Free practice · No sign-up required
20 questions with answer explanations. Choose an answer below to begin.
When evaluating an IAM policy, which of the following is true regarding an explicit deny?
Domain 4.1 Design and implement IAM policies
0/20 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
AWS sample integrations for learning how serverless services work together. Useful supporting practice for architecture and developer study.
Try it: Choose a two-service pattern. Sketch its event path, identify the execution role, and explain what should happen if processing fails. Deploy only after reviewing its prerequisites and cleanup steps.
Code is free to read. Deploying AWS resources can incur charges.
Find the certification owner's exam pages and preparation resources before choosing topics to study.
Try it: Open your target certification and its exam guide. Mark each objective as explain, practice, or revisit; map your next missed question to one of those objectives.
Public exam information is free. Training, exams, and lab access may have separate charges.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
When evaluating an IAM policy, which of the following is true regarding an explicit deny?
An explicit deny overrides any allow.
An explicit deny can be overridden by a service control policy.
An explicit deny is only evaluated if there is no matching allow.
An explicit deny with a condition is ignored if the condition is not met.
Correct answer
An explicit deny overrides any allow.
In AWS IAM, an explicit deny always overrides any allow statement. Even if a user has an allow on the same action, if an explicit deny exists, the deny wins. This is fundamental to IAM policy evaluation logic. Service control policies (SCPs) can add additional deny boundaries but do not override an explicit deny. An explicit deny is effective regardless of other statements.
Which feature of AWS CloudTrail ensures that log files have not been tampered with after delivery?
Log file validation using SHA-256
S3 server-side encryption with AWS KMS
CloudTrail log integration with CloudWatch Logs
IAM policies restricting access to the log bucket
Correct answer
S3 server-side encryption with AWS KMS
CloudTrail log file validation uses SHA-256 hashing and digital signatures to confirm log integrity. When enabled, CloudTrail creates a digest file that contains hashes of log files, allowing you to detect any modification after delivery. Encryption protects data at rest but not integrity, and CloudWatch Logs integration does not provide integrity verification.
Which statement about automatic KMS key rotation is correct?
Automatic rotation is enabled by default for customer managed keys.
Automatic rotation creates a new key material but retains the same key ID.
Automatic rotation can be disabled after it is enabled.
Automatic rotation only applies to asymmetric keys.
Correct answer
Automatic rotation can be disabled after it is enabled.
When automatic rotation is enabled for an AWS KMS customer managed key, KMS creates new key material each year but the key ID remains the same, so existing encrypted data remains accessible. Rotation is not enabled by default; it must be enabled by the customer. Once enabled, it cannot be disabled. It applies to symmetric keys only.
A security group is configured to allow inbound SSH traffic from a specific IP address. What happens if the security group is later modified to remove that inbound rule?
Existing SSH connections are immediately terminated.
Existing SSH connections remain active, but new connections are blocked.
Both existing and new SSH connections are allowed for a grace period.
New SSH connections are allowed for 60 seconds, then blocked.
Correct answer
New SSH connections are allowed for 60 seconds, then blocked.
Security groups are stateful—when you allow inbound traffic, the outbound response is automatically allowed regardless of outbound rules. However, changes to inbound rules affect only new connections. Existing connections that were established before the rule change remain active because connection state is tracked. This prevents abrupt disconnection.
A web application receives suspicious requests containing SQL commands embedded in URL parameters. Which AWS WAF rule type should be used to block these requests?
SQL database managed rule group
Cross-site scripting (XSS) match conditions
Size constraint rule with a minimum length
IP set match rule blocking a known attacker
Correct answer
SQL database managed rule group
The SQL database managed rule group in AWS WAF inspects for patterns of SQL injection attacks. It includes signatures that detect SQL commands in query strings, body, or headers. Cross-site scripting rules target XSS, not SQL injection. Size constraints block based on request size, and IP sets block source IPs—neither targets SQL injection.
A company wants to restrict access to an S3 bucket so that only requests originating from the company's corporate IP address range are allowed. What is the most efficient way to implement this?
Attach a bucket policy with a condition using the aws:SourceIp key.
Use S3 block public access and an ACL granting access to the IP range.
Create a VPC endpoint and allow only requests from the VPC.
Use AWS WAF with an IP set attached to the S3 bucket.
Correct answer
Use S3 block public access and an ACL granting access to the IP range.
An S3 bucket policy with a condition on aws:SourceIp can restrict access to a specific IP range. This is straightforward and does not require additional infrastructure. S3 ACLs do not support IP-based restrictions. VPC endpoints require specific VPC setup. WAF cannot be directly attached to S3; it works with CloudFront.
Which AWS service can be used to encrypt CloudWatch Logs at rest using an AWS KMS key?
CloudWatch Logs supports KMS encryption directly.
CloudWatch Logs must be sent to S3 with default encryption.
CloudWatch Logs encryption is only possible using server-side encryption with S3.
CloudWatch Logs does not support custom KMS keys.
Correct answer
CloudWatch Logs encryption is only possible using server-side encryption with S3.
CloudWatch Logs can be encrypted using AWS KMS customer managed keys. You associate a KMS key with a log group, and all data written to that log group is encrypted. This is done through the CloudWatch Logs console or API. It is not necessary to route logs through S3 for encryption.
A security team discovers that an EC2 instance in a VPC is sending outbound traffic to a known malicious IP address. Which approach will help identify the source process using existing logs?
Enable VPC Flow Logs and analyze the source IP and port.
Enable AWS CloudTrail and review EC2 API calls.
Review the EC2 instance metadata for user data.
Use AWS Config to check the security group rules.
Correct answer
Use AWS Config to check the security group rules.
VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, including source IP, destination IP, port, and protocol. This can help identify which IP initiated the connection. CloudTrail records API calls, not network traffic. Instance metadata and Config do not provide network flow details.
Amazon GuardDuty detects a finding indicating that an EC2 instance might be compromised because it is communicating with a known command-and-control server. What is the most automated way to isolate the instance?
Use EventBridge to trigger a Lambda function that modifies the security group to block all traffic.
Use CloudWatch alarm to send an SNS notification to an administrator.
Use AWS Config to automatically remediate the security group.
Use EC2 Auto Scaling to terminate the instance.
Correct answer
Use EventBridge to trigger a Lambda function that modifies the security group to block all traffic.
Amazon EventBridge can listen for GuardDuty findings and trigger a Lambda function. The Lambda function can revoke the offending security group rules or attach a new restrictive group, thereby isolating the compromised instance. CloudWatch alarms notify humans, not automated remediation. Config can detect changes but not directly respond to GuardDuty in real time. Auto Scaling termination is not automatic based on GuardDuty findings.
A company uses a centrally managed KMS key in account A to encrypt data. Account B needs to decrypt that data using the same key. What is required?
Add account B as a principal in the KMS key policy and create a grant.
Export the key material and import it into account B's KMS.
Use ACM to share the key between accounts.
Copy the ciphertext to account B and use a separate KMS key.
Correct answer
Export the key material and import it into account B's KMS.
To allow cross-account decryption, the key policy in account A must include a statement granting account B's root user (or specific IAM roles) the necessary KMS permissions. Additionally, account B must create a grant or have appropriate IAM policies to use the key. Exporting key material is not supported for customer managed keys. ACM is for certificates, not KMS keys.
An application uses Amazon Cognito to authenticate users. Which Cognito component is responsible for providing temporary AWS credentials for accessing AWS resources?
Identity pool
User pool
Cognito sync
Cognito events
Correct answer
Cognito sync
Amazon Cognito identity pools (federated identities) are used to exchange identity tokens from user pools or external identity providers for temporary AWS credentials. User pools provide user authentication and token generation but not AWS credentials directly. Cognito sync is for synchronizing user data, and events are triggers for custom workflows.
An organization wants to protect an application behind an Application Load Balancer from a large-scale DDoS attack at layer 7. Which AWS service should be used?
AWS Shield Advanced with AWS WAF
AWS Shield Standard alone
Amazon GuardDuty with AWS Lambda
AWS Network Firewall
Correct answer
AWS Network Firewall
AWS Shield Advanced provides enhanced DDoS protection and includes AWS WAF at no extra cost. WAF can filter layer 7 attacks such as HTTP floods. Shield Standard is automatic but only protects against common layer 3/4 attacks. GuardDuty detects threats but does not block DDoS. Network Firewall is for network-layer filtering, not application-layer.
A company uses AWS Secrets Manager to store database credentials. They want to automatically rotate the credentials on a schedule. What is the simplest way to achieve this?
Enable automatic rotation in Secrets Manager and configure the Lambda rotation function.
Manually update the secret in Secrets Manager and update the database.
Use AWS Systems Manager Parameter Store with automatic rotation.
Use IAM roles for the database instead of secrets.
Correct answer
Enable automatic rotation in Secrets Manager and configure the Lambda rotation function.
Secrets Manager supports automatic rotation with a built-in Lambda function that updates both the secret and the database. You simply enable rotation and provide the required configuration. Parameter Store does not have automatic rotation built-in. IAM roles are only applicable for AWS services, not database credentials.
A security analyst needs to view a record of all AWS API calls made within an account for the past 90 days. Which service should be used?
AWS CloudTrail
Amazon CloudWatch Logs
AWS Config
VPC Flow Logs
Correct answer
Amazon CloudWatch Logs
AWS CloudTrail records API calls and stores them in log files. By default, CloudTrail event history is available for 90 days, but for longer retention you can create a trail to deliver to S3. CloudWatch Logs ingests logs but does not record API calls directly. Config records configuration changes, not API calls. VPC Flow Logs capture network traffic, not API calls.
An S3 bucket is configured with default encryption using SSE-S3. A user uploads an object with a request that does not include any encryption headers. How is the object encrypted?
The object is encrypted using SSE-S3 automatically.
The object is not encrypted because no encryption was specified.
The object is encrypted using SSE-KMS because default encryption requires it.
The object is encrypted using client-side encryption.
Correct answer
The object is encrypted using SSE-KMS because default encryption requires it.
When default encryption is enabled on an S3 bucket, any object uploaded without encryption headers is automatically encrypted using the configured default encryption method (SSE-S3, SSE-KMS, or DSSE-KMS). In this case, it will be encrypted with SSE-S3. Without default encryption, the object would be unencrypted. SSE-KMS would only apply if default encryption is set to SSE-KMS.
An IAM role has a trust policy that allows an EC2 instance to assume it. The role also has a permissions boundary that limits the maximum permissions. Which statement about the effective permissions is correct?
The effective permissions are the intersection of the role's permissions policy and the permissions boundary.
The permissions boundary is ignored if the trust policy allows the role.
The effective permissions are the union of the permissions policy and the boundary.
The permissions boundary is only applied to the trust policy, not the permissions policy.
Correct answer
The permissions boundary is only applied to the trust policy, not the permissions policy.
When a permissions boundary is set on an IAM role, the role's effective permissions are the intersection of the permissions policy attached to the role and the boundary policy. The boundary limits the maximum permissions, so any action allowed by the permissions policy but not allowed by the boundary is denied. The trust policy controls who can assume the role, not the permissions.
A company uses Network ACLs and security groups for subnet isolation. Which of the following is a key difference between the two?
Security groups are stateful, while network ACLs are stateless.
Security groups are stateless, while network ACLs are stateful.
Network ACLs support allow rules only, while security groups support allow and deny rules.
Network ACLs are evaluated before security groups for inbound traffic.
Correct answer
Security groups are stateful, while network ACLs are stateless.
Security groups are stateful—return traffic is automatically allowed. Network ACLs are stateless—return traffic must be explicitly allowed. Both support allow rules, but security groups do not support deny rules; network ACLs support both allow and deny. For inbound traffic, security groups are evaluated first if an instance is launched in a subnet.
Amazon Macie is used to discover sensitive data stored in S3. Which of the following can Macie detect?
AWS access keys in CloudTrail logs
Personally identifiable information (PII) in S3 objects
SQL injection attempts in application logs
Root user activity in the account
Correct answer
Personally identifiable information (PII) in S3 objects
Amazon Macie uses machine learning and pattern matching to detect sensitive data such as PII, financial data, and credentials within S3 objects. It does not analyze CloudTrail logs for access keys (that is more of GuardDuty). SQL injection detection is handled by WAF, and root user activity is monitored by CloudTrail and GuardDuty.
A development team needs to store configuration data that includes database connection strings. The data must be stored encrypted and be accessible to EC2 instances automatically. Which service should be used?
AWS Systems Manager Parameter Store with SecureString
Amazon S3 with SSE-KMS
AWS Secrets Manager
AWS CloudFormation parameters
Correct answer
AWS Secrets Manager
AWS Systems Manager Parameter Store offers SecureString parameters that are encrypted using KMS. EC2 instances can retrieve them using the AWS Systems Manager agent and IAM roles. S3 is not as integrated for automatic retrieval. Secrets Manager is designed for secrets but is more expensive. CloudFormation parameters are not encrypted and are used at deployment time.
An administrator wants to grant a user permission to use a specific KMS key but only for encrypting data, not decrypting. What is the correct approach?
Attach an IAM policy with kms:Encrypt action for that key.
Attach a key policy with kms:Encrypt and kms:Decrypt for the user.
Create a new key that only supports encryption.
Use a KMS grant with the CryptographyEncrypt operation only.
Correct answer
Use a KMS grant with the CryptographyEncrypt operation only.
KMS grants allow you to delegate a subset of permissions for a specific operation. You can create a grant that allows only the Encrypt operation on a key. IAM policies can also restrict actions, but they must be combined with key policies. A key policy that allows both Encrypt and Decrypt would give more than needed. There is no key type that supports only encryption; encryption implies decryption for the same key.
Recall the answer before opening each card.
An explicit deny overrides any allow statement, even if another policy allows the same action. It always results in 'Deny'.
Log file validation using SHA-256 hashes and digital signatures in digest files. This detects any modification after delivery.
No. Once enabled, it cannot be disabled. Rotation occurs annually for symmetric customer managed keys only.
Existing connections remain active because security groups are stateful and track connection state. Only new connections are blocked.
SQL database managed rule group. It inspects request patterns for SQL commands.
Use a bucket policy with an aws:SourceIp condition. Do not rely on ACLs or block public access alone.
Yes. You associate a KMS key with a log group. All data is encrypted at rest.
VPC Flow Logs capture network traffic metadata including source/destination IPs. CloudTrail records API calls, not network flows.
EventBridge triggers a Lambda function that modifies the security group to block all traffic.
Add a key policy grant for Account B's root/roles, and Account B must have IAM permissions to use the key.
Identity pools (federated identities) exchange tokens for AWS credentials. User pools only provide authentication tokens.
AWS Shield Advanced (with WAF included). Shield Standard protects only layers 3/4.
Enable automatic rotation and configure the built-in Lambda function. Secrets Manager handles the rest.
CloudTrail event history provides 90 days of API activity by default. For longer retention, create a trail to S3.
It is encrypted with SSE-S3 automatically. The default encryption method applies.
Effective permissions are the intersection of the permissions policy and the boundary. Actions allowed by the policy but not by the boundary are denied.
Security groups are stateful (return traffic automatically allowed); network ACLs are stateless (must explicitly allow return traffic).
Personally identifiable information (PII) such as names, addresses, credit card numbers, and credentials.
AWS Systems Manager Parameter Store with SecureString parameters. EC2 uses the SSM agent and IAM role to access them.
Use a KMS grant that allows only the Encrypt operation. IAM policies with granular actions can also work with key policy.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
IAM policies follow an explicit deny override rule, permissions boundaries intersect with permission policies to limit maximum permissions, and cross-account KMS access requires a key policy granting the external account and appropriate IAM roles or grants. Trust policies control who can assume a role, while permission policies define what actions are allowed. The practice bank highlights that IAM is the cornerstone of AWS security, with policy evaluation logic being deterministic: deny always wins. Also, for granting least privilege, KMS grants allow limiting actions to encrypt only.
CloudTrail provides API call history, with log file validation using digest files to ensure integrity. VPC Flow Logs capture network traffic metadata to identify source/destination IPs. GuardDuty findings can trigger automated remediation via EventBridge and Lambda to modify security groups. The practice bank emphasizes choosing the correct log source for specific needs: CloudTrail for API calls, Flow Logs for network flows, and Config for configuration changes. Automated isolation is best achieved by event-driven Lambda functions rather than manual or notification-only methods.
Security groups are stateful (return traffic automatically allowed) while network ACLs are stateless (explicit rules required). For DDoS protection at layer 7, AWS Shield Advanced with WAF is preferred over Network Firewall. SQL injection is blocked by AWS WAF SQL database managed rule group. S3 bucket access can be restricted by IP using a bucket policy with aws:SourceIp condition—not S3 ACLs or block public access alone. The practice bank clarifies that choosing the right service (WAF vs. Shield vs. Network Firewall) depends on the attack layer and scope.
KMS automatic rotation is enabled by the customer and cannot be disabled once enabled; it applies to symmetric keys only. CloudWatch Logs can be encrypted directly with a KMS key, not only via S3. S3 default encryption (SSE-S3) applies when no encryption headers are provided. For secrets like database credentials, AWS Systems Manager Parameter Store with SecureString is a cost-effective option; Secrets Manager offers automatic rotation via Lambda. Macie detects PII in S3 objects. The practice bank tests your ability to match encryption features to services.
Study workflow
Start by reading all applicable policies (identity-based, resource-based, permissions boundary, SCP). If any statement explicitly denies the action, the result is Deny. If there is no explicit deny but an allow, and the request passes all boundaries, it's Allow. Otherwise, implicit Deny.
Identify what you need to trace: API calls → CloudTrail; network flows → VPC Flow Logs; configuration changes → AWS Config; DNS queries → Route 53 Resolver Query Logs. For each scenario, pick the service that captures the required data.
Create an EventBridge rule that matches GuardDuty findings (e.g., UnauthorizedAccess:EC2/SSHBruteForce). Target a Lambda function that modifies the EC2 security group (revoke ingress/egress rules or attach a new restrictive group). Test with sample findings.
In the key-owning account, edit the key policy to grant the external account's root user (or specific roles) permissions: kms:Decrypt, kms:DescribeKey, etc. In the external account, create an IAM role/policy that allows using the key via kms:Decrypt and attach to the user/resource.
For simple rotation, use Parameter Store with a Lambda function triggered by EventBridge (scheduled event). The Lambda retrieves the current secret, generates a new password, updates the database, and stores the new value in Parameter Store. For automatic rotation without custom code, use Secrets Manager.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Security groups are stateful: if you allow inbound traffic, outbound return is automatically allowed. Network ACLs are stateless: you must explicitly allow both inbound and outbound traffic. Also, security groups support only allow rules; NACLs support both allow and deny rules.
When enabled, CloudTrail creates digest files containing SHA-256 hashes of log files, signed with the private key of an AWS key pair. You can use the public key to verify the digest, ensuring no log file was modified after delivery.
No. Once you enable automatic rotation for a customer managed symmetric key, you cannot disable it. KMS will rotate the key material annually. The key ID remains the same, so existing ciphertext remains decryptable.
Use an S3 bucket policy with a condition block using aws:SourceIp. For example: "Condition": {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}. This does not require VPC endpoints or additional infrastructure.
Set up an Amazon EventBridge rule that matches GuardDuty findings (e.g., command-and-control communication). The rule triggers an AWS Lambda function that modifies the instance's security group to deny all inbound/outbound traffic, effectively isolating the instance.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
