CCP AWS Cloud Security and Compliance 2 — Questions and Answers
Question 1: Which AWS service enables multi-factor authentication (MFA) enforcement for IAM users?
- Amazon Cognito
- AWS IAM (Correct answer)
- AWS SSO
- AWS Directory Service
Correct answer: AWS IAM
AWS IAM allows administrators to require MFA for individual users or enforce it via IAM policies across the account.
Question 2: What is the primary purpose of AWS CloudTrail?
- Monitor infrastructure performance metrics
- Record API calls and account activity for auditing (Correct answer)
- Scan code for security vulnerabilities
- Manage SSL/TLS certificates
Correct answer: Record API calls and account activity for auditing
AWS CloudTrail records API calls made in your AWS account, providing an audit trail of who did what, when, and from where.
Question 3: Which AWS service performs automated security assessments of EC2 instances and container workloads to find vulnerabilities?
- Amazon GuardDuty
- Amazon Inspector (Correct answer)
- AWS Macie
- AWS Shield
Correct answer: Amazon Inspector
Amazon Inspector automatically assesses applications for software vulnerabilities and unintended network exposures on EC2 and container workloads.
Question 4: Which AWS offering provides automatic protection against DDoS attacks for all AWS customers at no additional cost?
- AWS WAF
- AWS Shield Standard (Correct answer)
- AWS Shield Advanced
- Amazon GuardDuty
Correct answer: AWS Shield Standard
AWS Shield Standard is automatically enabled for all AWS customers at no extra cost and protects against common network and transport-layer DDoS attacks.
Question 5: Which IAM best practice recommends avoiding the use of root account credentials for everyday tasks?
- Principle of Least Privilege
- Root Account Protection (Correct answer)
- Role-Based Access Control
- Identity Federation
Correct answer: Root Account Protection
AWS recommends locking away root account credentials and creating individual IAM users for day-to-day operations to minimize risk.
Question 6: Which service centralizes security findings from multiple AWS security services into a single dashboard?
- AWS Config
- AWS Security Hub (Correct answer)
- Amazon Detective
- AWS CloudTrail
Correct answer: AWS Security Hub
AWS Security Hub aggregates, organizes, and prioritizes security findings from services like GuardDuty, Inspector, and Macie in one place.
CCP AWS Cloud Security and Compliance 2
Which AWS service enables multi-factor authentication (MFA) enforcement for IAM users?