Practice: AWS Cloud Security, Governance, and Compliance

Which AWS service continuously monitors accounts for malicious activity using machine learning?

• AWS Audit Manager

• Amazon CloudWatch

• Amazon Inspector

• Amazon GuardDuty

Answer explanation

GuardDuty analyzes logs and network activity to detect threats using machine learning. Inspector scans workloads for software vulnerabilities, not malicious activity.

Tags

Blooms Level: Remember

A developer enables HTTPS on a web application. Which encryption type is being used?

• Encryption in transit

• Tokenization of data

• Client-side hashing

• Encryption at rest

Answer explanation

HTTPS protects data moving between client and server, which is encryption in transit. Encryption at rest applies to stored data, such as an EBS volume.

Tags

Blooms Level: Apply

Which AWS service collects metrics and sends alarms for operational resource monitoring?

• AWS Config

• AWS CloudTrail

• AWS Artifact

• Amazon CloudWatch

Answer explanation

CloudWatch handles metrics, logs, and alarms for operational monitoring. CloudTrail is a common mix-up but tracks API activity, not performance metrics.

Tags

Blooms Level: Remember

Which service scans EC2 instances and container images for software vulnerabilities?

• Amazon GuardDuty

• AWS Security Hub

• AWS Shield Standard

• Amazon Inspector

Answer explanation

Inspector performs automated vulnerability assessments on workloads and container images. GuardDuty detects threats from account activity, not software flaws.

Tags

Blooms Level: Remember

Which TWO services help auditors review changes and activity in an AWS account?

• Amazon Route 53

• AWS CloudTrail

• Amazon CloudFront

• AWS Config

• AWS Shield

Answer explanation

CloudTrail records API calls and Config tracks resource configuration changes. Together they support audit and governance reviews of account activity.

Tags

Blooms Level: Apply

Where should a compliance officer download an SOC 2 report for an external audit?

• AWS Audit Manager

• AWS Security Hub

• AWS Artifact

• AWS Trusted Advisor

Answer explanation

Artifact is the self-service portal for AWS compliance reports and agreements. Audit Manager helps build your own audit evidence, not download AWS-issued reports.

Tags

Blooms Level: Apply

Which statement best describes the AWS approach to compliance across services?

• Only EC2 services hold compliance certifications

• Compliance scope varies by individual AWS service

• All AWS services share identical compliance certifications

• Compliance applies only in the United States

Answer explanation

Each AWS service is certified against specific frameworks; not every service holds every certification. Customers must verify service-level scope before assuming coverage.

Tags

Blooms Level: Understand

Which service centralizes security findings from GuardDuty, Inspector, and Macie into one dashboard?

• AWS Security Hub

• AWS CloudTrail

• Amazon CloudWatch

• AWS Config

Answer explanation

Security Hub aggregates findings across security services into a unified view. CloudWatch monitors performance metrics, not consolidated security findings.

Tags

Blooms Level: Remember

Which TWO benefits does cloud security on AWS provide to customers?

• Built-in encryption options for many services

• Elimination of all customer security duties

• Inheritance of AWS compliance certifications

• Direct customer access to AWS hardware

• Customers manage data center physical security

Answer explanation

Customers inherit AWS controls and can enable native encryption features. AWS still owns physical security, and customers keep responsibility for their data.

Tags

Blooms Level: Understand

Which service automates the collection of evidence for compliance audits?

• AWS CloudTrail

• AWS Audit Manager

• Amazon Inspector

• AWS Artifact

Answer explanation

Audit Manager continuously collects evidence mapped to compliance frameworks. Artifact only provides AWS-issued compliance reports for download, not automated evidence collection.

Tags

Blooms Level: Remember