1. Home
2. All questions
3. Secure architecture

AWS Certified Solutions Architect study material: Secure architecture

154 questions of the 500 in the AWS Certified Solutions Architect – Associate quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 1. An architect attaches a permissions boundary to an IAM role that already has an administrator policy. What effect does the boundary have on the role?
2. 2. A team must let an application in account A read an S3 bucket in account B. What is the minimum policy configuration required?
3. 3. Within a single AWS account, a bucket policy grants s3:GetObject to a role that has no S3 permissions in its own identity-based policy. What happens when the role calls GetObject?
4. 4. A request is allowed by an identity-based policy but explicitly denied by a service control policy. What is the outcome?
5. 5. A VPC interface endpoint is created without an endpoint policy attached. What access does it permit?
6. 6. Which statement describes the only resource-based policy that the IAM service itself supports?
7. 7. An organization wants a single mechanism to share subnets and Transit Gateway attachments with several member accounts without writing a resource policy on each one. Which service does this?
8. 8. An application running on an EC2 instance needs to read from S3. Which approach follows AWS security guidance?
9. 9. A company runs servers in its own data centre that must call AWS APIs. It already operates an internal PKI. Which mechanism issues temporary AWS credentials to those servers?
10. 10. Which AWS STS operation exchanges a SAML assertion from an external identity provider for temporary AWS credentials?
11. 11. A security team wants to generate a least-privilege policy for a role from the activity that role has actually performed. Which service produces it?
12. 12. An auditor asks which S3 buckets and IAM roles are reachable from outside the account. Which service reports that exposure?
13. 13. What distinguishes an IAM role from an IAM user?
14. 14. An administrator wants to change the permissions of a service-linked role that an AWS service created. What can they do?
15. 15. Why does AWS refuse to delete a service-linked role while dependent resources still exist?
16. 16. Which multi-factor authentication type does AWS describe as resistant to phishing, interception and replay?
17. 17. An administrator enables MFA on the account root user. What is the effect on the IAM users in that account?
18. 18. How long can temporary security credentials issued by AWS STS remain valid?
19. 19. An organization has only the consolidated billing features enabled. What does this mean for service control policies?
20. 20. An administrator attaches a restrictive SCP and is surprised that their own actions in the management account are unaffected. Why?
21. 21. An administrator removes the FullAWSAccess policy from an organizational unit without attaching any other allow policy. What is the result for member accounts in that OU?
22. 22. A member account reaches a resource that has no resource-based policy. Which policies must all allow the action?
23. 23. Which capability lets one AWS managed application pass a signed-in user's identity to another so CloudTrail records the person who acted?
24. 24. A team wants encryption at rest with no key to manage, no charge for the key, and easy sharing of encrypted data across accounts. Which KMS key type fits?
25. 25. An auditor needs CloudTrail evidence of every use of the key protecting a data set. Which KMS key type makes that impossible?
26. 26. An instance's security group allows outbound HTTPS but has no inbound rule for the returning traffic. Can the instance receive the response?
27. 27. Which two statements correctly describe network ACLs in a VPC? Choose two.
28. 28. What does the default S3 Object Ownership setting, bucket owner enforced, do?
29. 29. With ACLs disabled on a bucket, a client uploads an object specifying a custom grant to another AWS account. What does S3 return?
30. 30. An organization wants to guarantee that no S3 bucket in any member account can be made public. Which two actions achieve this? Choose two.
31. 31. An organization enables Block Public Access at the organization level, but one bucket has it disabled at bucket level. What protection does that bucket have?
32. 32. At which level do the four S3 Block Public Access settings have to be applied together as one policy?
33. 33. A team wants to block public access to one particular object while leaving the rest of the bucket unchanged. What does S3 Block Public Access offer?
34. 34. A developer generates a presigned URL for a private S3 object and sends it to an external partner. Whose permissions does the download use?
35. 35. What is the longest a presigned URL created with the AWS CLI can remain valid?
36. 36. A workload in a private subnet must call an AWS service without any traffic reaching an internet gateway. Which approach meets the requirement?
37. 37. Which two responsibilities belong to AWS Secrets Manager rather than another AWS service? Choose two.
38. 38. Where does AWS recommend storing SSH keys, rather than in Secrets Manager?
39. 39. How many subdomains does a single ACM wildcard certificate protect?
40. 40. A mobile app must let users sign in with Google and then read from a private S3 bucket. Which Cognito components does this need?
41. 41. An API only needs to verify signed-in users and receives no AWS resource calls from them. Which Cognito component suffices?
42. 42. Which two threats does Amazon GuardDuty look for? Choose two.
43. 43. Which service discovers sensitive data in S3 and raises a finding when a bucket becomes publicly readable?
44. 44. Which two resource types does Amazon Inspector scan for software vulnerabilities? Choose two.
45. 45. A security team wants Inspector enabled once for every account in the organization, including accounts that join later. What should they configure?
46. 46. A public web application behind an Application Load Balancer must block requests from specific IP ranges and inspect query strings. Which service does this?
47. 47. Which DDoS protection does a workload on AWS receive without any additional charge?
48. 48. Under the AWS shared responsibility model, which party is responsible for security of the cloud?
49. 49. Which two capabilities does AWS Security Hub CSPM provide? Choose two.
50. 50. Which open source intrusion prevention system provides stateful inspection in AWS Network Firewall?
51. 51. A company wants a governed multi-account environment with a landing zone built in under an hour. Which service orchestrates Organizations, Service Catalog and IAM Identity Center to do this?
52. 52. In AWS Control Tower, what is a guardrail?
53. 53. Which Control Tower feature lets distributed teams open new accounts from configurable templates?
54. 54. How many key policies can a single AWS KMS key have?
55. 55. An IAM policy grants kms:Decrypt on a key, but the key policy does not enable IAM policies. What happens when the principal calls Decrypt?
56. 56. How does the scope of a KMS key policy differ from that of an IAM policy?
57. 57. After automatic rotation replaces a customer managed key's material, what happens to data encrypted before the rotation?
58. 58. Which two key types can only be rotated manually, by creating a replacement key? Choose two.
59. 59. A data key generated by a KMS key has leaked. What does rotating that KMS key achieve?
60. 60. Why do AWS services that encrypt data at rest typically use a KMS grant rather than editing the key policy?
61. 61. Which two statements about KMS grants are correct? Choose two.
62. 62. An application creates a KMS grant and immediately needs its permissions. What makes them usable at once?
63. 63. A workload running as GitHub Actions outside AWS needs to call AWS APIs without stored keys. Which federation approach fits?
64. 64. Why does AWS warn against putting a password in EC2 instance user data?
65. 65. What isolation does a single AWS Fargate task receive?
66. 66. How is traffic protected on an inter-Region VPC peering connection?
67. 67. Which protocol does AWS Site-to-Site VPN use to secure the connection between an on-premises network and a VPC?
68. 68. Which two authentication options can Amazon RDS Proxy use when connecting to the database? Choose two.
69. 69. A subnet must be reachable only from other resources in the same VPC, with no route anywhere else. What is this called?
70. 70. A data lake team must grant access to particular columns and rows of S3 data queried through Athena and Redshift Spectrum. Which service enforces that?
71. 71. How does the Lake Formation permissions model relate to IAM?
72. 72. S3 replication is configured across accounts, and the destination account must control who can read the replicas. Which option achieves this?
73. 73. An enterprise wants to lift Active Directory-aware applications into AWS and keep using an actual Windows Server Active Directory. Which option fits?
74. 74. An IAM user switches to a role in the console. What happens to their original permissions?
75. 75. How does an application stop using a role it assumed programmatically?
76. 76. Which two policy types does an architect reach for most often when granting permissions in AWS?
77. 77. What is the practical difference between an AWS managed policy and a customer managed policy?
78. 78. What happens to an inline policy when the IAM user it is attached to is deleted?
79. 79. Which characteristic sets access control lists apart from every other AWS policy type?
80. 80. How many managed session policies can be passed when assuming a role?
81. 81. Which service does AWS recommend for managing workforce sign-in and permissions across many AWS accounts from one place?
82. 82. Which two practices does IAM security guidance recommend for reducing standing permissions? Choose two.
83. 83. An administrator must let a team lead manage IAM permissions in an account without being able to widen their own access. Which mechanism does this?
84. 84. A newly created AWS account is inspected and contains no IAM roles at all. Is this expected?
85. 85. How many MFA devices may a single IAM user register?
86. 86. Which advantage do temporary credentials have over long-term access keys when a task finishes?
87. 87. An application in Sydney calls AWS STS and wants to reduce latency. What can it do, and what is the effect on the credentials?
88. 88. Before tightening a service control policy, a team wants to know which services an account genuinely uses. Which two data sources reveal this?
89. 89. An SCP is approaching its maximum size. What does AWS suggest to reclaim room?
90. 90. Which step does AWS skip when handling a request to a service such as S3 that permits anonymous callers?
91. 91. Which two capabilities does AWS Organizations provide beyond consolidated billing? Choose two.
92. 92. Which mechanism seeds newly created member accounts with baseline resources and permissions?
93. 93. An organization wants attribute-based access control to key off a consistent classification of resources. Which Organizations feature supports that?
94. 94. Which KMS key type carries a monthly charge for merely existing, in addition to per-request charges?
95. 95. A team wants to share EBS volumes encrypted under an AWS managed key with another AWS account. What blocks them?
96. 96. How often does KMS rotate the material of an AWS managed key?
97. 97. A security group is created in one VPC and must also protect resources in another VPC in the same Region. What makes that possible?
98. 98. Which naming rule applies to a security group?
99. 99. A bucket policy denies PutObject unless the request carries the server-side-encryption header. What unintended effect can this have?
100. 100. What does S3 server-side encryption leave unprotected?
101. 101. Which two policy types set a maximum on permissions without granting any themselves? Choose two.
102. 102. An organization wants to cap what can be done to resources in member accounts without editing each resource policy. Which two statements about resource control policies are correct? Choose two.
103. 103. Which two things must be true for a principal to use a KMS key? Choose two.
104. 104. A KMS key has had its material rotated four times. How many keys does it count as against the account's key quota?
105. 105. An administrator needs to withdraw everything a KMS grant allowed, without unpicking policy statements. What should they do?
106. 106. Which two statements about on-demand rotation of a KMS key are correct? Choose two.
107. 107. What does enabling automatic rotation on a customer managed key do by default?
108. 108. Which two conditions must hold before disabling ACLs on an existing S3 bucket? Choose two.
109. 109. Which Security Hub control is satisfied by enabling all four Block Public Access settings on a bucket?
110. 110. A team must host a static website out of S3. How should Block Public Access be handled?
111. 111. How quickly does an account-level Block Public Access setting take effect across AWS Regions?
112. 112. Which two statements about Amazon Cognito identity pools are correct? Choose two.
113. 113. Which access control models does a Cognito identity pool use to decide what a user may reach?
114. 114. Which two things can AWS Certificate Manager do with certificates? Choose two.
115. 115. A company needs an ACM-signed certificate for use on servers inside its own internal PKI. What makes that possible?
116. 116. Which two kinds of traffic can AWS Network Firewall inspect? Choose two.
117. 117. Which two controls can AWS Network Firewall apply to outbound VPC traffic? Choose two.
118. 118. Which sharing target is available for some resource types in AWS RAM but not for all of them?
119. 119. In AWS Control Tower, what is the landing zone?
120. 120. Which two automation options does AWS Security Hub offer for handling findings? Choose two.
121. 121. How can Macie findings be fed into an automated remediation workflow?
122. 122. How does Amazon Inspector decide what to scan?
123. 123. Which two resource types can AWS WAF protect? Choose two.
124. 124. What does AWS Shield Advanced add beyond the protection every AWS workload already receives?
125. 125. An account on the Basic Support plan relies on Trusted Advisor's Security checks. What must the team remember?
126. 126. Which statement describes how an identity-based policy differs from a resource-based policy?
127. 127. Which two statements about how a session policy affects an assumed role are correct? Choose two.
128. 128. Why does AWS recommend federating human users rather than creating IAM users for them?
129. 129. A single AWS account is not using IAM Identity Center but must federate with an external identity provider. Which two protocols can IAM use? Choose two.
130. 130. Which sign-in scenario still justifies creating an IAM user rather than federating?
131. 131. A role must be assumable by anyone on a team who needs it, rather than tied to one person. Which property of roles makes this possible?
132. 132. Why is embedding AWS access keys in a mobile application discouraged?
133. 133. Which two facts about MFA on AWS accounts are correct? Choose two.
134. 134. Which three MFA types does AWS accept?
135. 135. Why does AWS advise against attaching a new SCP directly to the organization root?
136. 136. In what order does AWS process a request before deciding whether to allow it?
137. 137. An administrator removes a permissions boundary from an IAM user. What is the possible effect?
138. 138. Which two statements about AWS managed KMS keys are correct? Choose two.
139. 139. Since when have AWS services stopped adopting AWS managed keys as the default for encryption at rest?
140. 140. An architect must choose between a customer managed key and an AWS owned key. Which requirement points to the customer managed key?
141. 141. What does an inbound security group rule specify?
142. 142. What do security groups and network ACLs cost to use in a VPC?
143. 143. With ACLs disabled on a bucket, which policy types decide access?
144. 144. Which two signs indicate an S3 bucket policy may expose data publicly? Choose two.
145. 145. Which two AWS Config managed rules give a standing detective control over publicly exposed S3 buckets? Choose two.
146. 146. Why does AWS recommend keeping SSE-C disabled unless a workload specifically requires it?
147. 147. A bucket has SSE-C blocked. What does S3 return for a PutObject request that asks for SSE-C?
148. 148. Why does AWS advise emptying rather than deleting a general purpose bucket that is no longer used?
149. 149. Which encryption does S3 apply to objects under SSE-S3?
150. 150. How can an account force every upload to a bucket to use SSE-S3?
151. 333. Since January 2023, what encryption is applied to new object uploads to S3?
152. 362. Traffic goes from a private subnet through a NAT gateway to a public AWS service endpoint. Where does that traffic travel?
153. 441. What does Fargate require an application to declare when launching a task?
154. 445. What work can be offloaded from compute targets to a load balancer?