Which statement correctly contrasts Amazon GuardDuty with Amazon Inspector?
Intermediate · Choose one
Explanation
Answer: B. The two answer different questions. GuardDuty continuously analyzes activity such as CloudTrail management events, VPC Flow Logs, and DNS logs to find behavior that suggests compromise, while Inspector examines the software present in EC2 instances, container images, and Lambda functions to find known vulnerabilities before they are exploited.
A. GuardDuty performs no vulnerability scanning at all, and Inspector's coverage extends well beyond container images.
C. Aggregating findings from multiple security services into one view is the role of AWS Security Hub, not Inspector.
D. This reverses the two services. Vulnerability scanning is Inspector's function and log-based threat detection is GuardDuty's.
02
Which TWO resources can an AWS WAF web ACL be associated with directly? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: D and E. AWS WAF protects resources that terminate and understand HTTP, which is why it attaches to layer 7 entry points such as CloudFront distributions, Application Load Balancers, Amazon API Gateway REST APIs, and Amazon Cognito user pools. Traffic reaching an application through one of these is inspected before it is forwarded.
A. A Network Load Balancer operates at layer 4 and does not parse HTTP, so a web ACL cannot be associated with it. Workloads behind an NLB are usually fronted by CloudFront or an ALB when AWS WAF is needed.
B. An Amazon EBS volume is block storage and carries no network traffic to inspect.
C. AWS WAF is never attached to an instance. Instance-level filtering by address and port is the job of a security group.
03
A team creates a new custom security group and a new custom network ACL, associates the network ACL with a subnet, and attaches the security group to an Amazon EC2 instance in that subnet, without adding any rules to either. What is the resulting behavior?
Hard · Choose one
Explanation
Answer: A. The two constructs have different starting positions, and knowing them prevents a lot of wasted troubleshooting. A newly created security group contains one outbound rule permitting all traffic and no inbound rules, whereas a newly created network ACL contains only the final deny rules, so it blocks everything until explicit numbered rules are added in both directions.
B. This describes the default network ACL, which permits all traffic, rather than a custom one. A new security group also never permits inbound traffic by default.
C. This reverses both behaviors, and the allow-all description applies to the default network ACL rather than a custom one.
D. The security group permits all outbound traffic from the moment it is created, so traffic is not blocked in both directions.
04
A company imports a third-party SSL/TLS certificate into AWS Certificate Manager and associates it with an Application Load Balancer. What must the company plan for?
Hard · Choose one
Explanation
Answer: A. Managed renewal applies only to certificates that ACM itself issued, because only then does ACM control the validation and issuance process. An imported certificate is opaque to ACM, so tracking its expiry and repeating the import is the customer's responsibility, and ACM can send expiry notifications to help.
B. Automatic renewal of an imported certificate is impossible, since ACM has no relationship with the external certificate authority that issued it.
C. The US East (N. Virginia) requirement applies to certificates used with Amazon CloudFront. A certificate for an Application Load Balancer must be in the same Region as the load balancer.
D. Importing a certificate into ACM carries no charge. Costs arise from AWS Private CA when issuing private certificates.
05
A security team suspects that an AWS KMS customer managed key may have been used by a compromised application. They must stop the key being used immediately while the investigation continues, but must not lose the ability to decrypt existing data later. What should they do?
Hard · Choose one
Explanation
Answer: A. Disabling a key makes AWS KMS reject every request to use it, so encryption and decryption stop at once, and the key and its material remain intact. If the investigation clears the application, the key is simply re-enabled and data protected by it becomes readable again.
B. Rotation creates new backing key material for future encryption while retaining the old material. It does not block the key from being used and is not a containment action.
C. Scheduling deletion starts a mandatory waiting period, and once the key is deleted the data it protects is unrecoverable. Deletion can be cancelled during the waiting period but is far riskier than disabling.
D. An alias is only a friendly name. Removing it does not stop anything that references the key by its key ID or ARN.
06
Which AWS service allows an operations team to model and provision a complete set of AWS resources from a declarative template file, so that identical environments can be recreated on demand?
Easy · Choose one
Explanation
Answer: A. AWS CloudFormation is the AWS infrastructure as code (IaC) service. You describe the desired resources in a JSON or YAML template, and CloudFormation provisions and configures them as a single unit called a stack. Because the template is a file, it can be stored in version control and reused to build identical development, test, and production environments.
B. AWS Systems Manager operates and manages existing instances and resources (patching, run command, parameter store). It is an operations tool, not a template-driven provisioning engine.
C. AWS Config records and evaluates the configuration of resources that already exist and reports on compliance drift. It does not provision resources.
D. AWS Control Tower automates the set-up of a secure multi-account landing zone with guardrails. It orchestrates accounts, not the individual resource stacks inside a workload.
07
An administrator must run the same sequence of AWS operations every night from a Linux server, driven by a shell script that is scheduled with cron. Which method of accessing AWS services is most appropriate?
Easy · Choose one
Explanation
Answer: B. The AWS CLI is a unified tool that issues AWS service commands from a terminal. Because the commands are text, they can be placed in a shell script and scheduled, which makes the CLI the standard choice for repeatable, automated operational tasks. The three primary access methods are the AWS Management Console, the AWS CLI, and the AWS SDKs.
A. AWS Artifact is a self-service portal for downloading AWS compliance reports and agreements. It does not operate AWS resources.
C. The AWS Management Console is a graphical web interface driven by a human clicking through pages. It cannot be invoked by a cron job or scripted.
D. The AWS Health Dashboard reports on the health of AWS services and on events affecting the account. It is an information source, not an automation interface.
08
Which of the following are valid ways to interact with and manage AWS services? (Choose TWO.)
Easy · Select 2 answers
Explanation
Answer: A and E. AWS provides three primary access methods: the AWS Management Console (graphical web interface), the AWS CLI (command line), and the AWS SDKs (programmatic access from application code). The console and the CLI are two of these three.
B. Amazon CloudWatch is a monitoring and observability service for metrics, logs, and alarms. It is not an interface for managing AWS resources broadly.
C. AWS Trusted Advisor is an inspection service that gives recommendations on cost, performance, security, fault tolerance, service limits, and operational excellence. It is a service you consume, not an access method.
D. AWS Artifact is a self-service portal for downloading AWS compliance reports and agreements. It is not an access method for managing services.
09
A manufacturing company keeps its ERP system in its own data center because of contractual data residency terms, while running its new customer-facing web application on AWS. The two environments are connected with AWS Direct Connect. Which cloud deployment model does this describe?
Intermediate · Choose one
Explanation
Answer: D. A hybrid deployment connects resources that run in an on-premises data center with resources that run in the AWS Cloud, so the two act as a single extended environment. Direct Connect or AWS Site-to-Site VPN is the usual connectivity layer. This is the standard pattern when some workloads must stay on-premises for latency, licensing, or data residency reasons.
A. An on-premises or private cloud deployment uses virtualization and resource management within the company's own data center only. This scenario clearly includes AWS.
B. Multi-cloud means using two or more public cloud providers. Only one public cloud provider, AWS, is described here.
C. An all-in cloud deployment means every part of the application is provisioned in the cloud. Here the ERP system deliberately remains in the company's data center.
10
A startup wants to deploy a Java web application to AWS. The team does not want to manually configure EC2 instances, load balancers, or Auto Scaling groups, but they do want the ability to inspect and adjust the underlying resources later if needed. Which service best fits?
Intermediate · Choose one
Explanation
Answer: C. AWS Elastic Beanstalk lets you upload application code and automatically handles capacity provisioning, load balancing, Auto Scaling, and application health monitoring. Crucially, it provisions standard AWS resources (EC2, ELB, Auto Scaling groups) in your account, so you retain full visibility and control over them if you need to tune the environment.
A. AWS Lambda is event-driven and function-based. Running a traditional Java web application on it would require re-architecting, and there are no underlying EC2 instances or load balancers for the team to inspect.
B. AWS CloudFormation would provision the resources, but the team would have to author the templates themselves. It does not remove the need to define the load balancer and Auto Scaling configuration.
D. Amazon Lightsail bundles compute, storage, and networking into simplified plans and intentionally abstracts the underlying resources, which conflicts with the requirement to inspect and adjust them.