Unit 4: AWS Fundamentals - Practice Quiz

1 What is an AWS Region?

2 What is an AWS Availability Zone?

3 Why might an application use resources in multiple Availability Zones?

4 What is a common purpose of AWS edge locations?

5 Which AWS service belongs primarily to the compute category?

6 Which AWS service is primarily used for object storage?

7 Which AWS service is a managed relational database service?

8 What is the AWS Management Console?

9 What can a user do from the AWS Management Console?

10 What is commonly used to find a service in the AWS Management Console?

11 Under the AWS Shared Responsibility Model, AWS is responsible for security of the cloud. What does this include?

12 Under the AWS Shared Responsibility Model, what is generally a customer responsibility?

13 For an Amazon EC2 instance, who is generally responsible for patching the guest operating system?

14 What is the main purpose of AWS Identity and Access Management (IAM)?

15 What does an IAM user usually represent?

16 What is an IAM group?

17 What does the principle of least privilege mean?

18 What does multi-factor authentication (MFA) add to an AWS sign-in?

19 Which practice is recommended for the AWS account root user?

20 Which password practice improves AWS account security?

21 A company must deploy an application in one AWS Region and keep it available if a single data center fails. Which architecture best meets this requirement?

22 A website stores static images in Amazon S3, but users around the world experience high latency. Which AWS infrastructure component should be used to improve delivery speed?

23 A business must keep customer data within a particular country because of regulatory requirements. Which factor should primarily guide its AWS deployment decision?

24 Two application servers require low-latency communication but must remain in separate failure domains. Where should they be deployed?

25 An application must run code whenever a file is uploaded to Amazon S3, without requiring the company to manage servers. Which compute service is most appropriate?

26 A team needs a managed relational database with automated backups and support for SQL transactions. Which AWS service best fits these requirements?

27 An order-processing application needs a message queue so that its web tier and worker tier can operate independently. Which service category and service should be selected?

28 An administrator created an EC2 instance in eu-west-1, but it does not appear after the administrator signs in to the AWS Management Console. What should be checked first?

29 An administrator wants to run AWS CLI commands from a browser without installing local tools or manually configuring credentials. Which console feature should be used?

30 A user signed in to one AWS account must administer resources in another account without using another password. The required trust and permissions already exist. Which console action should the user take?

31 A company runs an application on Amazon EC2. Who is responsible for installing security updates for the guest operating system?

32 A publicly accessible Amazon S3 bucket exposes confidential files. Under the Shared Responsibility Model, who is primarily responsible for correcting the bucket permissions?

33 A company uses Amazon RDS for a production database. Which task remains the company's responsibility?

34 An EC2 application needs permission to read objects from one S3 bucket. Which approach follows IAM security best practices?

35 An IAM user has an Allow policy for Amazon S3, but another applicable policy explicitly denies s3:DeleteObject. What happens when the user tries to delete an object?

36 Twenty developers require the same read-only permissions for several AWS services. What is the most manageable IAM solution?

37 A company wants administrators to perform sensitive IAM actions only when they have authenticated with MFA. Which IAM mechanism can enforce this requirement?

38 Which action most effectively improves the security of an AWS account's root user?

39 A developer accidentally publishes an IAM access key in a public repository. What should the security team do first?

40 A security team needs a durable record of API activity across all enabled AWS Regions for later investigation. Which solution is most appropriate?

41 A workload runs on EC2 instances in two Availability Zones behind an Application Load Balancer. Its database uses a single EC2 instance with EBS volumes in one Availability Zone. Which failure remains a single point of failure despite the multi-AZ application tier?

42 A company must keep application data in eu-west-1, but administrators need one identity system for accessing workloads in several AWS Regions. Which design best matches AWS service scope?

43 Users worldwide download static objects from an S3 bucket in one Region. The company needs lower latency without creating writable bucket replicas. Which infrastructure component should primarily serve the cached objects?

44 An auditor asks both who changed a security group yesterday and whether that group has violated an approved configuration rule over time. Which pairing directly addresses both questions?

45 A checkout service experiences unpredictable traffic spikes, while an order processor must consume requests at a controlled rate and retry transient failures. Which service category and service best fit the decoupling requirement?

46 An AWS Organizations administrator attaches an SCP that allows only Amazon S3 actions to a member account. A new IAM user in that account has no identity-based policies. What S3 access does the user receive from the SCP?

47 An IAM administrator with AdministratorAccess signs in to a member account, but the console denies creation of an internet gateway. CloudTrail confirms the same principal made the request. Which control can still explain the denial?

48 An engineer opens AWS CloudShell from the console in us-east-1, creates a file in the home directory, and later opens CloudShell in eu-west-1. The command credentials work, but the file is absent. What best explains this behavior?

49 A user can sign in to the AWS Management Console and view EC2 instances but receives AccessDenied when stopping one. Which statement is most accurate?

50 A company runs an unsupported Linux version on Amazon EC2. An attacker exploits an unpatched guest operating system vulnerability, although AWS has patched the physical host and hypervisor. Under the shared responsibility model, who was responsible for the missed guest patch?

51 A team uses Amazon RDS for PostgreSQL with automatic minor version upgrades enabled. Which task remains primarily the customer's responsibility?

52 An S3 bucket uses server-side encryption with Amazon S3 managed keys (SSE-S3), but a public bucket policy exposes confidential objects. Which responsibility was not fulfilled?

53 Two teams run the same container image: one on Amazon ECS using EC2 launch type and one on AWS Fargate. Which responsibility differs between the deployments?

54 A user has an identity policy allowing s3:GetObject on arn:aws:s3:::reports/*. The bucket policy also allows the action, but a permissions boundary explicitly denies it. What is the result?

55 A Lambda function's execution role allows dynamodb:PutItem, but the function receives an error stating that it cannot assume the role during startup. What should be checked first?

56 A role's identity policy allows all Amazon S3 and DynamoDB actions. Its permissions boundary allows only Amazon S3 actions. An SCP allows both services. Assuming no other policies apply, which effective permissions can the role receive?

57 A company uses ABAC so developers may terminate EC2 instances only when the instance's project tag matches the developer's principal tag. Which IAM comparison expresses the intended condition?

58 An organization has created administrative IAM roles and no longer uses the member account root users operationally. Which remaining action most reduces root credential risk?

59 A third-party monitoring vendor assumes the same role name in many customer accounts. Which control most directly reduces the confused deputy risk when the vendor accesses your account?

60 A security team needs emergency administrative access if its identity provider is unavailable. Which design best preserves both recoverability and accountability?