Security and Compliance
Free AWS Certified SysOps Administrator - Associate practice — 6 questions on Security and Compliance, with explanations. No sign-up. Full 12-question mixed test →
A company in Account A stores objects in an S3 bucket encrypted with a customer managed AWS KMS key. A SysOps administrator needs to grant an IAM role in Account B the ability to decrypt and read these objects, following least privilege. What should be configured?
Cross-account access to KMS-encrypted objects requires permission on BOTH sides: the KMS key policy must explicitly allow the external principal (KMS key policies are the source of truth for a customer managed key), and the calling account needs an IAM policy granting kms:Decrypt on that key ARN. S3 bucket permissions alone are not sufficient when a customer managed key is involved.
An organization needs to be able to prove that CloudTrail log files delivered to S3 have not been tampered with after delivery, across all AWS Regions in the account. Which configuration BEST meets this requirement?
Log file validation generates a SHA-256/RSA digest file for each delivered log file, cryptographically proving whether the log file has been altered or deleted after delivery. Combining this with a multi-Region trail ensures every Region is covered, and MFA delete on the destination bucket adds protection against unauthorized deletion of the log objects themselves.
A team needs Amazon RDS database credentials to rotate automatically every 30 days without the team writing custom rotation logic. Which AWS service should they use?
AWS Secrets Manager provides native, built-in rotation templates/Lambda functions specifically for RDS, Aurora, DocumentDB, and Redshift, allowing rotation on a schedule (e.g., every 30 days) with minimal setup and no custom rotation logic required.
A SysOps administrator must continuously evaluate resource configurations across multiple AWS accounts against the CIS AWS Foundations Benchmark and view aggregated compliance findings in one place. Which solution BEST satisfies this requirement?
AWS Security Hub is purpose-built to enable industry standards like the CIS AWS Foundations Benchmark, continuously run automated checks, and aggregate findings across multiple accounts and Regions (via Security Hub's cross-Region aggregation and integration with AWS Organizations), giving a single unified compliance dashboard.
A cloud security team wants to allow a development team to create their own IAM roles, but no role the developers create should ever be able to exceed S3 read-only access, regardless of what policies they attach. Which configuration achieves this?
A permissions boundary is the correct IAM mechanism for capping the maximum permissions a principal can grant to itself or to entities it creates. By attaching the boundary to the developers and enforcing (via an IAM policy condition on iam:CreateRole) that any role they create must also have that same boundary attached, the effective permissions of any role they create can never exceed the boundary, no matter what permission policies are attached to it.
A company runs internal-only applications on private hostnames (e.g., app.internal.example.com) that are never exposed to the public internet, and wants TLS certificates for them managed through AWS Certificate Manager. Which statement is correct?
ACM's standard public certificate authority only issues certificates for domain names that can be validated as owned by the requester via public DNS (CNAME) or email validation, which is not possible for private/internal-only hostnames. AWS Certificate Manager Private Certificate Authority (ACM PCA) lets an organization stand up its own private CA hierarchy to issue and manage certificates for internal hostnames trusted only within the organization's infrastructure.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
undefined $34.99 with code 89CE4ED79F19FA855B6D — valid through Sep 23.
Get my $34.99 deal →