CCP AWS Security and Compliance 2 — Questions and Answers
Question 1: Which AWS service allows you to audit user activity and API calls across your AWS infrastructure?
- Amazon CloudWatch
- AWS CloudTrail (Correct answer)
- AWS Config
- Amazon Inspector
Correct answer: AWS CloudTrail
AWS CloudTrail records API calls and user activity in your AWS account, providing a complete audit trail for compliance and security analysis.
Question 2: What AWS tool helps you identify S3 buckets that contain sensitive data such as PII?
- Amazon GuardDuty
- AWS Inspector
- Amazon Macie (Correct answer)
- AWS Trusted Advisor
Correct answer: Amazon Macie
Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in Amazon S3.
Question 3: Which AWS service lets you set fine-grained permissions for AWS services and resources using JSON-based policies?
- AWS Organizations
- AWS IAM (Correct answer)
- AWS Control Tower
- Amazon Cognito
Correct answer: AWS IAM
AWS Identity and Access Management (IAM) lets you manage access to AWS services and resources securely using policies.
Question 4: What is an IAM role used for in AWS?
- Storing long-term access credentials for a user
- Granting temporary permissions to entities that need access to AWS resources (Correct answer)
- Creating groups of users with shared permissions
- Defining password policies for AWS accounts
Correct answer: Granting temporary permissions to entities that need access to AWS resources
IAM roles are used to delegate access to AWS resources with temporary security credentials, without sharing long-term keys.
Question 5: Which AWS service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?
- Amazon Macie
- AWS Security Hub
- Amazon Inspector (Correct answer)
- AWS Shield
Correct answer: Amazon Inspector
Amazon Inspector automatically assesses EC2 instances and ECR container images for vulnerabilities and deviations from best practices.
Question 6: What does AWS WAF protect against?
- DDoS attacks at the network layer
- Common web exploits such as SQL injection and cross-site scripting (Correct answer)
- Unauthorized access to AWS accounts
- Data loss in S3 buckets
Correct answer: Common web exploits such as SQL injection and cross-site scripting
AWS WAF (Web Application Firewall) protects web applications from common exploits like SQL injection and XSS that could affect availability or compromise security.
CCP AWS Security and Compliance 2
Which AWS service allows you to audit user activity and API calls across your AWS infrastructure?