According to the AWS penetration testing policy, what may a customer do without requesting prior approval from AWS?
Intermediate · Choose one
Explanation
Answer: B. AWS permits customers to carry out security assessments against a published list of services for resources they own, without prior approval. The list has expanded over time and includes Amazon EC2, Amazon RDS, Amazon CloudFront, Amazon API Gateway, AWS Lambda, Amazon ECS, AWS Fargate, and others.
A. Denial of service and simulated denial of service testing appear on the prohibited activities list in the penetration testing policy. DDoS simulation is governed by a separate AWS policy that requires an AWS pre-approved DDoS test partner and published traffic thresholds, and anything outside that requires a Simulated Events form submitted in advance.
C. The policy covers only resources the customer owns. Testing AWS's own infrastructure or other tenants is never permitted.
D. Testing another customer's infrastructure is out of scope of the policy entirely, and AWS does not grant consent on another customer's behalf.
02
A company must encrypt objects in an Amazon S3 bucket with a key that the company creates, can disable centrally at any moment without changing the application, and whose every use is recorded in AWS CloudTrail. Which option meets all three requirements?
Intermediate · Choose one
Explanation
Answer: C. A customer managed key is created and owned by the customer, who controls its key policy, can enable or disable it and schedule its deletion, and sees every cryptographic operation against it as a CloudTrail event. Disabling the key immediately stops objects protected by it from being decrypted, without touching the application.
A. SSE-S3 uses keys that Amazon S3 owns and manages. The customer cannot disable them, set a policy on them, or audit their individual use.
B. A Config rule reports whether encryption is configured. It is a detective check and provides no key control at all.
D. With SSE-C the customer holds the key outside AWS and must send it with every request, so there is no central place to disable it and no AWS-side audit trail of key usage.
03
An auditor asks a company to show both how its AWS resources were configured over the past year and which identity changed them. Which TWO services should the company use? (Choose TWO.)
Intermediate · Select 2 answers
Explanation
Answer: C and E. The two services are complementary halves of an audit trail. AWS Config keeps the configuration history of each resource, answering what the resource looked like and when it changed, while AWS CloudTrail records the API calls, answering which principal made the change, from where, and with what parameters.
A. AWS Artifact provides AWS's own audit reports and agreements. It contains no information about the customer's resources.
B. Amazon Inspector reports software vulnerabilities and unintended network exposure in workloads, which is a different question from who changed what.
D. Amazon CloudWatch collects metrics, logs, and alarms describing how systems are performing. It holds neither configuration history nor a record of API callers.
04
A team in AWS account B needs to read objects from an Amazon S3 bucket in AWS account A. What is the recommended way to grant this access?
Intermediate · Choose one
Explanation
Answer: B. A cross-account role is the standard pattern. The role's trust policy names account B as the principal that may assume it, and its permissions policy defines exactly what may be done in account A. The team receives temporary credentials, and access can be revoked at any time by changing the role.
A. Copying data duplicates it, adds cost and latency, and multiplies the number of places the data must be secured and governed.
C. Obscurity is not access control. Public buckets are routinely discovered and are one of the most common causes of data exposure.
D. Sharing long-term keys across an organizational boundary removes accountability and creates a credential that neither account can easily rotate or revoke cleanly.
05
What is an IAM permissions boundary?
Intermediate · Choose one
Explanation
Answer: B. A permissions boundary caps rather than grants. The identity's effective permissions are the intersection of its identity-based policies and its boundary, which lets an administrator safely delegate policy creation to a team while guaranteeing they cannot escalate beyond the cap.
A. Organization-wide guardrails are service control policies and resource control policies in AWS Organizations. A boundary is attached to one user or role.
C. The number of attachable policies is an IAM quota, unrelated to what a permissions boundary does.
D. A boundary never grants anything on its own. An action must still be allowed by an identity-based or resource-based policy.
06
A security team wants a single output listing every IAM user in an account, whether each has MFA enabled, and when each access key was last rotated and used. Which capability provides this?
Intermediate · Choose one
Explanation
Answer: C. The credential report is a downloadable CSV covering all IAM users in the account and the state of their credentials, including password status and last use, MFA status, and the rotation and last-used details of each access key. It can be generated at most once every four hours.
A. An aggregator centralizes AWS Config resource configuration and compliance data. It is not a credential inventory.
B. Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure, which is unrelated to IAM credentials.
D. CloudTrail Insights detects unusual patterns in API call volume or error rates. It reports anomalies, not credential status.
07
A development team needs to store non-sensitive configuration values, such as service endpoint URLs and feature flags, and retrieve them from applications at no per-item charge. Which service is the appropriate choice?
Intermediate · Choose one
Explanation
Answer: B. Parameter Store provides hierarchical storage for configuration data and secrets, with standard parameters available at no additional charge. It suits values that change rarely and do not require automatic rotation, and it can still encrypt sensitive values as SecureString parameters using AWS KMS.
A. AWS KMS manages encryption keys. It is not a store for application configuration values.
C. Secrets Manager is priced per secret per month plus API calls. Its value is automatic rotation, which plain configuration data does not need.
D. AWS Artifact is a repository for AWS compliance reports and agreements and has no application configuration role.
08
A company uses AWS IAM Identity Center and needs to give one group of engineers the same set of permissions in five different AWS accounts. What should the company create?
Intermediate · Choose one
Explanation
Answer: D. A permission set is a reusable definition of permissions that IAM Identity Center applies by creating and maintaining an IAM role in each account where the set is assigned. One definition therefore produces consistent access across many accounts, and changing it updates every account at once.
A. A service control policy limits the maximum permissions available in accounts. It grants nothing and cannot give the engineers access.
B. Cognito user pools authenticate the end users of a customer-facing application, not a company's own workforce signing in to AWS accounts.
C. Creating separate IAM users per account reintroduces exactly the duplication and drift that IAM Identity Center exists to remove, and gives each engineer several sets of credentials.
09
A company keeps its employee identities in an existing on-premises Microsoft Active Directory and wants AWS to authenticate against that directory without replicating or caching the directory data in the cloud. Which option meets this requirement?
Intermediate · Choose one
Explanation
Answer: D. AD Connector is a directory proxy. It forwards authentication requests to the existing on-premises Active Directory rather than storing or replicating directory data in AWS, which is what makes it the right fit when the requirement is explicitly that no directory data may live in the cloud.
A. AWS Managed Microsoft AD creates an actual directory running in AWS. It can trust an on-premises domain, but it does hold directory data in the cloud.
B. Amazon Cognito is an identity platform for a company's application end users and is not a mechanism for proxying enterprise directory authentication.
C. AWS Resource Access Manager shares resources such as subnets between accounts. It does not authenticate people.
10
What does the trust policy of an IAM role define?
Intermediate · Choose one
Explanation
Answer: D. Every role has two policies working together. The trust policy is a resource-based policy naming the principals that may assume the role, such as an AWS service, another account, or a federated identity provider, while the permissions policy determines what the resulting session may do.
A. Role assumption events are recorded by AWS CloudTrail as AssumeRole calls, not stored in the trust policy.
B. That is the role's permissions policy. Separating who may assume from what they may do is the reason a role has both.
C. A cap on permissions is a permissions boundary, which is attached in addition to the role's other policies.