Practice Set
Practice questions aggregated across this exam type.
Practice Questions
10 of 172 questions
Q1. A SaaS provider needs to access resources in its customers' AWS accounts by assuming a cross-account IAM role that each customer creates. The security team wants to prevent a confused deputy attack, where one customer could trick the SaaS provider into acting on another customer's account. What should each customer require in the role's trust policy?
Select one answer before revealing.
Q2. A company wants to let its developers create IAM roles for their applications, but the security team must guarantee that developers can never create a role with more permissions than a defined ceiling — even if the developer attaches AdministratorAccess to the new role. Which IAM feature enforces this?
Select one answer before revealing.
Q3. A security engineer must produce a report of all S3 buckets, IAM roles, and KMS keys in the company's AWS organization that can be accessed from OUTSIDE the organization. Which service provides these findings natively?
Select one answer before revealing.
Q4. A security team attaches an SCP to the root of its AWS organization that denies s3:DeleteBucket. Later, an administrator signed in to the organization's management account successfully deletes an S3 bucket there. Why did the SCP not block the action?
Select one answer before revealing.
Q5. An application must encrypt 500 MB video files client-side using AWS KMS. When the developer calls the KMS Encrypt API directly with a file, the request fails. What is the correct approach?
Select one answer before revealing.
Q6. A financial services company has a regulatory requirement that encryption keys must be stored in single-tenant hardware validated to FIPS 140-2 Level 3, and that AWS must have no ability to access the key material. Which service meets these requirements?
Select one answer before revealing.
Q7. A data lake writes millions of small objects per hour to an S3 bucket encrypted with SSE-KMS using a customer managed key. The team notices high KMS costs and ThrottlingException errors from KMS. What is the recommended fix that keeps SSE-KMS encryption?
Select one answer before revealing.
Q8. A security engineer enables automatic key rotation on a customer managed KMS key that encrypts thousands of existing S3 objects and database backups. What must the team do so that existing data remains decryptable and applications keep working after rotation?
Select one answer before revealing.
Q9. A web application behind an Application Load Balancer is receiving SQL injection attempts in query strings and form bodies. The security team wants to block these requests before they reach the application, with minimal rule-writing effort. What should they do?
Select one answer before revealing.
Q10. A public API is being flooded by a set of IP addresses making thousands of requests per minute, degrading service for legitimate users. The addresses change frequently, so a static IP block list is impractical. Which AWS WAF feature handles this automatically?
Select one answer before revealing.
Important Concepts
Study chapter-wise concepts before you practice.