An application is built entirely on AWS Lambda. Under the shared responsibility model, which item remains the customer's responsibility?
Intermediate · Choose one
Explanation
Answer: C. AWS curates and publishes security updates for all supported managed runtimes and container base images, and applies runtime updates automatically for functions left in the default Auto runtime update mode. AWS states that in all cases the customer is responsible for applying updates to their function code, including its dependencies. Serverless removes infrastructure work; it never removes responsibility for the code the customer wrote or imported.
A. Lambda scales the execution environment automatically in response to the request rate. AWS operates that mechanism, so it is not a customer maintenance responsibility, beyond optional concurrency settings the customer may choose to apply.
B. AWS explicitly takes responsibility for curating and publishing security updates for all supported managed runtimes and container base images.
D. For Lambda, AWS manages the underlying infrastructure, the operating system, and the application platform. The customer has no operating system to patch.
42
How does the division of responsibility change as a customer moves a workload from Amazon EC2 to an abstracted service such as Amazon S3?
Intermediate · Choose one
Explanation
Answer: A. AWS states that for abstracted services such as Amazon S3 and Amazon DynamoDB, AWS operates the infrastructure layer, the operating system, and the platforms, and customers access endpoints to store and retrieve data. The customer's remaining duties concentrate on the content itself and who may reach it.
B. AWS states directly that customer responsibility is determined by the AWS Cloud services the customer selects, so the boundary shifts by service.
C. Abstracted services reduce the customer's operational surface rather than expanding it; there is no operating system or platform left for the customer to manage.
D. Customer data and its classification never move to AWS. AWS states that customers own and control their content regardless of which service holds it.
43
An external auditor asks a company to identify a security control that it fully inherits from AWS and therefore does not need to test itself. Which control fits that description?
Hard · Choose one
Explanation
Answer: A. AWS defines inherited controls as those a customer fully inherits from AWS, and names physical and environmental controls as the example. The customer performs no part of the control and can evidence it to an auditor using the AWS third-party attestation reports rather than testing it directly.
B. Awareness and training is a shared control. AWS trains AWS employees; the customer must train its own, so this half is not inherited.
C. Patch management is a shared control. AWS patches the infrastructure, but the customer half named here, the guest operating systems, is performed by the customer and must be tested.
D. Configuration management is a shared control. AWS maintains the configuration of its infrastructure devices, while the customer configures its own operating systems, databases, and applications.
44
A company stores regulated data in Amazon S3 and enables server-side encryption with an AWS KMS customer managed key. Under the shared responsibility model, which task remains the company's responsibility?
Hard · Choose one
Explanation
Answer: B. Encryption changes how data is protected, not who decides who may reach it. Data classification and the access controls around the key, meaning the key policy plus the IAM permissions of the callers, stay with the customer. A correctly encrypted object is still exposed if the key policy grants the wrong principal.
A. Storage classes such as S3 Standard redundantly store objects across a minimum of three Availability Zones as part of the service AWS operates; the customer does not arrange this.
C. AWS KMS keys are generated and used inside hardware security modules that AWS operates and that are validated under FIPS 140-3 Security Level 3. Customers never operate that hardware.
D. Media destruction is performed by AWS as part of its infrastructure responsibilities and is an inherited control for the customer.
45
Which AWS service provides on-demand access to AWS compliance reports, such as SOC and PCI DSS reports?
Easy · Choose one
Explanation
Answer: A. AWS Artifact is the self-service portal for AWS security and compliance documentation. It supplies third-party audit artifacts such as SOC 1, SOC 2, SOC 3, ISO, and PCI DSS reports, and it also holds agreements a customer may need to accept with AWS. AWS provides these documents free of charge.
B. AWS Config records and evaluates the configuration of a customer's own resources over time. It reports on the customer's compliance posture, not on AWS's audit attestations.
C. AWS Trusted Advisor inspects a customer's account against best-practice checks. It does not distribute AWS audit reports.
D. AWS CloudTrail records API activity in the customer's account for auditing and governance. It produces the customer's own audit trail rather than AWS's certifications.
46
A security team needs to determine which identity called a particular AWS API, from which IP address, and at what time. Which service records this information?
Easy · Choose one
Explanation
Answer: B. AWS CloudTrail enables operational and risk auditing, governance, and compliance by recording actions taken in an account as events. Each event captures the identity that made the request, the time, the source IP address, and the parameters, which is exactly the who-did-what record an investigation needs.
A. AWS Config records what a resource's configuration is and how it has changed. It answers what changed, while CloudTrail answers who changed it.
C. Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It does not log API activity.
D. Amazon CloudWatch collects metrics, logs, and alarms about resource and application performance. It reports on how systems are behaving rather than which principal invoked an API.
47
A company must protect customer data while it travels between a user's browser and an Amazon CloudFront distribution. Which control addresses this requirement?
Easy · Choose one
Explanation
Answer: A. Data moving across a network needs encryption in transit, which on AWS means TLS. AWS Certificate Manager provisions the public certificate at no charge, deploys it to integrated services such as Amazon CloudFront and Amazon API Gateway, and renews it automatically before it expires. A certificate used with CloudFront must be requested in the US East (N. Virginia) Region.
B. Amazon EBS encryption protects data at rest on the volume. It does nothing for traffic crossing the network to reach the distribution.
C. Encrypting the log bucket protects stored log files at rest. The user's request has already traversed the internet by the time a log entry is written.
D. Encryption at rest on Amazon RDS protects the stored database. The requirement described concerns the browser-to-load-balancer path, which is a different segment entirely.
48
An auditor asks a company to show exactly how a set of security groups was configured on a specific date eight months ago, and to list every configuration change since then. Which AWS service is designed to provide this?
Intermediate · Choose one
Explanation
Answer: D. AWS Config gives a detailed view of the configuration of AWS resources, including how they were configured in the past, so a customer can see how configurations and relationships change over time. Config rules can additionally evaluate whether each recorded configuration was compliant.
A. CloudTrail Event history in the console retains only the past 90 days of management events per Region, so a state from eight months ago is no longer there. CloudTrail also records the API call rather than the resulting configuration state.
B. AWS Trusted Advisor reports on the current state of an account against best-practice checks. It does not maintain a configuration history.
C. Amazon CloudWatch metrics are time-series measurements of performance and utilization. They carry no record of a security group's rule set.
49
Which TWO statements about AWS Artifact are correct? (Choose TWO.)
Intermediate · Select 2 answers
Explanation
Answer: C and E. AWS Artifact has two functions: on-demand download of AWS security and compliance documents, and management of agreements between the customer and AWS. AWS states that it provides these documents and agreements free of charge, and that a customer using AWS Organizations can accept an agreement such as a Business Associate Addendum on behalf of every account in the organization.
A. Continuous evaluation of resource configurations against rules is what AWS Config does. Artifact is a document repository and does not inspect the customer's environment.
B. AWS notes that customers are responsible for developing or obtaining the documents that demonstrate their own security and compliance. Artifact attests to AWS, not to what the customer built on it.
D. Aggregating findings from other security services into one view is the role of AWS Security Hub, delivered today as AWS Security Hub CSPM.
50
What is true about server-side encryption of new objects uploaded to Amazon S3?
Intermediate · Choose one
Explanation
Answer: C. Since January 2023, all new object uploads to Amazon S3 are automatically encrypted at no additional cost and with no impact on performance. Server-side encryption with Amazon S3 managed keys, known as SSE-S3, is the base level of encryption applied to every bucket, using 256-bit AES-GCM.
A. Specifying an encryption header on a request selects a particular encryption option. Omitting it does not cause a rejection; the object is encrypted using the bucket's default encryption configuration, which is SSE-S3 unless the bucket has been set to use SSE-KMS or DSSE-KMS.
B. This describes the behavior before the change. Default encryption no longer has to be switched on for new uploads to be encrypted.
D. A customer managed KMS key is one option, and it does carry a charge, but it is not required. The default SSE-S3 encryption uses keys that Amazon S3 manages at no cost.