Examkin

Security and Compliance

441 questions

All types441Multiple choice225Multiple select216
Question 81Question →

A startup is deploying a serverless backend application using AWS Lambda. Under the AWS Shared Responsibility Model, which TWO of the following tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Writing and securing the application code running inside the Lambda functions; Configuring Identity and Access Management (IAM) execution roles for the Lambda functions

Answer

Under the AWS Shared Responsibility Model for AWS Lambda, the customer is responsible for writing and securing the application code and configuring Identity and Access Management (IAM) execution roles.
In serverless compute services like AWS Lambda, the boundary of responsibility shifts upwards. AWS manages the physical security, virtual machines, operating system, and the runtime software stack. The customer remains responsible for configuration and data management, specifically securing the application code written for the function and configuring IAM execution roles to control access to other AWS resources.

Step-by-Step Solution

1
Identify the AWS service model type for AWS Lambda.
AWS Lambda is a serverless (managed) service where physical infrastructure, virtualization, operating systems, and managed runtime environments are handled entirely by AWS.
Understanding the service model helps determine the boundary of shared responsibility.
2
Distinguish between responsibilities for security 'of' the cloud (AWS) and security 'in' the cloud (customer) for Lambda.
AWS secures the execution environment, OS patching, runtime version maintenance, and physical hardware. The customer secures their own code, configuration settings, and access control (IAM).
This separation determines the specific operational tasks assigned to each party.

Key Concept

AWS Shared Responsibility Model for Serverless/Managed Services
Question 82Question →

A financial services company is setting up daily administrative access to their AWS infrastructure for a new operations team. To comply with security audits, they must ensure individual accountability and adhere to the principle of least privilege. Which of the following security practices should the company implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create individual IAM users for each team member and assign permissions by placing them in an IAM group with appropriate policies.; Enable Multi-Factor Authentication (MFA) for each individual user account and the AWS account root user.

Answer

Create individual IAM users for each team member, manage their permissions using IAM groups, and enable Multi-Factor Authentication (MFA) on all accounts.
Establishing individual IAM users and organizing them into groups ensures that user activity is auditable and permissions adhere to the principle of least privilege. Requiring MFA for all users, including the root user, enforces a strong secondary layer of access validation to protect resources from credential leakage.

Step-by-Step Solution

1
Evaluate the requirement for individual accountability and permission control.
Determine that shared credentials must be avoided and that permissions must be managed centrally and specifically for roles.
Creating individual IAM users ensures that all actions can be audited to a specific person, while IAM groups allow efficient distribution of minimum necessary permissions.
2
Evaluate identity authentication security measures.
Determine that Multi-Factor Authentication (MFA) should be enforced for all administrative and root accounts.
MFA is the primary AWS recommendation to safeguard credentials from being compromised.

Key Concept

AWS Identity and Access Management (IAM) Security Best Practices
Estimated Time:1m 30s
Question 83Question →

A financial organization is deploying a microservices-based application using Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring security group rules to control inbound and outbound network traffic to the containerized services; Defining Identity and Access Management (IAM) task roles to restrict what AWS resources the containerized applications can access

Answer

The customer is responsible for configuring security group rules to control network traffic and defining IAM task roles to restrict container access to AWS resources.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. When using AWS Fargate, this includes defining IAM task roles to govern application-level access to other AWS resources, and configuring security group rules to control inbound and outbound network traffic to the containerized service.

Step-by-Step Solution

1
Identify the AWS service and its deployment model.
Amazon ECS on AWS Fargate is identified as a serverless container service.
The service model dictates the boundary of responsibility. Fargate shifts host management responsibilities to AWS.
2
Differentiate between infrastructure security and configuration security.
Infrastructure security (physical security, host OS patching, hypervisor management) belongs to AWS. Configuration security (IAM, network access rules, application configuration) belongs to the customer.
This determines which duties are classified as security 'of' the cloud versus security 'in' the cloud.
3
Select the operations that correspond to customer configurations.
Configuring security groups and setting up IAM task roles are selected.
These tasks involve configuring access permissions and network security rules for the customer's specific workloads.

Key Concept

Shared Responsibility Model
Estimated Time:1m 30s
Question 84Question →

A retail enterprise is undergoing a Payment Card Industry Data Security Standard (PCI DSS) audit for its payment processing system hosted on AWS. The external auditors require evidence that the physical infrastructure of the AWS data centers hosting the services meets the required security standards. According to the AWS Shared Responsibility Model, which action should the retail enterprise take to meet this requirement?

Show answer & explanation

Answer: Retrieve the AWS PCI DSS compliance reports and Attestation of Compliance (AoC) from AWS Artifact.

Answer

Retrieve the AWS PCI DSS compliance reports and Attestation of Compliance (AoC) from AWS Artifact.
Under the AWS Shared Responsibility Model, AWS is responsible for security of the cloud, which includes the physical security of data centers. Because customers cannot access or physically audit AWS data centers, AWS undergoes independent third-party audits to verify compliance. The resulting compliance reports, such as the PCI DSS Attestation of Compliance (AoC), are made available on-demand to customers via AWS Artifact.

Step-by-Step Solution

1
Identify the compliance requirement and responsibility boundary.
The requirement is to verify the physical security and compliance of AWS data centers. Under the Shared Responsibility Model, AWS is solely responsible for physical security.
Since customers have no physical access to AWS facilities, they must rely on third-party audits performed on AWS's infrastructure.
2
Determine the AWS service that provides access to third-party compliance reports.
AWS Artifact is identified as the portal that grants on-demand access to AWS's security and compliance documentation.
This is the official method for customers to download compliance reports, such as PCI DSS and SOC, to hand over to their auditors.

Key Concept

Retrieving AWS compliance documentation under the Shared Responsibility Model using AWS Artifact.
Question 85Question →

A logistics company uses AWS Elastic Beanstalk to deploy and scale a web application. The platform automatically provisions Amazon EC2 instances, an Application Load Balancer, and an Auto Scaling group to support the workload. The company's security team is defining the operational boundaries for securing this deployment.

Which of the following tasks remains the sole responsibility of the customer under the AWS Shared Responsibility Model?

Show answer & explanation

Answer: Configuring security group rules to restrict network access to the EC2 instances and applying updates to the application code.

Answer

Configuring security group rules to restrict network access to the EC2 instances and applying updates to the application code.
The correct option is correct because managing security groups and application code are customer responsibilities (security 'in' the cloud). Even though AWS Elastic Beanstalk automates deployment, the provisioned EC2 instances run in the customer's environment, leaving network access rules (security groups) and code security under the customer's control.

Step-by-Step Solution

1
Analyze the service model in the scenario.
AWS Elastic Beanstalk is a Platform as a Service (PaaS) that provisions standard Infrastructure as a Service (IaaS) resources, including Amazon EC2 instances, under the customer's control.
Identifying the service model helps determine where the boundary of responsibility lies for the operating system and network settings.
2
Differentiate between security 'of' the cloud and security 'in' the cloud.
AWS manages the physical infrastructure, virtualization hypervisors, and data center facilities. The customer manages the guest operating system, network firewalls (security groups), and application code.
Applying the Shared Responsibility Model principles isolates customer duties from AWS duties.
3
Evaluate the choices based on the customer's operational responsibilities.
Configuring security groups and updating application code are customer duties (security 'in' the cloud), whereas physical security, hypervisor patching, and data center compliance belong to AWS.
Verifying each option ensures the correct option matches the customer's responsibility profile.

Key Concept

Under the AWS Shared Responsibility Model, customers retain control and responsibility for configuration tasks (such as security groups and application updates) on resources provisioned in their accounts, even when deployed through managed or platform-level services.
Question 86Question →

A company needs to grant a newly hired customer support team read-only access to specific Amazon S3 buckets. Which of the following identity and access management (IAM) practices should the administrator use to configure this access? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM group and add the individual customer support IAM users to it.; Attach the S3 read-only IAM policy directly to the IAM group.

Answer

Create an IAM group to manage the customer support users collectively, and attach the Amazon S3 read-only IAM policy directly to that group.
The correct practices involve creating an IAM group to manage the customer support team collectively and attaching the S3 read-only IAM policy directly to that group. This aligns with the AWS best practice of using groups to manage permissions for multiple users with similar access needs, ensuring administrative overhead is reduced and permissions are inherited consistently.

Step-by-Step Solution

1
Group creation
An IAM group is created for the customer support team, and individual IAM user accounts are created for each agent and added to this group.
This establishes a logical boundary for managing permissions for a team of people with the same job function, following standard identity management practices.
2
Policy attachment
The S3 read-only IAM policy is attached directly to the group.
By attaching the policy to the group, all users added to the group automatically inherit the required permissions without needing direct policy assignment.

Key Concept

AWS IAM permissions management using IAM groups and policies to control access to resources.
Question 87Question →

A healthcare startup stores encrypted patient records in a private Amazon S3 bucket in its production AWS account. An internal compliance officer (an IAM user in the same account) requires read-only access to these records for auditing. Simultaneously, an automated diagnostic application running in an external partner's AWS account must upload new patient reports directly to the same bucket. The startup's security policy prohibits sharing credentials or setting up cross-account identity federation. Which of the following configurations represents the most secure, AWS-recommended approach to grant the required access?

Show answer & explanation

Answer: Attach an identity-based policy to the compliance officer's IAM user granting read access, and attach a resource-based policy (bucket policy) to the S3 bucket granting write access to the partner's external AWS account.

Answer

Attach an identity-based policy to the compliance officer's IAM user granting read access, and attach a resource-based policy (bucket policy) to the S3 bucket granting write access to the partner's external AWS account.
The correct answer is to attach an identity-based policy to the compliance officer's IAM user granting read access, and attach a resource-based policy (bucket policy) to the S3 bucket granting write access to the partner's external AWS account. Identity-based policies are optimal for managing access for users in the local account, while resource-based bucket policies are the most secure way to grant cross-account permissions directly without requiring the creation of local IAM users, the sharing of credentials, or the setup of full cross-account role assumption.

Step-by-Step Solution

1
Analyze the access requirements for the internal user.
The internal compliance officer is an IAM user in the same AWS account. An identity-based policy attached directly to the user (or their group) is the standard and most secure way to grant read access to S3.
Identity-based policies are designed to manage permissions for identities within the local account.
2
Analyze the access requirements for the external partner's application.
The application runs in an external AWS account. To grant cross-account access without sharing credentials, a resource-based S3 bucket policy should be configured to trust the external account's ARN or identity.
S3 bucket policies (resource-based) can directly grant cross-account access, eliminating the need to create IAM users or share long-term credentials.
3
Combine the configurations and evaluate best practices.
The combination of an identity-based policy for the internal user and a resource-based bucket policy for the external partner's application provides the most secure configuration while adhering to the principle of least privilege.
This avoids creating unnecessary IAM users with static keys or exposing root credentials, matching AWS security best practices.

Key Concept

Distinction between identity-based policies (attached to users/groups/roles) and resource-based policies (attached to resources like S3 buckets) for cross-account access.
Estimated Time:2m 0s
Question 88Question →

A global logistics company needs to evaluate its cloud environment against the Federal Risk and Authorization Management Program (FedRAMP) requirements. The company must obtain official AWS compliance documents and verify which AWS services are compliant under the FedRAMP authorization boundary. Which of the following two actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS FedRAMP partner package and authorization documents using AWS Artifact.; Consult the AWS Services in Scope by Compliance Program page to check service eligibility.

Answer

The correct actions are to download the AWS FedRAMP partner package and authorization documents using AWS Artifact, and to consult the AWS Services in Scope by Compliance Program page to check service eligibility.
The correct actions are to download the compliance documents using AWS Artifact and to consult the AWS Services in Scope by Compliance Program page. AWS Artifact is the official portal for self-service retrieval of security and compliance reports (such as FedRAMP, SOC, and PCI reports). The AWS Services in Scope by Compliance Program page lists all AWS services that meet specific compliance standards, allowing the customer to verify which services are compliant.

Step-by-Step Solution

1
Identify the requirement to retrieve AWS compliance reports and verify which services are compliant.
Recognize that AWS compliance documents must be obtained securely, and the scope of compliant services must be checked.
To ensure audit readiness and verify that only approved services are used in the compliant workload.
2
Determine the appropriate AWS tools and resources for these tasks.
Identify AWS Artifact as the central portal for security reports and the AWS Services in Scope webpage as the definitive directory for service compliance.
AWS Artifact provides self-service access to compliance reports, and the Services in Scope page details which services comply with specific standards.

Key Concept

Compliance and Governance
Question 89Question →

A company uses Amazon Route 53 to host and manage its domain name system (DNS) records. Under the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Show answer & explanation

Answer: Creating and configuring the DNS records inside the Route 53 hosted zones

Answer

Creating and configuring the DNS records inside the Route 53 hosted zones
Under the AWS Shared Responsibility Model, configuring resources, defining entries, and managing access to the services that are provisioned are customer responsibilities. Creating and configuring DNS records within Route 53 hosted zones is a configuration task managed by the customer. AWS retains responsibility for the physical servers, OS patching, and network routing of the Route 53 infrastructure.

Step-by-Step Solution

1
Identify the service type and model boundary in the scenario.
Amazon Route 53 is a fully managed DNS service provided by AWS.
Determining if a service is managed or unmanaged helps define what the customer must configure versus what AWS maintains automatically.
2
Distinguish between infrastructure security and data/configuration management.
AWS secures the physical hardware and patching of Route 53 servers, while the customer controls DNS record definitions and hosted zone settings.
Under the Shared Responsibility Model, the customer is responsible for security 'in' the cloud (configurations, access policies, data), and AWS is responsible for security 'of' the cloud (physical security, hardware, hypervisors).

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:45s
Question 90Question →

A municipal agency is planning to host citizen records on AWS. The agency's compliance team needs to obtain AWS SOC 3 reports and sign a Business Associate Addendum (BAA) with AWS. Which of the following options represent the correct service and action to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use AWS Artifact to retrieve the required SOC 3 compliance report; Use AWS Artifact to review and accept the Business Associate Addendum (BAA)

Answer

Use AWS Artifact to retrieve the required SOC 3 compliance report, and use AWS Artifact to review and accept the Business Associate Addendum (BAA).
AWS Artifact is the primary self-service portal for accessing AWS compliance reports and managing agreements. The service provides on-demand access to AWS security and compliance documents (such as SOC reports) and allows customers to review and accept agreements (such as the BAA) directly through the AWS Management Console.

Step-by-Step Solution

1
Identify the compliance and governance needs of the agency.
The agency needs to download official compliance reports (SOC 3) and accept a specific agreement (BAA) with AWS.
Understanding the compliance requirement determines which AWS service is needed.
2
Determine the AWS service designed for compliance reports and agreements.
AWS Artifact is the dedicated service for retrieving AWS security reports and accepting agreements.
AWS Artifact provides on-demand access to compliance documents and manages agreements directly through the console.

Key Concept

AWS compliance reports and agreements are managed through AWS Artifact.
Estimated Time:1m 0s
Question 91Question →

A company is conducting a security audit of its AWS infrastructure. The audit reveals that the IT team uses the AWS account root user for daily configuration tasks, and several application servers use embedded long-term AWS access keys to write data to Amazon S3. Which of the following actions should the company take to align with AWS Identity and Access Management (IAM) security best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) on the AWS account root user and create individual IAM users for daily administrative tasks.; Configure the application servers to use IAM roles with temporary credentials instead of long-term access keys.

Answer

Enable multi-factor authentication (MFA) on the AWS account root user and create individual IAM users for daily administrative tasks, and configure the application servers to use IAM roles with temporary credentials instead of long-term access keys.
The correct actions are securing the root user with multi-factor authentication (MFA) while using individual IAM users for daily administrative activities, and configuring application servers to use IAM roles with temporary credentials rather than long-term access keys. These actions adhere to the principle of least privilege, guarantee auditability, and minimize the risk of compromised long-term credentials.

Step-by-Step Solution

1
Analyze the security risk of using the AWS account root user for daily configuration tasks.
The root user possesses unrestricted privileges that cannot be locked down. Continued operational use increases the attack surface.
AWS security standards state that the root user should be secured with MFA and restricted to a tiny subset of account-level administrative actions.
2
Address the risk of hardcoded long-term credentials on application servers.
Long-term access keys are permanent until rotated manually, presenting a leak risk if credentials are checked into repositories or compromised.
AWS recommends replacing static credentials with IAM roles, which leverage short-term, temporary security credentials that rotate automatically.
3
Evaluate and discard insecure administrative models.
Shared credentials (like shared IAM users or shared root accounts) break audit trails, and requesting AWS to manage client keys violates the Shared Responsibility Model.
Every administrator must have a unique identity, and the customer retains operational control over IAM configuration.

Key Concept

Applying core IAM security principles including root account protection, temporary credentials via IAM roles, and distinct administrative identities.
Estimated Time:2m 0s
Question 92Question →

A startup is preparing for a security audit and needs to download official AWS compliance documentation. Which AWS service provides on-demand access to AWS security and compliance reports, such as Service Organization Control (SOC) reports and ISO certifications?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the correct service because it is specifically designed to provide customers with on-demand access to AWS security and compliance reports (such as SOC 1/2/3 and ISO certifications) and agreements.

Step-by-Step Solution

1
Identify the user requirement, which is to find and download official AWS compliance documentation (such as SOC and ISO reports) to support a security audit.
Access to official AWS security and compliance reports is required.
These reports demonstrate that the underlying AWS infrastructure meets specific security standards.
2
Select the AWS service designed as a self-service portal for retrieving these specific audit reports and compliance agreements.
AWS Artifact is the designated service for this purpose.
AWS Artifact provides on-demand access to AWS compliance documents.

Key Concept

AWS Artifact is the central repository for on-demand access to AWS compliance reports and agreements.
Estimated Time:45s
Question 93Question →

An energy technology provider is migrating its financial billing system to AWS. The company's compliance department needs to obtain a confidential AWS System and Organization Controls (SOC) 1 Type II report to prove to their external auditors that the AWS infrastructure controls are operating effectively. Which AWS resource should the company use to locate, accept the terms of, and download this report?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the go-to portal for downloading AWS compliance documents, such as SOC 1, SOC 2, and PCI DSS reports. It provides a secure, self-service interface where customers can accept the terms of the documents and download them to share with external auditors.

Step-by-Step Solution

1
Determine the user's primary requirement.
The requirement is to retrieve AWS's own third-party security and compliance reports (SOC 1 Type II).
This establishes the scope as compliance report retrieval rather than active resource monitoring or account log auditing.
2
Evaluate the capabilities of the available AWS security and governance services.
AWS Artifact provides on-demand access to AWS compliance reports and agreements. AWS Config monitors resource configurations. AWS CloudTrail records API calls. AWS Support manages customer cases.
This highlights the differences in service purposes to find the correct tool.
3
Select the correct service based on the evaluated capabilities.
AWS Artifact is the specific portal where customers accept agreements and download SOC and PCI reports.
Only AWS Artifact meets the direct, self-service download requirement for the SOC 1 Type II report.

Key Concept

AWS Artifact serves as the central, self-service portal for accessing AWS compliance reports, including SOC, PCI, and ISO certifications.
Question 94Question →

A mobile gaming startup is deploying a high-throughput, low-latency leaderboard and player session store using Amazon ElastiCache for Redis. The startup needs to secure this environment to protect user session tokens from unauthorized external access while maintaining compliance with regional data privacy standards. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

Show answer & explanation

Answer: Configuring VPC security groups to restrict network access to the cache cluster nodes

Answer

Configuring VPC security groups to restrict network access to the cache cluster nodes
The correct answer is configuring VPC security groups to restrict network access to the cache cluster nodes. Under the AWS Shared Responsibility Model, firewall configuration and network access controls (such as security groups) are always the customer's responsibility, regardless of whether the service is IaaS or a managed database/cache service.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon ElastiCache for Redis is a managed database/caching service.
Managed services shift the management of the underlying physical infrastructure, operating system, and database software patching to AWS.
2
Determine the boundary of customer responsibility for managed services under the Shared Responsibility Model.
The customer remains responsible for data protection, identity and access management (IAM), and network traffic configuration (such as security groups).
This isolates the customer's responsibility to security 'in' the cloud, specifically network firewall rules and access credentials.
3
Evaluate the choices to find the one matching the customer's responsibility.
Configuring VPC security groups is a customer task, whereas patching the guest OS, maintaining physical security, and performing physical audits are AWS responsibilities.
This correctly identifies the boundary of network security configuration for ElastiCache nodes.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:1m 5s
Question 95Question →

An online media streaming company is undergoing a security audit. The compliance team needs to access AWS security documents and accept standard agreements regarding content protection. Which TWO of the following tasks can the team perform using AWS Artifact to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Download AWS security and compliance documents, such as SOC and PCI reports; Review and accept AWS compliance agreements, such as a Business Associate Addendum (BAA)

Answer

Downloading AWS security and compliance documents, such as SOC and PCI reports, and reviewing and accepting AWS compliance agreements, such as a Business Associate Addendum (BAA).
AWS Artifact is the central portal for retrieving AWS compliance reports and managing agreements. The option to download compliance documents (such as SOC/PCI reports) and the option to review and accept compliance agreements (such as a BAA) correctly identify the core functionalities of AWS Artifact.

Step-by-Step Solution

1
Analyze the business requirement of accessing security documents and accepting agreements.
Identify that AWS Artifact is the primary self-service portal for security reports and agreements.
AWS Artifact enables customers to download compliance reports (such as SOC and PCI) and sign agreements (such as a BAA).
2
Evaluate the distractors against the Shared Responsibility Model and other security services.
Eliminate options involving instance scanning, API auditing, and physical data center security.
These tasks are handled by Amazon Inspector, AWS CloudTrail, and AWS internal physical security teams respectively.

Key Concept

AWS Artifact is a self-service compliance portal that provides on-demand access to AWS security and compliance reports and online agreements.
Estimated Time:1m 0s
Question 96Question →

A consulting firm is storing client project documents in an Amazon Simple Storage Service (Amazon S3) bucket. Under the AWS Shared Responsibility Model, which operational task is the sole responsibility of the customer?

Show answer & explanation

Answer: Configuring S3 bucket policies and enabling data encryption

Answer

Configuring S3 bucket policies and enabling data encryption
Under the AWS Shared Responsibility Model, customers are responsible for security 'in' the cloud. For Amazon S3, this includes managing access permissions using S3 bucket policies and deciding how to encrypt the stored objects.

Step-by-Step Solution

1
Determine the service model type for Amazon S3 in the scenario.
Amazon S3 is a managed storage service.
Determining the service type helps define the boundary between customer and AWS responsibilities.
2
Differentiate between security 'of' the cloud and security 'in' the cloud for S3.
AWS manages physical security, hardware, and server operating systems. The customer manages data access configurations, user permissions, and data encryption.
Since the customer owns the data and access configuration, configuring S3 bucket policies and enabling encryption falls under customer responsibility.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:45s
Question 97Question →

A company is using Amazon DynamoDB to store user profile data for a mobile application. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring Identity and Access Management (IAM) policies to restrict table access; Enabling client-side encryption for the data before it is written to the table

Answer

Configuring Identity and Access Management (IAM) policies to restrict table access and Enabling client-side encryption for the data before it is written to the table
Configuring access control policies and managing data encryption (like client-side encryption) are customer responsibilities because they fall under 'security in the cloud'. The customer has sole control over who is authorized to access their database resources and how their data is encrypted before or during transit.

Step-by-Step Solution

1
Analyze the service type
Amazon DynamoDB is a fully managed (PaaS/serverless) database service.
Managed services shift the responsibility of operating system patching, hardware provisioning, and database engine maintenance to AWS.
2
Identify customer responsibilities for managed services
The customer is still responsible for data protection (like client-side encryption) and access management (IAM policies).
Under the Shared Responsibility Model, the customer is always responsible for the security of their data and who has access to it ('security in the cloud').

Key Concept

Under the AWS Shared Responsibility Model, AWS is responsible for 'security of the cloud' (managed database engine, OS patching, hardware, and physical security), while the customer is responsible for 'security in the cloud' (data classification, client-side encryption, and access management/IAM policies).
Question 98Question →

A startup needs to grant a new database administrator access to manage Amazon RDS databases. Which of the following actions aligns with AWS security best practices for identity management?

Show answer & explanation

Answer: Create a dedicated IAM user for the database administrator and attach an identity-based policy containing only the permissions required for Amazon RDS management.

Answer

Create a dedicated IAM user for the database administrator and attach an identity-based policy containing only the permissions required for Amazon RDS management.
The correct option outlines the standard AWS identity best practice: creating a distinct, individual IAM user for each person requiring access and attaching an identity-based policy restricted to only the resources they need (least privilege).

Step-by-Step Solution

1
Identify the type of identity required for an internal human user who needs permanent, daily access.
An individual IAM user must be created rather than sharing credentials or using temporary roles directly for daily login without federation.
This establishes accountability and ensures that individual actions can be audited.
2
Determine the minimum permissions required for the user to perform their specific job function.
An identity-based IAM policy should be created and attached to the user, granting access only to Amazon RDS resources.
This adheres to the principle of least privilege, minimizing the security footprint of the user credentials.

Key Concept

AWS identity management best practices including the use of individual IAM users and the principle of least privilege.
Estimated Time:45s
Question 99Question →

A public sector organization is migrating a legacy database to AWS and must ensure the architecture meets strict government compliance guidelines. The organization needs to retrieve AWS's third-party compliance reports and must understand the compliance boundaries under the AWS Shared Responsibility Model. Which of the following describes the correct service for retrieving these reports and the compliance responsibility division if they deploy the database on Amazon EC2?

Show answer & explanation

Answer: AWS Artifact is used to retrieve the compliance reports, and the customer is responsible for patching the guest operating system and the database engine.

Answer

AWS Artifact is used to retrieve the compliance reports, and the customer is responsible for patching the guest operating system and the database engine.
AWS Artifact is the dedicated service for retrieving AWS compliance documents, including SOC and PCI reports. Because the database is hosted on Amazon EC2, it functions as an Infrastructure as a Service (IaaS) model where the customer is responsible for patching the guest operating system and the database engine.

Step-by-Step Solution

1
Identify the service required to retrieve AWS's official third-party compliance audits and certificates.
AWS Artifact is identified as the portal providing on-demand access to AWS compliance reports (e.g., SOC, PCI, FedRAMP).
AWS Artifact serves as the centralized repository for compliance documentation.
2
Determine the boundary of responsibility for an Amazon EC2-based database deployment.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, meaning the customer is responsible for security 'in the cloud,' which includes the guest operating system, applications, database engines, and patching.
Under the Shared Responsibility Model, AWS manages security 'of the cloud' (physical host, virtualization layer) while the customer manages security 'in the cloud' (guest OS, database, and configurations).

Key Concept

AWS Artifact is the primary portal for compliance reports, and customers are responsible for guest OS and application patching on EC2 under the Shared Responsibility Model.
Question 100Question →

A retail company is migrating its core transactional inventory system to Amazon Aurora MySQL-Compatible Edition. The database will store sensitive inventory and pricing data and must be accessible only by specific application servers running in a private subnet. According to the AWS Shared Responsibility Model, which TWO of the following tasks are the responsibility of the customer to secure and maintain this database cluster?

Select all that apply

Show answer & explanation

Answer: Configuring database-level user accounts, database permissions, and roles within the MySQL database engine.; Setting up security group rules to restrict incoming database traffic to only the authorized application servers.

Answer

Configuring database-level user accounts, permissions, and roles within the MySQL engine, as well as setting up security group rules to restrict network traffic, are the responsibilities of the customer.
For a managed database service like Amazon Aurora, the customer is responsible for 'security in the cloud'. This includes configuring database-level users, roles, and permissions within the engine to enforce the principle of least privilege, and configuring network security rules (security groups) to control which resources can communicate with the database. AWS handles the maintenance of the underlying physical servers, hypervisors, and guest operating system.

Step-by-Step Solution

1
Identify the type of service being used in the scenario.
Amazon Aurora is a fully managed relational database service.
Understanding the service category (managed database/PaaS) helps determine the boundary where AWS takes over guest OS and software maintenance.
2
Evaluate the customer's responsibilities for a managed database service.
The customer is responsible for firewall settings (security groups), data encryption configurations, and database-level user access control.
AWS manages the database platform, but the customer retains control over network access to the database and internal database-level permissions.
3
Identify AWS's responsibilities for a managed database service.
AWS handles physical infrastructure security, host operating system patching, database engine updates, and hardware lifecycle management.
Managed services offload the operational burden of OS-level administration and physical infrastructure management to AWS.
4
Select the two correct options that map to the customer's responsibilities.
The correct selections are managing database-level user accounts/roles and configuring security group rules.
These tasks directly represent configuration of access control and network firewalls, which remain customer responsibilities.

Key Concept

AWS Shared Responsibility Model for Managed Services (PaaS)
PreviousPage 5 / 23Next
Security and Compliance Practice Questions — AWS Certified Cloud Practitioner — Page 5 | Examkin