A company keeps its employee identities in an existing on-premises Microsoft Active Directory and wants AWS to authenticate against that directory without replicating or caching the directory data in the cloud. Which option meets this requirement?
Intermediate · Choose one
Explanation
Answer: D. AD Connector is a directory proxy. It forwards authentication requests to the existing on-premises Active Directory rather than storing or replicating directory data in AWS, which is what makes it the right fit when the requirement is explicitly that no directory data may live in the cloud.
A. AWS Managed Microsoft AD creates an actual directory running in AWS. It can trust an on-premises domain, but it does hold directory data in the cloud.
B. Amazon Cognito is an identity platform for a company's application end users and is not a mechanism for proxying enterprise directory authentication.
C. AWS Resource Access Manager shares resources such as subnets between accounts. It does not authenticate people.
52
What does the trust policy of an IAM role define?
Intermediate · Choose one
Explanation
Answer: D. Every role has two policies working together. The trust policy is a resource-based policy naming the principals that may assume the role, such as an AWS service, another account, or a federated identity provider, while the permissions policy determines what the resulting session may do.
A. Role assumption events are recorded by AWS CloudTrail as AssumeRole calls, not stored in the trust policy.
B. That is the role's permissions policy. Separating who may assume from what they may do is the reason a role has both.
C. A cap on permissions is a permissions boundary, which is attached in addition to the role's other policies.
53
An IAM user has an identity-based policy that allows all Amazon EC2 actions. A service control policy attached to the organizational unit containing the account denies ec2:RunInstances. What happens when the user tries to launch an instance?
Hard · Choose one
Explanation
Answer: C. A service control policy is a guardrail, so an action must be permitted by both the SCP and the identity-based policy for the request to succeed. An explicit deny found in any applicable policy ends evaluation immediately, which is why the broad EC2 allow cannot rescue the call.
A. There is no ordering by which an identity-based allow can overcome an SCP deny. The evaluation logic looks for an explicit deny across all policy types first.
B. The management account is the exception in the opposite direction: SCPs do not restrict principals in the management account, but they do restrict member accounts, which is the case described here.
D. SCPs apply to the IAM users and roles in affected member accounts alike.
54
A security team must identify which Amazon S3 buckets, IAM roles, and AWS KMS keys in an account can be accessed by principals outside the company's AWS organization. Which capability reports this?
Hard · Choose one
Explanation
Answer: B. IAM Access Analyzer evaluates the resource-based policies in an account against a defined zone of trust, which can be the account or the whole organization, and reports each resource that can be reached from outside it. The analysis is based on logical reasoning about the policies rather than on observed traffic, so it finds exposure that nobody has exploited yet.
A. CloudTrail Insights highlights unusual API call volumes and error rates. It reports on activity, not on the permissions a policy grants.
C. The credential report describes the state of IAM user credentials. It says nothing about which resources are shared externally.
D. Amazon Macie discovers sensitive data inside Amazon S3 objects. It reports what the data is, not who outside the organization can reach it.
55
Which statement about an IAM user group is correct?
Hard · Choose one
Explanation
Answer: C. A group is a convenience for managing permissions, not an identity. Because it has no credentials and cannot be a principal, a resource-based policy cannot grant access to a group; it grants to the users or roles themselves. Groups also contain only users, never other groups.
A. Assuming an identity to receive temporary credentials describes an IAM role, which is a different construct with its own trust policy.
B. IAM does not support nested groups. A user can belong to multiple groups, which is how overlapping permission sets are expressed.
D. Groups have no credentials of any kind, so there is nothing to sign in with.
56
Which TWO statements about AWS IAM Identity Center are correct? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: D and E. IAM Identity Center is the recommended way to manage workforce access across many AWS accounts. One identity source feeds it, which may be its own directory, Active Directory, or an external provider such as Okta or Microsoft Entra ID, and assigning a permission set causes it to provision and keep in sync an IAM role in each target account so users receive temporary credentials.
A. Consumer or customer sign-in for an application is the purpose of Amazon Cognito. Identity Center is for a company's own workforce.
B. Removing per-account IAM users is one of the main reasons to adopt it. Users sign in once through the access portal and reach every account they are entitled to.
C. It builds on IAM rather than replacing it. The access a user receives is delivered through IAM roles and evaluated by the same policy logic.
57
What is the security benefit of federating workforce users into AWS through an external identity provider instead of creating an IAM user for each person?
Hard · Choose one
Explanation
Answer: A. Federation moves the credential lifecycle to a system the company already operates, so joiners and leavers are handled once, in one place. In AWS the federated user assumes a role and receives temporary credentials that expire, which removes the standing password and access keys an IAM user would otherwise carry.
B. The identity provider proves who the user is; AWS still decides what they may do, through the roles and policies the federated session assumes.
C. Federated users can reach both the AWS Management Console and the APIs, which is why it is the recommended pattern for human access.
D. Federation issues short-lived credentials on demand. It does not create or synchronize permanent access keys.
58
Which AWS security control operates at the instance level and is stateful, meaning that return traffic for an allowed connection is permitted automatically?
Easy · Choose one
Explanation
Answer: D. A security group is a virtual firewall attached to an elastic network interface. Because it is stateful, allowing an inbound request means the response is allowed out regardless of the outbound rules, which is why security groups need only describe the traffic a workload should accept.
A. A network ACL operates at the subnet boundary and is stateless, so return traffic must be allowed explicitly by a rule in the opposite direction.
B. AWS WAF inspects the content of HTTP and HTTPS requests at the application layer rather than filtering by address and port at the instance.
C. AWS Shield Standard automatically mitigates common network and transport layer DDoS attacks. It is not a configurable per-instance firewall.
59
Where can a company find and subscribe to third-party security software, such as endpoint protection, firewalls, or SIEM tools, to deploy in its AWS environment?
Easy · Choose one
Explanation
Answer: C. AWS Marketplace is a curated digital catalog where independent software vendors publish security products as machine images, container images, SaaS subscriptions, and professional services. Purchases flow through the customer's AWS account and appear on the same AWS invoice.
A. AWS Service Catalog lets an organization publish and govern its own approved product portfolio for internal users, rather than offering third-party products for purchase.
B. AWS Artifact distributes AWS compliance reports and agreements. It sells no software.
D. AWS Trusted Advisor evaluates an account against best-practice checks and makes recommendations. It is not a procurement channel.
60
Where does AWS publish notices about security issues and vulnerabilities that affect AWS services, along with guidance on what customers should do?
Easy · Choose one
Explanation
Answer: B. AWS Security Bulletins are the official channel for security notices about AWS services, including relevant CVE identifiers and any customer action required. They are published on the AWS security pages and are available as an RSS feed, alongside the AWS Security Blog for deeper technical guidance.
A. AWS Service Catalog manages an organization's approved internal product portfolio and has no security notification role.
C. AWS Artifact holds audit reports and agreements. It is not used to announce vulnerabilities or remediation guidance.
D. Amazon Inspector reports vulnerabilities found in the customer's own workloads. It does not publish AWS service-level security notices.