AWS describes certain responsibilities as shared controls, which apply to both the infrastructure layer and the customer layer but in separate contexts. Which of the following is an example AWS gives of a shared control?
Intermediate · Choose one
Explanation
Answer: D. A shared control is one where both parties carry out the same class of activity in different scopes. AWS names three: patch management, configuration management, and awareness and training. In each case AWS performs the control for its infrastructure and employees while the customer performs it for their own systems and staff.
A. Zone security and service communications protection are what AWS calls customer specific controls, based solely on the application the customer deploys. AWS performs no counterpart.
B. Physical and environmental controls are an inherited control. The customer inherits them wholly from AWS and performs no part of them.
C. Media disposal is performed only by AWS. The customer has no equivalent activity because they never possess the hardware.
42
A company migrates a self-managed MySQL database from Amazon EC2 to Amazon RDS. Which responsibility shifts from the customer to AWS as a result of this migration?
Intermediate · Choose one
Explanation
Answer: C. Amazon RDS is a managed service, and AWS states that it manages backups, software patching, automatic failure detection, and recovery. Moving up the abstraction ladder from EC2 to RDS transfers the undifferentiated maintenance of the engine and host to AWS while leaving the data and its access controls with the customer.
A. Logins and privileges inside the database are managed with the database engine's own security features, which remain the customer's responsibility on Amazon RDS.
B. Network access to a DB instance is controlled by security groups and subnet placement, both configured by the customer.
D. Encryption at rest for an RDS DB instance is a customer choice and configuration. AWS provides the capability; the customer decides whether and how to apply it.
43
An application is built entirely on AWS Lambda. Under the shared responsibility model, which item remains the customer's responsibility?
Intermediate · Choose one
Explanation
Answer: C. AWS curates and publishes security updates for all supported managed runtimes and container base images, and applies runtime updates automatically for functions left in the default Auto runtime update mode. AWS states that in all cases the customer is responsible for applying updates to their function code, including its dependencies. Serverless removes infrastructure work; it never removes responsibility for the code the customer wrote or imported.
A. Lambda scales the execution environment automatically in response to the request rate. AWS operates that mechanism, so it is not a customer maintenance responsibility, beyond optional concurrency settings the customer may choose to apply.
B. AWS explicitly takes responsibility for curating and publishing security updates for all supported managed runtimes and container base images.
D. For Lambda, AWS manages the underlying infrastructure, the operating system, and the application platform. The customer has no operating system to patch.
44
How does the division of responsibility change as a customer moves a workload from Amazon EC2 to an abstracted service such as Amazon S3?
Intermediate · Choose one
Explanation
Answer: A. AWS states that for abstracted services such as Amazon S3 and Amazon DynamoDB, AWS operates the infrastructure layer, the operating system, and the platforms, and customers access endpoints to store and retrieve data. The customer's remaining duties concentrate on the content itself and who may reach it.
B. AWS states directly that customer responsibility is determined by the AWS Cloud services the customer selects, so the boundary shifts by service.
C. Abstracted services reduce the customer's operational surface rather than expanding it; there is no operating system or platform left for the customer to manage.
D. Customer data and its classification never move to AWS. AWS states that customers own and control their content regardless of which service holds it.
45
An auditor asks a company to show exactly how a set of security groups was configured on a specific date eight months ago, and to list every configuration change since then. Which AWS service is designed to provide this?
Intermediate · Choose one
Explanation
Answer: D. AWS Config gives a detailed view of the configuration of AWS resources, including how they were configured in the past, so a customer can see how configurations and relationships change over time. Config rules can additionally evaluate whether each recorded configuration was compliant.
A. CloudTrail Event history in the console retains only the past 90 days of management events per Region, so a state from eight months ago is no longer there. CloudTrail also records the API call rather than the resulting configuration state.
B. AWS Trusted Advisor reports on the current state of an account against best-practice checks. It does not maintain a configuration history.
C. Amazon CloudWatch metrics are time-series measurements of performance and utilization. They carry no record of a security group's rule set.
46
Which TWO statements about AWS Artifact are correct? (Choose TWO.)
Intermediate · Select 2 answers
Explanation
Answer: C and E. AWS Artifact has two functions: on-demand download of AWS security and compliance documents, and management of agreements between the customer and AWS. AWS states that it provides these documents and agreements free of charge, and that a customer using AWS Organizations can accept an agreement such as a Business Associate Addendum on behalf of every account in the organization.
A. Continuous evaluation of resource configurations against rules is what AWS Config does. Artifact is a document repository and does not inspect the customer's environment.
B. AWS notes that customers are responsible for developing or obtaining the documents that demonstrate their own security and compliance. Artifact attests to AWS, not to what the customer built on it.
D. Aggregating findings from other security services into one view is the role of AWS Security Hub, delivered today as AWS Security Hub CSPM.
47
What is true about server-side encryption of new objects uploaded to Amazon S3?
Intermediate · Choose one
Explanation
Answer: C. Since January 2023, all new object uploads to Amazon S3 are automatically encrypted at no additional cost and with no impact on performance. Server-side encryption with Amazon S3 managed keys, known as SSE-S3, is the base level of encryption applied to every bucket, using 256-bit AES-GCM.
A. Specifying an encryption header on a request selects a particular encryption option. Omitting it does not cause a rejection; the object is encrypted using the bucket's default encryption configuration, which is SSE-S3 unless the bucket has been set to use SSE-KMS or DSSE-KMS.
B. This describes the behavior before the change. Default encryption no longer has to be switched on for new uploads to be encrypted.
D. A customer managed KMS key is one option, and it does carry a charge, but it is not required. The default SSE-S3 encryption uses keys that Amazon S3 manages at no cost.
48
A European company must ensure that its customer content is stored only in AWS Regions within the European Union. Which statement reflects the AWS position on where customer content is stored?
Intermediate · Choose one
Explanation
Answer: A. AWS states that customers own their content and choose the AWS Regions in which it is stored, and that AWS will not move or replicate content outside the chosen Regions except as necessary to provide the services the customer initiated or to comply with law or a binding order of a governmental body. Region selection is therefore the primary control for data residency requirements.
B. Region selection is made by the customer for each resource. Billing details have no bearing on where data is placed.
C. AWS does not silently replicate customer content to other Regions. Cross-Region copying happens only when the customer configures it, for example with S3 Cross-Region Replication.
D. Cross-Region disaster recovery is something the customer designs and enables. Amazon S3 achieves its durability target within a single Region, with most storage classes storing objects across at least three Availability Zones; the One Zone classes are the exception.
49
A company has 200 developers who all require exactly the same set of permissions. What is the most maintainable way to grant those permissions?
Intermediate · Choose one
Explanation
Answer: B. An IAM group is a collection of users that permissions can be attached to as a unit. Changing the group policy updates every member at once, and joiners and leavers are handled by group membership alone, which keeps the permission model consistent and auditable as the team changes.
A. Roles are for identities that assume them temporarily, such as applications or federated users. Creating one role per person reproduces the maintenance problem rather than solving it.
C. Attaching the same policy 200 times creates 200 places to update. Any policy change risks leaving some users out of step with the rest.
D. Root user credentials cannot be restricted by a policy and must never be shared. This would give every developer unrestricted access to the account.
50
An IAM user belongs to a group whose policy allows s3:DeleteObject. A separate policy attached directly to that user explicitly denies s3:DeleteObject. What happens when the user tries to delete an object?
Intermediate · Choose one
Explanation
Answer: C. IAM evaluates all applicable policies together and applies a fixed order of precedence: an explicit deny always wins, otherwise an explicit allow is required, and anything not explicitly allowed is denied by default. An explicit deny in an identity-based policy, a service control policy, or a resource control policy overrides an allow from any source.
A. There is no precedence between group-attached and user-attached policies. IAM combines every policy that applies to the principal and then applies the deny-over-allow rule.
B. A single explicit deny anywhere is sufficient. A bucket policy could add its own deny, but the identity-based deny already settles the outcome.
D. Policies are not ranked by when they were attached. AWS evaluates every policy that applies to the request, and the enforcement logic looks first for an explicit deny in any of them; if one applies, the final decision is deny.