AWS Certification Style Questions from Security and Compliance
Question 1 – AWS Certificate Manager (ACM)
Your company needs HTTPS for a website fronted by an Application Load Balancer with minimal overhead. Which solution is best?
A. Buy a certificate and manually install on EC2 instances
B. Use AWS Certificate Manager to provision and attach a certificate to ALB
C. Generate a self-signed certificate and deploy manually
D. Upload certificate into S3 and reference it
Answer: B
Explanation: ACM provides free, auto‑renewing SSL/TLS certificates that integrate with ALB, CloudFront, and API Gateway.
Question 2 – AWS Certificate Manager (ACM)
For an internal microservices TLS requirement, which ACM option should you use?
A. Public ACM Certificates
B. ACM Private Certificate Authority
C. Third‑party CA only
D. SSL installed via IAM
Answer: B
Explanation:ACM Private CA issues and manages private certificates for internal services.
Question 3 – Secrets Manager
Which AWS service allows automatic credential rotation for RDS databases?
A. Secrets Manager
B. IAM Identity Center
C. Systems Manager Parameter Store
D. AWS Config
Answer: A
Explanation: AWS Secrets Manager natively rotates credentials for RDS and Aurora.
Question 4 – Secrets Manager
Which problem is solved by Secrets Manager instead of storing API keys in code?
A. Monitor traffic flows
B. Hardcoded secrets eliminated
C. Multi‑AZ failover
D. Data warehouse analytics
Answer: B
Explanation: Secrets Manager securely stores secrets and delivers them programmatically, preventing hardcoding.
Question 5 – AWS Artifact
Where can you download ISO, SOC, FedRAMP reports for auditors?
A. AWS Inspector
B. AWS Artifact
C. Security Hub
D. Macie
Answer: B
Explanation:Artifact is AWS’s compliance report & agreements portal.
Question 6 – AWS Artifact
A customer needs to review the AWS PCI DSS compliance attestation. Which service provides it?
A. GuardDuty
B. Artifacts
C. Config
D. Access Analyzer
Answer: B
Explanation: All AWS compliance certifications are downloadable in Artifact.
Question 7 – GuardDuty
GuardDuty detects an EC2 instance talking to a crypto‑mining domain. What should you do first?
A. Delete CloudTrail logs
B. Isolate the instance
C. Terminate IAM root user
D. Disable GuardDuty
Answer: B
Explanation: Best practice: quarantine compromised resources, then investigate.
Question 8 – GuardDuty
Which data sources does GuardDuty use?
A. VPC Flow Logs, CloudTrail, DNS logs
B. EC2, S3, Lambda logs only
C. Inspector reports only
D. IAM password policy
Answer: A
Explanation: GuardDuty continuously monitors AWS native logs to detect anomalies.
Question 9 – Amazon Inspector
Which vulnerabilities does Amazon Inspector detect?
A. Application code bugs
B. CVEs and software vulnerabilities
C. DNS misconfigurations
D. IAM password policy misuses
Answer: B
Explanation: Inspector scans workloads/containers for CVE vulnerabilities.
Question 10 – Inspector
Inspector finds a package vulnerability on EC2. Which AWS resource logs the findings?
A. Security Hub
B. VPC Flow Logs
C. IAM Analyzer
D. Artifact
Answer: A
Explanation: Inspector publishes findings into Security Hub.
Question 11 – AWS Config
Compliance requires all EC2 must have IMDSv2 enabled. Which service enforces this?
A. IAM Access Analyzer
B. AWS Config
C. GuardDuty
D. AWS Abuse
Answer: B
Explanation: AWS Config has managed rules for security posture like IMDSv2.
Question 12 – AWS Config
Can AWS Config automatically remediate misconfigured resources?
A. No, must be manual
B. Yes, via Config Rules Remediation Actions (SSM automation)
C. Only for IAM policies
D. Only via CLI scripts
Answer: B
Explanation: Config can auto‑remediate with SSM automation documents.
Question 13 – Macie
Which service discovers PII in S3 using ML?
A. Macie
B. Security Hub
C. CloudTrail
D. Inspector
Answer: A
Explanation:Macie scans S3 for PII using NLP/ML.
Question 14 – Macie
Your compliance policy forbids sensitive data in public buckets. Which service detects this?
A. Macie
B. GuardDuty
C. Access Analyzer
D. CloudWatch
Answer: A
Explanation: Macie detects PII + highlights public S3 exposures.
Question 15 – Security Hub
Security Hub integrates with which AWS services?
A. GuardDuty, Inspector, Macie, Config
B. ACM, Secrets Manager only
C. SNS and SQS only
D. IAM and STS
Answer: A
Explanation: Security Hub aggregates findings across core AWS security services.
Question 16 – Security Hub
Which compliance frameworks are pre‑built in Security Hub?
A. PCI DSS, CIS, AWS Foundational Best Practices
B. HIPAA by default
C. GDPR enforcement
D. ISO 27017
Answer: A
Explanation: Security Hub checks against PCI DSS & CIS, plus AWS best practices.
Question 17 – Detective
Which service provides graphs/visuals for investigating GuardDuty alerts?
A. Detective
B. Config
C. Inspector
D. Secrets Manager
Answer: A
Explanation: Detective visualizes relationships from multiple logs for root cause analysis.
Question 18 – Detective
A SOC analyst wants to trace root cause of suspicious API calls. Which service is ideal?
A. GuardDuty
B. Detective
C. Artifact
D. Abuse
Answer: B
Explanation:Detective is built for investigation, built on VPC Flow Logs & GuardDuty.
Question 19 – AWS Abuse
What triggers AWS Abuse notifications?
A. Exceeding billing limits
B. Compromised AWS resources sending spam/malware
C. IAM misconfigurations
D. Config non‑compliance
Answer: B
Explanation: AWS Abuse handles malicious use complaints about your resources.
Question 20 – AWS Abuse
What is the customer’s responsibility when AWS contacts you via Abuse reports?
A. Ignore it
B. Investigate and remediate compromised resources
C. Ask AWS to fix automatically
D. Disable IAM Analyzer
Answer: B
Explanation: AWS notifies; customer must remediate.
Question 21 – IAM Access Analyzer
What’s IAM Access Analyzer’s primary role?
A. Detecting network DDoS
B. Identifying public/external resource access
C. Enforcing MFA
D. Providing vulnerability scans
Answer: B
Explanation: IAM Access Analyzer finds unintended external access.
Question 22 – Access Analyzer
Which resource can it analyze?
A. S3 Buckets
B. Only EC2 AMIs
C. CloudWatch alarms
D. Route 53 endpoints
Answer: A
Explanation: Supported types: S3, IAM roles, KMS keys, Lambda layers, secrets.
Question 23 – WAF & Shield
Which combination protects against volumetric DDoS + SQL injection?
A. GuardDuty
B. WAF + Shield
C. Config
D. Macie
Answer: B
Explanation: Shield = L3/L4 DDoS, WAF = L7 app filtering.
Question 24 – Shield Advanced
Which unique benefit is only available with Shield Advanced?
A. Always‑on network protection
B. 24/7 AWS DDoS Response Team
C. CloudTrail logging
D. IAM enforcement
Answer: B
Explanation:Shield Advanced includes the DRT & cost protection.
Question 25 – AWS Network Firewall
Where does Network Firewall operate?
A. Instance OS level
B. VPC subnet boundaries
C. Route 53 DNS
D. CloudFront edge
Answer: B
Explanation: Network Firewall attaches at VPC subnet level.
Question 26 – Network Firewall
Which rules can it use?
A. Only Security Group rules
B. Suricata rulesets
C. IAM policies
D. WAF managed rules
Answer: B
Explanation: Network Firewall supports Suricata-compatible deep packet inspection rules.
Question 27 – Firewall Manager
A compliance officer wants consistent WAF policies across accounts. Which service helps?
A. Config
B. Firewall Manager
C. Inspector
D. MaaS
Answer: B
Explanation:Firewall Manager applies rules org-wide.
Question 28 – Firewall Manager
Which policies can it enforce?
A. Security Groups, WAF, Shield Advanced, Network Firewall
B. CloudTrail logs only
C. IAM MFA
D. Macie PII scans
Answer: A
Explanation: Firewall Manager centralizes multiple firewall/security services.
Question 29 – KMS
Which describes AWS KMS correctly?
A. FIPS 140‑2 Level 3 HSM dedicated access
B. Fully managed encryption keys integrated with AWS
C. PKCS#11 direct API
D. Used only for IAM
Answer: B
Explanation:KMS is a managed key management service, integrated with AWS services.
Question 30 – CloudHSM
Your bank requires exclusive key control in FIPS 140‑2 Level 3 hardware. Which service?
A. KMS with AWS‑managed CMKs
B. CloudHSM
C. Parameter Store
D. IAM Analyzer
Answer: B
Explanation: CloudHSM provides dedicated, customer‑controlled HSMs with FIPS 140‑2 Level 3 compliance.