DevOps Engineering on AWS Certification Security Automation and Compliance on AWS

Question 1

Which AWS service continuously monitors AWS resource configurations and evaluates them against desired configurations?

Accepted Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Security Hub

Question 2

What AWS IAM feature allows you to set permission boundaries that limit the maximum permissions an IAM entity can have?

Accepted Answer

Permission boundaries

Answer

IAM roles

Answer

Service control policies

Answer

Resource-based policies

Question 3

Which AWS service manages encryption keys and provides hardware security module (HSM) backing for cryptographic operations?

Accepted Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 4

What AWS service automates security assessments of EC2 instances and container images for vulnerabilities and deviations from best practices?

Accepted Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS Security Hub

Question 5

Which AWS Organizations feature allows central governance by setting guardrails that restrict what actions can be performed in member accounts?

Accepted Answer

Service control policies (SCPs)

Answer

IAM permission boundaries

Answer

Resource-based policies

Answer

AWS Config rules

Question 6

What is the purpose of AWS Secrets Manager in a DevOps pipeline?

Accepted Answer

Storing, rotating, and retrieving secrets like database credentials and API keys

Answer

Encrypting S3 objects at rest

Answer

Managing IAM role permissions

Answer

Auditing API calls in the account