2.4
Question 1
A company hosts an e-commerce application on Amazon EC2 behind an Application Load Balancer. The security team wants to block requests that contain common SQL injection patterns before they reach the application. Which AWS service should the company use?
A. AWS WAF
B. AWS Shield
C. Amazon GuardDuty
D. AWS Trusted Advisor
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS WAF helps protect web applications by allowing or blocking HTTP and HTTPS requests based on rules, including rules designed to detect SQL injection and cross-site scripting. * **Why B is incorrect:** AWS Shield provides protection against distributed denial-of-service (DDoS) attacks, not detailed web request filtering. * **Why C is incorrect:** Amazon GuardDuty detects suspicious activity and potential threats in AWS accounts and workloads; it does not filter application-layer web requests. * **Why D is incorrect:** AWS Trusted Advisor provides recommendations and checks for areas such as security, cost optimization, and performance; it does not block SQL injection requests.Question 2
A public-facing application is experiencing repeated volumetric DDoS attacks. The company wants enhanced DDoS protection, access to additional visibility, and assistance from AWS during attacks. Which AWS service provides these capabilities?
A. AWS Shield Advanced
B. AWS WAF
C. Amazon Macie
D. AWS Certificate Manager (ACM)
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Shield Advanced provides enhanced protection against DDoS attacks, additional visibility into attacks, and access to AWS DDoS Response Team support. * **Why B is incorrect:** AWS WAF filters web requests using rules but is not the primary service for enhanced volumetric DDoS protection and response support. * **Why C is incorrect:** Amazon Macie helps discover and protect sensitive data in Amazon S3. * **Why D is incorrect:** AWS Certificate Manager provisions and manages certificates for encrypted connections; it does not provide DDoS protection.Question 3
A security team wants a managed service that continuously analyzes AWS account activity, network traffic, and DNS requests to identify potential threats such as compromised credentials or cryptocurrency mining. Which AWS service meets this requirement?
A. Amazon GuardDuty
B. Amazon Detective
C. AWS Firewall Manager
D. AWS CloudHSM
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon GuardDuty is a threat detection service that continuously monitors AWS data sources and generates security findings for suspicious activity. * **Why B is incorrect:** Amazon Detective helps investigate and analyze the root cause of security findings; it is not primarily the service that detects threats. * **Why C is incorrect:** AWS Firewall Manager centrally configures and manages firewall rules across AWS accounts and resources. * **Why D is incorrect:** AWS CloudHSM provides dedicated hardware security modules for cryptographic key storage and operations.Question 4
A company uses AWS Organizations and has many AWS accounts. The security team wants to centrally apply AWS WAF web ACLs and security group policies across resources in those accounts. Which AWS service should the company use?
A. AWS Firewall Manager
B. AWS Shield Standard
C. AWS Resource Access Manager (AWS RAM)
D. Amazon Cognito
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Firewall Manager centrally configures and manages firewall rules, including AWS WAF rules, across accounts and resources in an AWS Organizations environment. * **Why B is incorrect:** AWS Shield Standard provides automatic baseline DDoS protection for AWS services but does not centrally manage firewall policies across accounts. * **Why C is incorrect:** AWS RAM shares supported AWS resources across accounts; it does not centrally enforce WAF or security group policies. * **Why D is incorrect:** Amazon Cognito provides user identity and access management for applications, not centralized firewall policy management.Question 5
A small company needs a specialized endpoint security product from an independent software vendor. The company wants to find and purchase the product without building the security capability itself. Where should the company look?
A. AWS Marketplace
B. AWS Security Blog
C. Amazon GuardDuty
D. AWS Certificate Manager (ACM)
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Marketplace offers third-party software products and services, including security solutions from AWS Partners and independent software vendors. * **Why B is incorrect:** The AWS Security Blog provides security news, guidance, and best practices but is not a catalog for purchasing third-party software. * **Why C is incorrect:** Amazon GuardDuty is an AWS-managed threat detection service, not a marketplace for third-party products. * **Why D is incorrect:** AWS Certificate Manager manages SSL/TLS certificates and does not provide third-party endpoint security products.Question 6
A company wants to identify common security weaknesses in its AWS account and also needs AWS-authored troubleshooting articles for a security configuration problem. Which TWO resources should the company use? (Select TWO)
A. AWS Trusted Advisor
B. AWS Knowledge Center
C. AWS Firewall Manager
D. Amazon Macie
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** AWS Trusted Advisor provides checks and recommendations that can help identify security issues, such as certain account and access configuration weaknesses. * **Why B is correct:** The AWS Knowledge Center provides AWS-authored answers, troubleshooting guidance, and explanations for common technical and security-related issues. * **Why C is incorrect:** AWS Firewall Manager centrally manages firewall policies; it does not provide general account security checks or troubleshooting documentation. * **Why D is incorrect:** Amazon Macie discovers and helps protect sensitive data in Amazon S3; it is not a general-purpose AWS troubleshooting resource.Question 7
An organization hosts a customer portal over HTTPS. The organization wants AWS to provision, store, and renew the public SSL/TLS certificate used by the application. Which AWS service should it use?
A. AWS Certificate Manager (ACM)
B. AWS CloudHSM
C. AWS Shield Advanced
D. Amazon Cognito
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Certificate Manager provisions and manages SSL/TLS certificates and can automatically renew eligible certificates used with integrated AWS services. * **Why B is incorrect:** AWS CloudHSM provides dedicated hardware security modules for cryptographic operations and key storage; it does not generally manage public SSL/TLS certificate lifecycle in the same way as ACM. * **Why C is incorrect:** AWS Shield Advanced provides enhanced DDoS protection. * **Why D is incorrect:** Amazon Cognito provides authentication and user identity capabilities for applications.Question 8
A financial services company must maintain control of cryptographic keys using dedicated, tamper-resistant hardware. The company wants a managed service that provides hardware security modules in AWS. Which service meets this requirement?
A. AWS CloudHSM
B. AWS Certificate Manager (ACM)
C. AWS Resource Access Manager (AWS RAM)
D. Amazon Macie
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS CloudHSM provides dedicated hardware security modules that allow customers to generate, store, and use cryptographic keys in hardware under their control. * **Why B is incorrect:** AWS Certificate Manager manages SSL/TLS certificates and is not a general-purpose dedicated HSM service. * **Why C is incorrect:** AWS RAM shares supported AWS resources across accounts and does not provide cryptographic key storage. * **Why D is incorrect:** Amazon Macie helps discover and protect sensitive data in Amazon S3.Question 9
A company is designing two applications. One is a consumer mobile application that needs user sign-up and sign-in capabilities. The other is an internal application that must integrate with the company’s Microsoft Active Directory. Which TWO AWS services are appropriate? (Select TWO)
A. Amazon Cognito
B. AWS Directory Service
C. Amazon GuardDuty
D. AWS Shield
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** Amazon Cognito provides user pools and identity capabilities for applications, including consumer sign-up and sign-in. * **Why B is correct:** AWS Directory Service provides managed directory capabilities and can integrate AWS applications with Microsoft Active Directory. * **Why C is incorrect:** Amazon GuardDuty detects threats and suspicious activity; it does not provide application user authentication or directory services. * **Why D is incorrect:** AWS Shield provides DDoS protection and does not manage application identities or directory integration.Question 10
A security investigation team receives a finding that an IAM role may have been compromised. The team needs to understand the relationship between the finding, affected resources, and historical activity. It also wants to identify sensitive information stored in Amazon S3 that could be exposed. Which TWO services should the team use? (Select TWO)
A. Amazon Detective
B. Amazon Macie
C. AWS Trusted Advisor
D. AWS Certificate Manager (ACM)
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** Amazon Detective helps security teams investigate findings by analyzing related account activity, resources, and relationships to determine the potential root cause and scope of an issue. * **Why B is correct:** Amazon Macie discovers and helps protect sensitive data in Amazon S3, including data that could be exposed by compromised credentials or permissions. * **Why C is incorrect:** AWS Trusted Advisor provides recommendations and checks but is not designed for detailed security investigation or sensitive-data discovery. * **Why D is incorrect:** AWS Certificate Manager manages SSL/TLS certificates and does not investigate IAM activity or analyze sensitive S3 data.Question 11
A company hosts an online store behind an Application Load Balancer. The security team wants to block requests that contain common SQL injection patterns before they reach the application. Which AWS service should the company use?
A. AWS WAF
B. Amazon GuardDuty
C. Amazon Macie
D. AWS Trusted Advisor
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS WAF helps protect web applications by filtering HTTP and HTTPS requests based on rules, including rules that detect SQL injection and cross-site scripting attempts. * **Why distractors are incorrect:** * **B (Amazon GuardDuty):** Detects suspicious activity and potential threats in AWS accounts and workloads; it does not filter web requests. * **C (Amazon Macie):** Discovers and helps protect sensitive data in Amazon S3. * **D (AWS Trusted Advisor):** Provides recommendations related to cost optimization, performance, security, fault tolerance, and service limits.Question 12
A company wants protection against common distributed denial-of-service attacks without deploying or managing additional infrastructure. Which AWS service provides this protection automatically for AWS resources?
A. AWS Shield Standard
B. AWS Firewall Manager
C. Amazon Detective
D. AWS CloudHSM
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Shield Standard provides automatic protection against common network and transport layer DDoS attacks for AWS services such as Amazon CloudFront and Amazon Route 53. * **Why distractors are incorrect:** * **B (AWS Firewall Manager):** Centrally manages firewall rules and security policies across AWS accounts and resources. * **C (Amazon Detective):** Helps investigate and analyze the root cause of security findings. * **D (AWS CloudHSM):** Provides dedicated hardware security modules for cryptographic key storage and operations.Question 13
A large organization uses AWS Organizations and wants its security team to centrally apply AWS WAF rules to Application Load Balancers in multiple member accounts. Which AWS service meets this requirement?
A. AWS Firewall Manager
B. AWS Shield Standard
C. Amazon Cognito
D. AWS Certificate Manager
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Firewall Manager centrally configures and manages firewall rules, including AWS WAF policies, across accounts and resources in AWS Organizations. * **Why distractors are incorrect:** * **B (AWS Shield Standard):** Provides automatic DDoS protection but does not centrally manage WAF policies across accounts. * **C (Amazon Cognito):** Provides user authentication, authorization, and identity federation for applications. * **D (AWS Certificate Manager):** Manages SSL/TLS certificates and does not centrally manage firewall rules.Question 14
A security team wants a service that continuously monitors AWS accounts and workloads for findings such as unusual API calls, compromised credentials, and communication with known malicious IP addresses. Which service should the team use?
A. Amazon GuardDuty
B. Amazon Macie
C. Amazon Detective
D. AWS Trusted Advisor
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon GuardDuty continuously monitors for malicious or unauthorized activity by analyzing sources such as AWS CloudTrail events, VPC Flow Logs, and DNS logs. * **Why distractors are incorrect:** * **B (Amazon Macie):** Focuses on discovering and protecting sensitive data in Amazon S3. * **C (Amazon Detective):** Investigates security findings and helps determine their root cause; it is not primarily the detection service. * **D (AWS Trusted Advisor):** Provides best-practice recommendations rather than continuous threat detection.Question 15
Amazon GuardDuty has generated a finding involving an IAM role and several Amazon EC2 instances. The security team needs to visualize related activities and determine the potential root cause of the finding. Which service should the team use?
A. Amazon Detective
B. Amazon Macie
C. AWS WAF
D. AWS Certificate Manager
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon Detective analyzes and visualizes security-related data to help investigate findings and identify the root cause and scope of suspicious activity. * **Why distractors are incorrect:** * **B (Amazon Macie):** Identifies sensitive data and potential data security risks in Amazon S3. * **C (AWS WAF):** Filters web traffic using configurable rules. * **D (AWS Certificate Manager):** Provisions and manages SSL/TLS certificates.Question 16
A company stores customer documents in Amazon S3. The compliance team needs to discover personally identifiable information (PII) in the documents and identify potentially sensitive data exposure. Which AWS service should the company use?
A. Amazon Macie
B. Amazon GuardDuty
C. AWS Shield
D. AWS Directory Service
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon Macie uses machine learning and pattern matching to discover and help protect sensitive data, including PII, in Amazon S3. * **Why distractors are incorrect:** * **B (Amazon GuardDuty):** Detects threats and suspicious activity in AWS environments. * **C (AWS Shield):** Protects supported AWS resources against DDoS attacks. * **D (AWS Directory Service):** Provides managed directory services and Microsoft Active Directory capabilities.Question 17
A company is deploying a public HTTPS website on AWS. The company wants to obtain and manage an SSL/TLS certificate without manually handling the certificate’s private key or renewal process. Which service should the company use?
A. AWS Certificate Manager
B. AWS CloudHSM
C. Amazon Cognito
D. AWS Firewall Manager
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates for use with supported AWS services. AWS-issued public certificates can be automatically renewed when configured appropriately. * **Why distractors are incorrect:** * **B (AWS CloudHSM):** Provides dedicated HSMs for cryptographic operations and key storage, not managed public website certificates. * **C (Amazon Cognito):** Manages application users and identity federation. * **D (AWS Firewall Manager):** Centrally manages firewall policies.Question 18
A financial services company must maintain cryptographic keys in single-tenant, tamper-resistant hardware that it controls. Which AWS service is designed for this requirement?
A. AWS CloudHSM
B. AWS Certificate Manager
C. Amazon Macie
D. Amazon Detective
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS CloudHSM provides dedicated hardware security modules that allow customers to generate, store, and use cryptographic keys in customer-controlled HSMs. * **Why distractors are incorrect:** * **B (AWS Certificate Manager):** Manages SSL/TLS certificates rather than providing dedicated HSM infrastructure. * **C (Amazon Macie):** Discovers sensitive data in Amazon S3. * **D (Amazon Detective):** Helps investigate security findings.Question 19
A mobile application needs a managed directory where users can sign up, sign in, reset passwords, and use multi-factor authentication. Which AWS service should the development team use?
A. Amazon Cognito
B. AWS Directory Service
C. Amazon GuardDuty
D. AWS RAM
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon Cognito provides user pools for application user registration, authentication, account recovery, and features such as multi-factor authentication. * **Why distractors are incorrect:** * **B (AWS Directory Service):** Provides managed directory options such as Microsoft Active Directory for applications and resources that require directory services. * **C (Amazon GuardDuty):** Detects suspicious activity and threats. * **D (AWS RAM):** Shares supported AWS resources across accounts, organizational units, or an organization.Question 20
A company is migrating applications that require Microsoft Active Directory authentication to AWS. The company wants AWS to operate the directory infrastructure. Which service should it use?
A. AWS Directory Service
B. Amazon Cognito
C. AWS CloudHSM
D. Amazon Macie
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Directory Service provides managed directory options, including AWS Managed Microsoft AD, Simple AD, and AD Connector. * **Why distractors are incorrect:** * **B (Amazon Cognito):** Provides identity management for application users rather than a managed Microsoft Active Directory environment. * **C (AWS CloudHSM):** Provides dedicated cryptographic hardware. * **D (Amazon Macie):** Discovers sensitive data in Amazon S3.Question 21
A central security account needs to share a subnet with application accounts so that resources in those accounts can use the subnet. The company wants to share the resource without transferring ownership. Which service should it use?
A. AWS Resource Access Manager (AWS RAM)
B. AWS Firewall Manager
C. AWS Shield
D. Amazon Cognito
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS RAM allows supported resources, such as subnets, to be shared with other AWS accounts, organizational units, or an entire AWS Organization while the resource remains owned by the sharing account. * **Why distractors are incorrect:** * **B (AWS Firewall Manager):** Centrally manages firewall and security policies. * **C (AWS Shield):** Provides DDoS protection. * **D (Amazon Cognito):** Manages application identities and user authentication.Question 22
A company wants to identify whether its AWS account has security configuration weaknesses, such as unrestricted access to certain resources or missing security best practices. Which AWS service can provide these recommendations?
A. AWS Trusted Advisor
B. Amazon Detective
C. AWS WAF
D. AWS Certificate Manager
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Trusted Advisor evaluates an AWS environment and provides recommendations across categories including security, cost optimization, performance, fault tolerance, and service limits. * **Why distractors are incorrect:** * **B (Amazon Detective):** Investigates security findings rather than providing general account optimization recommendations. * **C (AWS WAF):** Filters web requests according to configured rules. * **D (AWS Certificate Manager):** Manages SSL/TLS certificates.Question 23
A company needs a specialized third-party security product that is not offered as a native AWS service. The company wants to find, compare, and procure security software designed to run in AWS. Where should the company look?
A. AWS Marketplace
B. AWS Security Blog
C. AWS Trusted Advisor
D. Amazon Macie
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Marketplace provides access to software products from AWS Partners and third-party vendors, including security products and solutions. * **Why distractors are incorrect:** * **B (AWS Security Blog):** Publishes security guidance, announcements, and best practices but is not a software procurement catalog. * **C (AWS Trusted Advisor):** Provides recommendations about an AWS environment. * **D (Amazon Macie):** Discovers sensitive data in Amazon S3.Question 24
A cloud architect wants official AWS guidance about security best practices and solutions for a specific configuration issue. Which two resources should the architect consult? (Select TWO)
A. AWS Knowledge Center
B. AWS Security Blog
C. Amazon Cognito
D. AWS RAM
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** The AWS Knowledge Center contains troubleshooting articles, how-to guidance, and answers to frequently asked AWS questions. * **Why B is correct:** The AWS Security Blog provides security guidance, announcements, technical information, and recommended practices. * **Why distractors are incorrect:** * **C (Amazon Cognito):** Is an AWS identity service, not a documentation resource. * **D (AWS RAM):** Shares supported AWS resources across accounts and organizations.Question 25
A security team wants to detect unusual API activity and possible compromised credentials in an AWS account. Which service is most appropriate for this requirement?
A. Amazon GuardDuty
B. Amazon Macie
C. AWS Certificate Manager
D. AWS Resource Access Manager
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon GuardDuty analyzes AWS account and workload activity to identify suspicious behavior, compromised credentials, and potential threats. * **Why distractors are incorrect:** * **B (Amazon Macie):** Focuses on sensitive data discovery and protection in Amazon S3. * **C (AWS Certificate Manager):** Manages SSL/TLS certificates. * **D (AWS Resource Access Manager):** Shares supported resources across AWS accounts.Question 26
A public API is receiving a very large number of requests from individual IP addresses. The company wants to temporarily block IP addresses that exceed a defined request rate. Which AWS WAF capability should the company use?
A. A rate-based rule
B. An SSL/TLS certificate
C. A directory group
D. A Detective investigation
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS WAF rate-based rules count requests from IP addresses over a time period and can block or otherwise manage IP addresses that exceed the configured threshold. * **Why distractors are incorrect:** * **B (An SSL/TLS certificate):** Encrypts and authenticates HTTPS connections but does not limit request rates. * **C (A directory group):** Organizes users in a directory service and does not filter public web traffic. * **D (A Detective investigation):** Analyzes security activity after or during a finding and does not enforce request limits.Question 27
A company uses AWS WAF across resources in multiple AWS accounts. The security team wants to ensure that new Application Load Balancers created in member accounts automatically receive the organization’s approved web protection rules. Which service should the team use?
A. AWS Firewall Manager
B. AWS Certificate Manager
C. Amazon GuardDuty
D. Amazon Cognito
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Firewall Manager can centrally apply and manage AWS WAF policies across accounts and resources in an AWS Organization. * **Why distractors are incorrect:** * **B (AWS Certificate Manager):** Manages SSL/TLS certificates and does not apply WAF rules. * **C (Amazon GuardDuty):** Detects threats but does not centrally enforce web application firewall policies. * **D (Amazon Cognito):** Manages application users and authentication.Question 28
A company wants enhanced DDoS protection with additional visibility, attack diagnostics, and access to the AWS DDoS Response Team. Which service or feature should the company choose?
A. AWS Shield Advanced
B. AWS Shield Standard
C. Amazon Macie
D. AWS Trusted Advisor
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Shield Advanced provides enhanced DDoS protection, additional attack visibility, reporting, and access to specialized AWS support through the DDoS Response Team. * **Why distractors are incorrect:** * **B (AWS Shield Standard):** Provides automatic protection against common DDoS attacks but does not provide the full set of Shield Advanced capabilities. * **C (Amazon Macie):** Discovers sensitive data in Amazon S3. * **D (AWS Trusted Advisor):** Provides account and resource recommendations.Question 29
A web application needs to allow customers to sign in using an existing social identity provider. The application also needs temporary AWS credentials so authenticated users can access authorized AWS resources. Which Amazon Cognito components provide these capabilities? (Select TWO)
A. A user pool
B. An identity pool
C. AWS CloudHSM
D. AWS Firewall Manager
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** Amazon Cognito user pools provide user directories and support authentication through social and other identity providers. * **Why B is correct:** Amazon Cognito identity pools provide temporary AWS credentials for authenticated or unauthenticated users to access authorized AWS resources. * **Why distractors are incorrect:** * **C (AWS CloudHSM):** Provides dedicated hardware security modules for cryptographic operations. * **D (AWS Firewall Manager):** Centrally manages firewall policies across accounts and resources.Question 30
A company has multiple AWS accounts and wants to share a centrally managed AWS resource with selected accounts while retaining ownership in the central account. Which two statements describe AWS Resource Access Manager (AWS RAM)? (Select TWO)
A. It can share supported resources with accounts in an AWS Organization.
B. It allows the resource owner to retain ownership of the shared resource.
C. It detects compromised credentials and malicious API activity.
D. It filters HTTP requests based on web application firewall rules.