Security and Compliance

210. Application teams must be able to create IAM roles for their own workloads without a central team reviewing each request, and without exceeding their own permissions. Which solution meets these requirements?

1. A Grant the teams full IAM access and audit the roles they create each month.
2. B Require every role request to be raised as a ticket for the central team to create.
3. C Delegate role creation to the teams with a policy that requires a permissions boundary on every role they create.
4. D Create a fixed set of roles centrally and ask teams to use whichever fits.

211. Machine identities must have their credentials rotated automatically without application changes. Which solution meets these requirements?

1. A Store the credentials in Systems Manager Parameter Store as String parameters and update them quarterly.
2. B Embed the credentials in the application configuration and redeploy after each rotation.
3. C Issue long-lived IAM access keys and rotate them manually each quarter.
4. D Store the credentials in AWS Secrets Manager with rotation enabled and have applications retrieve them at run time.

212. Access must be granted based on resource tags rather than by enumerating resources in each policy. Which approach meets these requirements?

1. A Implement attribute-based access control using policy conditions that compare principal tags against resource tags.
2. B Enumerate the resource ARNs in each policy and update them as resources change.
3. C Implement role-based access control with one role per resource group.
4. D Grant broad permissions and rely on tagging for cost reporting only.

213. Workforce users must reach many AWS accounts with corporate credentials and centrally assigned permissions. Which solution meets these requirements?

1. A Create IAM users in each account synchronized from the corporate directory.
2. B Create an Amazon Cognito user pool federated to the corporate provider.
3. C Configure a SAML identity provider and matching roles in every member account.
4. D Configure AWS IAM Identity Center with the corporate provider as the identity source and assign permission sets across the accounts.

214. AWS WAF rules and security group baselines must be applied and continuously enforced across every account from one place. Which solution meets these requirements?

1. A Configure AWS Firewall Manager policies from the delegated administrator account so the rules are applied and drift is remediated.
2. B Create an AWS Config conformance pack reporting accounts missing the rules.
3. C Attach a service control policy requiring the rules to be present in each account.
4. D Deploy the rules with CloudFormation StackSets to every account.

215. Sensitive data held in Amazon S3 across many accounts must be discovered and classified automatically. Which solution meets these requirements?

1. A Enable S3 server access logging and analyse the request patterns.
2. B Enable Amazon Inspector and review its findings for the buckets.
3. C Run an AWS Glue crawler over the buckets and review the inferred schemas.
4. D Enable Amazon Macie with a delegated administrator and run sensitive data discovery jobs across the organization's buckets.

216. TLS certificates for internal services must be issued and renewed from an authority the organization controls. Which solution meets these requirements?

1. A Purchase certificates from an external provider and import them into ACM.
2. B Request public certificates from AWS Certificate Manager for the internal domain names.
3. C Deploy AWS Private Certificate Authority and issue certificates from it to the internal services.
4. D Generate self-signed certificates on each service and distribute the trust chain manually.

217. Defence in depth must be applied to a public web application beyond a single control. Which combination of steps meets these requirements? (Select TWO.)

1. A Associate an AWS WAF web ACL with managed rule groups to the application endpoint.
2. B Increase the application's instance size so it absorbs more traffic.
3. C Restrict the application's security groups and network ACLs to the required flows only.
4. D Enable detailed CloudWatch monitoring on the application instances.
5. E Publish the application's architecture diagram to the security team.

218. An automated compliance check must confirm continuously that CloudTrail log file validation remains enabled on every trail in the organization. Which solution meets these requirements?

1. A Run the CloudTrail validate-logs command manually each quarter.
2. B Review the trail configuration in the console during the annual audit.
3. C Deploy an AWS Config rule through an organization conformance pack that evaluates log file validation on each trail.
4. D Enable log file validation when each trail is created and record the setting in the runbook.

219. A security team must be alerted when an IAM policy grants access to principals outside the organization. Which solution meets these requirements?

1. A Enable IAM Access Analyzer with the account as the zone of trust and review the findings weekly.
2. B Enable Amazon GuardDuty and review findings for anomalous cross-account activity.
3. C Create an AWS Config rule that evaluates IAM policies for external principals.
4. D Enable IAM Access Analyzer with the organization as the zone of trust and route its findings to a notification target.

220. Unexpected security events must raise an alert rather than waiting for a scheduled review. Which solution meets these requirements?

1. A Export the findings to Amazon S3 for quarterly analysis.
2. B Route GuardDuty and Security Hub findings through EventBridge to a notification or remediation target as they are produced.
3. C Review the GuardDuty findings console at the weekly operations meeting.
4. D Increase the frequency of the Amazon Inspector assessment runs.

221. An auditor must establish which principal made a specific infrastructure change and from where. Which source provides this?

1. A Review the VPC Flow Logs for the subnet containing the resource.
2. B Query AWS CloudTrail for the relevant API call and read the identity, timestamp, and source address from the record.
3. C Review the AWS Config configuration timeline for the changed resource.
4. D Query CloudWatch Logs for the application logs from the affected period.

222. A session issued to a role must be restricted further than the role's own policy for one specific operation. Which approach is appropriate?

1. A Pass a session policy when assuming the role so the effective permissions are the intersection of both.
2. B Reduce the role's maximum session duration.
3. C Attach an additional policy to the role permanently.
4. D Create a second role with narrower permissions for that operation.

223. Access to a resource must be granted based on a tag matching between the requesting principal and the resource. Which approach is appropriate?

1. A Grant broad access and audit the usage afterwards.
2. B Enumerate the permitted resource ARNs in the policy.
3. C Create a separate role for each tag value.
4. D Write a policy condition comparing the principal's tag against the resource's tag so access follows tagging.

224. A machine identity's credential must rotate without any application change or restart. Which approach is appropriate?

1. A Read the credential from a configuration file on the host.
2. B Read the credential from an environment variable set at deployment.
3. C Retrieve the credential from a managed secret store at use time so a rotated value is picked up automatically.
4. D Cache the credential in the application at startup.

225. An organization must ensure new Amazon S3 buckets cannot be made public in any account. Which approach is appropriate?

1. A Apply a bucket policy denying public access to each bucket as it is created.
2. B Enable S3 Block Public Access at the account level and prevent its modification with a service control policy.
3. C Create an AWS Config rule that reports public buckets for remediation.
4. D Review the bucket inventory monthly for public buckets.

226. Certificates used by internal services must renew without operator action. Which approach is appropriate?

1. A Issue long-lived certificates so renewal is infrequent.
2. B Issue self-signed certificates that do not expire.
3. C Issue certificates manually and set a calendar reminder before expiry.
4. D Issue the certificates from a private certificate authority integrated with a service that renews and deploys them automatically.

227. Sensitive data discovered in an unexpected location must trigger an automated response. Which approach is appropriate?

1. A Export the findings to a report for quarterly analysis.
2. B Review the discovery findings at the weekly security meeting.
3. C Increase the frequency of the discovery jobs.
4. D Route the discovery finding through EventBridge to an Automation runbook that restricts access and notifies the owner.

228. An audit requires evidence that a control has operated continuously rather than at a point in time. Which approach is appropriate?

1. A Confirm the control was configured correctly at deployment.
2. B Review the control's configuration at the end of each quarter.
3. C Produce a screenshot of the control's configuration at audit time.
4. D Collect evidence continuously against the control with an audit framework so the record covers the whole period.

229. An organization must detect when a resource configuration drifts from its infrastructure as code definition. Which approach is appropriate?

1. A Redeploy the stack on a schedule to overwrite any drift.
2. B Compare the template files against the previous release.
3. C Run CloudFormation drift detection on the stacks and alert on resources reported as drifted.
4. D Review the resource configuration manually each quarter.

230. An alert must fire when an unusual pattern of API activity occurs in an account, without a predefined threshold. Which approach is appropriate?

1. A Review the CloudTrail event history each morning.
2. B Enable AWS Config and review configuration changes daily.
3. C Enable CloudTrail Insights so deviations from the account's established call pattern generate events.
4. D Create a CloudWatch alarm on a fixed number of API calls per hour.

231. An IAM policy must permit an action only when the requested resource carries a tag matching the principal's tag. Which element is required?

1. A A separate statement per tag value.
2. B A permissions boundary listing the tags.
3. C A condition comparing the resource tag against the principal tag using a policy variable.
4. D A resource ARN listing every permitted resource.

232. Temporary credentials issued to a federated user must be restricted below the role's permissions for one session. Which mechanism is appropriate?

1. A A permissions boundary on the role.
2. B An additional policy attached to the role permanently.
3. C A session policy passed when the role is assumed, producing the intersection of role and session permissions.
4. D A shorter maximum session duration.

233. An automated control must prevent an EBS volume from being created without encryption. Which approach is appropriate?

1. A Attach an IAM policy denying volume creation without encryption to each role.
2. B Review new volumes weekly for encryption.
3. C Create a Config rule reporting unencrypted volumes.
4. D Enable EBS encryption by default in each Region so every new volume is encrypted regardless of the request.

234. A pipeline must prevent a secret from being committed to source control. Which approach is appropriate?

1. A Store secrets in a separate repository.
2. B Run secret scanning on commits and reject any that contain credential patterns.
3. C Review each commit manually for secrets.
4. D Rotate all credentials weekly in case one is committed.

235. An organization must detect when a resource is created without required tags and correct it automatically. Which combination of steps meets these requirements? (Select TWO.)

1. A Review the resource inventory monthly for untagged resources.
2. B Create an AWS Config rule evaluating the required tag keys.
3. C Attach an automatic remediation action that applies the tags or notifies the owner.
4. D Enable cost allocation tags in the billing console.
5. E Create a CloudWatch alarm on the resource count.

236. An audit must confirm that a control operated throughout a period rather than at a point in time. Which evidence is appropriate?

1. A A screenshot of the control's configuration taken at audit time.
2. B Continuous compliance records from AWS Config or Audit Manager covering the whole period.
3. C A statement from the engineer who configured the control.
4. D The CloudFormation template that created the control.

237. An organization must grant a pipeline temporary access to a production account for the duration of a deployment. Which approach is appropriate?

1. A Grant the pipeline's account administrator access to production.
2. B Create an IAM user in the production account for the pipeline.
3. C Share credentials with the pipeline through a secret.
4. D Have the pipeline assume a deployment role with a short session duration scoped to the deployment actions.

238. An organization must ensure that IAM roles created by automation carry required tags for attribution. Which approach is appropriate?

1. A Document the tagging requirement for automation authors.
2. B Create a Config rule reporting untagged roles.
3. C Add a policy condition requiring the tag keys on the role creation action so untagged roles cannot be created.
4. D Tag roles during the weekly review.

239. An organization must revoke a departed employee's access across all accounts immediately. Which approach is appropriate?

1. A Rotate the access keys in each account.
2. B Remove the user from each account's permission sets individually.
3. C Disable the user in the central identity provider, which removes their federated access to every account.
4. D Delete the user's IAM users in each account.

240. An organization must prevent a deployment from disabling encryption on a resource. Which approach is appropriate?

1. A Review deployment templates before merge.
2. B Add a policy condition denying the create or modify action when the encryption parameter is absent or false.
3. C Enable encryption by default where the service supports it and accept the rest.
4. D Create a Config rule reporting unencrypted resources.

241. An organization must scan infrastructure code for hardcoded credentials before it is deployed. Which approach is appropriate?

1. A Rotate credentials regularly in case one is hardcoded.
2. B Run secret scanning as a required pipeline stage that fails on any credential pattern found.
3. C Review the code manually during pull request review.
4. D Scan the deployed resources for exposed credentials.

242. An organization must ensure a deployment cannot grant a role broader permissions than policy allows. Which approach is appropriate?

1. A Audit created roles weekly.
2. B Review the deployment's IAM changes manually.
3. C Require a permissions boundary on roles the deployment creates, enforced by a condition on the create action.
4. D Restrict who may run the deployment.

243. An organization must confirm that a security control remains in place across accounts without querying each one. Which approach is appropriate?

1. A Review the organization's account list.
2. B Ask each account owner for confirmation.
3. C Query each account's Config console in turn.
4. D Aggregate AWS Config compliance data to a central account and query the aggregated view.

244. An audit must show that a remediation ran each time a control was found non-compliant. Which source is appropriate?

1. A The Config rule's current compliance status.
2. B The account's CloudTrail management events.
3. C The remediation automation's execution history correlated with the Config rule's compliance events.
4. D The resource's current configuration.

245. An organization must evaluate a new account against its control framework as soon as it is created. Which approach is appropriate?

1. A Ask the account owner to deploy the pack.
2. B Deploy the organization conformance pack to the organizational unit with automatic deployment so new accounts are evaluated on joining.
3. C Deploy the conformance pack manually after the account is handed over.
4. D Evaluate the account at the next quarterly audit.