DevOps Engineering on AWS Certification Security, Compliance, and Governance on AWS DevOps 2 — Questions and Answers
Question 1: Which AWS feature enforces MFA deletion on S3 bucket versioning to prevent accidental or malicious deletion?
- S3 MFA Delete (Correct answer)
- S3 Object Lock
- S3 Bucket Policy
- S3 Versioning
Correct answer: S3 MFA Delete
S3 MFA Delete requires multi-factor authentication to permanently delete object versions or change the versioning state of a bucket.
Question 2: Which AWS service provides a web application firewall to protect against SQL injection and XSS attacks?
- AWS WAF (Correct answer)
- AWS Shield
- AWS Firewall Manager
- Amazon GuardDuty
Correct answer: AWS WAF
AWS WAF is a web application firewall that lets you create rules to block common web exploits like SQL injection and cross-site scripting.
Question 3: Which AWS service allows you to centrally manage and enforce WAF rules, Security Groups, and Shield Advanced protections across multiple accounts?
- AWS Firewall Manager (Correct answer)
- AWS Security Hub
- AWS Organizations
- AWS Control Tower
Correct answer: AWS Firewall Manager
AWS Firewall Manager provides centralized management of firewall rules across accounts in an AWS Organization, ensuring consistent security policies.
Question 4: Which AWS Config rule type uses AWS-managed logic to evaluate resource configurations against best practices?
- AWS managed rules (Correct answer)
- Custom Lambda rules
- Conformance Packs
- Config Aggregators
Correct answer: AWS managed rules
AWS managed rules are pre-built Config rules maintained by AWS that check common compliance and security configurations without requiring custom code.
Question 5: Which AWS service provides a set of prescriptive security controls and a landing zone to govern a multi-account AWS environment?
- AWS Control Tower (Correct answer)
- AWS Organizations
- AWS Config
- AWS Security Hub
Correct answer: AWS Control Tower
AWS Control Tower automates the setup of a multi-account environment with built-in governance guardrails using AWS Organizations, Config, and other services.
Question 6: Which IAM concept defines the maximum permissions an IAM entity can have, regardless of what policies are attached to it?
- Permission Boundary (Correct answer)
- Service Control Policy
- Resource Policy
- Session Policy
Correct answer: Permission Boundary
Permission Boundaries set the maximum permissions that an IAM user or role can have, even if their attached policies grant broader access.
DevOps Engineering on AWS Certification Security, Compliance, and Governance on AWS DevOps 2
Which AWS feature enforces MFA deletion on S3 bucket versioning to prevent accidental or malicious deletion?