AWS Cloud Practitioner: Security and Compliance

23 questions with the correct answer and an explanation for each. Topic: Security and Compliance. Free, no account needed.

These questions are written from AWS’s published exam guide and service documentation. They are not real exam questions — nobody who has sat the exam may reproduce those, and any site offering them is putting your certification at risk.

Take this test interactively

1. A company asks who is responsible for guarding the data center building that hosts its cloud resources and for replacing a failed physical disk inside it.

  1. The customer, because physical security is a shared control
  2. AWS
  3. The customer, because this is a customer-specific control
  4. AWS and the customer jointly, split by rack ownership

Answer: B — AWS

Physical and environmental security of the facilities is security of the cloud, which AWS handles entirely.

2. A company decides how to classify its customer data, whether to encrypt it, and which IAM permissions to grant for accessing it. Whose responsibility is this?

  1. AWS, because it operates the underlying infrastructure
  2. AWS, because IAM is an AWS-managed service
  3. The customer
  4. Split evenly between AWS and the customer

Answer: C — The customer

Data classification, encryption, and IAM permissions are all part of security in the cloud, which is the customer's responsibility.

3. A company runs its application on Amazon EC2 instances. Who is responsible for applying security patches to the guest operating system on those instances?

  1. AWS, since it manages the hypervisor
  2. The customer
  3. AWS, since EC2 abstracts away the operating system
  4. Neither party, since patches apply automatically

Answer: B — The customer

On EC2, an infrastructure-as-a-service offering, the customer looks after the guest operating system, including updates and security patches.

4. A company stores and retrieves its data through Amazon S3 endpoints. Who is responsible for maintaining the operating system and platform that S3 itself runs on?

  1. The customer, since they own the data stored in the bucket
  2. The customer, since S3 is infrastructure as a service
  3. AWS
  4. Both parties equally, as a shared control

Answer: C — AWS

S3 is an abstracted service, so AWS operates the infrastructure, operating system, and platform, leaving the customer to manage only their data and its permissions.

5. A company patches the guest operating systems on its EC2 instances while AWS patches the underlying infrastructure those instances run on. What kind of control does this illustrate?

  1. An inherited control, because the customer inherits patch management wholly from AWS
  2. A shared control, because each party does its part at its own layer
  3. A customer-specific control, because the patching arises from what the customer chose to run
  4. An inherited control at the infrastructure layer and a customer-specific control at the guest OS, with no single category covering both

Answer: B — A shared control, because each party does its part at its own layer

Patch management is the standard example of a shared control, where both AWS and the customer do their part at their own layer.

6. A company's external auditor requests documentation proving that AWS's own infrastructure meets SOC 2 requirements, as part of a vendor risk review. Where should the company get this documentation?

  1. AWS Artifact
  2. AWS Config
  3. AWS CloudTrail
  4. AWS Key Management Service

Answer: A — AWS Artifact

Artifact provides on-demand downloads of AWS's own security and compliance reports, such as SOC 2, for submission to auditors or regulators.

7. A regulator asks a company to prove that the application it hosts on AWS itself meets PCI DSS requirements, not that AWS's infrastructure does. Who is responsible for producing that evidence?

  1. The company itself
  2. AWS, which supplies it through AWS Artifact
  3. The accreditation body that issued AWS's certifications
  4. AWS Config, by recording the application's resource configurations

Answer: A — The company itself

Artifact only supplies documents about AWS's own compliance; proving compliance of what a customer builds on AWS remains the customer's responsibility under the shared responsibility model.

8. A company wants to protect customer data as it travels between a web application and its database over the network. Which protection does this requirement describe?

  1. Encryption in transit
  2. Encryption at rest
  3. Single-tenant hardware holding the keys under the customer's direct control
  4. On-demand downloads of security and compliance documents

Answer: A — Encryption in transit

Data moving across a network, typically protected with TLS, is encryption in transit, as distinct from encryption at rest which protects data where it is stored.

9. Regulation requires a financial firm to hold its encryption keys on dedicated, single-tenant hardware under its direct control. Which service meets this requirement?

  1. AWS CloudHSM
  2. AWS Key Management Service
  3. AWS Artifact
  4. AWS Config

Answer: A — AWS CloudHSM

CloudHSM provides dedicated hardware security modules for exactly the case where regulation demands single-tenant hardware and direct key control; KMS creates and controls keys but is not the single-tenant hardware option.

10. An S3 bucket was unexpectedly deleted overnight, and the security team needs to identify which IAM user made the API call that deleted it. Which service should they check?

  1. AWS CloudTrail
  2. Amazon CloudWatch
  3. AWS Config
  4. AWS Artifact

Answer: A — AWS CloudTrail

CloudTrail records API calls and account activity, making it the audit trail for tracing an action back to the user who performed it.

11. A compliance team wants to check whether every S3 bucket in an account has encryption enabled, and to see whether any bucket's configuration has changed over time. Which service fits this need?

  1. AWS Config
  2. Amazon CloudWatch
  3. AWS CloudTrail
  4. AWS Key Management Service

Answer: A — AWS Config

Config records resource configuration over time and assesses it against rules, which is what checking every bucket for a required setting like encryption calls for.

12. A company just created a new standalone AWS account and has not configured anything beyond the initial sign-up. What is true about multi-factor authentication for the root user at this point?

  1. MFA is enforced by default, but it must be added during account creation or when prompted at a later sign-in
  2. MFA is optional and AWS never prompts the account owner to add it
  3. MFA is enforced automatically only after the first 90 days
  4. MFA is fully configured automatically with no setup required from the account owner

Answer: A — MFA is enforced by default, but it must be added during account creation or when prompted at a later sign-in

MFA is enforced for root users by default, but the account owner still has to add it themselves during creation or at a later sign-in prompt.

13. In a standalone AWS account that is not part of AWS Organizations, the only IAM administrator accidentally revokes their own IAM permissions. Which identity can restore those permissions?

  1. The root user
  2. An IAM role with administrator permissions, assumed by the locked-out administrator
  3. AWS Support, by opening a support case
  4. A federated user signing in through the company's identity provider

Answer: A — The root user

Restoring IAM user permissions after the only IAM administrator has revoked their own is on the list of tasks that genuinely require the root user. The account is standalone, so there is no management account to perform the task centrally.

14. An administrator for a standalone AWS account needs to update the payment currency preference and change which AWS Regions are enabled for the account. Do they need to sign in as the root user to make these two changes?

  1. No — neither change requires root credentials
  2. Yes — both changes require root credentials
  3. Only the payment currency preference requires root credentials
  4. Only the AWS Regions setting requires root credentials

Answer: A — No — neither change requires root credentials

Payment currency preference and AWS Regions both fall in the set of account settings that do not require root credentials to change.

15. A company sets up AWS Organizations and creates several new accounts as members of the organization. By default, what root user credentials exist for these new member accounts?

  1. None — the accounts have no root user credentials at all by default
  2. A temporary root password that must be changed at first sign-in
  3. Root access keys are generated automatically for programmatic access
  4. The member accounts share the same root credentials as the management account

Answer: A — None — the accounts have no root user credentials at all by default

New accounts created inside an organization have no root user credentials by default, and cannot sign in as root or recover a password unless account recovery is enabled.

16. An application running on an EC2 instance needs to write to an S3 bucket and should not have any long-term access keys stored on the instance. Which IAM construct fits this need?

  1. An IAM role
  2. An IAM group that the instance is added to
  3. An IAM user created for the application and added to a group that grants S3 access
  4. A customer managed policy attached directly to the instance

Answer: A — An IAM role

A role is a set of permissions assumed temporarily by a service or an application, with no long-term credentials involved. A group is a collection of users, and a policy is a document that has to be attached to an identity, so neither can be given to an instance on its own.

17. A company wants its employees to sign in to several AWS accounts and business applications using the credentials from their existing corporate identity provider, rather than maintaining a separate IAM user in every account. Which approach fits?

  1. AWS IAM Identity Center with federated identities
  2. An IAM group in each account with an AWS managed policy attached
  3. Sharing root user credentials across the accounts
  4. Storing each employee's password in AWS Secrets Manager

Answer: A — AWS IAM Identity Center with federated identities

IAM Identity Center provides single sign-on across multiple accounts and applications and is what AWS recommends for human access, while federated identity is what lets users authenticate with their existing identity provider instead of getting AWS credentials of their own.

18. A team wants to identify EC2 instances running software with known CVEs, scan container images stored in ECR, and check Lambda functions for unintended network exposure — all without maintaining a manual scan schedule. Which service handles this?

  1. Amazon GuardDuty
  2. Amazon Macie
  3. Amazon Inspector
  4. Amazon Detective

Answer: C — Amazon Inspector

Inspector looks at EC2 instances, ECR container images, and Lambda functions, finding CVEs and unintended network exposure, and rescans automatically when something changes or a new CVE appears.

19. A security analyst suspects an IAM credential has been stolen and is being used for cryptomining, and wants continuous, always-on analysis of CloudTrail management events, VPC flow logs, and DNS logs to catch this kind of activity. Which service is built for that?

  1. Amazon Macie
  2. Amazon GuardDuty
  3. Amazon Inspector
  4. Amazon Detective

Answer: B — Amazon GuardDuty

GuardDuty analyzes CloudTrail management events, VPC flow logs, and DNS logs to find threats like compromised credentials and cryptomining, running continuously with nothing to schedule.

20. After another security service raises an alert, an analyst wants to dig into automatically collected log data to work out the root cause and reconstruct what actually happened, rather than surface a brand-new type of problem. Which service does this job?

  1. Amazon Inspector
  2. AWS Security Hub
  3. AWS Trusted Advisor
  4. Amazon Detective

Answer: D — Amazon Detective

Detective doesn't surface new findings; it examines automatically collected log data to investigate the root cause of findings raised by the other services.

21. A company wants to scan the objects in its S3 buckets to find where personally identifiable information, financial data, or credentials are stored, and to be alerted if any of those buckets are publicly accessible. Which service fits?

  1. Amazon Inspector
  2. Amazon GuardDuty
  3. Amazon Macie
  4. Amazon Detective

Answer: C — Amazon Macie

Macie examines objects in Amazon S3 to find sensitive data such as PII, financial information, and credentials, and flags publicly accessible buckets.

22. A company already runs several detection tools plus some partner security products and wants one place to pull in and prioritize all the resulting findings, as well as check its environment against security standards. Which service should it use?

  1. AWS Trusted Advisor
  2. AWS Security Hub
  3. Amazon Detective
  4. AWS Firewall Manager

Answer: B — AWS Security Hub

Security Hub sits above the individual detection services, consuming and prioritizing findings from them and partner products, and checking the environment against security standards.

23. A company operates many AWS accounts and wants to define firewall rules once and apply them centrally across all of those accounts, instead of configuring each account's firewall separately. Which service fits?

  1. AWS WAF
  2. AWS Shield
  3. AWS Firewall Manager
  4. AWS Security Hub

Answer: C — AWS Firewall Manager

Firewall Manager is built to manage firewall rules centrally across multiple accounts.

Take this test interactively

More AWS Cloud Practitioner practice tests