CoStudy

HomeCertificationsAWS Cloud Practitioner › Security and Compliance

Security and Compliance — AWS Cloud Practitioner practice questions

92 multiple-choice questions and 58 flashcards on Security and Compliance, about 27% of the AWS Cloud Practitioner bank. Every one carries a written rationale.

Written and maintained by Nick Burton · last updated 2026-08-22 · how we write and review questions

What this chapter covers

Security and Compliance is one of 4 chapters in CoStudy's AWS Cloud Practitioner bank, and it holds 92 of the bank's 335 multiple-choice questions — roughly 27% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.

Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.

Free Security and Compliance practice questions

10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.

AWS Organizations:

  1. Central IAM users across one account
  2. Central logging of API calls only for AWS workloads
  3. Central management of multiple accounts
  4. Central control-plane for containers

Answer: C — Central management of multiple accounts

Organizations manages many accounts with SCPs and consolidated billing. IAM handles users. CloudTrail logs API. ECS/EKS manages containers.

What does AWS Resource Access Manager (RAM) enable?

  1. Managing IAM roles within one account
  2. Sharing resources across accounts in an org
  3. Providing consolidated billing reports
  4. Patching EC2 at scheduled times

Answer: B — Sharing resources across accounts in an org

B, RAM enables cross-account sharing of subnets, Transit Gateways, and more. A, C, D describe other services.

Which service scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities and unintended network exposure?

  1. Amazon GuardDuty
  2. AWS Config
  3. Amazon Inspector
  4. Amazon Macie

Answer: C — Amazon Inspector

A) GuardDuty detects threats and anomalous behavior, not software vulnerability scanning. B) AWS Config handles configuration compliance, not vulnerability scanning. C) Correct: Inspector scans EC2 instances, ECR images, and Lambda functions for known vulnerabilities and unintended network exposure. D) Macie scans for sensitive data, not vulnerabilities.

Which AWS service helps protect web applications from common web exploits (SQL injection, XSS)?

  1. AWS WAF (Web Application Firewall)
  2. Serverless functions triggered by events (AWS Lambda)
  3. Dedicated virtual machines by the hour
  4. Managed Kubernetes control plane only

Answer: A — AWS WAF (Web Application Firewall)

A) Correct: AWS WAF (Web Application Firewall). Other options describe different AWS services that are common confusions.

Which AWS service provides automatic DDoS protection at no additional cost for all AWS customers?

  1. AWS WAF
  2. Amazon GuardDuty
  3. AWS Shield
  4. AWS Inspector

Answer: C — AWS Shield

Shield protects against DDoS attacks. WAF blocks web exploits. GuardDuty detects threats. Inspector scans for vulns.

Which type of encryption protects data while it is transmitted over the network?

  1. Global content delivery at edge
  2. Isolated virtual network with subnets
  3. Encryption in transit (e.g., TLS)
  4. Private dedicated link to on-premises

Answer: C — Encryption in transit (e.g., TLS)

A) Correct: Encryption in transit (e.g., TLS). Other options describe different AWS services that are common confusions.

An SCP denies an action but an IAM policy allows it. What happens?

  1. Action is allowed because IAM wins
  2. Action is denied because SCP is ceiling
  3. Action is conditionally allowed with MFA
  4. Result depends on the AWS Region used

Answer: B — Action is denied because SCP is ceiling

B, SCPs are a hard ceiling. A deny in SCP overrides any IAM allow. A, C, D misread the model.

Which service stores database credentials and rotates them automatically?

  1. AWS Secrets Manager rotation service
  2. AWS Key Management Service keys
  3. AWS Identity and Access Management
  4. AWS Certificate Manager TLS service

Answer: A — AWS Secrets Manager rotation service

A, Secrets Manager handles secret storage and native rotation. B manages encryption keys, not credentials. C is identity. D is TLS certificates.

Which is the customer's responsibility under the Shared Responsibility Model?

  1. AWS secures everything for the customer
  2. Customer secures everything including hardware
  3. AWS secures cloud, customer secures content
  4. AWS and customer split all tasks 50/50

Answer: C — AWS secures cloud, customer secures content

AWS secures infrastructure; customer secures data/config/access. The other options contradict the model.

How should an application on EC2 obtain credentials to call the S3 API?

  1. Embed long-lived access keys in code
  2. Store the root user keys as env vars
  3. Save keys in Parameter Store as plaintext
  4. Attach an IAM role to the EC2 instance

Answer: D — Attach an IAM role to the EC2 instance

D, IAM roles for EC2 provide auto-rotated temporary credentials. A, B, C are anti-patterns; embedded or long-lived keys should never be used.

Security and Compliance flashcards

4 cards from the 58 in this chapter.

What is MFA?

Multi-factor authentication — requires 2+ verification factors. AWS supports virtual MFA, hardware MFA, and U2F keys.

What is the AWS Shared Responsibility Model for containers?

AWS manages the underlying infrastructure and container service. Customer manages container images, code, IAM permissions, and network configuration.

What is AWS Inspector?

Automated vulnerability assessment for EC2 instances and container images. Scans for software vulnerabilities and network exposure.

Which service enables governance of multi-account environments with guardrails?

AWS Control Tower — sets up and governs multi-account environments with preventive and detective guardrails.

Practise the full chapter

These are a sample. The full Security and Compliance chapter runs 150 items with per-chapter progress tracking, on the web and in the iOS app.

Open AWS Cloud Practitioner in CoStudy →

Other AWS Cloud Practitioner chapters

All AWS Cloud Practitioner practice questions →