1. As a Security Engineer, you are responsible for securing your cloud deployment. Which feature helps secure your Amazon VPC resources by providing isolation at the instance level?

A) VPN connection
B) Network ACLs
C) VPC peering
D) Security groups



2. According to the AWS shared responsibility model, which AWS service allows you to adhere to security best practices by assigning fine-grained permissions to users and groups?

A) AWS Trusted Advisor
B) Amazon Cognito
C) AWS Identity and Access Management (IAM)
D) Amazon GuardDuty



3. You are responsible for managing IAM users in your company. What is an IAM policy?

A) IAM policy is a JavaScript Object Notation (JSON) document that defines permissions for the entities you attach it to.
B) IAM policy is a collection of IAM users that lets you specify permissions for multiple users.
C) IAM policy is a YAML file that defines permissions for the entities you attach it to.
D) IAM policy is a Comma-Separated Values (CSV) document that defines permissions for the entities you attach it to.



4. Your company wants to have a secure way of generating, storing, and managing cryptographic keys. The company also wants to have exclusive access for the keys. Which option can you use for this purpose?

A) You should use Amazon S3 server-side encryption.
B) You should use AWS CloudHSM.
C) You should use AWS KMS and the standard AWS KMS encryption keys.
D) You should use AWS KMS and an external key material.



5. A company wants to build and run applications on premises using the same programming interfaces as in AWS Regions, while using local compute and storage resources for lower latency. Which solution should you recommend?

A) AWS Outposts
B) AWS CloudFormation
C) AWS Elastic Beanstalk
D) Edge locations