AWS Solutions Architect Security & Compliance 1 — Questions and Answers
Question 1: Which AWS service is used to manage user access and permissions securely?
- AWS Shield
- AWS Identity and Access Management (IAM) (Correct answer)
- Amazon S3
- AWS WAF
Correct answer: AWS Identity and Access Management (IAM)
AWS Identity and Access Management (IAM) is the AWS service used to manage user access and permissions securely. IAM allows you to control who is authenticated and authorized to use resources, enabling you to define granular permissions for users, groups, and roles. This is fundamental for enforcing the principle of least privilege and maintaining a secure cloud environment.
Question 2: What is the primary benefit of enabling Multi-Factor Authentication (MFA) for AWS accounts?
- Speeds up the login process
- Eliminates the need for passwords
- Adds an extra layer of security against unauthorized access (Correct answer)
- Allows unlimited access to all AWS services
Correct answer: Adds an extra layer of security against unauthorized access
The primary benefit of enabling Multi-Factor Authentication (MFA) for AWS accounts is that it adds a crucial extra layer of security against unauthorized access. MFA requires users to provide two or more verification factors to gain access, typically something they know (password) and something they have (e.g., a token or mobile device). This significantly reduces the risk of account compromise, even if a password is stolen.
Question 3: Which AWS service helps protect applications from Distributed Denial of Service (DDoS) attacks?
- AWS IAM
- AWS Shield (Correct answer)
- AWS CloudFormation
- AWS Lambda
Correct answer: AWS Shield
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. It provides always-on detection and automatic inline mitigations to protect against common and sophisticated DDoS attacks. This ensures the availability and performance of your applications even under attack.
Question 4: What is the purpose of AWS Key Management Service (KMS)?
- Monitors network traffic
- Manages encryption keys for securing data (Correct answer)
- Automates infrastructure deployment
- Optimizes cloud storage usage
Correct answer: Manages encryption keys for securing data
AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data. It integrates with other AWS services to provide encryption for data at rest and in transit. KMS helps you maintain control over your cryptographic keys, enhancing data security and compliance.
Question 5: Which AWS service provides compliance and governance monitoring for cloud resources?
- AWS CloudTrail
- AWS Config (Correct answer)
- AWS Auto Scaling
- AWS Lambda
Correct answer: AWS Config
AWS Config provides a detailed inventory of your AWS resources and their configurations, continuously monitoring for changes. It allows you to assess, audit, and evaluate the configurations of your AWS resources, helping ensure compliance with internal guidelines and regulatory standards. By tracking resource changes, Config enables governance and operational troubleshooting.
Question 6: What is a key security best practice for managing AWS access credentials?
- Store access keys in application code
- Use IAM roles instead of long-term access keys (Correct answer)
- Share AWS root account credentials with multiple users
- Disable all user accounts for increased security
Correct answer: Use IAM roles instead of long-term access keys
Using IAM roles instead of long-term access keys is a key security best practice because roles provide temporary credentials that are automatically rotated. This eliminates the need to manage and secure static, long-lived access keys, which pose a greater risk if compromised. IAM roles also enable fine-grained permissions, adhering to the principle of least privilege for applications and services.
AWS Solutions Architect Security & Compliance 1
Which AWS service is used to manage user access and permissions securely?