Start learning →

AWS Security — free MCQ practice

Choose from 3 questions across 1 subjects and 2 topics. Open any question for its answer and worked solution, or keep learning through bite-sized lessons and reviews with Quill.

Start learning AWS Security with Quill →

AWS Security subjects

Cloudcomputing (3)

Explore popular topics

ScsdatagovScsthreatresponse

Try a AWS Security question

Which AWS service lets a responder query large volumes of CloudTrail / VPC Flow / WAF logs stored in S3 using SQL — used for incident investigation?Read the answer and worked solution →Which AWS service provides dedicated FIPS 140-2 Level 3 HSMs for tenants with strict regulatory requirements (e.g. PCI-DSS encryption-key custody)?Read the answer and worked solution →Which AWS service automatically discovers and classifies sensitive data (PII, financial data, credentials) in Amazon S3 using ML?Read the answer and worked solution →

Worked practice questions

Which AWS service lets a responder query large volumes of CloudTrail / VPC Flow / WAF logs stored in S3 using SQL — used for incident investigation?

  1. Amazon Athena
  2. Amazon EBS
  3. AWS Snowball
  4. Amazon RDS
Show answer and solution

Correct answer: A. Amazon Athena

Athena queries S3-resident logs with SQL (per SCS-C02 §1.2, §1.3). The others can't query S3 with SQL.

Open this question →

Which AWS service provides dedicated FIPS 140-2 Level 3 HSMs for tenants with strict regulatory requirements (e.g. PCI-DSS encryption-key custody)?

  1. Amazon RDS
  2. Amazon Macie
  3. AWS CloudHSM
  4. Amazon Route 53
Show answer and solution

Correct answer: C. AWS CloudHSM

CloudHSM is the dedicated FIPS-3 HSM (per SCS-C02 §5.2). The others aren't HSMs.

Open this question →

Which AWS service automatically discovers and classifies sensitive data (PII, financial data, credentials) in Amazon S3 using ML?

  1. Amazon Macie
  2. AWS Shield
  3. Amazon Inspector
  4. Amazon GuardDuty
Show answer and solution

Correct answer: A. Amazon Macie

Macie is the S3 sensitive-data classifier (per SCS-C02 §6.3). GuardDuty is threat-detection Inspector is vuln scan Shield is DDoS.

Open this question →

How to practise

  1. Choose a AWS Security question and try to work out your answer.
  2. Open the question to check the correct answer and read its worked solution.
  3. Continue in the app for bite-sized lessons, explanations and review with Quill. You can start without creating an account.