question: 1
Which AWS service helps you monitor and automatically respond to security events, such as unauthorized API calls?
A. AWS CloudTrail
B. Amazon GuardDuty
C. AWS Security Hub
D. AWS IAM
correct answer: B
explanation: 🛡️ Amazon GuardDuty continuously monitors for malicious or unauthorized behavior and generates security findings for potential threats, such as unauthorized API calls.

question: 2
Which of the following best describes AWS IAM roles?
A. They are used to manage access to AWS services and resources within an account.
B. They are used to define security policies that are attached to users.
C. They are used to allow resources to access other resources within the same account.
D. They are used to limit which regions a user can access in AWS.
correct answer: A
explanation: 🔑 AWS IAM roles are used to grant permissions to users, groups, or AWS services to access AWS resources within an account, ensuring secure access management.

question: 3
Which of the following services allows you to enforce compliance with security policies and auditing for AWS resources?
A. AWS Config
B. AWS Systems Manager
C. AWS CloudTrail
D. AWS Shield
correct answer: A
explanation: 📜 AWS Config enables you to continuously monitor and record your AWS resource configurations and evaluate compliance against defined security policies.

question: 4
What is the main purpose of AWS Key Management Service (KMS)?
A. To provide centralized control over the security of your AWS resources
B. To manage and store encryption keys used for encrypting data
C. To monitor and log API calls to AWS services
D. To enforce IAM policies across AWS accounts
correct answer: B
explanation: 🔒 AWS KMS helps you manage and control the encryption keys used to encrypt your data, ensuring that only authorized users and applications can decrypt it.

question: 5
Which AWS service would you use to protect an application running on EC2 instances from DDoS attacks?
A. AWS Shield
B. AWS WAF
C. AWS IAM
D. Amazon CloudWatch
correct answer: A
explanation: 🛡️ AWS Shield provides DDoS protection for applications running on AWS, helping mitigate the impact of large-scale attacks on EC2 instances.

question: 6
Which of the following AWS services can be used to centrally manage security and compliance across multiple AWS accounts?
A. AWS IAM
B. AWS Security Hub
C. AWS Config
D. AWS CloudTrail
correct answer: B
explanation: 🔍 AWS Security Hub provides a central view of security alerts and compliance status from multiple AWS accounts, helping you monitor and manage security issues.

question: 7
What is the recommended way to handle API keys and secrets used by your application running on AWS?
A. Store API keys in plaintext in your application code
B. Use Amazon S3 to store API keys
C. Use AWS Secrets Manager to securely store and rotate secrets
D. Hardcode API keys into the environment variables of EC2 instances
correct answer: C
explanation: 🔑 AWS Secrets Manager helps you securely store, retrieve, and automatically rotate sensitive data like API keys, preventing hardcoding and improving security.

question: 8
Which of the following AWS services can help you detect unauthorized access to your AWS resources?
A. AWS Shield
B. Amazon Inspector
C. AWS GuardDuty
D. AWS Config
correct answer: C
explanation: 👀 AWS GuardDuty is a threat detection service that identifies malicious or unauthorized activity by continuously monitoring AWS environments for security risks.

question: 9
What AWS service can you use to enable fine-grained access control to specific data within an Amazon S3 bucket?
A. S3 Bucket Policies
B. IAM Policies
C. S3 Access Control Lists (ACLs)
D. All of the above
correct answer: D
explanation: 🔐 You can use a combination of S3 Bucket Policies, IAM Policies, and S3 ACLs to control fine-grained access to specific data within an S3 bucket.

question: 10
Which AWS service can be used to enable automatic scaling of web applications based on demand, improving security by preventing denial-of-service attacks?
A. Amazon EC2 Auto Scaling
B. AWS Lambda
C. AWS Elastic Load Balancer
D. Amazon CloudFront
correct answer: A
explanation: ⚙️ Amazon EC2 Auto Scaling automatically adjusts the number of instances to handle traffic spikes and scale down during low-demand periods, improving performance and security.

question: 11
Which AWS service helps you identify and manage user permissions across multiple accounts?
A. AWS CloudTrail
B. AWS Config
C. AWS Organizations
D. AWS IAM
correct answer: C
explanation: 🌍 AWS Organizations allows you to manage and enforce user permissions, policies, and account structures across multiple AWS accounts.

question: 12
What is the most secure way to manage long-term access to AWS resources?
A. Use root user credentials
B. Create and manage IAM users with specific permissions
C. Share access keys between IAM users
D. Use SSH keys for all EC2 instances
correct answer: B
explanation: 🔑 The best practice is to create IAM users with specific permissions rather than using root credentials or sharing access keys. This reduces the risk of unauthorized access.

question: 13
What feature does AWS provide to prevent unauthorized access to EC2 instances, by blocking non-compliant configurations?
A. AWS Config
B. AWS Shield
C. AWS WAF
D. Amazon Inspector
correct answer: A
explanation: 📜 AWS Config continuously monitors your AWS resources to detect non-compliant configurations, ensuring that only compliant EC2 instances are allowed access.

question: 14
Which AWS service is primarily used for automating security compliance and auditing of cloud resources?
A. AWS Security Hub
B. AWS CloudTrail
C. AWS Config
D. AWS CloudFormation
correct answer: C
explanation: 🛠️ AWS Config tracks configuration changes and helps automate compliance auditing to ensure AWS resources are compliant with your security and governance policies.

question: 15
What should you use to automatically rotate credentials like API keys or passwords for AWS resources?
A. AWS IAM Roles
B. AWS Secrets Manager
C. AWS CloudTrail
D. AWS Lambda
correct answer: B
explanation: 🔑 AWS Secrets Manager helps you automatically rotate credentials like API keys, passwords, and database credentials, ensuring that sensitive information is managed securely.

question: 16
Which of the following is a key advantage of using AWS KMS for encryption?
A. It only supports symmetric encryption.
B. It is fully managed and integrates with AWS services.
C. It requires custom hardware to function.
D. It is only available for EC2 instances.
correct answer: B
explanation: 🔒 AWS KMS is a fully managed service that integrates seamlessly with other AWS services, simplifying encryption management for your data and applications.

question: 17
Which of the following actions would help you secure an S3 bucket?
A. Enable versioning and encryption
B. Assign IAM policies to S3 objects
C. Disable public access for the S3 bucket
D. All of the above
correct answer: D
explanation: 🛡️ To secure an S3 bucket, you should enable versioning and encryption, assign appropriate IAM policies, and disable public access to ensure data protection and secure access.

question: 18
Which AWS service allows you to inspect the security posture of your AWS accounts and resources?
A. AWS Shield
B. Amazon Inspector
C. AWS Security Hub
D. AWS GuardDuty
correct answer: C
explanation: 🔍 AWS Security Hub provides an aggregated view of security findings, helping you assess and improve the security posture of your AWS resources.

question: 19
Which of the following is a best practice for securing Amazon EC2 instances?
A. Disable all inbound network traffic
B. Use security groups to control access to instances
C. Use root user access for managing instances
D. Store application secrets in EC2 instance metadata
correct answer: B
explanation: 🔒 Security groups act as virtual firewalls for EC2 instances, controlling inbound and outbound traffic based on defined rules. This is the best practice for securing EC2 instances.

question: 20
What should you use to control access to your AWS resources based on the principle of least privilege?
A. AWS IAM Policies
B. AWS Lambda
C. AWS CloudTrail
D. Amazon S3 Bucket Policies
correct answer: A
explanation: 🛡️ AWS IAM Policies allow you to control access to AWS resources based on the principle of least privilege, ensuring that users and services only have the permissions necessary for their tasks.