A company subscribes to AWS Shield Advanced and wants around-the-clock engagement with the AWS Shield Response Team during a DDoS event. What is required for the company to obtain that support?
Hard · Choose one
Explanation
Answer: A. Shield Response Team access is a Shield Advanced benefit, but AWS conditions it on the account being subscribed to the Business Support plan or the Enterprise Support plan. Note that AWS is retiring the Business Support plan on 1 January 2027 and replacing it with Business Support+, so the same requirement will be expressed with the newer plan name. Shield Advanced itself is billed monthly per organization with a one-year commitment, and separately includes DDoS cost protection in the form of service credits for usage spikes caused by an attack.
B. There is no per-incident engagement fee. The entitlement follows from the Shield Advanced subscription combined with the qualifying Support plan.
C. Bot Control is a paid AWS WAF feature and is specifically excluded from the AWS WAF usage that Shield Advanced covers at no extra cost. It has no bearing on response team access.
D. Firewall Manager helps apply Shield Advanced protections consistently across an organization, but it is not a condition of Shield Response Team engagement.
42
A cloud practitioner needs to quickly check whether multi-factor authentication is enabled on the account root user and whether any security groups allow unrestricted access to specific ports, without deploying agents or scanners. Which service provides these checks?
Hard · Choose one
Explanation
Answer: B. AWS Trusted Advisor inspects an account against best-practice checks in categories that include security, and reports findings with recommended actions. MFA on the root account and security groups with specific ports unrestricted are both core security checks, and they are among the small set available to every account regardless of support plan.
A. Amazon Inspector scans workloads such as EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure. It does not evaluate account-level settings like root user MFA.
C. Amazon GuardDuty analyzes activity logs to detect threats in progress. It would report suspicious root user activity but does not audit whether MFA has been configured.
D. AWS Artifact distributes AWS compliance reports and agreements. It performs no inspection of the customer's account configuration.
43
A team configures an AWS Lambda function to use the Manual runtime update mode so that the function stays on one specific runtime version. What is the security consequence of this choice?
Hard · Choose one
Explanation
Answer: B. AWS curates and publishes security updates for supported managed runtimes, and by default applies them automatically. Choosing Manual mode pins the function to one runtime version, which is useful for rolling back an incompatible change, but it moves the timing decision, and therefore the exposure window, to the customer.
A. AWS continues to publish runtime updates regardless of any one customer's update mode. Manual mode only changes whether that function picks them up.
C. Every workload on AWS sits inside the model. The boundary can shift with the service and its configuration, but nothing falls outside it.
D. The execution environment's operating system is AWS's responsibility in every Lambda update mode. The customer has no host to patch.
44
A company uses AWS Systems Manager Patch Manager to automate operating system patching across its Amazon EC2 fleet. How does using this AWS service affect responsibility for guest operating system patching?
Hard · Choose one
Explanation
Answer: C. Using an AWS service to perform a task does not move that task across the responsibility boundary. Patch Manager automates a job the customer owns: the customer still defines the patch baseline, the maintenance window, and the approval rules, and bears the consequence if a patch is never applied.
A. No AWS management tool transfers accountability. The distinction is between who operates the layer and who merely automates work within it.
B. The origin of the Amazon Machine Image does not change the boundary. Once an instance is running, its guest operating system belongs to the customer.
D. Auto Scaling changes how instances are replaced, not who is responsible for the software inside them.
45
A company moves from running Kubernetes itself on Amazon EC2 instances to Amazon EKS with AWS Fargate. Which TWO responsibilities move to AWS as a result? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: A and D. Each step up the abstraction ladder hands AWS more of the undifferentiated operational work. Amazon EKS runs and patches the control plane, and Fargate removes the worker nodes the customer would otherwise have to patch and size. Both were previously the customer's to operate on self-managed Kubernetes.
B. Authorization for the customer's workloads is always a customer decision. Managed compute changes where the pod runs, not what it is permitted to do.
C. Container images are software the customer supplies, so their content and vulnerabilities stay with the customer on every platform.
E. Kubernetes RBAC is configuration inside the cluster the customer defines. Amazon EKS operates the control plane but does not decide who may do what within it.
46
A company claims that because AWS is certified under ISO 27001 and is a PCI DSS Level 1 service provider, the payment application it runs on AWS is automatically PCI DSS compliant. Why is this reasoning wrong?
Hard · Choose one
Explanation
Answer: A. Compliance follows the same boundary as security. AWS's attestations let a customer inherit and evidence the infrastructure controls rather than testing them, which shortens an audit considerably, but the controls the customer owns, such as access management, encryption choices, logging, and application security, must still be implemented and evidenced by the customer.
B. Support plans affect the technical assistance a customer receives. They have no bearing on which compliance obligations the customer carries.
C. AWS Artifact is where a customer downloads AWS audit reports and accepts agreements such as a Business Associate Addendum. Accepting an agreement does not certify the customer's own application.
D. AWS compliance programs cover services across Regions worldwide, with the scope for each program published by AWS. Geography is not the flaw in the reasoning.
47
Which TWO statements about AWS Key Management Service keys are correct? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: A and D. The three key types differ in who creates and controls them. AWS managed keys are created by a service for use on the customer's behalf, are visible in the account, cannot be modified, and are rotated by AWS annually. Customer managed keys give the customer full lifecycle control, including the key policy, enabling and disabling, rotation settings, and scheduled deletion.
B. AWS owned keys belong to an AWS service and are used across many accounts. They are not in the customer's account and cannot be viewed, audited, or managed by the customer.
C. AWS KMS is integrated with a wide range of services, including Amazon EBS, Amazon RDS, AWS Secrets Manager, and Amazon DynamoDB, and can also be called directly to encrypt small amounts of data.
E. Rotation creates new backing key material while the key ID and ARN stay the same, so applications continue to work unchanged and older data is still decryptable with the retained material.
48
An organization must ensure that identities outside the organization cannot access its Amazon S3 buckets, regardless of the bucket policies that individual account owners write. Which AWS Organizations policy type is designed for this?
Hard · Choose one
Explanation
Answer: D. Resource control policies set the maximum permissions available on the resources in an organization's accounts, which lets a central team restrict access by external principals even when a local bucket policy tries to grant it. Like service control policies, they grant nothing on their own and do not apply to the management account's resources.
A. A service control policy caps what the principals inside the organization's member accounts may do. It does not constrain an external principal reaching a resource through a resource-based policy.
B. A permissions boundary applies to a single IAM user or role in one account, so it cannot express an organization-wide rule about who may reach a resource.
C. A conformance pack detects and can remediate non-compliant configurations after the fact. It is not an authorization control evaluated on each request.
49
A regulator requires a company to keep a searchable record of AWS API activity for seven years. Which approach meets the requirement?
Hard · Choose one
Explanation
Answer: D. Long-term retention requires the customer to direct events somewhere durable. A trail writes events continuously to an S3 bucket the customer controls and retains for as long as its lifecycle policy says, while a CloudTrail Lake event data store keeps events in a queryable store with retention that can be configured for many years.
A. AWS Config records resource configuration state, not API calls, so it cannot serve as the API activity record an auditor is asking for.
B. CloudWatch metrics are numeric time series about performance and utilization. They contain no record of who called which API.
C. Event history is limited to the last 90 days of management events in each Region. It is free and requires no setup, but it cannot satisfy a multi-year requirement.
50
In AWS Control Tower, what characterizes a detective control?
Hard · Choose one
Explanation
Answer: A. AWS Control Tower groups controls, formerly called guardrails, by behavior. A detective control inspects resources that already exist, is implemented with AWS Config rules, and surfaces a clear or in-violation status on the dashboard so an owner can act.
B. Evaluating resources before they are provisioned and refusing non-compliant ones describes a proactive control, implemented with CloudFormation hooks.
C. Blocking the call before it succeeds describes a preventive control, implemented with policies such as service control policies.
D. Detection and remediation are separate. A detective control reports the violation; automatic correction requires a remediation action the customer configures.