Back to Subject
View Notes

Unit 1 - Practice Quiz

INT364

1 Which component of the AWS Global Infrastructure consists of one or more discrete data centers with redundant power, networking, and connectivity?

A. AWS Region
B. Availability Zone
C. Edge Location
D. Local Zone

2 Which factor should primarily be considered when choosing an AWS Region to reduce latency for end-users?

A. Cost of services
B. Proximity to the end-users
C. Number of Availability Zones
D. Compliance requirements

3 What is the primary function of AWS Edge Locations?

A. To host EC2 instances
B. To provide low-latency content delivery via CloudFront
C. To store cold data archives
D. To manage IAM policies

4 Which pillar of the AWS Well-Architected Framework focuses on the ability to run and monitor systems to deliver business value and to continually improve processes and procedures?

A. Security
B. Reliability
C. Operational Excellence
D. Performance Efficiency

5 Which design principle is recommended by the AWS Well-Architected Framework regarding capacity planning?

A. Guess capacity needs based on averages
B. Stop guessing capacity needs
C. Always over-provision to ensure performance
D. Manually adjust capacity once a month

6 In the Shared Responsibility Model, which of the following is the customer's responsibility?

A. Physical security of data centers
B. Patching the underlying host infrastructure
C. Client-side data encryption
D. decommissioning storage devices

7 What is the primary purpose of AWS Identity and Access Management (IAM)?

A. To manage DNS records
B. To securely control access to AWS services and resources
C. To monitor network traffic
D. To deploy applications

8 Which IAM entity represents a person or service that interacts with AWS?

A. IAM Policy
B. IAM Group
C. IAM User
D. IAM Role

9 What is the recommended best practice for the AWS account root user?

A. Use it for daily administrative tasks
B. Share the password with the development team
C. Enable Multi-Factor Authentication (MFA) and lock away credentials
D. Create access keys for the root user for API access

10 Which IAM feature allows you to associate permissions with a collection of users?

A. IAM Role
B. IAM Group
C. IAM Policy
D. Access Key

11 What format are IAM policies written in?

A. XML
B. YAML
C. JSON
D. HTML

12 Which principle suggests granting only the permissions required to perform a task?

A. Principle of Maximum Authority
B. Principle of Least Privilege
C. Principle of Root Access
D. Principle of Shared Responsibility

13 An IAM Role is best described as:

A. A permanent identity with long-term credentials
B. An identity with permission policies that can be assumed by a user or service
C. A group of users with shared permissions
D. A document defining password policies

14 What is the default effect of an IAM policy if no Allow or Deny is explicitly stated?

A. Implicit Allow
B. Implicit Deny
C. Explicit Deny
D. Conditional Allow

15 Which AWS service enables you to manage access across multiple AWS accounts centrally?

A. AWS Organizations
B. Amazon Inspector
C. AWS Config
D. Amazon CloudWatch

16 What mechanism allows users from an external identity provider (IdP) like Active Directory to access AWS resources without creating IAM users?

A. IAM Groups
B. Identity Federation
C. Access Keys
D. MFA

17 Which industry standard is commonly used for federating users into AWS?

A. HTML5
B. SAML 2.0
C. HTTP
D. FTP

18 To allow an application running on an EC2 instance to access an S3 bucket securely, what should you configure?

A. Embed Access Keys in the application code
B. Attach an IAM Role to the EC2 instance
C. Create a new IAM User for the instance
D. Make the S3 bucket public

19 Which API call is used to obtain temporary security credentials when assuming a role?

A. sts:GetSessionToken
B. sts:AssumeRole
C. iam:CreateUser
D. iam:GetRole

20 What is the primary service used for creating and managing cryptographic keys in AWS?

A. AWS Secrets Manager
B. AWS Shield
C. AWS Key Management Service (KMS)
D. Amazon Macie

21 Which type of encryption protects data while it is stored on a disk?

A. Encryption in Transit
B. Encryption at Rest
C. End-to-End Encryption
D. SSL/TLS

22 What does Server-Side Encryption (SSE) on Amazon S3 imply?

A. The user encrypts data before uploading
B. AWS encrypts the data after it is received and before saving it to disk
C. The data is encrypted during transfer over the internet only
D. AWS stores the encryption keys on the user's computer

23 Which AWS service protects against Distributed Denial of Service (DDoS) attacks?

A. AWS WAF
B. AWS Shield
C. Amazon Inspector
D. AWS Artifact

24 Which service helps protect your web applications from common web exploits like SQL injection and cross-site scripting?

A. AWS Shield
B. AWS WAF
C. AWS Firewall Manager
D. Amazon GuardDuty

25 Amazon GuardDuty is best described as:

A. A firewall for EC2 instances
B. An automated vulnerability assessment service
C. An intelligent threat detection service
D. A compliance reporting tool

26 Which service automatically discovers, classifies, and protects sensitive data (like PII) in AWS?

A. Amazon Macie
B. Amazon Inspector
C. AWS Config
D. AWS Secrets Manager

27 Which service is used to assess applications for exposure, vulnerabilities, and deviations from best practices?

A. Amazon Inspector
B. AWS Trusted Advisor
C. AWS Shield
D. AWS WAF

28 What does the 'Sustainability' pillar of the Well-Architected Framework focus on?

A. Reducing cost
B. Minimizing the environmental impacts of running cloud workloads
C. Ensuring high availability
D. Managing access controls

29 Which AWS service records API calls for your account and delivers log files to you?

A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS X-Ray
D. AWS Config

30 In IAM, what is the 'PowerUserAccess' managed policy?

A. Full access to all services including IAM
B. Full access to all services excluding IAM management
C. Read-only access to all services
D. Access to billing information only

31 What feature allows you to grant cross-account access to S3 resources explicitly within the S3 service?

A. Bucket Policies
B. Security Groups
C. NACLs
D. Service Control Policies

32 Which cryptographic method uses a public key for encryption and a private key for decryption?

A. Symmetric encryption
B. Asymmetric encryption
C. Hashing
D. Obfuscation

33 What is 'Envelope Encryption'?

A. Encrypting the email used to send keys
B. Encrypting plaintext data with a data key, then encrypting the data key with a master key
C. Wrapping a physical hard drive in a secure envelope
D. Encrypting data only at the network edge

34 Which AWS feature can be used to ensure that EBS volumes created by users are always encrypted?

A. AWS Config Rules
B. IAM Roles
C. VPC Flow Logs
D. EBS Snapshots

35 When designing for failure in the Cloud, what is a key concept?

A. Single point of failure
B. Tightly coupled components
C. Decoupling components
D. Vertical scaling only

36 What is the purpose of Service Control Policies (SCPs) in AWS Organizations?

A. To grant permissions to IAM users
B. To define the maximum available permissions for member accounts
C. To configure firewall rules
D. To manage encryption keys

37 Which credential is required for programmatic access to AWS via the CLI?

A. User Name and Password
B. Access Key ID and Secret Access Key
C. MFA Token only
D. SSH Key Pair

38 What is the function of AWS Secrets Manager?

A. To store IAM user passwords
B. To rotate, manage, and retrieve database credentials and API keys
C. To encrypt EBS volumes
D. To firewall web applications

39 Which pillar of the Well-Architected Framework focuses on the ability to prevent financial loss?

A. Cost Optimization
B. Reliability
C. Security
D. Performance Efficiency

40 Which security service provides on-demand access to AWS compliance reports (e.g., SOC, PCI)?

A. AWS Artifact
B. AWS Config
C. Amazon Inspector
D. AWS Shield

41 In IAM, what is the 'Principal' in a policy statement?

A. The action being performed
B. The resource being accessed
C. The entity (user/role) allowed or denied access
D. The condition under which access is granted

42 What is the difference between a Security Group and a Network ACL (NACL)?

A. Security Groups are stateless; NACLs are stateful
B. Security Groups act at the subnet level; NACLs act at the instance level
C. Security Groups are stateful; NACLs are stateless
D. There is no difference

43 Which AWS service allows you to manage encryption keys in a dedicated, single-tenant hardware security module (HSM)?

A. AWS KMS
B. AWS CloudHSM
C. AWS Secrets Manager
D. Amazon S3

44 How often should IAM Access Keys be rotated according to best practices?

A. Never
B. Once every 10 years
C. Regularly
D. Only when a breach occurs

45 Which IAM tool helps you identify unused credentials and excessive permissions?

A. IAM Credential Report / Access Analyzer
B. AWS Cost Explorer
C. AWS CloudFormation
D. Route 53

46 If an explicit Deny and an explicit Allow exist for the same request, which one takes precedence?

A. Explicit Allow
B. Explicit Deny
C. The most recent policy
D. The policy with the most permissions

47 Which is a valid use case for Web Identity Federation?

A. Authenticating users via Google or Facebook to access AWS resources
B. Connecting an on-premise data center to VPC
C. Encrypting S3 buckets
D. Managing EC2 instances

48 What is the 'Condition' element in an IAM JSON policy used for?

A. To define who can access the resource
B. To specify the resource ARN
C. To specify circumstances under which the policy grants permission
D. To list the allowed actions

49 Which service acts as a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads?

A. Amazon GuardDuty
B. AWS WAF
C. AWS Shield
D. Amazon Macie

50 What type of scaling is described as adding more power (CPU, RAM) to an existing machine?

A. Horizontal Scaling
B. Vertical Scaling
C. Diagonal Scaling
D. Auto Scaling