What is the primary purpose of AWS Certificate Manager?
Easy · Choose one
Explanation
Answer: B. AWS Certificate Manager issues and manages the TLS certificates that enable encryption in transit. Public certificates for use with integrated AWS services such as Elastic Load Balancing, Amazon CloudFront, and Amazon API Gateway are provided at no cost, and ACM renews the certificates it issued before they expire.
A. AWS compliance reports are obtained from AWS Artifact.
C. Creating and controlling keys for data at rest is the role of AWS Key Management Service.
D. Storing and rotating credentials is the role of AWS Secrets Manager.
62
A company needs to let another AWS account in the same AWS Organizations organization use a subnet in a VPC that the company owns, without recreating the network in the other account. Which service enables this?
Intermediate · Choose one
Explanation
Answer: C. AWS RAM lets a resource owner share supported resources with other accounts, organizational units, or an entire organization. VPC subnets are shareable only with accounts in the same organization, while resources such as AWS Transit Gateway and AWS License Manager configurations can also be shared with accounts outside it. Sharing avoids duplicating infrastructure while the owner keeps control of the resource.
A. AWS Certificate Manager issues and manages TLS certificates, which is unrelated to cross-account resource sharing.
B. AWS Directory Service provides managed Active Directory capabilities and has no role in sharing network resources.
D. Consolidated billing combines the charges of member accounts onto one invoice. It does not share technical resources between them.
63
Which statement about a VPC network ACL is correct?
Intermediate · Choose one
Explanation
Answer: D. Network ACLs are the subnet-level layer of VPC network security and behave very differently from security groups. Being stateless, they need matching rules in both directions, including the ephemeral port range for responses, and their numbered rules are evaluated lowest number first with the first match deciding the outcome.
A. Instance-level filtering is what a security group does. A network ACL is associated with subnets.
B. Allow-only rules evaluated as a whole describe a security group. The ability to write explicit deny rules is a key reason to use a network ACL, for example to block a specific address range.
C. Statefulness is the defining property of a security group, not of a network ACL.
64
A company wants to block requests originating from specific countries and to rate-limit requests to a public API so that a single client cannot overwhelm it. Which service provides these controls?
Intermediate · Choose one
Explanation
Answer: B. AWS WAF evaluates each HTTP or HTTPS request against the rules in a web ACL and can allow, block, count, or challenge it. Geographic match rules and rate-based rules are both native rule types, alongside managed rule groups that cover common exploits such as SQL injection and cross-site scripting.
A. A security group attaches to an elastic network interface and cannot be associated with an Amazon API Gateway API at all. Even where it does apply, it filters on IP address, protocol, and port and cannot count requests over time or evaluate the country a request came from.
C. Amazon GuardDuty is a detection service. It generates findings about suspicious activity and does not block or filter traffic.
D. AWS Shield Standard mitigates common network and transport layer DDoS attacks automatically, but it offers no configurable application-layer rules.
65
What does the DDoS cost protection feature of AWS Shield Advanced provide?
Intermediate · Choose one
Explanation
Answer: A. An attack drives up usage even when it is successfully mitigated, because the application scales out and transfers more data. DDoS cost protection requests service credits for those charges on protected resources such as Amazon EC2, Elastic Load Balancing, Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53, so a customer is not billed for absorbing an attack.
B. The subscription fee is not refunded. The protection concerns usage charges caused by the attack.
C. There is no charge cap. Shield Advanced does include AWS WAF usage on protected resources at no extra cost, which is a separate benefit from cost protection.
D. Access to the Shield Response Team is a Shield Advanced benefit but depends on the account's AWS Support plan, and it is not what cost protection means.