Home › Certifications › AWS Cloud Practitioner › Security and Compliance
92 multiple-choice questions and 58 flashcards on Security and Compliance, about 27% of the AWS Cloud Practitioner bank. Every one carries a written rationale.
Security and Compliance is one of 4 chapters in CoStudy's AWS Cloud Practitioner bank, and it holds 92 of the bank's 335 multiple-choice questions — roughly 27% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
AWS Organizations:
Answer: C — Central management of multiple accounts
Organizations manages many accounts with SCPs and consolidated billing. IAM handles users. CloudTrail logs API. ECS/EKS manages containers.
What does AWS Resource Access Manager (RAM) enable?
Answer: B — Sharing resources across accounts in an org
B, RAM enables cross-account sharing of subnets, Transit Gateways, and more. A, C, D describe other services.
Which service scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities and unintended network exposure?
Answer: C — Amazon Inspector
A) GuardDuty detects threats and anomalous behavior, not software vulnerability scanning. B) AWS Config handles configuration compliance, not vulnerability scanning. C) Correct: Inspector scans EC2 instances, ECR images, and Lambda functions for known vulnerabilities and unintended network exposure. D) Macie scans for sensitive data, not vulnerabilities.
Which AWS service helps protect web applications from common web exploits (SQL injection, XSS)?
Answer: A — AWS WAF (Web Application Firewall)
A) Correct: AWS WAF (Web Application Firewall). Other options describe different AWS services that are common confusions.
Which AWS service provides automatic DDoS protection at no additional cost for all AWS customers?
Answer: C — AWS Shield
Shield protects against DDoS attacks. WAF blocks web exploits. GuardDuty detects threats. Inspector scans for vulns.
Which type of encryption protects data while it is transmitted over the network?
Answer: C — Encryption in transit (e.g., TLS)
A) Correct: Encryption in transit (e.g., TLS). Other options describe different AWS services that are common confusions.
An SCP denies an action but an IAM policy allows it. What happens?
Answer: B — Action is denied because SCP is ceiling
B, SCPs are a hard ceiling. A deny in SCP overrides any IAM allow. A, C, D misread the model.
Which service stores database credentials and rotates them automatically?
Answer: A — AWS Secrets Manager rotation service
A, Secrets Manager handles secret storage and native rotation. B manages encryption keys, not credentials. C is identity. D is TLS certificates.
Which is the customer's responsibility under the Shared Responsibility Model?
Answer: C — AWS secures cloud, customer secures content
AWS secures infrastructure; customer secures data/config/access. The other options contradict the model.
How should an application on EC2 obtain credentials to call the S3 API?
Answer: D — Attach an IAM role to the EC2 instance
D, IAM roles for EC2 provide auto-rotated temporary credentials. A, B, C are anti-patterns; embedded or long-lived keys should never be used.
4 cards from the 58 in this chapter.
What is MFA?
Multi-factor authentication — requires 2+ verification factors. AWS supports virtual MFA, hardware MFA, and U2F keys.
What is the AWS Shared Responsibility Model for containers?
AWS manages the underlying infrastructure and container service. Customer manages container images, code, IAM permissions, and network configuration.
What is AWS Inspector?
Automated vulnerability assessment for EC2 instances and container images. Scans for software vulnerabilities and network exposure.
Which service enables governance of multi-account environments with guardrails?
AWS Control Tower — sets up and governs multi-account environments with preventive and detective guardrails.
These are a sample. The full Security and Compliance chapter runs 150 items with per-chapter progress tracking, on the web and in the iOS app.
Open AWS Cloud Practitioner in CoStudy →