AWS Security & Compliance 2 — Questions and Answers
Question 1: Which AWS service automatically discovers, classifies, and protects sensitive data such as PII in Amazon S3?
- Amazon Macie (Correct answer)
- Amazon GuardDuty
- AWS Config
- Amazon Inspector
Correct answer: Amazon Macie
Amazon Macie uses machine learning to identify and protect sensitive data like PII stored in S3.
Question 2: What is the AWS shared responsibility model's division for patching the guest operating system on an EC2 instance?
- The customer is responsible (Correct answer)
- AWS is responsible
- It is fully automated by AWS
- No patching is required
Correct answer: The customer is responsible
Customers are responsible for patching the guest OS and applications on EC2 instances under security 'in' the cloud.
Question 3: Which feature allows you to grant temporary, limited-privilege credentials to users from an identity provider?
- IAM roles with STS (Correct answer)
- IAM users
- Root account access keys
- Access control lists
Correct answer: IAM roles with STS
AWS STS issues temporary credentials that are assumed via IAM roles for federated or cross-account access.
Question 4: What does AWS KMS primarily provide?
- Creation and control of encryption keys (Correct answer)
- DDoS protection
- Web application firewall rules
- Network packet inspection
Correct answer: Creation and control of encryption keys
AWS Key Management Service (KMS) lets you create and manage cryptographic keys for encryption.
Question 5: Which service provides continuous monitoring for malicious activity and unauthorized behavior across AWS accounts?
- Amazon GuardDuty (Correct answer)
- AWS Trusted Advisor
- Amazon Macie
- AWS Artifact
Correct answer: Amazon GuardDuty
Amazon GuardDuty is a threat detection service that monitors for malicious and unauthorized activity.
Question 6: What is the most secure way to handle the AWS account root user?
- Enable MFA and avoid daily use (Correct answer)
- Share credentials with the team
- Use it for all API calls
- Store its access keys in code
Correct answer: Enable MFA and avoid daily use
Best practice is to secure the root user with MFA and use IAM identities for everyday tasks.
Question 7: Which AWS service offers on-demand access to AWS compliance reports such as SOC and PCI documentation?
- AWS Artifact (Correct answer)
- AWS Config
- AWS CloudTrail
- Amazon Inspector
Correct answer: AWS Artifact
AWS Artifact provides self-service downloads of AWS compliance reports and agreements.
AWS Security & Compliance 2
Which AWS service automatically discovers, classifies, and protects sensitive data such as PII in Amazon S3?