AWS Security & Compliance 3 — Questions and Answers
Question 1: Which service records API calls and account activity for governance, compliance, and auditing?
- AWS CloudTrail (Correct answer)
- Amazon CloudWatch
- AWS Config
- Amazon GuardDuty
Correct answer: AWS CloudTrail
AWS CloudTrail logs API calls and events across your account for audit and compliance.
Question 2: What does AWS Config primarily help you do?
- Assess and audit resource configurations (Correct answer)
- Detect malware in EC2
- Encrypt S3 buckets
- Block SQL injection
Correct answer: Assess and audit resource configurations
AWS Config tracks resource configuration changes and evaluates them against desired rules.
Question 3: Which AWS service helps protect web applications from common exploits like SQL injection and XSS?
- AWS WAF (Correct answer)
- AWS Shield
- Amazon Macie
- AWS KMS
Correct answer: AWS WAF
AWS WAF lets you define rules to filter malicious web requests such as SQL injection and XSS.
Question 4: What level of DDoS protection does AWS Shield Standard provide?
- Automatic protection at no extra cost (Correct answer)
- Only after manual activation
- Paid per-request protection
- No DDoS protection
Correct answer: Automatic protection at no extra cost
AWS Shield Standard is automatically enabled for all AWS customers at no additional charge.
Question 5: Which IAM policy element explicitly overrides any matching Allow statement?
- An explicit Deny (Correct answer)
- A wildcard Allow
- A condition key
- A resource ARN
Correct answer: An explicit Deny
In IAM, an explicit Deny always takes precedence over any Allow.
Question 6: Which service performs automated security assessments for software vulnerabilities and unintended network exposure on EC2 and container images?
- Amazon Inspector (Correct answer)
- AWS Artifact
- Amazon Macie
- AWS CloudTrail
Correct answer: Amazon Inspector
Amazon Inspector continuously scans workloads for vulnerabilities and network exposure.
Question 7: What is the recommended approach for granting an application running on EC2 access to S3?
- Attach an IAM role to the instance (Correct answer)
- Hardcode access keys in the app
- Use the root account keys
- Store keys in a public bucket
Correct answer: Attach an IAM role to the instance
Attaching an IAM role provides temporary, automatically rotated credentials without storing keys.
AWS Security & Compliance 3
Which service records API calls and account activity for governance, compliance, and auditing?