Hard practice exam 1

Explanation

Answer: B. The two services behave differently and are often confused. Amazon S3 applies server-side encryption with S3 managed keys to every new object upload as a baseline that cannot be turned off, at no extra cost. Amazon EBS encryption is a choice made when a volume is created, and an account can set encryption by default as a per-Region setting so new volumes are always encrypted.

• A. This reverses the two behaviors. Bucket-level default encryption is no longer a prerequisite for new S3 objects to be encrypted.
• C. This is true of Amazon S3 but not of Amazon EBS, where encryption by default must be enabled by the customer in each Region.
• D. Neither service requires a customer managed key. Amazon S3 uses S3 managed keys by default, and Amazon EBS can use the AWS managed key for EBS.

Explanation

Answer: C. A service control policy is a guardrail, so an action must be permitted by both the SCP and the identity-based policy for the request to succeed. An explicit deny found in any applicable policy ends evaluation immediately, which is why the broad EC2 allow cannot rescue the call.

• A. There is no ordering by which an identity-based allow can overcome an SCP deny. The evaluation logic looks for an explicit deny across all policy types first.
• B. The management account is the exception in the opposite direction: SCPs do not restrict principals in the management account, but they do restrict member accounts, which is the case described here.
• D. SCPs apply to the IAM users and roles in affected member accounts alike.

Explanation

Answer: B. IAM Access Analyzer evaluates the resource-based policies in an account against a defined zone of trust, which can be the account or the whole organization, and reports each resource that can be reached from outside it. The analysis is based on logical reasoning about the policies rather than on observed traffic, so it finds exposure that nobody has exploited yet.

• A. CloudTrail Insights highlights unusual API call volumes and error rates. It reports on activity, not on the permissions a policy grants.
• C. The credential report describes the state of IAM user credentials. It says nothing about which resources are shared externally.
• D. Amazon Macie discovers sensitive data inside Amazon S3 objects. It reports what the data is, not who outside the organization can reach it.

Explanation

Answer: C. A group is a convenience for managing permissions, not an identity. Because it has no credentials and cannot be a principal, a resource-based policy cannot grant access to a group; it grants to the users or roles themselves. Groups also contain only users, never other groups.

• A. Assuming an identity to receive temporary credentials describes an IAM role, which is a different construct with its own trust policy.
• B. IAM does not support nested groups. A user can belong to multiple groups, which is how overlapping permission sets are expressed.
• D. Groups have no credentials of any kind, so there is nothing to sign in with.

Explanation

Answer: D and E. IAM Identity Center is the recommended way to manage workforce access across many AWS accounts. One identity source feeds it, which may be its own directory, Active Directory, or an external provider such as Okta or Microsoft Entra ID, and assigning a permission set causes it to provision and keep in sync an IAM role in each target account so users receive temporary credentials.

• A. Consumer or customer sign-in for an application is the purpose of Amazon Cognito. Identity Center is for a company's own workforce.
• B. Removing per-account IAM users is one of the main reasons to adopt it. Users sign in once through the access portal and reach every account they are entitled to.
• C. It builds on IAM rather than replacing it. The access a user receives is delivered through IAM roles and evaluated by the same policy logic.

Explanation

Answer: A. Federation moves the credential lifecycle to a system the company already operates, so joiners and leavers are handled once, in one place. In AWS the federated user assumes a role and receives temporary credentials that expire, which removes the standing password and access keys an IAM user would otherwise carry.

• B. The identity provider proves who the user is; AWS still decides what they may do, through the roles and policies the federated session assumes.
• C. Federated users can reach both the AWS Management Console and the APIs, which is why it is the recommended pattern for human access.
• D. Federation issues short-lived credentials on demand. It does not create or synchronize permanent access keys.

Explanation

Answer: D and E. AWS WAF protects resources that terminate and understand HTTP, which is why it attaches to layer 7 entry points such as CloudFront distributions, Application Load Balancers, Amazon API Gateway REST APIs, and Amazon Cognito user pools. Traffic reaching an application through one of these is inspected before it is forwarded.

• A. A Network Load Balancer operates at layer 4 and does not parse HTTP, so a web ACL cannot be associated with it. Workloads behind an NLB are usually fronted by CloudFront or an ALB when AWS WAF is needed.
• B. An Amazon EBS volume is block storage and carries no network traffic to inspect.
• C. AWS WAF is never attached to an instance. Instance-level filtering by address and port is the job of a security group.

Explanation

Answer: A. The two constructs have different starting positions, and knowing them prevents a lot of wasted troubleshooting. A newly created security group contains one outbound rule permitting all traffic and no inbound rules, whereas a newly created network ACL contains only the final deny rules, so it blocks everything until explicit numbered rules are added in both directions.

• B. This describes the default network ACL, which permits all traffic, rather than a custom one. A new security group also never permits inbound traffic by default.
• C. This reverses both behaviors, and the allow-all description applies to the default network ACL rather than a custom one.
• D. The security group permits all outbound traffic from the moment it is created, so traffic is not blocked in both directions.

Explanation

Answer: A. Managed renewal applies only to certificates that ACM itself issued, because only then does ACM control the validation and issuance process. An imported certificate is opaque to ACM, so tracking its expiry and repeating the import is the customer's responsibility, and ACM can send expiry notifications to help.

• B. Automatic renewal of an imported certificate is impossible, since ACM has no relationship with the external certificate authority that issued it.
• C. The US East (N. Virginia) requirement applies to certificates used with Amazon CloudFront. A certificate for an Application Load Balancer must be in the same Region as the load balancer.
• D. Importing a certificate into ACM carries no charge. Costs arise from AWS Private CA when issuing private certificates.

Explanation

Answer: A. Disabling a key makes AWS KMS reject every request to use it, so encryption and decryption stop at once, and the key and its material remain intact. If the investigation clears the application, the key is simply re-enabled and data protected by it becomes readable again.

• B. Rotation creates new backing key material for future encryption while retaining the old material. It does not block the key from being used and is not a containment action.
• C. Scheduling deletion starts a mandatory waiting period, and once the key is deleted the data it protects is unrecoverable. Deletion can be cancelled during the waiting period but is far riskier than disabling.
• D. An alias is only a friendly name. Removing it does not stop anything that references the key by its key ID or ARN.