DevOps Engineering on AWS Certification Security, Compliance, and Governance on AWS DevOps 1 — Questions and Answers
Question 1: Which AWS service manages encryption keys used to protect data at rest and in transit across AWS services?
- AWS Key Management Service (KMS) (Correct answer)
- AWS Certificate Manager
- AWS Secrets Manager
- AWS CloudHSM
Correct answer: AWS Key Management Service (KMS)
AWS KMS is a managed service that creates and controls the cryptographic keys used to encrypt your data, integrating with most AWS services.
Question 2: Which AWS service automatically rotates database credentials, API keys, and other secrets on a configurable schedule?
- AWS Secrets Manager (Correct answer)
- AWS Systems Manager Parameter Store
- AWS KMS
- AWS Certificate Manager
Correct answer: AWS Secrets Manager
AWS Secrets Manager automatically rotates secrets on a defined schedule by invoking a Lambda function, eliminating hardcoded credentials.
Question 3: Which IAM feature allows you to grant temporary, limited access to AWS resources without sharing long-term credentials?
- IAM Roles (Correct answer)
- IAM Users
- IAM Groups
- IAM Policies
Correct answer: IAM Roles
IAM Roles provide temporary security credentials via AWS STS, allowing entities to assume permissions without needing permanent access keys.
Question 4: Which AWS service provides threat detection by analyzing CloudTrail, VPC Flow Logs, and DNS logs using ML?
- Amazon GuardDuty (Correct answer)
- AWS Security Hub
- Amazon Inspector
- AWS Macie
Correct answer: Amazon GuardDuty
Amazon GuardDuty continuously monitors CloudTrail, VPC Flow Logs, and DNS logs using machine learning to detect malicious activity and unauthorized behavior.
Question 5: Which AWS service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?
- Amazon Inspector (Correct answer)
- Amazon GuardDuty
- AWS Security Hub
- AWS Config
Correct answer: Amazon Inspector
Amazon Inspector automatically discovers and scans EC2 workloads and container images for software vulnerabilities and network reachability issues.
Question 6: Which AWS policy type can be applied to an entire AWS Organization or OU to restrict the maximum permissions available to member accounts?
- Service Control Policy (SCP) (Correct answer)
- IAM Permission Boundary
- Resource-based Policy
- IAM Role Trust Policy
Correct answer: Service Control Policy (SCP)
Service Control Policies in AWS Organizations define the maximum available permissions for accounts and OUs, acting as guardrails that cannot be overridden.
DevOps Engineering on AWS Certification Security, Compliance, and Governance on AWS DevOps 1
Which AWS service manages encryption keys used to protect data at rest and in transit across AWS services?