AWS Cloud Practitioner Security,
Governance & Compliance Practice Test
2026–2027 | AWS Security Questions,
Answers & Detailed Rationales
1. Which AWS security principle most directly describes the practice of granting
only the permissions required to perform a specific task?
A. Defense in depth
B. Least privilege
C. Fault tolerance
D. Elasticity
Answer: B. Least privilege
Rationale: Least privilege means granting identities only the permissions
necessary to perform their required tasks. This reduces the potential impact of
compromised credentials or accidental misuse.
,2. A company wants to provide an application running on Amazon EC2 with
permission to access an Amazon S3 bucket without storing long-term access
keys on the instance. What should the company use?
A. IAM user
B. IAM group
C. IAM role
D. AWS account root user
Answer: C. IAM role
Rationale: An IAM role provides temporary credentials to AWS resources such as
EC2 instances. This avoids embedding long-term access keys in application code
or configuration files.
3. Which AWS service continuously records API activity and account actions for
auditing and governance purposes?
A. Amazon GuardDuty
B. AWS CloudTrail
C. AWS Shield
D. Amazon Inspector
Answer: B. AWS CloudTrail
Rationale: AWS CloudTrail records AWS API calls and related account activity. Its
logs can be used for security investigations, compliance auditing, and
operational troubleshooting.
4. An organization needs to identify suspicious activity such as unusual API calls,
credential compromise indicators, or communication with known malicious IP
addresses. Which service is most appropriate?
,A. Amazon GuardDuty
B. AWS Artifact
C. AWS Config
D. AWS Audit Manager
Answer: A. Amazon GuardDuty
Rationale: Amazon GuardDuty is a threat-detection service that analyzes AWS
account and workload-related data to identify potentially malicious or
unauthorized activity.
5. Which AWS service provides access to AWS compliance reports and
agreements?
A. AWS Artifact
B. AWS CloudTrail
C. AWS Security Hub
D. AWS Config
Answer: A. AWS Artifact
Rationale: AWS Artifact provides on-demand access to AWS security and
compliance documentation, including reports and agreements that customers
may need for regulatory or audit purposes.
6. A company wants to automatically evaluate whether AWS resources comply
with predefined configuration rules. Which service should it use?
A. AWS Config
B. AWS Shield
C. Amazon Macie
D. AWS WAF
Answer: A. AWS Config
, Rationale: AWS Config continuously evaluates AWS resource configurations
against desired rules and provides configuration history and compliance
information.
7. Which AWS service is designed to protect web applications from common
Layer 7 attacks such as SQL injection and cross-site scripting?
A. AWS Shield
B. AWS WAF
C. Amazon GuardDuty
D. AWS Network Firewall
Answer: B. AWS WAF
Rationale: AWS WAF is a web application firewall that allows organizations to
inspect and control HTTP and HTTPS requests using configurable rules.
8. Which AWS service provides managed protection against distributed denial-
of-service attacks?
A. AWS Shield
B. Amazon Inspector
C. AWS Artifact
D. AWS Config
Answer: A. AWS Shield
Rationale: AWS Shield provides managed DDoS protection for AWS applications.
AWS Shield Standard is automatically included, while Shield Advanced provides
additional protection and capabilities.
Governance & Compliance Practice Test
2026–2027 | AWS Security Questions,
Answers & Detailed Rationales
1. Which AWS security principle most directly describes the practice of granting
only the permissions required to perform a specific task?
A. Defense in depth
B. Least privilege
C. Fault tolerance
D. Elasticity
Answer: B. Least privilege
Rationale: Least privilege means granting identities only the permissions
necessary to perform their required tasks. This reduces the potential impact of
compromised credentials or accidental misuse.
,2. A company wants to provide an application running on Amazon EC2 with
permission to access an Amazon S3 bucket without storing long-term access
keys on the instance. What should the company use?
A. IAM user
B. IAM group
C. IAM role
D. AWS account root user
Answer: C. IAM role
Rationale: An IAM role provides temporary credentials to AWS resources such as
EC2 instances. This avoids embedding long-term access keys in application code
or configuration files.
3. Which AWS service continuously records API activity and account actions for
auditing and governance purposes?
A. Amazon GuardDuty
B. AWS CloudTrail
C. AWS Shield
D. Amazon Inspector
Answer: B. AWS CloudTrail
Rationale: AWS CloudTrail records AWS API calls and related account activity. Its
logs can be used for security investigations, compliance auditing, and
operational troubleshooting.
4. An organization needs to identify suspicious activity such as unusual API calls,
credential compromise indicators, or communication with known malicious IP
addresses. Which service is most appropriate?
,A. Amazon GuardDuty
B. AWS Artifact
C. AWS Config
D. AWS Audit Manager
Answer: A. Amazon GuardDuty
Rationale: Amazon GuardDuty is a threat-detection service that analyzes AWS
account and workload-related data to identify potentially malicious or
unauthorized activity.
5. Which AWS service provides access to AWS compliance reports and
agreements?
A. AWS Artifact
B. AWS CloudTrail
C. AWS Security Hub
D. AWS Config
Answer: A. AWS Artifact
Rationale: AWS Artifact provides on-demand access to AWS security and
compliance documentation, including reports and agreements that customers
may need for regulatory or audit purposes.
6. A company wants to automatically evaluate whether AWS resources comply
with predefined configuration rules. Which service should it use?
A. AWS Config
B. AWS Shield
C. Amazon Macie
D. AWS WAF
Answer: A. AWS Config
, Rationale: AWS Config continuously evaluates AWS resource configurations
against desired rules and provides configuration history and compliance
information.
7. Which AWS service is designed to protect web applications from common
Layer 7 attacks such as SQL injection and cross-site scripting?
A. AWS Shield
B. AWS WAF
C. Amazon GuardDuty
D. AWS Network Firewall
Answer: B. AWS WAF
Rationale: AWS WAF is a web application firewall that allows organizations to
inspect and control HTTP and HTTPS requests using configurable rules.
8. Which AWS service provides managed protection against distributed denial-
of-service attacks?
A. AWS Shield
B. Amazon Inspector
C. AWS Artifact
D. AWS Config
Answer: A. AWS Shield
Rationale: AWS Shield provides managed DDoS protection for AWS applications.
AWS Shield Standard is automatically included, while Shield Advanced provides
additional protection and capabilities.
