AWS AWS Security and IAM 5 — Questions and Answers
Question 1: Which AWS service continuously monitors and records API calls made in your AWS account for auditing purposes?
- Amazon CloudWatch
- AWS CloudTrail (Correct answer)
- AWS Config
- Amazon GuardDuty
Correct answer: AWS CloudTrail
AWS CloudTrail records API calls and account activity as events, providing an audit trail for governance and compliance.
Question 2: What is the function of AWS Secrets Manager compared to AWS Systems Manager Parameter Store?
- Secrets Manager only stores database credentials while Parameter Store stores all other secrets
- Secrets Manager provides automatic secret rotation while Parameter Store requires manual rotation (Correct answer)
- Secrets Manager is free while Parameter Store charges per API call
- Secrets Manager uses KMS by default while Parameter Store never encrypts values
Correct answer: Secrets Manager provides automatic secret rotation while Parameter Store requires manual rotation
AWS Secrets Manager natively supports automatic rotation of secrets like database passwords, whereas Parameter Store requires custom Lambda functions for rotation.
Question 3: Which AWS KMS key type allows you to import your own key material and is managed entirely by you?
- AWS Managed Key
- Customer Managed Key (CMK) with imported key material (Correct answer)
- AWS Owned Key
- Data Encryption Key (DEK)
Correct answer: Customer Managed Key (CMK) with imported key material
Customer Managed Keys with imported key material let you bring your own cryptographic material while AWS KMS handles the infrastructure.
Question 4: An application running in Account A needs to access an S3 bucket in Account B. What is the most efficient configuration?
- Create an IAM user in Account B and share its access keys with Account A
- Add a bucket policy in Account B that allows Account A's IAM role, then grant the role permission to assume cross-account access (Correct answer)
- Enable S3 Transfer Acceleration between accounts
- Use VPC Peering to allow direct access
Correct answer: Add a bucket policy in Account B that allows Account A's IAM role, then grant the role permission to assume cross-account access
Cross-account S3 access requires a bucket policy in the target account plus an IAM role or user in the source account with appropriate permissions.
Question 5: Which GuardDuty finding type would indicate that an IAM user's credentials may be compromised?
- UnauthorizedAccess:EC2/SSHBruteForce
- UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B (Correct answer)
- Recon:EC2/PortProbeUnprotectedPort
- CryptoCurrency:EC2/BitcoinTool.B
Correct answer: UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B
The UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B finding indicates a successful console login from a potentially compromised or unusual location.
Question 6: What is the primary purpose of AWS IAM Access Analyzer?
- To simulate IAM policy evaluation before deployment
- To identify resources shared with external entities outside your zone of trust (Correct answer)
- To rotate IAM user credentials automatically
- To enforce MFA on all IAM users
Correct answer: To identify resources shared with external entities outside your zone of trust
IAM Access Analyzer uses automated reasoning to identify resources like S3 buckets or IAM roles accessible from outside your account or organization.
Question 7: A security team wants to enforce MFA for all IAM user console logins without modifying each user's individual policies. What is the best approach?
- Attach an inline policy to every user requiring MFA
- Use an SCP to deny all actions if MFA is not present (Correct answer)
- Enable MFA in the IAM account settings globally
- Create a Lambda function that checks MFA on each login
Correct answer: Use an SCP to deny all actions if MFA is not present
An SCP with a Deny effect for actions where aws:MultiFactorAuthPresent is false enforces MFA organization-wide without touching individual user policies.
AWS AWS Security and IAM 5
Which AWS service continuously monitors and records API calls made in your AWS account for auditing purposes?