Mixed practice exam 2

Explanation

Answer: A. AWS states that customers own their content and choose the AWS Regions in which it is stored, and that AWS will not move or replicate content outside the chosen Regions except as necessary to provide the services the customer initiated or to comply with law or a binding order of a governmental body. Region selection is therefore the primary control for data residency requirements.

• B. Region selection is made by the customer for each resource. Billing details have no bearing on where data is placed.
• C. AWS does not silently replicate customer content to other Regions. Cross-Region copying happens only when the customer configures it, for example with S3 Cross-Region Replication.
• D. Cross-Region disaster recovery is something the customer designs and enables. Amazon S3 achieves its durability target within a single Region, with most storage classes storing objects across at least three Availability Zones; the One Zone classes are the exception.

Explanation

Answer: D. CloudTrail Event history provides a viewable, searchable, downloadable, and immutable record of the past 90 days of management events in an AWS Region, at no charge. To keep events beyond that window, a customer creates a trail that delivers events to Amazon S3 or configures a CloudTrail Lake event data store with a longer retention period.

• A. Event history is available in every account and Region. Organization-wide aggregation is a feature of organization trails, not a limitation on the console view.
• B. Events are an immutable record of the API activity itself. Deleting the resource does not remove the history of calls made against it.
• C. The relationship is the reverse. Management events are recorded by default, while data events are high-volume and must be explicitly enabled, usually with additional cost.

Explanation

Answer: C. These three are GuardDuty's foundational data sources. AWS states that nothing else needs to be enabled for GuardDuty to start analyzing and processing them, and that GuardDuty accesses them at no additional cost from AWS CloudTrail, Amazon VPC, and Route 53, so the customer does not have to activate or pay for those logs separately. GuardDuty's own foundational charges are based on the volume of events and logs it analyzes.

• A. AWS Config records resource configuration state and is not a GuardDuty data source. GuardDuty is a threat detection service driven by activity logs.
• B. CloudWatch metrics and agent-collected application logs are monitoring telemetry. GuardDuty draws on account, network, and DNS activity instead.
• D. Amazon S3 data events are not a foundational data source. They are analyzed by the S3 Protection plan, which is one of several protection plans billed separately from the foundational sources, although GuardDuty does turn S3 Protection on automatically when it is first enabled in a Region.

Explanation

Answer: C. This capability is delivered today as AWS Security Hub CSPM, which gives a comprehensive view of security state in AWS, receives findings from services such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie, and assesses the environment against standards including AWS Foundational Security Best Practices, CIS, PCI DSS, and NIST. AWS split the original service in 2025: what was previously known as Security Hub is now Security Hub CSPM, while a newer AWS Security Hub correlates those findings into prioritized exposures. The certification's in-scope services list still names it AWS Security Hub.

• A. Amazon CloudWatch collects metrics, logs, and alarms for operational monitoring, not consolidated security findings and compliance standard scores.
• B. AWS Config evaluates resource configurations against rules and conformance packs. It does not ingest findings from GuardDuty, Inspector, or Macie.
• D. Amazon Detective analyzes and investigates findings to identify root cause. It works on findings after they exist rather than aggregating them and scoring the environment against standards.

Explanation

Answer: B. Amazon Detective helps analyze, investigate, and quickly identify the root cause of security findings or suspicious activity. It builds a behavior graph from CloudTrail management events, VPC Flow Logs, EKS audit logs, and GuardDuty findings, and applies machine learning, statistical analysis, and graph theory to visualize how resources interacted over time.

• A. Amazon Macie discovers sensitive data in Amazon S3. It has no role in reconstructing the activity behind a threat finding.
• C. Amazon Inspector is a vulnerability management service. It reports which software flaws and network exposures exist, not how an incident unfolded.
• D. AWS Certificate Manager provisions and renews TLS certificates. It performs no security investigation function.

Explanation

Answer: D. Least privilege is about the scope of each grant rather than the number of people who hold one. It means granting only the actions, resources, and conditions a task genuinely requires. AWS notes that a team may begin with broader permissions while it learns what a workload needs, then reduce them over time, using signals such as IAM last accessed information to remove permissions that were never used.

• A. Restricting root user use is a separate and valid best practice, but least privilege applies to every identity in the account, not only the root user.
• B. Limiting headcount is not the same idea. Ten people with correctly scoped permissions is a better security posture than two people who each hold administrator access.
• C. Consolidating everyone into a single group forces one permission set on people with different jobs, which is the opposite of least privilege.

Explanation

Answer: B. Multi-factor authentication requires something the user knows, their password, plus something they have, an authenticator device. AWS supports passkeys and FIDO security keys, virtual authenticator applications, and hardware time-based one-time password tokens, and an identity can register up to eight MFA devices.

• A. A password policy strengthens the first factor. A longer, more complex password is still a single factor, so a stolen password still grants access.
• C. A resource-based policy governs what a principal is authorized to do once identified. It plays no part in proving who the principal is.
• D. Access keys are long-term credentials for programmatic access through the AWS CLI and SDKs. They are an alternative credential type, not a second factor for console sign-in.

Explanation

Answer: D. AWS states that a role does not have standard long-term credentials such as a password or access keys. When an identity assumes a role it receives temporary security credentials for that role session, which expire automatically. This is why roles are the recommended way to grant access to applications, AWS services, and federated users.

• A. An IAM group is a container used to attach permissions to a collection of users. It is not an identity, cannot be signed in to, and cannot be named as a principal in a policy.
• B. An IAM user is an identity with long-term credentials, which may include a console password and access keys. Those credentials persist until someone rotates or deletes them.
• C. The root user has long-term credentials, specifically the account email address and password, and holds unrestricted access to the account.

Explanation

Answer: A and E. The root user holds unrestricted access that cannot be limited by an identity-based policy, so protection focuses on making the credentials hard to misuse and rarely needed. AWS strongly recommends enabling MFA, and recommends against creating root access keys because programmatic access with unrestricted permissions is a severe risk if the keys leak. MFA is now required for the root user across all AWS account types.

• B. Sharing credentials destroys accountability, since CloudTrail can only record that the root user acted and not which person did so. AWS instead suggests controls such as multi-person approval, where no single person holds both the password and the MFA device.
• C. Identity-based policies cannot restrict the root user, which is why AWS focuses on credential protection and on centralized root access management in AWS Organizations rather than on limiting root with a policy.
• D. AWS advises not to access the root user unless a task genuinely requires it, and to perform daily work with IAM roles or IAM Identity Center workforce users.

Explanation

Answer: B. An IAM group is a collection of users that permissions can be attached to as a unit. Changing the group policy updates every member at once, and joiners and leavers are handled by group membership alone, which keeps the permission model consistent and auditable as the team changes.

• A. Roles are for identities that assume them temporarily, such as applications or federated users. Creating one role per person reproduces the maintenance problem rather than solving it.
• C. Attaching the same policy 200 times creates 200 places to update. Any policy change risks leaving some users out of step with the rest.
• D. Root user credentials cannot be restricted by a policy and must never be shared. This would give every developer unrestricted access to the account.