A company wants its employees to sign in with their existing Microsoft Entra ID credentials and then access several AWS accounts within its AWS Organizations structure. Which service should the company use?
Intermediate · Choose one
Explanation
Answer: D. AWS IAM Identity Center connects workforce users to AWS accounts and AWS managed applications. Deployed as an organization instance in the AWS Organizations management account, it becomes the single point for managing user access across accounts, and it federates with an external identity provider such as Microsoft Entra ID or Okta through SAML 2.0, so the company federates once rather than per account.
A. AWS Resource Access Manager shares resources such as subnets and Transit Gateways between accounts. It does not authenticate people.
B. AD Connector is a directory proxy that redirects requests to an existing on-premises Microsoft Active Directory. It can serve as an identity source for on-premises AD, but it does not federate a cloud identity provider such as Microsoft Entra ID and it does not manage access across multiple AWS accounts.
C. Amazon Cognito is an identity platform for a company's web and mobile application end users, not for its own employees signing in to AWS accounts.
52
A startup is building a mobile application and needs sign-up, sign-in, and social identity provider support for the consumers who use the app. Which AWS service is designed for this requirement?
Intermediate · Choose one
Explanation
Answer: C. Amazon Cognito is an identity platform for web and mobile apps, acting as a user directory, an authentication server, and an authorization service. A user pool handles sign-up and sign-in for the app's own users, including federation with social providers, while an identity pool can exchange those tokens for temporary AWS credentials when the app must call AWS services directly.
A. IAM Identity Center manages workforce access, meaning a company's own employees reaching AWS accounts and AWS managed applications. It is not intended as the sign-in system for a consumer application.
B. AWS Directory Service provides Microsoft Active Directory capabilities for enterprise workloads and directory-aware applications, not consumer app sign-in.
D. IAM controls access by principals to AWS resources. Creating an IAM user for every consumer of a mobile app does not scale and is not the intended use of the service.
53
An application connects to an Amazon RDS database, and the security team requires that the database credentials be rotated automatically on a schedule without the team writing and maintaining custom rotation code. Which service meets this requirement?
Intermediate · Choose one
Explanation
Answer: A. AWS Secrets Manager stores secrets encrypted with AWS KMS and provides built-in automatic rotation on a configurable schedule. For Amazon RDS, Aurora, DocumentDB, and Redshift it offers managed rotation, so the credential is rotated without the customer supplying a rotation function.
B. AWS KMS creates and manages the encryption keys that protect a secret. It does not store the database credential or rotate it.
C. IAM access keys authenticate a principal to AWS APIs. They are not the database engine's own username and password, and they carry no automatic rotation.
D. Parameter Store securely stores configuration data and secrets as SecureString parameters, but it has no built-in rotation. The AWS documentation itself points to Secrets Manager for database credentials because of that difference.
54
A security team must find software vulnerabilities in its Amazon EC2 instances and container images, and separately must discover personally identifiable information stored in Amazon S3. Which TWO services should the team use? (Choose TWO.)
Intermediate · Select 2 answers
Explanation
Answer: A and C. Amazon Inspector is a vulnerability management service that automatically discovers workloads and continually scans them for software vulnerabilities and unintended network exposure, covering EC2 instances, container images in Amazon ECR, and Lambda functions. Amazon Macie is a data security service that uses machine learning and pattern matching to discover sensitive data in Amazon S3.
B. Amazon GuardDuty is a threat detection service that identifies malicious or unauthorized activity from activity logs. It does not enumerate software vulnerabilities or classify stored data.
D. AWS Shield Advanced provides enhanced DDoS protection for specific resource types. It is unrelated to vulnerability scanning or data discovery.
E. AWS Certificate Manager provisions, deploys, and renews TLS certificates. It plays no part in either requirement.
55
A company with dozens of AWS accounts wants to define AWS WAF rules and VPC security group policies centrally, enforce them across every account, and have them applied automatically to newly created accounts. Which service does this, and what does it require?
Intermediate · Choose one
Explanation
Answer: A. AWS Firewall Manager centrally configures and manages firewall rules across accounts and resources, and automatically applies protections to new accounts and resources as they are added. Its prerequisites include membership in AWS Organizations, a designated Firewall Manager administrator account, and AWS Config enabled. Policy types cover AWS WAF, Shield Advanced, security groups, network ACLs, and DNS Firewall.
B. A web ACL in AWS WAF is created and associated within one account. Nothing in AWS WAF alone propagates configuration across an organization or onto future accounts.
C. Shield Advanced is billed per organization, but protection is an explicit opt-in for each resource, and it does not distribute WAF or security group policies.
D. GuardDuty detects threats and can be administered organization-wide, but it does not create or enforce firewall rules.
56
A company must manage its encryption keys in single-tenant, dedicated hardware security modules that it alone controls, with AWS having no access to the key material. Which service meets this requirement?
Intermediate · Choose one
Explanation
Answer: C. AWS CloudHSM gives single-tenant access to dedicated hardware security modules that the customer controls, with user management performed inside the HSM rather than through IAM. AWS states that it has no access to the keys or data inside a CloudHSM cluster. Clusters can run in FIPS 140-3 Security Level 3 mode, though that alone is not the deciding factor, because AWS KMS keys are also protected by FIPS 140-3 Security Level 3 validated HSMs. What distinguishes CloudHSM is the tenancy and control model: a dedicated cluster in the customer's own VPC, with key material AWS cannot reach.
A. A customer managed key gives full control over its policy, rotation, and deletion, but by default it is created in the AWS-operated KMS key store rather than in dedicated hardware the customer controls, and AWS KMS performs cryptographic operations with it on the customer's behalf.
B. An AWS managed key is created by an AWS service on the customer's behalf. The customer can view and audit it but cannot modify it, and the hardware is multi-tenant and operated by AWS.
D. AWS Secrets Manager stores and rotates secrets such as credentials. It is not a key management service and does not provide dedicated cryptographic hardware.
57
AWS names awareness and training as one of its shared controls. What does that mean in practice?
Intermediate · Choose one
Explanation
Answer: A. A shared control is one where both parties carry out the same class of activity in completely separate contexts. For awareness and training, each organization is accountable for its own workforce: AWS trains AWS employees, and the customer trains the people who build and operate the customer's workloads.
B. AWS publishes training and certification offerings commercially, but delivering a customer's internal security awareness program is not part of the shared responsibility model.
C. Certifications attest that AWS operates its controls effectively. They say nothing about whether the customer's own staff are trained, which auditors will still expect the customer to demonstrate.
D. Responsibility never runs in that direction. AWS personnel are governed by AWS internal controls, which the customer evidences through AWS audit reports rather than by training AWS staff.
58
A company stores application records in Amazon DynamoDB. Which task remains the company's responsibility?
Intermediate · Choose one
Explanation
Answer: C. DynamoDB is an abstracted service, so AWS runs everything from the hardware up to the platform. The customer's remaining duties concentrate on the content: knowing what the data is, deciding how sensitive it is, and controlling which principals can read or write it.
A. There is no operating system exposed to the customer in DynamoDB. AWS operates the entire fleet behind the service endpoint.
B. Redundancy across Availability Zones is built into the service by AWS. The customer does not configure or maintain it.
D. The service software is AWS's to maintain. Customers cannot install or defer updates to it.
59
AWS describes some controls as customer specific, meaning they are solely the customer's responsibility based on the application being deployed. Which of the following is the example AWS gives?
Intermediate · Choose one
Explanation
Answer: D. Customer specific controls have no AWS counterpart at all. AWS names service and communications protection, and zone security, as controls that depend entirely on how the customer designs and segments its own application, so AWS performs no equivalent activity.
A. Patch management is one of the three shared controls, carried out by both parties in different scopes.
B. Physical and environmental controls are inherited controls. The customer fully inherits them from AWS and performs no part of them.
C. Awareness and training is also a shared control, since both AWS and the customer must train their own people.
60
An auditor asks which party is accountable for classifying the data a company stores in AWS and deciding how long to retain it. Which answer is correct?
Intermediate · Choose one
Explanation
Answer: C. Ownership of content never transfers to AWS. The customer chooses which services hold the data, which AWS Regions store it, how it is classified and encrypted, and who may access it. Retention and classification are decisions only the data owner can make.
A. Moving to an abstracted service reduces the customer's operational work but does not transfer ownership of the data or the decisions about it.
B. The shared controls AWS names are patch management, configuration management, and awareness and training. Data classification is not among them.
D. Operating the storage platform is not the same as owning what is stored on it. AWS provides the service; the content and the decisions about it stay with the customer.