.
A. The root user is intrinsic to the account and is not an IAM identity that can be deleted. Removing its credentials is the supported approach.
B. Permissions boundaries apply to IAM users and roles. They cannot be attached to the root user, whose access is not constrained by identity-based policy mechanisms.
C. A service control policy can restrict what a member account's principals may do, but it does not remove credentials and does not prevent someone from signing in as the root user.
39
Which statement about multi-factor authentication in AWS Identity and Access Management is correct?
Hard · Choose one
Explanation
Answer: C. AWS supports three MFA types: passkeys and FIDO security keys, virtual authenticator applications, and hardware time-based one-time password tokens. The root user and IAM users can each register up to eight devices of any type, and AWS recommends registering multiple devices to add resilience if one is lost.
A. The one-device limit was raised. Registering several devices is now explicitly recommended precisely so that losing one does not lock the identity out.
B. MFA on the root user is not merely available but required. AWS now requires MFA to be configured for the root user across standalone, management, and member accounts.
D. AWS ended support for enabling SMS text message MFA and advises customers still using it to move to a passkey or security key, a virtual MFA device, or a hardware MFA device.
40
A company attaches a service control policy to an organizational unit in AWS Organizations. What is the effect of that policy?
Hard · Choose one
Explanation
Answer: B. AWS states plainly that no permissions are granted by a service control policy. An SCP defines a permissions guardrail that caps what principals in the affected member accounts can do. A principal still needs an identity-based or resource-based policy granting the action, and the SCP determines whether that grant can take effect.
A. SCPs sit alongside identity-based policies during evaluation rather than replacing them. Both must permit an action for it to succeed.
C. SCPs never grant. An action allowed by an SCP but not allowed by any IAM policy remains denied.
D. AWS states that SCPs do not affect users or roles in the management account. They affect only the member accounts of the organization.