What is the AWS Shared Responsibility Model?
A) AWS: Security OF the Cloud (physical infrastructure, hardware, networking, hypervisor).
B) Security responsibilities are randomly assigned per service and documented in each service SLA.
C) The customer is responsible for all security including physical data centres and hardware.
D) AWS is responsible for all security including customer data, applications, and access management.
A) AWS: Security OF the Cloud (physical infrastructure, hardware, networking, hypervisor).
What is AWS responsible for in the Shared Responsibility Model?
A) Security group rules, bucket policies, database user permissions, and network ACL rules.
B) Application code, OS configuration, firewall rules, and data backup strategies.
C) Physical data centre security, hardware and software infrastructure, networking, virtualisation, global…
D) Customer data encryption, IAM policies, OS patching on EC2, and application security.
C) Physical data centre security, hardware and software infrastructure, networking, virtualisation, global…
What is the customer responsible for in the Shared Responsibility Model?
A) Customer data, platform/applications/IAM, OS/network/firewall configuration, client-side data encryption, server-side…
B) Physical hardware, hypervisor patches, data centre power and cooling, and network cables.
C) AWS global network infrastructure, Availability Zone design, and edge location management.
D) RDS engine patching, Lambda runtime updates, and S3 infrastructure durability.
A) Customer data, platform/applications/IAM, OS/network/firewall configuration, client-side data encryption, server-side…
In the Shared Responsibility Model, who patches an EC2 OS?
A) The customer. EC2 is IaaS – AWS manages the physical host and hypervisor only.
B) It is shared equally — AWS patches the kernel; the customer patches user-space packages.
C) AWS — they manage all patching for EC2 as part of the managed compute service.
D) Neither — EC2 instances use immutable AMIs and are replaced rather than patched.
A) The customer. EC2 is IaaS – AWS manages the physical host and hypervisor only.
In the Shared Responsibility Model, who patches an RDS DB engine?
A) It is shared — the customer patches minor versions; AWS patches major versions only.
B) AWS. RDS is a managed (PaaS) service – AWS handles OS and database engine patching.
C) Neither — RDS DB engines are containerised and automatically replaced rather than patched.
D) The customer — RDS only manages the hardware; DB engine patching is customer-owned.
B) AWS. RDS is a managed (PaaS) service – AWS handles OS and database engine patching.
In the Shared Responsibility Model, who manages S3 bucket policies and encryption?
A) Neither — S3 is publicly accessible by default and does not support bucket policies.
B) AWS — S3 is a fully managed SaaS service and all policies are set by default.
C) It is shared — AWS manages encryption keys; customers manage bucket policy syntax.
D) The customer.
D) The customer.
What is the key rule of the Shared Responsibility Model?
A) The higher the service tier (IaaS→SaaS), the more responsibility shifts to the customer.
B) AWS is always responsible for data security regardless of service type or configuration.
C) ‘If you put it there, you manage it.’ Managed services offload more responsibility to AWS; unmanaged services (like EC2)…
D) Security is always 100% the customer’s responsibility regardless of the service used.
C) ‘If you put it there, you manage it.’ Managed services offload more responsibility to AWS; unmanaged services (like EC2)…
What is AWS Artifact?
A) A free self-service portal for downloading AWS compliance reports (SOC, PCI, ISO) and signing legal agreements like…
B) AWS Artifact is the managed container image registry for storing Docker images.
C) A CI/CD tool for packaging and deploying application artefacts to AWS services.
D) A service for storing and versioning application build outputs in S3-backed repositories.
A) A free self-service portal for downloading AWS compliance reports (SOC, PCI, ISO) and signing legal agreements like…
What compliance frameworks does AWS support?
A) Only US-specific frameworks — HIPAA, FedRAMP, and SOX. EU compliance is customer-managed.
B) HIPAA (healthcare), PCI-DSS (payment cards), SOC 1/2/3, ISO 27001, FedRAMP (US government), GDPR (EU data protection).
C) ISO 27001 only — all other frameworks require customers to conduct their own audits.
D) PCI-DSS and HIPAA only — all other compliance certifications require third-party audits.
B) HIPAA (healthcare), PCI-DSS (payment cards), SOC 1/2/3, ISO 27001, FedRAMP (US government), GDPR (EU data protection).
What is the AWS Compliance Center?
A) The dashboard inside AWS Config that shows real-time compliance rule evaluation results.
B) A central location to research cloud-related regulatory requirements, browse country-specific laws, discover how…
C) A tool inside IAM that scans your policies for compliance violations automatically.
D) A paid service where AWS consultants help you pass compliance audits for your workloads.
B) A central location to research cloud-related regulatory requirements, browse country-specific laws, discover how…
What is AWS Audit Manager?
A) A cost management service that audits AWS spending against budget thresholds.
B) A log analysis tool that detects unusual API activity and flags potential audit risks.
C) Continuously collects data to prepare for audits and ensure compliance with regulatory standards.
D) A service that automatically patches and remediates non-compliant resources in real time.
C) Continuously collects data to prepare for audits and ensure compliance with regulatory standards.
What are the key security concepts: encryption at rest, encryption in transit, MFA?
A) At rest: data encrypted when stored (S3, EBS, RDS). In transit: encrypted while moving (TLS/SSL). MFA: extra code required at login.
B) MFA is only available for root accounts. Encryption at rest is enabled by default on all services. In transit requires Direct Connect.
C) Encryption at rest: data encrypted during network transfer. In transit: data encrypted on disk. MFA: role-based access control.
D) Encryption at rest only applies to S3. In transit only applies to RDS. MFA is optional for all users.
A) At rest: data encrypted when stored (S3, EBS, RDS). In transit: encrypted while moving (TLS/SSL). MFA: extra code required at login.
What is ‘Defence in depth’?
A) Offloading all security responsibilities to AWS by using only managed services.
B) Protecting only the perimeter network to prevent all external threats from entering.
C) Applying multiple layers of security controls so that if one layer fails, others still protect the system.
D) Using a single, highly robust security control instead of many weaker individual controls.
C) Applying multiple layers of security controls so that if one layer fails, others still protect the system.
What is IAM and what does it cost?
A) Identity and Access Management – controls WHO can do WHAT in your AWS account. It is free to use.
B) IAM is AWS’s network firewall service for controlling traffic to EC2 instances.
C) IAM is the audit logging service that records all API calls in your account.
D) IAM is a paid security service billed per user, group, and policy created per month.
A) Identity and Access Management – controls WHO can do WHAT in your AWS account. It is free to use.
What are the 4 core IAM components?
A) Accounts, Organisations, Access Keys, and MFA Devices.
B) Certificates, Keys, Tokens, and Passwords — the four credential types.
C) Users – individual accounts for people or applications.
D) Root, Admin, Power User, and Read-Only — the four default permission tiers.
C) Users – individual accounts for people or applications.
What is an IAM User?
A) A temporary identity with auto-expiring credentials used for programmatic access only.
B) An individual AWS account for a person or application.
C) An IAM User is the same as an IAM Role — both provide temporary assumed credentials.
D) A pre-built AWS user with AdministratorAccess that manages your account by default.
B) An individual AWS account for a person or application.
What is an IAM Group?
A) A group of AWS accounts managed under a single AWS Organisation for billing purposes.
B) A temporary role that multiple users can assume simultaneously for shared tasks.
C) A collection of IAM users. Attach policies to the group and all users in the group inherit those permissions.
D) A security boundary equivalent to a VPC that isolates users from each other.
C) A collection of IAM users. Attach policies to the group and all users in the group inherit those permissions.
What is an IAM Role?
A) An IAM identity with specific permissions that can be assumed temporarily by trusted entities (EC2…
B) An IAM Role is the same as an IAM Policy — both define what actions are allowed.
C) A group of permissions that can only be used by IAM Users, not services.
D) A permanent credential set stored in IAM for machine-to-machine authentication.
A) An IAM identity with specific permissions that can be assumed temporarily by trusted entities (EC2…
What is an IAM Policy?
A) A billing rule that restricts spending on specific AWS services.
B) A network firewall rule that controls traffic to IAM-protected resources.
C) A JSON document that defines Allow or Deny permissions for specific actions on specific AWS resources.
D) A CloudFormation template that provisions IAM users and groups automatically.
C) A JSON document that defines Allow or Deny permissions for specific actions on specific AWS resources.
What is the structure of an IAM Policy JSON?
A) Version, Statement array containing: Effect (Allow/Deny), Action (e.g. s3:GetObject), Resource (e.g.
B) Allow/Deny, Username, Password, and AccessKey fields in a flat key-value structure.
C) Principal, Action, Resource, Condition — all four fields are required in every statement.
D) ServiceName, PermissionLevel (Read/Write/Admin), and ResourceARN only.
A) Version, Statement array containing: Effect (Allow/Deny), Action (e.g. s3:GetObject), Resource (e.g.
What are the 3 types of IAM policies?
A) Global policies, Regional policies, and Resource-level policies.
B) Read policies, Write policies, and Admin policies — the three access level tiers.
C) 1. AWS Managed – pre-built by AWS (e.g. AdministratorAccess, ReadOnlyAccess) | …
D) Account policies, User policies, and Service policies.
C) 1. AWS Managed – pre-built by AWS (e.g. AdministratorAccess, ReadOnlyAccess) | …
List the 8 IAM best practices.
A) 1. Use root for daily tasks 2. Create shared team users 3. Assign permissions per resource 4. Grant all permissions 5. Enable MFA only for root 6. Store credentials in code 7. Rotate annually 8. Use inline policies only
B) Lock down root + MFA, individual IAM users, use groups for permissions, least privilege, MFA for all privileged users, roles for services/apps, rotate credentials, use IAM Access Analyzer.
C) 1. Enable MFA only on production accounts 2. Use groups sparingly 3. Grant permissions one at a time 4. Store keys in environment variables 5. Rotate after breaches only 6. Use root for billing only 7. Share access keys via email 8. Review permissions annually
D) 1. Share root credentials with trusted admins 2. Use one IAM user per team 3. Assign permissions individually 4. Grant maximum access 5. Disable MFA for simplicity 6. Use access keys for all services 7. Never rotate credentials 8. Skip Access Analyzer
B) Lock down root + MFA, individual IAM users, use groups for permissions, least privilege, MFA for all privileged users, roles for services/apps, rotate credentials, use IAM Access Analyzer.
What is the Principle of Least Privilege?
A) Grant all users administrator access by default and restrict only when abuse is detected.
B) Grant identities only the minimum permissions required to perform their job – nothing extra.
C) Each AWS account should have the least possible number of IAM users to reduce attack surface.
D) Only the root user should have access to billing; all other users get read-only by default.
B) Grant identities only the minimum permissions required to perform their job – nothing extra.
What is AWS Organizations?
A) A paid premium service for enterprises to manage AWS service quotas across accounts.
B) A service for centrally managing multiple AWS accounts.
C) AWS Organizations is the same as AWS Control Tower — both manage multi-account setups.
D) A tool for organising AWS resources into logical groups within a single account.
B) A service for centrally managing multiple AWS accounts.
