A company uses AWS Organizations and wants to delete the root user credentials in its member accounts entirely, so that no one can sign in as the root user in those accounts. Which capability supports this?
Hard · Choose one
Explanation
Answer: D. With centralized root access management enabled, the management account or a delegated administrator can remove the root user password, access keys, signing certificates, and MFA from member accounts. Those accounts can then neither sign in as root nor perform root password recovery, and newly created member accounts have no root credentials by default.
A. The root user is intrinsic to the account and is not an IAM identity that can be deleted. Removing its credentials is the supported approach.
B. Permissions boundaries apply to IAM users and roles. They cannot be attached to the root user, whose access is not constrained by identity-based policy mechanisms.
C. A service control policy can restrict what a member account's principals may do, but it does not remove credentials and does not prevent someone from signing in as the root user.
02
Which statement about multi-factor authentication in AWS Identity and Access Management is correct?
Hard · Choose one
Explanation
Answer: C. AWS supports three MFA types: passkeys and FIDO security keys, virtual authenticator applications, and hardware time-based one-time password tokens. The root user and IAM users can each register up to eight devices of any type, and AWS recommends registering multiple devices to add resilience if one is lost.
A. The one-device limit was raised. Registering several devices is now explicitly recommended precisely so that losing one does not lock the identity out.
B. MFA on the root user is not merely available but required. AWS now requires MFA to be configured for the root user across standalone, management, and member accounts.
D. AWS ended support for enabling SMS text message MFA and advises customers still using it to move to a passkey or security key, a virtual MFA device, or a hardware MFA device.
03
A company attaches a service control policy to an organizational unit in AWS Organizations. What is the effect of that policy?
Hard · Choose one
Explanation
Answer: B. AWS states plainly that no permissions are granted by a service control policy. An SCP defines a permissions guardrail that caps what principals in the affected member accounts can do. A principal still needs an identity-based or resource-based policy granting the action, and the SCP determines whether that grant can take effect.
A. SCPs sit alongside identity-based policies during evaluation rather than replacing them. Both must permit an action for it to succeed.
C. SCPs never grant. An action allowed by an SCP but not allowed by any IAM policy remains denied.
D. AWS states that SCPs do not affect users or roles in the management account. They affect only the member accounts of the organization.
04
Which AWS service automatically defends against the most common network and transport layer distributed denial of service attacks for all AWS customers at no additional charge?
Easy · Choose one
Explanation
Answer: B. AWS Shield Standard is built into the AWS services a customer already uses, with no subscription, commitment, or additional charge. It defends against the common and most frequently occurring network and transport layer, meaning layer 3 and layer 4, DDoS events such as SYN floods and reflection attacks.
A. AWS Firewall Manager centrally administers firewall policies across accounts. It manages other services' protections rather than mitigating attacks itself.
C. AWS WAF inspects HTTP and HTTPS requests at the application layer. It is a chargeable service, is not automatically applied, and does not address layer 3 or layer 4 attacks.
D. Amazon GuardDuty detects threats by analyzing account, network, and DNS activity. It raises findings but does not block or absorb attack traffic.
05
Which AWS service inspects and filters HTTP and HTTPS requests, blocking patterns such as SQL injection and cross-site scripting before they reach an application?
Easy · Choose one
Explanation
Answer: A. AWS WAF is a web application firewall that operates at layer 7. A web ACL of rules evaluates each request and allows it, blocks it with an HTTP 403, or returns a custom response. Managed rule groups maintained by AWS and by AWS Marketplace sellers cover common exploits including SQL injection and cross-site scripting, and are updated as new threats emerge.
B. AWS Shield Standard mitigates volumetric network and transport layer attacks. It does not parse the content of an HTTP request.
C. A network ACL filters on IP addresses, protocols, and ports at the subnet boundary. It cannot see whether a request body contains an injection attempt.
D. Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure. It reports risks rather than filtering live traffic.
06
A security team must find software vulnerabilities in its Amazon EC2 instances and container images, and separately must discover personally identifiable information stored in Amazon S3. Which TWO services should the team use? (Choose TWO.)
Intermediate · Select 2 answers
Explanation
Answer: A and C. Amazon Inspector is a vulnerability management service that automatically discovers workloads and continually scans them for software vulnerabilities and unintended network exposure, covering EC2 instances, container images in Amazon ECR, and Lambda functions. Amazon Macie is a data security service that uses machine learning and pattern matching to discover sensitive data in Amazon S3.
B. Amazon GuardDuty is a threat detection service that identifies malicious or unauthorized activity from activity logs. It does not enumerate software vulnerabilities or classify stored data.
D. AWS Shield Advanced provides enhanced DDoS protection for specific resource types. It is unrelated to vulnerability scanning or data discovery.
E. AWS Certificate Manager provisions, deploys, and renews TLS certificates. It plays no part in either requirement.
07
A company with dozens of AWS accounts wants to define AWS WAF rules and VPC security group policies centrally, enforce them across every account, and have them applied automatically to newly created accounts. Which service does this, and what does it require?
Intermediate · Choose one
Explanation
Answer: A. AWS Firewall Manager centrally configures and manages firewall rules across accounts and resources, and automatically applies protections to new accounts and resources as they are added. Its prerequisites include membership in AWS Organizations, a designated Firewall Manager administrator account, and AWS Config enabled. Policy types cover AWS WAF, Shield Advanced, security groups, network ACLs, and DNS Firewall.
B. A web ACL in AWS WAF is created and associated within one account. Nothing in AWS WAF alone propagates configuration across an organization or onto future accounts.
C. Shield Advanced is billed per organization, but protection is an explicit opt-in for each resource, and it does not distribute WAF or security group policies.
D. GuardDuty detects threats and can be administered organization-wide, but it does not create or enforce firewall rules.
08
A company must manage its encryption keys in single-tenant, dedicated hardware security modules that it alone controls, with AWS having no access to the key material. Which service meets this requirement?
Intermediate · Choose one
Explanation
Answer: C. AWS CloudHSM gives single-tenant access to dedicated hardware security modules that the customer controls, with user management performed inside the HSM rather than through IAM. AWS states that it has no access to the keys or data inside a CloudHSM cluster. Clusters can run in FIPS 140-3 Security Level 3 mode, though that alone is not the deciding factor, because AWS KMS keys are also protected by FIPS 140-3 Security Level 3 validated HSMs. What distinguishes CloudHSM is the tenancy and control model: a dedicated cluster in the customer's own VPC, with key material AWS cannot reach.
A. A customer managed key gives full control over its policy, rotation, and deletion, but by default it is created in the AWS-operated KMS key store rather than in dedicated hardware the customer controls, and AWS KMS performs cryptographic operations with it on the customer's behalf.
B. An AWS managed key is created by an AWS service on the customer's behalf. The customer can view and audit it but cannot modify it, and the hardware is multi-tenant and operated by AWS.
D. AWS Secrets Manager stores and rotates secrets such as credentials. It is not a key management service and does not provide dedicated cryptographic hardware.
09
A company subscribes to AWS Shield Advanced and wants around-the-clock engagement with the AWS Shield Response Team during a DDoS event. What is required for the company to obtain that support?
Hard · Choose one
Explanation
Answer: A. Shield Response Team access is a Shield Advanced benefit, but AWS conditions it on the account being subscribed to the Business Support plan or the Enterprise Support plan. Note that AWS is retiring the Business Support plan on 1 January 2027 and replacing it with Business Support+, so the same requirement will be expressed with the newer plan name. Shield Advanced itself is billed monthly per organization with a one-year commitment, and separately includes DDoS cost protection in the form of service credits for usage spikes caused by an attack.
B. There is no per-incident engagement fee. The entitlement follows from the Shield Advanced subscription combined with the qualifying Support plan.
C. Bot Control is a paid AWS WAF feature and is specifically excluded from the AWS WAF usage that Shield Advanced covers at no extra cost. It has no bearing on response team access.
D. Firewall Manager helps apply Shield Advanced protections consistently across an organization, but it is not a condition of Shield Response Team engagement.
10
A cloud practitioner needs to quickly check whether multi-factor authentication is enabled on the account root user and whether any security groups allow unrestricted access to specific ports, without deploying agents or scanners. Which service provides these checks?
Hard · Choose one
Explanation
Answer: B. AWS Trusted Advisor inspects an account against best-practice checks in categories that include security, and reports findings with recommended actions. MFA on the root account and security groups with specific ports unrestricted are both core security checks, and they are among the small set available to every account regardless of support plan.
A. Amazon Inspector scans workloads such as EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure. It does not evaluate account-level settings like root user MFA.
C. Amazon GuardDuty analyzes activity logs to detect threats in progress. It would report suspicious root user activity but does not audit whether MFA has been configured.
D. AWS Artifact distributes AWS compliance reports and agreements. It performs no inspection of the customer's account configuration.