Back to Subject

Unit 4: Authentication and Authorization — AWS (IAM); CloudTrail, CloudWatch, and AWS Config - Practice Quiz

CSC301 — Introduction To Cloud Computing 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 What does the acronym IAM stand for in AWS?

Introduction to IAM Easy
A. Integrated Account Manager
B. Identity and Access Management
C. Infrastructure and Application Management
D. Internet Access Monitoring

2 Which of the following is an example of an IAM identity?

IAM Identities Easy
A. VPC Subnet
B. S3 Bucket
C. IAM User
D. EC2 Instance

3 In what format are IAM policies most commonly written?

IAM Policies Easy
A. YAML only
B. JSON
C. CSV
D. Binary

4 What does an IAM user primarily represent?

IAM Users Easy
A. A person or application that interacts with AWS
B. A physical server in a data center
C. A billing invoice for AWS services
D. A network firewall rule

5 What is the main purpose of an IAM group?

IAM Groups Easy
A. To attach permissions to multiple users at once
B. To encrypt network traffic
C. To launch virtual machines
D. To store data objects in the cloud

6 Which statement best describes an IAM role?

IAM Roles Easy
A. A permanent password for the root account
B. A storage bucket for log files
C. An identity with permissions that can be assumed temporarily
D. A billing alert for cost control

7 What is Amazon Cognito mainly used for?

Amazon Cognito Easy
A. Storing large datasets in warehouses
B. Monitoring EC2 instance CPU usage
C. Managing DNS records
D. User sign-up, sign-in, and access control for apps

8 AWS Managed Microsoft AD provides a managed version of which directory service?

AWS Managed Microsoft AD Easy
A. Microsoft Active Directory
B. Oracle Database
C. Linux LDAP only
D. Google Workspace

9 What is the primary benefit of AWS Single Sign-On (SSO)?

AWS single Sign-on Easy
A. Access multiple AWS accounts and apps with one login
B. Generate database backups
C. Automatically patch operating systems
D. Compress files before storage

10 What is AWS Key Management Service (KMS) used for?

AWS Key Management Service Easy
A. Creating and managing encryption keys
B. Load balancing traffic
C. Monitoring API calls
D. Hosting static websites

11 Which type of information is AWS Secrets Manager designed to store?

AWS Secrets Manager Easy
A. CloudWatch dashboards
B. Virtual machine images
C. Network routing tables
D. Database credentials and API keys

12 What does the HSM in AWS CloudHSM stand for?

AWS Cloud HSM Easy
A. Hybrid Storage Manager
B. Hosted Server Monitor
C. Hardware Security Module
D. High Speed Memory

13 What is the primary function of AWS CloudTrail?

CloudTrail Easy
A. Managing user passwords
B. Delivering content globally
C. Recording API calls and account activity
D. Scaling EC2 instances automatically

14 In CloudTrail, management events typically capture which kind of operations?

Management Events Easy
A. User login screen colors
B. Network packet contents
C. Only read operations on S3 objects
D. Control plane operations like creating resources

15 Data events in CloudTrail provide visibility into which type of activity?

Data Events Easy
A. DNS zone transfers
B. Billing and payment history
C. IAM group creation
D. Resource-level operations such as S3 object access

16 What does CloudTrail log file integrity validation help you verify?

Log File Integrity Validation Easy
A. Whether log files were modified or deleted
B. The cost of running services
C. The region of a VPC
D. The CPU usage of instances

17 What is Amazon CloudWatch primarily used for?

CloudWatch Easy
A. Encrypting S3 buckets
B. Storing relational databases
C. Monitoring resources and applications
D. Managing IAM users

18 What does a CloudWatch alarm do when a metric crosses a defined threshold?

CloudWatch Alarms Easy
A. Deletes the monitored resource
B. Creates a new AWS account
C. Encrypts the metric data
D. Triggers an action or notification

19 Amazon EventBridge is best described as what type of service?

Amazon Event Bridge Easy
A. A serverless event bus for connecting applications
B. A relational database engine
C. A file storage system
D. A virtual private network

20 What is the main purpose of AWS Config?

AWS Config Easy
A. Compressing data for backups
B. Running containerized applications
C. Tracking resource configurations and changes
D. Delivering email notifications

21 An EC2 instance needs to read objects from an S3 bucket without storing long-term credentials on the instance. What is the recommended IAM approach?

IAM Roles Medium
A. Use the root account credentials
B. Attach an IAM role to the instance
C. Store an access key in the user data script
D. Create an IAM user and embed its keys

22 In an IAM policy, if an explicit Allow and an explicit Deny both apply to the same action, what is the result?

IAM Policies Medium
A. Access is allowed
B. Access is denied
C. The policy is invalid
D. Access is logged but allowed

23 A company wants to grant the same set of permissions to 50 developers efficiently. What is the best practice?

IAM Groups Medium
A. Create one shared IAM user for all developers
B. Use the root account for all developers
C. Attach the policy to an IAM group and add users to it
D. Attach the policy to each user individually

24 A mobile app needs to let users sign in with Google and Facebook and receive temporary AWS credentials. Which service feature handles this?

Amazon Cognito Medium
A. CloudTrail event federation
B. Cognito Identity Pools with federated identities
C. AWS Managed Microsoft AD
D. IAM Groups with external keys

25 Which statement best describes how AWS KMS handles encryption of large S3 objects efficiently?

AWS Key Management Service Medium
A. It uses the CMK private key on the client
B. It stores objects unencrypted and hashes them
C. It encrypts the whole object directly with the CMK
D. It uses envelope encryption with a data key

26 What capability distinguishes AWS Secrets Manager from simply storing credentials in Parameter Store?

AWS Secrets Manager Medium
A. Built-in load balancing
B. Automatic data compression
C. Automatic rotation of secrets
D. Free unlimited storage

27 An organization requires single-tenant, FIPS 140-2 Level 3 validated hardware where they fully control the keys. Which service fits best?

AWS Cloud HSM Medium
A. AWS KMS multi-tenant keys
B. AWS Secrets Manager
C. Amazon Cognito
D. AWS CloudHSM

28 A security team wants a record of every API call made in their AWS account across all regions. Which configuration should they use?

CloudTrail Medium
A. A multi-region CloudTrail trail
B. AWS Config snapshots
C. A single-region trail only
D. CloudWatch metric filters

29 Which of the following is logged as a CloudTrail data event rather than a management event?

Data Events Medium
A. S3 GetObject on a specific object
B. Creating an IAM user
C. Launching an EC2 instance
D. Modifying a security group

30 How long does CloudTrail Event History retain viewable activity by default without creating a trail?

Event History Medium
A. 30 days
B. 1 year
C. 90 days
D. 7 days

31 What does CloudTrail log file integrity validation primarily allow you to verify?

Log File Integrity Validation Medium
A. That logs are compressed correctly
B. That logs are encrypted at rest
C. That logs were not modified or deleted after delivery
D. That API calls were successful

32 By default, standard CloudWatch monitoring for EC2 delivers metrics at what interval?

CloudWatch Metrics Medium
A. 5 minutes
B. 15 minutes
C. 10 seconds
D. 1 minute

33 You want to trigger an action only when average CPU exceeds 80% for 3 consecutive 5-minute periods. Which CloudWatch alarm settings achieve this?

CloudWatch Alarms Medium
A. Threshold 80%, period 15 min, evaluation periods 1
B. Threshold 80%, period 5 min, evaluation periods 3
C. Threshold 240%, period 5 min, evaluation periods 1
D. Threshold 80%, period 1 min, evaluation periods 3

34 To extract numeric values from application log lines and turn them into a CloudWatch metric, what should you create?

CloudWatch Logs Medium
A. A CloudTrail trail
B. A metric alarm directly on text
C. A metric filter
D. A log group alias

35 Which capability makes Amazon EventBridge preferable over basic CloudWatch Events for integrating with external SaaS applications?

Amazon Event Bridge Medium
A. Built-in HSM support
B. Support for third-party SaaS event sources via partner event buses
C. Automatic log encryption
D. Lower per-metric cost

36 An auditor asks whether all EBS volumes have been encrypted at every point in time over the last month. Which service answers this best?

AWS Config Medium
A. AWS Config with configuration history
B. CloudWatch metrics
C. Amazon Cognito
D. CloudTrail Event History

37 In AWS Config, what does a Configuration Item (CI) represent?

Configuration Items Medium
A. A billing line item
B. A CloudWatch alarm state
C. A real-time API call log
D. A point-in-time snapshot of a resource's attributes

38 If the AWS Config configuration recorder is stopped, what happens?

Configuration Recorder Medium
A. New configuration changes are no longer recorded
B. CloudTrail stops logging
C. Existing data is deleted immediately
D. Compliance rules still auto-remediate

39 A company with multiple AWS accounts under Organizations wants employees to use one login to access all accounts. Which service is designed for this?

AWS single Sign-on Medium
A. Amazon Cognito user pools
B. AWS Secrets Manager
C. AWS IAM Identity Center (AWS SSO)
D. AWS CloudHSM

40 Which of the following is NOT considered an IAM identity that permissions can be attached to?

IAM Identities Medium
A. An IAM role
B. An IAM user
C. An IAM group
D. A CloudWatch alarm

41 An IAM user belongs to a group with an attached policy that allows s3:DeleteObject on a bucket. The user also has an inline policy that explicitly denies s3:DeleteObject on the same bucket. Additionally, a resource-based bucket policy allows s3:DeleteObject for that user. What is the effective permission?

IAM Policies Hard
A. The delete is denied because an explicit deny overrides any allow
B. The delete is allowed because the resource-based policy grants it
C. The delete is allowed because inline policies are evaluated last
D. The delete is allowed because group and bucket policies outnumber the deny

42 An EC2 instance needs temporary credentials to call AWS APIs. Which mechanism provides these credentials securely without embedding long-term keys, and how are the credentials delivered?

IAM Roles Hard
A. An IAM user with access keys stored in the instance's environment variables
B. An IAM group assigned directly to the EC2 instance at launch
C. An IAM role via an instance profile, with credentials retrieved from the instance metadata service
D. A resource-based policy attached directly to the EC2 instance ARN

43 A policy's Condition block uses aws:MultiFactorAuthPresent set to true with a BoolIfExists operator. What behavior does BoolIfExists introduce compared to Bool?

IAM Identities Hard
A. It forces MFA to always be present or the request is denied
B. It allows the request if the MFA key is absent, and evaluates the boolean only when the key exists
C. It applies the condition only to federated identities and ignores IAM users
D. It converts the boolean to a numeric comparison for long-term credentials

44 A team wants to use the same KMS encryption key material across multiple AWS Regions for a global DynamoDB table. Which KMS feature satisfies this while keeping identical key material?

AWS Key Management Service Hard
A. Multi-Region keys, which share the same key ID and key material across replicas
B. Importing external key material separately into each Region's independent key
C. Enabling automatic key rotation on a single-Region CMK
D. KMS key aliases, which automatically synchronize ciphertext across Regions

45 An organization notices that API calls to an S3 object are not appearing in CloudTrail Event History. The management events trail is enabled. What is the most likely reason?

CloudTrail Hard
A. CloudTrail does not support S3 logging without AWS Config enabled
B. Event History only retains events for 24 hours, so they expired
C. S3 object-level operations are data events, which are not logged by default and must be explicitly enabled
D. Management events must be disabled before data events can appear

46 CloudTrail log file integrity validation produces a digest file. How does it allow you to detect whether a delivered log file was modified or deleted after delivery?

Log File Integrity Validation Hard
A. CloudWatch Alarms automatically re-hash files every hour to detect drift
B. Each log file is encrypted with a rotating KMS key that fails decryption if altered
C. Each digest file contains SHA-256 hashes of log files and is signed, and digests chain to the previous digest
D. The digest file stores a plaintext copy of each log for byte comparison

47 A CloudWatch alarm is configured with Evaluation Periods = 3, Datapoints to Alarm = 2, and a period of 5 minutes. What triggers the alarm state?

CloudWatch Alarms Hard
A. 2 consecutive breaching datapoints within a single 5-minute period
B. 3 breaching datapoints followed by 2 recovery datapoints
C. 3 consecutive breaching datapoints over 15 minutes
D. 2 breaching datapoints within any sliding window of the last 3 periods

48 In Amazon Cognito, what is the key functional difference between a User Pool and an Identity Pool when a mobile app needs both sign-in and temporary AWS credentials?

Amazon Cognito Hard
A. Both perform identical functions, and only one can be used at a time
B. The User Pool issues IAM access keys while the Identity Pool stores passwords
C. The Identity Pool authenticates users; the User Pool grants temporary AWS credentials
D. The User Pool authenticates and issues tokens; the Identity Pool exchanges tokens for temporary AWS credentials

49 AWS Secrets Manager is configured for automatic rotation of an RDS database credential using the 'single user' rotation strategy. During rotation, what risk exists that the 'multi-user' strategy mitigates?

AWS Secrets Manager Hard
A. The KMS key used to encrypt the secret is rotated simultaneously
B. The Lambda rotation function cannot connect to the database at all
C. The secret is permanently deleted if rotation fails midway
D. A brief window where the old password is invalidated before clients fetch the new one, causing failures

50 An enterprise requires FIPS 140-2 Level 3 single-tenant hardware with exclusive control over cryptographic key material, where AWS cannot access the keys. Which service meets this and what is a key operational implication?

AWS Cloud HSM Hard
A. IAM roles with MFA; cryptographic operations are offloaded to STS
B. AWS Secrets Manager; keys are stored in a shared multi-tenant vault
C. AWS KMS with a custom key store; AWS manages all backups automatically
D. AWS CloudHSM; the customer is solely responsible for key durability and must manage HSM cluster backups

51 AWS Config evaluates a custom rule written as a Lambda function. The rule should re-evaluate whenever a security group's inbound rules change. Which trigger type must the rule use to achieve near-real-time evaluation?

AWS Config Hard
A. CloudTrail event trigger with data event logging enabled
B. Periodic trigger set to a 1-minute interval for continuous polling
C. Configuration changes trigger, which invokes the rule when a configuration item is recorded
D. Snapshot trigger that fires only during daily configuration snapshots

52 An organization uses AWS IAM Identity Center (AWS SSO) with permission sets to grant access across multiple accounts. What AWS resource is actually provisioned in each target account when a permission set is assigned?

AWS single Sign-on Hard
A. A standalone IAM group synced from the external directory
B. A new IAM user per permission set with console password
C. A resource-based policy attached to every account's root
D. An IAM role that Identity Center creates and manages, assumed by the federated user

53 A company enables CloudTrail data event logging for a Lambda function and an S3 bucket. Why might this significantly increase cost compared to management events, and how is it priced?

Data Events Hard
A. Data events force all trails into multi-Region mode doubling charges
B. Data events require a dedicated KMS key billed hourly
C. Data events are stored in CloudWatch Logs which bills per alarm
D. Data events are high-volume and charged per event, unlike the first copy of management events which is free

54 By default, EC2 sends metrics to CloudWatch at 5-minute intervals (basic monitoring). A team needs 1-minute granularity and also sub-minute custom application metrics. Which combination is correct?

CloudWatch Metrics Hard
A. Use basic monitoring with CloudWatch Alarms set to 1-second periods
B. Custom metrics cannot go below 1 minute regardless of configuration
C. Enable detailed monitoring for 1-minute EC2 metrics and publish custom high-resolution metrics at 1-second granularity
D. Enable detailed monitoring, which provides 1-second EC2 metrics automatically

55 An EventBridge rule must match CloudTrail events only when an S3 bucket is made public (a specific PutBucketPolicy outcome). Which EventBridge feature evaluates the event JSON structure to decide a match?

Amazon Event Bridge Hard
A. A metric filter applied to CloudWatch Logs streams
B. An IAM condition key attached to the event bus policy
C. An event pattern that filters on specific fields and values within the event payload
D. A scheduled cron expression evaluated every minute

56 In AWS Config, what precisely does a Configuration Item (CI) represent, and what triggers the creation of a new CI?

Configuration Items Hard
A. A point-in-time snapshot of a resource's attributes, relationships, and metadata, created on any change
B. A continuous live stream of CloudTrail API calls for a resource
C. A billing record tracking the cost of a resource over time
D. A static template defining the desired state of a resource

57 A permissions boundary is attached to an IAM user granting only s3:*. The user's identity-based policy allows s3:* and ec2:*. What can the user actually do?

IAM Policies Hard
A. Both S3 and EC2 actions, because identity policies override boundaries
B. Only EC2 actions, because boundaries exclude listed services
C. Only S3 actions, because effective permissions are the intersection of the boundary and identity policy
D. Nothing, because a boundary and policy conflict results in implicit deny

58 A metric filter on a CloudWatch Logs group counts occurrences of the term ERROR. The log group receives data, and ERROR lines appear, but the derived metric shows no datapoints for periods with no matches. Why?

CloudWatch Logs Hard
A. Metric filters require an attached alarm before publishing any datapoints
B. The log group retention must be set to 'never expire' for metrics to appear
C. Metric filters only work on exported logs stored in S3
D. Metric filters only publish datapoints when a match occurs; absent matches produce no data unless a default value is set

59 An organization-wide trail is created in the management account using AWS Organizations. A member account administrator wants to delete this trail from within their account. What happens?

Trails Hard
A. They can convert it to a single-account trail without restrictions
B. They can modify it but changes apply to all member accounts
C. They can delete it, which stops logging only for their account
D. They cannot delete or modify it; organization trails are managed only from the management account

60 A company runs AWS Managed Microsoft AD and wants on-premises AD users to access AWS resources without recreating accounts, while keeping passwords on-premises. Which configuration achieves this?

AWS Managed Microsoft AD Hard
A. Enable AD Connector in place of AWS Managed Microsoft AD for full directory replication
B. Replace the on-premises AD with a Simple AD in the cloud
C. Export on-premises password hashes into Cognito User Pools
D. Establish a trust relationship between AWS Managed Microsoft AD and the on-premises AD domain
Previous MCQ
Unit 3
Next MCQ
Unit 5