Practice Security & Compliance questions for the AWS Certified Cloud Practitioner. Every question includes a full explanation of why the correct answer is right and why the tempting distractors are wrong.
37 questions available · medium difficulty · AWS CLF · Free, no registration required
10 example questions with full explanations. Use the interactive practice above to work through the complete set.
Question 1easy
A company wants to ensure that every AWS Identity and Access Management (IAM) user must verify their identity using both a password and a one-time code generated by an authentication app. Which IAM feature should the company enable?
- A.IAM Access Analyzer
- B.IAM Permission Boundaries
- C.Multi-Factor Authentication (MFA)✓
- D.AWS Single Sign-On
Correct answer: C
Multi-Factor Authentication (MFA) adds a second layer of verification beyond a password, requiring users to provide a time-based one-time code from an authenticator app or hardware device. This directly addresses the requirement for two-factor identity verification. IAM Access Analyzer identifies unintended resource access, not login security. Permission Boundaries limit the maximum permissions a role or user can have. AWS Single Sign-On (IAM Identity Center) centralizes access across accounts but does not by itself enforce a second factor for all IAM users.
Question 2easy
A security team needs to review a complete history of all API calls made in their AWS account, including who made each call, from which IP address, and at what time. Which AWS service provides this audit trail?
- A.Amazon CloudWatch
- B.AWS Config
- C.Amazon GuardDuty
- D.AWS CloudTrail✓
Correct answer: D
AWS CloudTrail records every API call made in an AWS account, capturing the identity of the caller, the source IP address, the time of the call, and the parameters used. This makes it the correct choice for building an audit trail of account activity. Amazon CloudWatch monitors performance metrics and logs, not API call history. AWS Config tracks changes to resource configurations over time. Amazon GuardDuty analyzes CloudTrail logs (among other sources) to detect threats, but it does not itself serve as the audit log.
Question 3easy
A startup is hosting a public web application on AWS. They are concerned about Distributed Denial of Service (DDoS) attacks. Which AWS service provides automatic, always-on DDoS protection at no additional cost for all AWS customers?
- A.AWS Shield Standard✓
- B.AWS WAF
- C.AWS Shield Advanced
- D.Amazon GuardDuty
Correct answer: A
AWS Shield Standard is automatically enabled for all AWS customers at no extra charge and provides protection against the most common and frequently occurring network and transport layer DDoS attacks. AWS WAF protects against web application attacks like SQL injection and cross-site scripting, not DDoS. AWS Shield Advanced is a paid, premium tier that adds enhanced DDoS protection, real-time visibility, and access to the AWS DDoS Response Team (DRT). Amazon GuardDuty is a threat detection service, not a DDoS mitigation tool.
Question 4easy
A healthcare company must provide auditors with official documentation proving that AWS meets HIPAA compliance requirements. Where should the company go to download these official AWS compliance reports and agreements?
- A.AWS Trusted Advisor
- B.AWS Artifact✓
- C.AWS Security Hub
- D.Amazon Inspector
Correct answer: B
AWS Artifact is a self-service portal where customers can download AWS compliance reports (such as SOC 2, PCI DSS, and ISO certifications) and review and accept agreements like the HIPAA Business Associate Addendum (BAA). This makes it the correct answer for obtaining official compliance documentation. AWS Trusted Advisor provides operational best-practice recommendations. AWS Security Hub aggregates security findings from multiple services. Amazon Inspector scans EC2 instances and containers for software vulnerabilities.
Question 5easy
A developer accidentally stored a database password directly in their application's source code. Which AWS service is specifically designed to securely store, retrieve, and automatically rotate credentials such as database passwords?
- A.AWS Key Management Service (KMS)
- B.Amazon S3 with server-side encryption
- C.AWS Secrets Manager✓
- D.AWS CloudHSM
Correct answer: C
AWS Secrets Manager is purpose-built for storing, managing, and automatically rotating sensitive credentials such as database passwords, API keys, and other secrets. Applications can retrieve the secret at runtime, removing the need to hardcode credentials. AWS KMS manages cryptographic keys for encrypting data, not for storing application credentials. Amazon S3 with encryption is object storage and is not designed for secret management or automatic rotation. AWS CloudHSM provides dedicated hardware security modules for cryptographic key generation, not credential storage.
Question 6medium
A company migrates its self-managed MySQL database to Amazon RDS. Under the AWS Shared Responsibility Model, the company is now responsible for patching the underlying database engine software on the RDS instance.
Correct answer: B
This statement is False. On Amazon RDS, AWS is responsible for patching the underlying database engine software as part of managing the platform. This is a key distinction from running a database on an EC2 instance, where the customer retains full responsibility for OS and database engine patching. The migration to RDS shifts operational tasks like engine patching, hardware provisioning, and backups to AWS, while the customer remains responsible for database configuration, user access, and the data itself.
Question 7medium
Amazon GuardDuty can still detect threats by analyzing VPC Flow Logs and DNS query logs even if the customer has not separately enabled AWS CloudTrail in their account.
Correct answer: A
This statement is True. GuardDuty is an independent threat detection service that pulls data from multiple sources — CloudTrail event logs, VPC Flow Logs, and DNS logs — using its own mechanisms, regardless of whether the customer has manually enabled those services. GuardDuty does not depend on the customer having configured CloudTrail or VPC Flow Logs themselves; it accesses these data streams directly. This is an important distinction because GuardDuty provides broader threat coverage than any single logging service alone.
Question 8medium
A security engineer configures a Network Access Control List (NACL) to allow inbound HTTP traffic on port 80. Because NACLs are stateful, the corresponding outbound response traffic will automatically be permitted without adding an outbound rule.
Correct answer: B
This statement is False. NACLs are stateless, meaning they evaluate inbound and outbound traffic independently. Allowing inbound traffic on port 80 does NOT automatically allow the outbound response — a separate outbound rule must be created for the ephemeral port range (typically 1024–65535) to permit return traffic. Security groups, by contrast, are stateful: if inbound traffic is allowed, the return traffic is automatically permitted regardless of outbound rules.
Question 9medium
AWS KMS supports automatic annual key rotation for all customer managed keys, including symmetric keys that use imported key material provided by the customer.
Correct answer: B
This statement is False. AWS KMS automatic key rotation is only available for symmetric customer managed keys where AWS generates the key material. It is NOT supported for keys with imported key material, asymmetric keys, or keys stored in custom key stores. When a customer imports their own key material, they are responsible for manually rotating the key themselves. This limitation exists because AWS cannot regenerate or control externally sourced key material.
Question 10medium
A company stores customer records in Amazon S3. Amazon Macie can automatically scan those S3 buckets using machine learning to identify objects that contain personally identifiable information (PII), such as names and credit card numbers.
Correct answer: A
This statement is True. Amazon Macie is a data security service that uses machine learning and pattern matching to automatically discover and classify sensitive data stored in Amazon S3. It can detect a wide range of sensitive data types including PII (names, addresses, passport numbers) and financial data (credit card numbers). Macie is purpose-built for S3 and provides visibility into where sensitive data resides, helping organizations address privacy and compliance requirements like GDPR and HIPAA.