Exam Simulator: Security and Compliance

Question 1 of 20

1. Question

Which of the following AWS service is a security management service which allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organization?

AWS Secrets Manager
AWS Firewall Manager
AWS Shield
AWS WAF

Question 2 of 20

2. Question

Which of the following options below is a control which a customer fully inherits from AWS in accordance with the AWS shared responsibility model?

Patch Management
Physical and Environmental controls
Configuration Management
Zone Security

Question 3 of 20

3. Question

Which of the following guidelines is not considered as a best practice for Amazon S3?

Ensure that your Amazon S3 buckets use the correct policies and are publicly accessible
Implement least privilege access
Use IAM roles for applications and AWS services that require Amazon S3 access
Enable multi-factor authentication (MFA) Delete

Question 4 of 20

4. Question

Your company needs to deny any permission to any user to perform any Amazon S3 operations on objects in an S3 bucket unless the request originates from the range of 83.122.40.0/24 IP addresses. Which of the following should you use to meet the requirement?

Network Access Control List
Bucket Policy
AWS Resource Groups
AWS Firewall Manager

Question 5 of 20

5. Question

You have been tasked to implement a solution to attach policies to multiple users at one time. Which AWS service will help you to meet the requirement?

AWS Identity and Access Management
AWS Resource Access Manager
AWS Resource Groups
AWS Secrets Manager

Question 6 of 20

6. Question

Which of the following AWS services support Access Control Lists (ACLs)? (Choose all that apply.)

Amazon S3
AWS WAF
Amazon Redshift
Amazon VPC
Amazon Elastic Container

Question 7 of 20

7. Question

Which of the following actions you can follow to improve the security of your Identity and Access Management (IAM) users? (Select all that apply.)

Configure a strong password policy for your users
Disable MFA
Share access keys
Keep unnecessary credentials
Monitor activity in your AWS account
Create individual IAM users

Question 8 of 20

8. Question

Assuming you are in the Identity and Access Management (IAM) dashboard of your AWS Management Console, which of the following services below can you manage? (Select all that apply)

Groups
Instances
Identity providers
Policies
Dedicated hosts

Question 9 of 20

9. Question

In compliance with PCI DSS, an EU-based company is required to provide compliance documents, such as Payment Card Industry (PCI). Where are these AWS compliance documents located?

AWS Certificate Manager
AWS Security Hub
AWS Secrets Manager
AWS Artifact

Question 10 of 20

10. Question

You have been tasked to increase the security of your VPC to control traffic in and out of your company’s subnets. Which of the following services will you use to complete the task?

Network ACL
AWS Shield
AWS WAF
AWS Resource Group

Question 11 of 20

11. Question

Which of the following AWS services is a fully managed data security service that uses machine learning and pattern matching to discover, classify, and help you protect your sensitive data in Amazon S3?

Amazon Inspector
Amazon GuardDuty
Amazon Macie
Amazon Detective

Question 12 of 20

12. Question

Which of the followings are considered prohibited activities when you conduct security assessments and penetration testing against AWS infrastructure? (Choose all that apply.)

DNS zone walking via Amazon Route 53 Hosted Zones
Conduct pen testing on Amazon CloudFront
Port flooding
Protocol flooding
Conduct pen testing on Amazon EC2 instances

Question 13 of 20

13. Question

AWS customers are welcome to carry out security assessments or penetration tests against AWS infrastructure without prior approval for 8 services. Which of the following services are included? (Choose all that apply.)

Elastic Load Balancers
Amazon Route 53
Amazon CloudFront
Amazon API Gateways
Amazon Redshift

Question 14 of 20

14. Question

Which of the following should you use if you need to provide temporary AWS credentials for users who have been authenticated via their social media logins as well as for guest users who do not require any authentication?

Amazon Cognito identity pool
Amazon Detective
Amazon GuardDuty
Amazon Inspector

Question 15 of 20

15. Question

Which of the following tasks fall under the sole responsibility of customer based on the shared responsibility model?

Patch Management
Service and Communications Protection
Configuration Management
Physical and Environmental controls

Question 16 of 20

16. Question

Which of the following are valid important characteristics of an IAM Group? (Choose all that apply.)

A group can contain many users
A user can't belong to multiple groups
Groups can't be nested
There's a default group that automatically includes all users in the AWS account
The number and size of IAM resources in an AWS account are limited

Question 17 of 20

17. Question

What you can use to delegate access to users, applications, or services that don’t normally have access to your AWS resources?

Policies
Access Control List
Roles
Groups

Question 18 of 20

18. Question

Which of the following policies are available for granting permission to your Amazon S3 resources and use JSON-based access policy language? (Choose all that apply.)

Session policies
Bucket policies
Service policies
User policies
Service control policies

Question 19 of 20

19. Question

Recently your company migrated to AWS and now you are responsible to implement a solution to identify unexpected and potentially unauthorized or malicious activity in your AWS environment. Which of the following AWS services will you implement to meet the requirement?

Amazon GuardDuty
Amazon Inspector
AWS Shield
AWS WAF

Question 20 of 20

20. Question

Which of the following are some common things you can do with the policy simulator? (Choose all that apply.)

Test policies that are attached to AWS resources, such as Amazon Inspector
Test policies that are attached to IAM users, groups, or roles in your AWS account
You can only simulate multiple permissions boundaries at a time
Test new policies that are not yet attached to a user, group, or role by typing or copying them into the simulator
Identify which specific statement in a policy results in allowing or denying access to a particular resource or action

Anastasia-Instructor September 1, 2022

Quiz Summary

Information

Results