Question 1 An SCP on Todo.io's Prod OU allows s3:*. A role in Prod has no IAM policies that mention S3, and the bucket has no bucket policy. Can the role read objects from a bucket in Prod?
Choose one answer Learn it: SCP (service control policy) · IAM (Identity and Access Management) · Set up AWS: Day 0
Question 2 Why does Todo.io keep its apps out of the management account of its organization?
Choose one answer Learn it: AWS Organizations · SCP (service control policy) · Set up AWS: Day 0
Question 3 Todo.io's auditors require that nobody in the Prod account can ever stop CloudTrail logging. Which control meets the requirement?
Choose one answer Learn it: SCP (service control policy) · Controls (guardrails) · Set up AWS: Day 0 with Control Tower
Question 4 Todo.io hires five engineers who need access to both the Dev and Prod accounts, with less access in Prod. What is the recommended way to set this up?
Choose one answer Learn it: IAM Identity Center · Permission set · Set up AWS: Day 0
Question 5 Todo.io runs six AWS accounts and wants a single bill, with usage across all six counted together for volume pricing. What gives them that?
Choose one answer Learn it: AWS Organizations
Question 6 Todo.io attaches an SCP to its Workloads OU. The Prod and Dev accounts sit in that OU, and a Sandbox OU sits inside it. Which accounts does the SCP apply to?
Choose one answer Learn it: AWS Organizations · SCP
Question 7 Todo.io wants to stop anyone, including the root user, from deleting the audit bucket in its Prod account. Prod is a member account. Can an SCP do that?
Choose one answer Learn it: SCP (service control policy) · Root user
Question 8 An SCP on the Prod OU denies a set of RDS actions. Which of these does the SCP NOT restrict?
Choose one answer Learn it: SCP (service control policy) · Service-linked role
Question 9 Todo.io may only run in us-east-1 and eu-west-1, in every account, now and in future accounts. What enforces that?
Choose one answer An SCP attached to the organization's root, at the top of the tree, that denies requests outside those two Regions. Correct. A preventive guardrail at the top of the tree covers every member account, including ones created later. (As always, SCPs skip the management account.) Global services such as IAM are left out of a Region rule. An IAM policy on every user and role that only allows those Regions. Not this one. Anyone who can edit IAM policies can remove it, and every new user or role needs it added. An AWS Config rule that flags resources in other Regions. Not this one. Config reports after the fact. The requirement says it may only run there. Deleting the default VPC in every other Region. Not this one. Many services don't need a VPC at all, and anyone can create a new VPC.
Learn it: SCP (service control policy) · Controls (guardrails) · Region
Question 10 Todo.io creates a new member account from its management account with AWS Organizations. Nobody knows a password for the new account. How does an administrator get in the first time?
Choose one answer From the management account, assume the OrganizationAccountAccessRole that Organizations created in the new account. Correct. Organizations creates that role in every account it creates, and trusts the management account to assume it. Borrowing a role means no new passwords or keys. Sign in to the new account as root with the management account's password. Not this one. Each account has its own root user and email address. The management account's password doesn't open it. Use the IAM user that Organizations creates for the administrator. Not this one. Organizations creates a role, not an IAM user. Wait for the new account to accept an invitation. Not this one. Invitations are for existing accounts that join. A new account created by the organization is a member at once.
Learn it: AWS Organizations · Set up AWS: Day 0 · IAM role
Question 11 Why does Todo.io put Prod and Dev in separate AWS accounts rather than in one account?
Choose one answer Learn it: AWS account
Question 12 Todo.io wants every production account, including ones it adds next year, to get the same guardrails automatically. What should it do?
Choose one answer Learn it: AWS Organizations · SCP
Question 13 Todo.io wants a multi-account setup with central logging, single sign-on and guardrails, built the AWS-recommended way, with the least work. What should it use?
Choose one answer Learn it: AWS Control Tower · Set up AWS: Day 0 with Control Tower · Landing zone
Question 14 A teammate says that once Todo.io uses Control Tower, it no longer uses AWS Organizations. Which statement is true?
Choose one answer Control Tower sets up and governs Organizations, IAM Identity Center, CloudTrail and Config. It doesn't replace them. Correct. The organization, the OUs and the SCPs are all still there. Control Tower manages them for you. Control Tower replaces Organizations with its own account system. Not this one. Control Tower runs on top of Organizations. Control Tower is only a dashboard; it changes nothing. Not this one. It creates accounts, applies controls and sets up logging and sign-in. Control Tower runs separately inside each member account. Not this one. It runs from the management account and governs the accounts below it.
Learn it: AWS Control Tower
Question 15 Todo.io needs a new account for its data team. It must arrive with logging on, guardrails applied and sign-in through Identity Center already set up. What creates it?
Choose one answer Learn it: Account Factory
Question 16 Why does a Control Tower landing zone keep every account's logs in a separate Log Archive account?
Choose one answer Someone who breaks into a workload account can't erase the evidence of what they did. Correct. Nobody runs apps in the Log Archive account, and workload accounts can't delete what is stored there. Storage is cheaper in a separate account. Not this one. The price of storage doesn't depend on which account holds it. CloudTrail can only write to another account. Not this one. CloudTrail can write to a bucket in the same account. Separating them is a security choice. Logs in workload accounts are deleted after 90 days. Not this one. Logs in S3 are kept as long as you choose, in any account.
Learn it: Landing zone · Set up AWS: Day 0 with Control Tower
Question 17 Todo.io wants to be told whenever an S3 bucket in any account becomes public. Teams must still be able to make the change. Which kind of Control Tower control fits?
Choose one answer A detective control. Correct. Detective controls are AWS Config rules. They spot something after it happens and report it, without blocking it. "Be told" is the clue. A preventive control. Not this one. Preventive controls are SCPs. They would block the change, which the requirement doesn't want. A proactive control. Not this one. Proactive controls check CloudFormation templates before resources are created. Buckets changed in the console would be missed. A mandatory control. Not this one. "Mandatory" says a control is always on, not what kind it is.
Learn it: Controls (guardrails)
Question 18 Nobody in Todo.io's Prod account, not even an administrator, may ever be able to turn off CloudTrail. Which kind of Control Tower control fits?
Choose one answer A preventive control. Correct. Preventive controls are SCPs: they block the action before it happens, for everyone in the account. A detective control. Not this one. Detective controls report after the change; CloudTrail would already be off. An IAM policy on each administrator. Not this one. An administrator can change their own IAM policies; an SCP sits above them. A budget alert. Not this one. Budgets watch spending, not what people can do.
Learn it: Controls (guardrails)
Question 19 A teammate edits one of Control Tower's SCPs by hand in the Organizations console. What does Control Tower do?
Choose one answer It reports drift, so the landing zone can be repaired to match its intended setup. Correct. Control Tower notices changes made outside it. Fixing the drift puts its managed resources back as they should be. Nothing. Changes made in the Organizations console are invisible to it. Not this one. Control Tower watches the resources it manages, wherever they are changed. It deletes the account that was changed. Not this one. It never deletes accounts on its own. It blocks the edit before it happens. Not this one. The edit goes through. Control Tower reports it afterwards.
Learn it: AWS Control Tower
Question 20 Todo.io had three accounts before it set up Control Tower. Can they be governed by it?
Choose one answer Yes. Existing accounts in the organization can be enrolled. Correct. Enrolling an account applies the landing zone's logging, guardrails and sign-in to it. No. They have to be closed and recreated with Account Factory. Not this one. Enrollment exists so that doesn't have to happen. Only by moving their workloads into the management account. Not this one. Workloads should never move into the management account. Only their root users can be governed. Not this one. Enrollment governs the whole account.
Learn it: AWS Control Tower
Question 21 Which statement about Control Tower's controls is true?
Choose one answer Some are mandatory and always on. Others are strongly recommended or elective, and you choose where to turn them on. Correct. Mandatory controls protect the landing zone itself, such as its logging. The rest you enable per OU. Every control is a preventive SCP. Not this one. Controls are preventive (SCPs), detective (Config rules) or proactive (CloudFormation hooks). Every control is optional. Not this one. Mandatory controls can't be turned off. Controls only apply to the management account. Not this one. Controls are applied to OUs, so they reach the accounts in them.
Learn it: Controls (guardrails)
Question 22 An engineer signs in to the IAM Identity Center access portal and opens the Prod account. What credentials do they get in Prod?
Choose one answer Temporary credentials for a role that Identity Center created from their permission set. Correct. Signing in means assuming a role, so the credentials expire on their own. No long-lived keys exist to leak. The password of an IAM user in Prod. Not this one. Identity Center doesn't create IAM users in the accounts. Permanent access keys for Prod. Not this one. Nothing here is permanent. That's the point. The Prod root user's credentials. Not this one. Root is never handed out by Identity Center.
Learn it: IAM Identity Center · Temporary credentials
Question 23 Todo.io assigns the ReadOnlyAccess permission set to an engineer in its Audit account. What does Identity Center create in the Audit account?
Choose one answer Learn it: Permission set
Question 24 Todo.io already manages its staff in Okta. It wants people to sign in to AWS with the same accounts, and leavers to lose AWS access when they are removed from Okta. What should it do?
Choose one answer Connect Okta to IAM Identity Center as its identity source. Correct. Identity Center can use an external directory instead of its own. One place to add and remove people. Create an IAM user in each account for every Okta user. Not this one. That duplicates every person, and removing someone from Okta wouldn't remove their IAM users. Use Amazon Cognito. Not this one. Cognito is for an app's own customers (Level 2), not for staff signing in to AWS. Share one AWS sign-in among everyone who is in Okta. Not this one. Shared sign-ins hide who did what, and can't be taken from one leaver.
Learn it: IAM Identity Center
Question 25 An engineer leaves Todo.io. They had access to all six accounts through IAM Identity Center. What is the quickest way to remove their access everywhere?
Choose one answer Disable or delete their user once: in Identity Center, or in the company directory it is connected to. Correct. One identity, one place to remove it. Sessions already open run out when their temporary credentials expire. Delete their IAM user in each of the six accounts. Not this one. They don't have IAM users; Identity Center gives them roles. Change the root password of every account. Not this one. They never had root, so this changes nothing for them. Delete the permission sets they used. Not this one. That removes access for everyone else who uses those permission sets too.
Learn it: IAM Identity Center
Question 26 An engineer needs full access in Dev but must only be able to look, not change, in Prod. How should Todo.io set this up in IAM Identity Center?
Choose one answer Assign an administrator permission set in Dev and a read-only permission set in Prod. Correct. Assignments are per account, so each account gets exactly the access it needs: least privilege. Assign the administrator permission set in both accounts and trust the engineer to be careful in Prod. Not this one. Least privilege means not relying on care. Give only what the job needs. Assign the administrator permission set in both, and add an SCP to Prod that denies all changes. Not this one. That SCP would stop everyone in Prod making changes, including deployments. Create an IAM user in Prod with read-only access as well. Not this one. Two identities for one person is harder to manage and to remove.
Learn it: Permission set
Question 27 Todo.io expects 50,000 people to sign up to manage their todos. Should those customers be created in IAM Identity Center?
Choose one answer No. Identity Center and IAM are for people and software that manage or call AWS. App customers belong to the app. Correct. Customer sign-up and login is the app's job; Amazon Cognito does it in Level 2. Yes. Identity Center is built for large numbers of users. Not this one. It's built for staff who sign in to AWS accounts, not for an app's customers. Yes, as IAM users, so each customer has their own permissions. Not this one. Customers should never be IAM principals. Yes, with one permission set per customer. Not this one. Customers don't sign in to AWS accounts at all.
Learn it: IAM Identity Center · IAM
Question 28 Roles named AWSReservedSSO_AdministratorAccess_… appear in Todo.io's Prod account. Where did they come from?
Choose one answer IAM Identity Center created them when a permission set was assigned in Prod. Correct. Identity Center was formerly called AWS SSO, hence the name. Change them through the permission set, not by hand. An attacker created them. Not this one. The AWSReservedSSO_ prefix is reserved for Identity Center. RDS created them as service-linked roles. Not this one. Service-linked roles are named AWSServiceRoleFor… Account Factory creates them in every account. Not this one. Account Factory sets up sign-in, but these roles come from permission set assignments.
Learn it: IAM Identity Center
Question 29 Todo.io wants every member of staff to use MFA when they sign in to AWS. Staff sign in through IAM Identity Center. Where should MFA be required?
Choose one answer Learn it: MFA (multi-factor authentication)
Question 30 What does an engineer see after signing in to the IAM Identity Center access portal?
Choose one answer The accounts they are assigned to, and the permission sets they can use in each. Correct. They pick an account and a permission set, and land in the console as that role. Every account in the organization, with administrator access to each. Not this one. They see only what has been assigned to them. Only the management account. Not this one. Staff rarely need the management account at all. A list of IAM users to sign in as. Not this one. There are no IAM users; access is through roles.
Learn it: IAM Identity Center
Question 31 In Todo.io's Prod account, a developer's role has an IAM policy that allows dynamodb:DeleteTable. An SCP attached to the Prod OU denies dynamodb:DeleteTable. The developer tries to delete a table. What happens?
Choose one answer Learn it: IAM policy · SCP (service control policy) · Set up AWS: Wrong Region
Question 32 Todo.io's founder signs in as the root user every day to manage everything. Which change best follows AWS security best practice?
Choose one answer Learn it: Root user · Set up AWS: Day 0
Question 33 Todo.io creates a new IAM role and attaches no policies to it. What can something using the role do?
Choose one answer Learn it: IAM (Identity and Access Management) · IAM policy
Question 34 Todo.io created an IAM role while the console was set to us-east-1. Can an app running in eu-west-1 use the role?
Choose one answer Yes. IAM is global, so roles aren't tied to a Region. Correct. A few services, IAM among them, are global. Most others, like RDS, are regional. No. The role only exists in us-east-1. Not this one. That's true of most services, but not of IAM. Only after the role is copied to eu-west-1. Not this one. There is nothing to copy; the same role works in every Region. Only if the app signs in through IAM Identity Center. Not this one. Apps use roles directly. Identity Center is for people.
Learn it: IAM (Identity and Access Management) · Region
Question 35 A Todo.io Lambda function must write to a DynamoDB table. How should it get that permission?
Choose one answer Learn it: IAM role · Lambda
Question 36 Which statement describes a resource-based policy?
Choose one answer It is attached to a resource, such as a Lambda function or an S3 bucket, and says who may use that resource. Correct. It names the principal: "API Gateway may invoke this function". The opposite of an identity policy, which is attached to the caller. It is attached to a user, group or role, and says what they may do. Not this one. That is an identity-based policy. It sets the most any identity in an account may do. Not this one. That is an SCP. It decides which Region a resource is created in. Not this one. Policies allow or deny requests. The Region is chosen when you create the resource.
Learn it: IAM policy
Question 37 A developer may create Lambda functions, but gets AccessDenied when choosing an existing execution role for a new function. What is missing?
Choose one answer Learn it: iam:PassRole
Question 38 Which part of an IAM role decides who is allowed to assume it?
Choose one answer Its trust policy. Correct. The trust policy names who may wear the role, such as ec2.amazonaws.com. The permissions policy says what the wearer can do. Its permissions policy. Not this one. That says what the role can do once assumed, not who may assume it. An SCP on the account. Not this one. An SCP caps what the role can do. It doesn't name who may assume it. The role's ARN. Not this one. The ARN is only the role's name.
Learn it: IAM role
Question 39 Todo.io's report job only reads items from the Todos table. Which policy follows the principle of least privilege?
Choose one answer Allow dynamodb:GetItem and dynamodb:Query on the Todos table's ARN. Correct. Only the actions the job uses, only on the one table it reads. Allow dynamodb:* on every resource. Not this one. That lets the job delete every table in the account. Attach AdministratorAccess. Not this one. That lets the job do anything in the account. Allow every action on the Todos table's ARN. Not this one. Right table, but it could also delete it.
Learn it: IAM policy
Question 40 In the ARN arn:aws:dynamodb:us-east-1:111122223333:table/Todos, what is 111122223333?
Choose one answer Learn it: ARN (Amazon Resource Name)
Question 41 Todo.io's staging database was deleted at 3 a.m. last night. Which service shows who deleted it, and from which IP address?
Choose one answer Learn it: CloudTrail · Set up AWS: Create the database
Question 42 Todo.io never created a CloudTrail trail. Can it still see who changed a security group yesterday?
Choose one answer Yes. CloudTrail Event history keeps 90 days of management events in each Region, with no setup. Correct. A trail is for keeping events longer, or in one place. No. Nothing is recorded until a trail exists. Not this one. Event history is always on. Only if AWS Config is turned on. Not this one. Config records settings; CloudTrail records who made the call. Only for changes made by the root user. Not this one. Every caller is recorded.
Learn it: CloudTrail
Question 43 Todo.io must keep a record of every AWS API call for seven years. What does it need?
Choose one answer A CloudTrail trail that delivers events to an S3 bucket, kept for seven years. Correct. A trail saves events to S3 for as long as you choose. Event history alone stops at 90 days. Set Event history to keep seven years. Not this one. Event history is fixed at 90 days. CloudWatch metrics. Not this one. Metrics are numbers over time, not a record of API calls. AWS Config. Not this one. Config records how resources are set up, not every API call.
Learn it: CloudTrail
Question 44 Todo.io wants one trail that records every account and every Region in its organization. What should it create?
Choose one answer An organization trail, from the management account. Correct. One trail covers every account and Region, including accounts added later. A trail in each account, one by one. Not this one. That works, but every new account needs one, and each account could switch its own off. An IAM Identity Center permission set. Not this one. Permission sets give people access; they don't record anything. An SCP. Not this one. SCPs limit what can be done; they record nothing.
Learn it: CloudTrail
Question 45 Someone tried to delete Todo.io's audit bucket, and IAM denied it. Does CloudTrail record the attempt?
Choose one answer Yes. CloudTrail records failed calls too, with the error. Correct. Denied attempts are often the most interesting events in an investigation. No. Only successful calls are recorded. Not this one. Failed calls are recorded too. Only if the attempt was made in the console. Not this one. Console, CLI and SDK calls are all recorded. Only if the caller used MFA. Not this one. Every call is recorded, with or without MFA.
Learn it: CloudTrail
Question 46 One teammate changes a setting in the console, another with the CLI, and the app with the SDK. Which does CloudTrail record?
Choose one answer All three. They all end up as the same signed AWS API call. Correct. That is why CloudTrail can see everything done to AWS, however it was done. Only the console change. Not this one. The console just makes API calls for you. Only the CLI change. Not this one. The CLI is one of three ways to make the same call. The console and CLI changes, but not the app's. Not this one. SDK calls are API calls too.
Learn it: CloudTrail · Set up AWS: Create the database
Question 47 A bucket policy changed overnight. Which service tells Todo.io who changed it?
Choose one answer AWS CloudTrail. Correct. It records the PutBucketPolicy call: who made it, when and from where. AWS Config. Not this one. Config shows what the policy looked like before and after, not who made the call. Amazon CloudWatch Logs. Not this one. Logs hold what applications print. IAM Identity Center. Not this one. Identity Center handles sign-in; it doesn't record API calls.
Learn it: CloudTrail · AWS Config
Question 48 An administrator in Todo.io's Dev account tries to turn off the organization trail. What happens?
Choose one answer They can't. Member accounts can see an organization trail but can't change or stop it. Correct. Only the management account (or a delegated administrator) controls the organization trail. It stops for every account in the organization. Not this one. Member accounts can't touch it. It stops, but only for the Dev account. Not this one. Member accounts can't switch it off for themselves either. Only the Dev account's root user can stop it. Not this one. Root in a member account can't change it either.
Learn it: CloudTrail
Question 49 What does AWS CloudTrail record?
Choose one answer AWS API calls: who made them, what they did, when, and from where. Correct. "Who did what to AWS" is CloudTrail's answer. What applications print. Not this one. That is CloudWatch Logs. CPU and memory use over time. Not this one. That is CloudWatch metrics. How each resource is configured, over time. Not this one. That is AWS Config.
Learn it: CloudTrail
Question 50 Todo.io looks in CloudTrail Event history in us-east-1 for a call made in eu-west-1, and can't find it. Why?
Choose one answer Event history is kept per Region; switch the console to eu-west-1 to see it. Correct. A multi-Region trail collects every Region in one place. Calls made in eu-west-1 aren't recorded. Not this one. They are recorded, in eu-west-1. Event history only records global services. Not this one. It records management events from regional services too. Events are deleted after one day. Not this one. Event history keeps 90 days.
Learn it: CloudTrail · Region
Question 51 A user reports an error. Todo.io's engineers want to read what the app printed while handling that request. Where do they look?
Choose one answer Learn it: CloudWatch Logs
Question 52 In CloudWatch Logs, what holds the logs for one app or one Lambda function?
Choose one answer A log group, with log streams inside it. Correct. You set retention and permissions on the log group. A bucket. Not this one. Buckets are S3. A trail. Not this one. Trails are CloudTrail. An organizational unit. Not this one. OUs group AWS accounts.
Learn it: CloudWatch Logs
Question 53 Todo.io's logs are kept forever by default, and the bill keeps growing. It only needs 30 days. What should it do?
Choose one answer Set each log group's retention to 30 days. Correct. CloudWatch Logs then deletes older events for you. Delete old log lines by hand each month. Not this one. Retention does it automatically. Change CloudTrail's retention. Not this one. CloudTrail is a different service. Attach an SCP that limits logs. Not this one. SCPs limit API calls; they don't expire data.
Learn it: CloudWatch Logs
Question 54 Todo.io's app on EC2 writes log files, but nothing shows up in CloudWatch Logs. What is needed?
Choose one answer Install the CloudWatch agent on the instance, and allow the instance's role to write logs. Correct. EC2 doesn't send logs by itself. Lambda and Fargate do, but an instance is your server. Nothing; EC2 sends every file automatically. Not this one. It sends nothing until the agent is set up. Turn on CloudTrail. Not this one. CloudTrail records API calls, not files on an instance. Open an inbound port on the instance. Not this one. The agent sends logs out; nothing needs to come in.
Learn it: EC2 (Elastic Compute Cloud) · CloudWatch Logs
Question 55 Todo.io wants to be alerted when its app logs more than 10 ERROR lines in a minute. What should it set up?
Choose one answer A metric filter on the log group that counts ERROR lines, and a CloudWatch alarm on that metric. Correct. Logs become a number you can alarm on. A CloudTrail trail. Not this one. CloudTrail doesn't read app output. An AWS Config rule. Not this one. Config checks resource settings, not log lines. Someone reading the logs every morning. Not this one. That finds problems hours late.
Learn it: CloudWatch Logs
Question 56 An EC2 instance in a public subnet sends its log lines to CloudWatch Logs. Which way do they travel?
Choose one answer Out through the internet gateway to CloudWatch Logs' public AWS endpoint. Correct. Like SQS and DynamoDB, CloudWatch Logs is a public AWS service, not something inside the VPC. They stay inside the VPC; CloudWatch Logs runs in every subnet. Not this one. It runs outside every customer VPC. Through the RDS database. Not this one. Logs don't pass through databases. Through an SQS queue. Not this one. The agent sends straight to CloudWatch Logs.
Learn it: VPC (Virtual Private Cloud) · CloudWatch Logs
Question 57 Can Todo.io's CloudWatch Logs show who deleted the staging database?
Choose one answer No. Deleting a database is an AWS API call, which CloudTrail records. CloudWatch Logs holds what apps print. Correct. Don't mix them up: CloudTrail is who did what to AWS; CloudWatch Logs is what your software said. Yes, always. Not this one. Only if something happened to print it, and AWS API calls are not printed there. Only if the CloudWatch agent is installed. Not this one. The agent ships files from an instance; it doesn't see API calls. Only in CloudWatch metrics. Not this one. Metrics are numbers, not who did what.
Learn it: CloudWatch Logs · CloudTrail
Question 58 Todo.io wants every log line from the last hour that mentions user u-123. What is the quickest way?
Choose one answer Search (or query with Logs Insights) the app's log group for the last hour. Correct. CloudWatch Logs can filter and query log events directly. Look up events in CloudTrail Event history. Not this one. CloudTrail has API calls, not app log lines. Check AWS Config. Not this one. Config has resource settings. Download every log file and search on a laptop. Not this one. It works, but it is slow and unnecessary.
Learn it: CloudWatch Logs
Question 59 Todo.io's app logs each user's password when they sign in, to help with debugging. What should Todo.io do?
Choose one answer Stop logging passwords: anyone allowed to read the log group could read them. Correct. Logs are read by many people and kept for a long time. Secrets never belong in them. Nothing; log groups are encrypted, so it is safe. Not this one. Encryption protects the stored data, not what authorised readers see. Nothing; only the root user can read logs. Not this one. Anyone whose policy allows reading the log group can. Shorten retention to one day and carry on. Not this one. For a whole day, the passwords are still exposed.
Learn it: CloudWatch Logs
Question 60 Inside a CloudWatch Logs log group, what is a log stream?
Choose one answer The sequence of log events from one source, such as one container or one Lambda instance. Correct. A log group holds many streams, one per source. Another name for a log group. Not this one. Streams sit inside a group. A CloudTrail trail. Not this one. Trails are CloudTrail. A real-time data stream for analytics. Not this one. That is a different service (Kinesis, Level 4).
Learn it: CloudWatch Logs
Question 61 Todo.io wants to see how a security group's rules looked last Tuesday, and every change since. Which service shows that?
Choose one answer Learn it: AWS Config
Question 62 A Config rule checks that no S3 bucket is public. A teammate makes a bucket public. Does the rule stop it?
Choose one answer No. Config reports the bucket as noncompliant after the change; it doesn't block it. Correct. Config is detective. You can attach a remediation that fixes it afterwards, but blocking needs a preventive control such as an SCP. Yes. Config rules block changes that break them. Not this one. Config evaluates after the fact. Yes, by deleting the bucket. Not this one. Config never deletes resources on its own. Only if CloudTrail is turned off. Not this one. CloudTrail has nothing to do with it.
Learn it: AWS Config · Control Tower controls
Question 63 What does an AWS Config rule mark each resource it checks as?
Choose one answer Compliant or noncompliant. Correct. The result shows on the Config (and Control Tower) dashboards. Allowed or denied. Not this one. That is how IAM answers requests. Public or private. Not this one. That is one thing a rule might check, not what it marks. Healthy or unhealthy. Not this one. That is how load balancers describe targets (Level 2).
Learn it: AWS Config
Question 64 AWS Config shows that a bucket became public at 14:02. Where should Todo.io look to find out who did it?
Choose one answer CloudTrail, for the call that changed the bucket around 14:02. Correct. Config says what changed and when; CloudTrail says who made the call. AWS Config again; it records the caller. Not this one. Config records the resource's settings, not the caller. CloudWatch Logs. Not this one. App output won't show who called S3. The bucket's object list. Not this one. Objects don't record who changed the bucket's settings.
Learn it: AWS Config · CloudTrail
Question 65 What are Control Tower's detective controls built from?
Choose one answer AWS Config rules. Correct. They spot problems after they happen and report them. Service control policies. Not this one. SCPs are the preventive controls. CloudFormation hooks. Not this one. Hooks are the proactive controls. IAM policies in each account. Not this one. Controls are applied across OUs, not written into each account's IAM.
Learn it: AWS Config · Controls (guardrails)
Question 66 Todo.io's auditors want ongoing evidence that every EBS volume is encrypted. What provides it?
Choose one answer An AWS Config rule that checks volume encryption, with its compliance history. Correct. Config keeps checking and keeps the record auditors need. CloudTrail Event history. Not this one. It shows calls, not whether every volume is encrypted right now. An SCP. Not this one. An SCP could block unencrypted volumes, but it produces no evidence about existing ones. A spreadsheet updated by hand. Not this one. Out of date the moment anything changes.
Learn it: AWS Config
Question 67 Which requirement points to AWS Config rather than an SCP?
Choose one answer "Report on any resource that isn't tagged with its owner." Correct. "Report on", "find out when" and "show evidence" are detective words: Config. "It must never be possible to disable CloudTrail." Not this one. "Must never" asks for a preventive control: an SCP. "Block any request outside approved Regions." Not this one. Blocking is preventive. "Prevent anyone from leaving the organization." Not this one. Preventing is preventive.
Learn it: Controls (guardrails)
Question 68 What does AWS Config record?
Choose one answer Each resource's configuration, and how it changes over time. Correct. A timeline of what each resource looked like. Only who made each API call. Not this one. That is CloudTrail. Application log lines. Not this one. That is CloudWatch Logs. Every network packet. Not this one. Config doesn't see traffic.
Learn it: AWS Config
Question 69 Todo.io turned on AWS Config in us-east-1 only. Resources in eu-west-1 aren't being recorded. Why?
Choose one answer Config records per Region; it has to be turned on in every Region Todo.io uses. Correct. Control Tower does this for you in the Regions it governs. Config is global, so this must be a bug. Not this one. Config is regional. Config doesn't work in eu-west-1. Not this one. It works in every commercial Region. Config needs CloudTrail to be on first. Not this one. They are separate services.
Learn it: AWS Config · Region
Question 70 Todo.io wants one view of compliance across all its accounts and Regions. What gives that?
Choose one answer A Config aggregator (for example in the Audit account) that collects results from every account and Region. Correct. One place to see what is noncompliant anywhere. Signing in to each account and Region in turn. Not this one. It works, but it is slow and easy to miss something. CloudTrail Event history. Not this one. It shows API calls, not compliance. IAM Identity Center. Not this one. It handles sign-in, not compliance.
Learn it: AWS Config
Question 71 Todo.io moves "update the monthly stats" out of its API function and into a worker, with an SQS queue between them. What should the API function's execution role gain?
Choose one answer sqs:SendMessage on that queue's ARN.Correct. Sending is an AWS API call approved by IAM. Least privilege: only the action the job needs, only on the queue it uses. sqs:* on *, so it keeps working if more queues are added.Not this one. That allows every SQS action on every queue in the account. Least privilege means the one action on the one queue. Nothing: open port 443 on the queue's security group instead. Not this one. SQS is a public AWS service outside your VPC, with no security group. IAM decides who may send. Nothing: an account's functions may send to its queues by default. Not this one. A function can do only what its execution role allows. Without the permission, SendMessage fails with AccessDenied.
Learn it: SQS (Simple Queue Service) · Lambda · IAM policy · VPC (Virtual Private Cloud)
Question 72 Before Day 0, Todo.io's developer deployed everything signed in as the root user. After Day 0, how should they sign in to the Prod account?
Choose one answer At the IAM Identity Center access portal, with MFA, picking Prod and a permission set. Correct. Opening an account from the portal assumes a role, so the developer gets temporary credentials that expire on their own. Root stays locked away. As root, but with MFA turned on. Not this one. MFA on root is right, but root is for the few jobs that need it, like closing the account. Day-to-day work uses an everyday sign-in. With access keys for the root user, kept in a config file. Not this one. Root access keys should never exist: they never expire and can do almost anything. With one shared IAM user that the whole team uses. Not this one. A shared login can't say who did what, and long-lived access keys can leak. Each person signs in once, as themselves, and gets temporary credentials. Learn it: Root user · IAM Identity Center
Question 73 What does "AWS account" mean?
Choose one answer Learn it: AWS account
Question 74 Which term is this? "A container for AWS resources, with its own identities and its own bill."
Choose one answer Learn it: AWS account
Question 75 Which AWS term is described by this analogy? "A flat in an apartment building. Separate locks, separate meter."
Choose one answer Learn it: AWS account
Question 76 What does "Root user" mean?
Choose one answer Learn it: Root user
Question 77 Which term is this? "The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it."
Choose one answer Learn it: Root user
Question 78 Which AWS term is described by this analogy? "The master key to the whole building."
Choose one answer Learn it: Root user
Question 79 What does "MFA (multi-factor authentication)" mean?
Choose one answer Learn it: MFA (multi-factor authentication)
Question 80 Which term is this? "A second proof of identity, like a code from an app or a security key, on top of a password."
Choose one answer Learn it: MFA (multi-factor authentication)
Question 81 Which AWS term is described by this analogy? "A PIN on top of the key card."
Choose one answer Learn it: MFA (multi-factor authentication)
Question 82 What does "AWS Organizations" mean?
Choose one answer Learn it: AWS Organizations
Question 83 Which term is this? "Groups many AWS accounts under one management account, with one bill and shared guardrails."
Choose one answer Learn it: AWS Organizations
Question 84 Which AWS term is described by this analogy? "The building management company that owns every flat."
Choose one answer Learn it: AWS Organizations
Question 85 What does "SCP (service control policy)" mean?
Choose one answer Learn it: SCP (service control policy)
Question 86 Which term is this? "An organization-wide guardrail that sets the most any identity in an account may do."
Choose one answer Learn it: SCP (service control policy)
Question 87 Which AWS term is described by this analogy? "The building's rules. Your lease can't give you permission to break them."
Choose one answer Learn it: SCP (service control policy)
Question 88 What does "IAM Identity Center" mean?
Choose one answer Learn it: IAM Identity Center
Question 89 Which term is this? "One place for people to sign in and get access to many AWS accounts."
Choose one answer Learn it: IAM Identity Center
Question 90 Which AWS term is described by this analogy? "The front desk that hands you a temporary key card for whichever flat you're cleared for."
Choose one answer Learn it: IAM Identity Center
Question 91 What does "Permission set" mean?
Choose one answer Learn it: Permission set
Question 92 Which term is this? "A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to."
Choose one answer Learn it: Permission set
Question 93 Which AWS term is described by this analogy? "A job description that comes with the right keys in every building."
Choose one answer Learn it: Permission set
Question 94 What does "AWS Control Tower" mean?
Choose one answer Learn it: AWS Control Tower
Question 95 Which term is this? "Sets up and governs a multi-account AWS environment (a landing zone) for you."
Choose one answer Learn it: AWS Control Tower
Question 96 Which AWS term is described by this analogy? "A developer who builds the whole apartment complex to code, then inspects it regularly."
Choose one answer Learn it: AWS Control Tower
Question 97 What does "Landing zone" mean?
Choose one answer Learn it: Landing zone
Question 98 Which term is this? "A ready-made, well-run multi-account AWS environment for your workloads, set up for you by Control Tower."
Choose one answer Learn it: Landing zone
Question 99 Which AWS term is described by this analogy? "A finished business park, with roads, security gates, CCTV and empty units ready to rent."
Choose one answer Learn it: Landing zone
Question 100 What does "Account Factory" mean?
Choose one answer Learn it: Account Factory
Question 101 Which term is this? "Control Tower's way to create new AWS accounts from a standard template."
Choose one answer Learn it: Account Factory
Question 102 Which AWS term is described by this analogy? "A vending machine for pre-furnished flats."
Choose one answer Learn it: Account Factory
Question 103 What does "Controls (guardrails)" mean?
Choose one answer Learn it: Controls (guardrails)
Question 104 Which term is this? "Control Tower's rules for every account in an OU. Some block, some report, some check before deploying."
Choose one answer Learn it: Controls (guardrails)
Question 105 Which AWS term is described by this analogy? "Locked doors, CCTV, and a plan check before building work starts."
Choose one answer Learn it: Controls (guardrails)
Question 106 What does "IAM (Identity and Access Management)" mean?
Choose one answer Learn it: IAM (Identity and Access Management)
Question 107 Which term is this? "Decides who can do what to which AWS resource."
Choose one answer Learn it: IAM (Identity and Access Management)
Question 108 Which AWS term is described by this analogy? "The building's security office that issues every badge."
Choose one answer Learn it: IAM (Identity and Access Management)
Question 109 What does "IAM role" mean?
Choose one answer Learn it: IAM role
Question 110 Which term is this? "An identity with permissions that something can "wear" temporarily. No password."
Choose one answer Learn it: IAM role
Question 111 Which AWS term is described by this analogy? "A visitor badge that's handed out at the door and expires."
Choose one answer Learn it: IAM role
Question 112 What does "IAM policy" mean?
Choose one answer Learn it: IAM policy
Question 113 Which term is this? "A JSON document listing allowed (or denied) actions on resources."
Choose one answer Learn it: IAM policy
Question 114 Which AWS term is described by this analogy? "The list of rooms printed on the back of a badge."
Choose one answer Learn it: IAM policy
Question 115 What does "ARN (Amazon Resource Name)" mean?
Choose one answer Learn it: ARN (Amazon Resource Name)
Question 116 Which term is this? "The unique full name of an AWS resource."
Choose one answer Learn it: ARN (Amazon Resource Name)
Question 117 Which AWS term is described by this analogy? "A full postal address, down to the flat number."
Choose one answer Learn it: ARN (Amazon Resource Name)
Question 118 What does "Temporary credentials" mean?
Choose one answer Learn it: Temporary credentials
Question 119 Which term is this? "Short-lived AWS keys handed out for a role, which expire automatically."
Choose one answer Learn it: Temporary credentials
Question 120 Which AWS term is described by this analogy? "A wristband that's only valid for today."
Choose one answer Learn it: Temporary credentials
Question 121 What does "Service-linked role" mean?
Choose one answer Learn it: Service-linked role
Question 122 Which term is this? "A role an AWS service creates and owns so it can act in your account on its own behalf."
Choose one answer Learn it: Service-linked role
Question 123 Which AWS term is described by this analogy? "A contractor's own access badge, issued and controlled by the contractor's company."
Choose one answer Learn it: Service-linked role
Question 124 What does "iam:PassRole" mean?
Choose one answer Learn it: iam:PassRole
Question 125 Which term is this? "The permission to hand an existing role to an AWS service."
Choose one answer Learn it: iam:PassRole
Question 126 Which AWS term is described by this analogy? "Being allowed to lend your colleague's key card to a contractor."
Choose one answer Learn it: iam:PassRole
Question 127 What does "CloudWatch Logs" mean?
Choose one answer Learn it: CloudWatch Logs
Question 128 Which term is this? "Where applications and AWS services send their log lines."
Choose one answer Learn it: CloudWatch Logs
Question 129 Which AWS term is described by this analogy? "The building's logbook."
Choose one answer Learn it: CloudWatch Logs
Question 130 What does "CloudTrail" mean?
Choose one answer Learn it: CloudTrail
Question 131 Which term is this? "A record of every AWS API call. Who did what, when, from where."
Choose one answer Learn it: CloudTrail
Question 132 Which AWS term is described by this analogy? "The building's CCTV and visitor book."
Choose one answer Learn it: CloudTrail
Question 133 What does "AWS Config" mean?
Choose one answer Learn it: AWS Config
Question 134 Which term is this? "Records how your resources are configured over time and checks them against rules."
Choose one answer Learn it: AWS Config
Question 135 Which AWS term is described by this analogy? "A building inspector with a notebook and a camera."
Choose one answer Learn it: AWS Config