DevOps Engineering on AWS Certification Security, Compliance, and Governance on AWS DevOps

Question 1

Which AWS service manages encryption keys used to protect data at rest and in transit across AWS services?

Accepted Answer

AWS Key Management Service (KMS)

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 2

Which AWS service automatically rotates database credentials, API keys, and other secrets on a configurable schedule?

Accepted Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Answer

AWS KMS

Answer

AWS Certificate Manager

Question 3

Which IAM feature allows you to grant temporary, limited access to AWS resources without sharing long-term credentials?

Accepted Answer

IAM Roles

Answer

IAM Users

Answer

IAM Groups

Answer

IAM Policies

Question 4

Which AWS service provides threat detection by analyzing CloudTrail, VPC Flow Logs, and DNS logs using ML?

Accepted Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Macie

Question 5

Which AWS service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?

Accepted Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS Config

Question 6

Which AWS policy type can be applied to an entire AWS Organization or OU to restrict the maximum permissions available to member accounts?

Accepted Answer

Service Control Policy (SCP)

Answer

IAM Permission Boundary

Answer

Resource-based Policy

Answer

IAM Role Trust Policy