Unit 6: The Security Pillar - Practice Quiz

1 What does AWS IAM primarily help you manage?

2 Which of the following is an IAM identity used to group users and assign common permissions?

3 What is the best practice regarding the AWS account root user?

4 What does MFA stand for in the context of securing AWS credentials?

5 Fine-grained authorization in AWS is primarily achieved using which element?

6 In an IAM policy, what does the Effect element typically specify?

7 What is the purpose of an IAM permission boundary?

8 A permission boundary is attached to which type of IAM entity?

9 What is a key characteristic of an IAM role?

10 Which scenario is a common use of an IAM role?

11 Which policy type is used to centrally manage permissions across accounts in an AWS Organization?

12 What is the main goal of detective controls in cloud security?

13 What does AWS CloudTrail primarily record?

14 Amazon CloudWatch Logs is mainly used to:

15 Amazon Athena allows you to query data stored in Amazon S3 using which language?

16 Which AWS service is used to assess, audit, and track resource configurations over time?

17 What is Amazon GuardDuty?

18 Amazon Inspector is primarily used to:

19 What is the main purpose of Amazon Detective?

20 AWS Security Hub provides which of the following?

21 A developer needs to grant an application running on an EC2 instance temporary access to an S3 bucket without embedding long-term credentials. Which IAM feature best fits this requirement?

22 An organization wants to reduce the risk associated with the AWS account root user. Which combination of actions is the most appropriate best practice?

23 You want an IAM policy to allow a user to access only objects within an S3 prefix matching their username. Which IAM feature enables this dynamic condition?

24 A team lead attaches a permissions boundary allowing only S3 and DynamoDB actions to an IAM user. The user also has an identity policy granting full EC2 access. What can the user actually do?

25 An application in Account A needs to read data from an S3 bucket in Account B. What is the standard AWS mechanism to achieve this cross-account access?

26 Which AWS Organizations feature lets you centrally restrict the maximum permissions available to all IAM users and roles across member accounts?

27 A security team wants to detect suspicious activity after it occurs, rather than preventing it. Which category of controls are they implementing?

28 An auditor needs to determine which API call deleted a specific EC2 instance and who made it. Which service provides this information?

29 You want to trigger an alarm when the word ERROR appears more than 5 times per minute in your application logs. Which CloudWatch Logs feature should you use?

30 A company stores large volumes of CloudTrail logs in S3 and wants to run ad-hoc SQL queries over them without provisioning servers. Which service is most appropriate?

31 A compliance officer wants to be notified whenever an S3 bucket is changed to allow public access, and to see how its configuration evolved over time. Which service best meets this need?

32 Which data sources does Amazon GuardDuty analyze to detect threats such as crypto-mining or communication with malicious IPs?

33 A DevOps team wants automated scanning of EC2 instances and container images for software vulnerabilities (CVEs) and unintended network exposure. Which service should they enable?

34 After GuardDuty raises a finding, an analyst needs to visualize linked events and understand the root cause across resources. Which service is purpose-built for this investigation?

35 An organization uses GuardDuty, Inspector, and Macie and wants a single dashboard that aggregates findings and checks against standards like CIS AWS Foundations. Which service provides this?

36 A web server in a public subnet must accept HTTPS traffic but should not initiate outbound connections except for OS updates. Which statement about security groups is correct for this design?

37 Which AWS component is stateless, operates at the subnet boundary, and supports explicit deny rules?

38 A team must ensure that data stored in an S3 bucket is encrypted at rest using keys they can audit and control the rotation of. Which approach fits best?

39 In AWS KMS envelope encryption, how is a large data object typically encrypted efficiently?

40 An IAM policy contains both an Allow for s3:* and an explicit Deny for s3:DeleteObject. What is the net effect when the user tries to delete an object?

41 An IAM policy grants s3:GetObject on arn:aws:s3:::reports/* but includes a condition "StringNotEquals": {"aws:PrincipalTag/dept": "finance"} inside a Deny statement. A user tagged dept=finance attempts to read an object. What is the effective result?

42 A developer has an identity-based policy allowing ec2:* and a permission boundary allowing only ec2:DescribeInstances and s3:GetObject. What actions can the developer actually perform?

43 An EC2 instance uses an instance profile role. An application on it needs to assume a role in another account. Which configuration is required for the cross-account sts:AssumeRole call to succeed?

44 Which approach best eliminates long-lived AWS credentials for an on-premises application that must call AWS APIs?

45 You need an immutable, tamper-evident record of all management events across every region, including validation that logs were not altered. Which CloudTrail configuration achieves this?

46 When querying CloudTrail logs stored in S3 with Athena, which practice most reduces query cost and scan time for queries filtered by date?

47 GuardDuty raises a finding that an EC2 instance is communicating with a known cryptomining domain. Which data source did GuardDuty most likely analyze to detect this?

48 Which statement best distinguishes Amazon Inspector from Amazon GuardDuty?

49 A security analyst has a GuardDuty finding and needs to understand the root cause and scope by visualizing related entities and behavior over time. Which service is purpose-built for this investigation?

50 An organization wants a single pane of glass that aggregates findings from GuardDuty, Inspector, and Macie and measures compliance against CIS benchmarks. Which service provides this?

51 You must detect whenever an S3 bucket's public access configuration changes and automatically remediate it. Which combination accomplishes continuous configuration auditing with remediation?

52 An application uses envelope encryption with AWS KMS. Which statement correctly describes how the data key is handled?

53 A security group allows inbound HTTPS from 0.0.0.0/0, and a network ACL denies inbound from a malicious 203.0.113.0/24. Traffic arrives from that CIDR. What happens?

54 Which mechanism enforces that no IAM principal in any account of an AWS Organization can disable CloudTrail, even if they have administrator permissions?

55 A request is evaluated with an identity-based Allow, a resource-based Allow, an SCP that does not mention the action, and a permission boundary that does not include the action. What is the result for an IAM user in the same account?

56 You want to trigger an alarm when the string UnauthorizedOperation appears more than 3 times in 5 minutes in application logs sent to CloudWatch Logs. Which approach works?

57 An organization must retain full control over the key lifecycle and be able to prove keys were generated in hardware they manage. Which KMS key option fits best?

58 Which classification correctly groups these controls: CloudTrail, Config, and GuardDuty?

59 An S3 bucket policy allows access only when aws:SourceVpce equals a specific VPC endpoint ID. A user with full S3 admin IAM permissions accesses the bucket over the public internet. What happens?

60 A Lambda function assumes an execution role. The role's trust policy specifies lambda.amazonaws.com as principal, but the function fails with an access error when writing to DynamoDB. Where is the problem most likely located?