Security and compliance
Practise only this domain. 72 questions with explanations, 20 at a time.
Start security and complianceSample questions
- An RDS database, an EBS snapshot and an S3 bucket must each be encrypted with the same KMS key, and that key must be usable in two Regions. Which key should be created?Medium
- A company suspects that S3 buckets contain unencrypted customer records and card numbers. Which service discovers and classifies that data automatically?Easy
- A manufacturing plant runs software on servers outside AWS and needs those workloads to obtain temporary AWS credentials through IAM roles instead of long-term access keys. Which service enables this?Medium
- An IAM user has hit the quota for attached managed policies. What is the right way to grant the remaining permissions?Hard
- A workload spans two Regions and encrypts its database, block volumes, and object storage with one customer managed key. The same key identifier must work in both Regions so that replicated data can be decrypted locally. Which KMS feature is required?Medium
- A Secrets Manager rotation schedule for an Aurora cluster started failing right after the team moved the rotation function into a different subnet. Logs show timeouts connecting to the database endpoint, with no authentication errors. What is the most probable cause?Medium
- A bank's security team wants a managed threat detection service that continuously analyzes account activity and network telemetry for compromised instance credentials, unusual API usage, and cryptocurrency mining, without deploying agents. Which service should be enabled?Easy