AWS AWS Security and IAM 5

Question 1

Which AWS service continuously monitors and records API calls made in your AWS account for auditing purposes?

Accepted Answer

AWS CloudTrail

Answer

AWS CloudTrail records API calls and account activity as events, providing an audit trail for governance and compliance.

Question 2

What is the function of AWS Secrets Manager compared to AWS Systems Manager Parameter Store?

Accepted Answer

Secrets Manager provides automatic secret rotation while Parameter Store requires manual rotation

Answer

AWS Secrets Manager natively supports automatic rotation of secrets like database passwords, whereas Parameter Store requires custom Lambda functions for rotation.

Question 3

Which AWS KMS key type allows you to import your own key material and is managed entirely by you?

Accepted Answer

Customer Managed Key (CMK) with imported key material

Answer

Customer Managed Keys with imported key material let you bring your own cryptographic material while AWS KMS handles the infrastructure.

Question 4

An application running in Account A needs to access an S3 bucket in Account B. What is the most efficient configuration?

Accepted Answer

Add a bucket policy in Account B that allows Account A's IAM role, then grant the role permission to assume cross-account access

Answer

Cross-account S3 access requires a bucket policy in the target account plus an IAM role or user in the source account with appropriate permissions.

Question 5

Which GuardDuty finding type would indicate that an IAM user's credentials may be compromised?

Accepted Answer

UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B

Answer

The UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B finding indicates a successful console login from a potentially compromised or unusual location.

AWS Practice Test

AWS Practice Test

AWS AWS Security and IAM 5