CCP AWS Security and Compliance 1 — Questions and Answers
Question 1: Which AWS service provides a centralized view of security alerts and compliance status across your AWS accounts?
- AWS Security Hub (Correct answer)
- AWS Shield
- Amazon GuardDuty
- AWS Inspector
Correct answer: AWS Security Hub
AWS Security Hub provides a comprehensive view of your security state in AWS and helps you check your environment against security industry standards.
Question 2: Under the AWS Shared Responsibility Model, who is responsible for patching the guest operating system on an Amazon EC2 instance?
- AWS
- The customer (Correct answer)
- Both AWS and the customer equally
- A third-party vendor
Correct answer: The customer
Under the shared responsibility model, the customer is responsible for patching and maintaining the guest OS on EC2 instances.
Question 3: Which AWS service helps you detect unusual activity and potential threats in your AWS account using machine learning?
- AWS WAF
- Amazon Macie
- Amazon GuardDuty (Correct answer)
- AWS Config
Correct answer: Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and anomalous behavior using machine learning.
Question 4: What is the AWS service that enables you to manage encryption keys for your data?
- AWS Certificate Manager
- AWS Key Management Service (KMS) (Correct answer)
- AWS Secrets Manager
- AWS CloudHSM
Correct answer: AWS Key Management Service (KMS)
AWS Key Management Service (KMS) is a managed service that makes it easy to create and control encryption keys used to encrypt your data.
Question 5: Which principle states that users should only be granted the permissions they need to perform their job?
- Defense in depth
- Least privilege (Correct answer)
- Zero trust
- Separation of duties
Correct answer: Least privilege
The principle of least privilege means granting only the minimum permissions required to perform a task, reducing the attack surface.
Question 6: Which AWS service provides DDoS protection at no additional cost for all AWS customers?
- AWS Shield Advanced
- AWS WAF
- AWS Shield Standard (Correct answer)
- Amazon CloudFront
Correct answer: AWS Shield Standard
AWS Shield Standard is automatically included for all AWS customers at no extra charge and protects against common DDoS attacks.
CCP AWS Security and Compliance 1
Which AWS service provides a centralized view of security alerts and compliance status across your AWS accounts?