DevOps Engineering on AWS Certification Security Automation and Compliance on AWS

Question 1

Which AWS service continuously monitors AWS resource configurations and evaluates them against desired configurations?

Accepted Answer

AWS Config

Answer

AWS Config continuously records resource configurations and evaluates them against config rules to detect non-compliant resources.

Question 2

What AWS IAM feature allows you to set permission boundaries that limit the maximum permissions an IAM entity can have?

Accepted Answer

Permission boundaries

Answer

Permission boundaries define the maximum permissions that an IAM entity (user or role) can have, even if their identity-based policies grant more.

Question 3

Which AWS service manages encryption keys and provides hardware security module (HSM) backing for cryptographic operations?

Accepted Answer

AWS KMS

Answer

AWS KMS (Key Management Service) provides managed encryption key creation and control, backed by FIPS 140-2 validated HSMs.

Question 4

What AWS service automates security assessments of EC2 instances and container images for vulnerabilities and deviations from best practices?

Accepted Answer

Amazon Inspector

Answer

Amazon Inspector automatically assesses EC2 instances and container images for software vulnerabilities and unintended network exposure.

Question 5

Which AWS Organizations feature allows central governance by setting guardrails that restrict what actions can be performed in member accounts?

Accepted Answer

Service control policies (SCPs)

Answer

Service Control Policies (SCPs) in AWS Organizations set maximum available permissions for all accounts in an organizational unit or the entire organization.

DevOps Engineering on AWS Certification Practice Test

DevOps Engineering on AWS Certification Practice Test

DevOps Engineering on AWS Certification Security Automation and Compliance on AWS