Security and Compliance
Free AWS Certified Cloud Practitioner practice — 6 questions on Security and Compliance, with explanations. No sign-up. Full 12-question mixed test →
A company runs its entire application on AWS Lambda, using function code that processes customer orders. Under the AWS shared responsibility model, which task is AWS responsible for?
For serverless services like Lambda, AWS manages the entire underlying infrastructure, including the host OS, runtime patching, and hardware — this is part of AWS's 'security of the cloud' responsibility, which expands significantly for managed/serverless services compared to EC2.
A company needs to automatically discover, classify, and alert on sensitive data such as personally identifiable information (PII) stored in Amazon S3 buckets. Which AWS service should they use?
Amazon Macie uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data (like PII and credentials) stored in Amazon S3.
A company wants its employees to sign in once using their existing corporate directory credentials and then access multiple AWS accounts without creating separate IAM users in each account. Which AWS service should they use?
AWS IAM Identity Center (successor to AWS Single Sign-On) provides centralized, single sign-on access across multiple AWS accounts, integrating with existing identity providers like Active Directory, so employees don't need separate IAM users per account.
A security team wants to apply the strongest recommended protection to the AWS account root user immediately after creating a new AWS account. Which action should they take?
AWS best practice is to enable MFA on the root user immediately, secure its credentials, and avoid using the root user for everyday tasks — instead, create individual IAM users/roles with least-privilege permissions for daily operations.
An e-commerce company's web application is being targeted by an attack that sends malicious HTTP requests containing SQL injection patterns to exploit its login form. Which AWS service should the company configure with rules to detect and block this specific type of application-layer attack?
AWS WAF (Web Application Firewall) lets customers create rules, including managed rule groups, that inspect HTTP/HTTPS requests and block patterns like SQL injection and cross-site scripting at Layer 7.
A company's compliance team needs to download AWS's ISO 27001 certification report on demand to satisfy an internal audit requirement. Which AWS service provides access to this type of compliance documentation?
AWS Artifact is the self-service portal that provides on-demand access to AWS's compliance reports, certifications (such as ISO 27001), and agreements, supporting the customer's audit and compliance needs.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →