CodeBuild reports<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. IAM policies<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Identity and Access Management policies define what actions principals are allowed or denied to perform on AWS resources. Policies can be attached to users, groups, roles, or resources depending on the authorization model being used. In DevOps environments, IAM policies are essential for controlling access to deployment pipelines, build systems, repositories, infrastructure services, and production resources. Following least-privilege principles helps reduce unnecessary permissions. Policies can also use conditions to restrict access based on factors such as resource tags, source identity, or requested AWS Region, providing more precise control over automated and human access.<\/span><\/p>\nQuestion 162. What restricts permissions delegated through an IAM role?<\/b><\/h3>\n\n- <\/b> Security group<\/span>
\n<\/span>2.<\/b> Permission boundary<\/span>
\n<\/span>3.<\/b> CloudFormation template<\/span>
\n<\/span>4.<\/b> EventBridge rule<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Permission boundary<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An IAM permissions boundary defines the maximum permissions that an identity-based policy can grant to an IAM principal. It does not directly grant permissions by itself; instead, it establishes a limit on the permissions the principal can receive from other applicable identity policies. This is useful in large organizations where administrators need to delegate IAM role or user creation without allowing delegated administrators to create principals with unrestricted permissions. Permission boundaries can therefore provide an additional security control for CI\/CD environments and development teams that need to create or manage IAM roles while remaining within centrally defined authorization limits.<\/span><\/p>\nQuestion 163. What analyzes unintended AWS access paths?<\/b><\/h3>\n\n- <\/b> AWS IAM Access Analyzer<\/span>
\n<\/span>2.<\/b> Amazon ECR<\/span>
\n<\/span>3.<\/b> AWS CodeArtifact<\/span>
\n<\/span>4.<\/b> CloudWatch Logs<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. AWS IAM Access Analyzer<\/b><\/p>\n
Explanation:<\/b><\/p>\n
IAM Access Analyzer helps organizations identify resources that are accessible from outside their intended trust boundaries. It can analyze resource-based policies and identify external access paths involving resources such as S3 buckets, IAM roles, KMS keys, and other supported services. This can help security and DevOps teams discover unintended cross-account or public access. Access Analyzer findings can then be reviewed and addressed by modifying resource policies or permissions. It complements normal IAM policy reviews by providing visibility into effective external access rather than requiring administrators to manually inspect every possible policy relationship.<\/span><\/p>\nQuestion 164. What provides temporary AWS credentials?<\/b><\/h3>\n\n- <\/b> AWS STS<\/span>
\n<\/span>2.<\/b> Amazon ECR<\/span>
\n<\/span>3.<\/b> CloudFormation<\/span>
\n<\/span>4.<\/b> CodeBuild<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. AWS STS<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Security Token Service provides temporary security credentials that can be used to access AWS resources. Temporary credentials are particularly useful for automation, cross-account access, federated identities, and applications that should not rely on long-term access keys. In DevOps workflows, IAM roles can be assumed through STS to obtain temporary credentials for deployment or administrative operations. These credentials have a limited lifetime and include an access key ID, secret access key, and session token. Using temporary role credentials reduces the need to distribute permanent credentials across build systems, deployment servers, and automation scripts.<\/span><\/p>\nQuestion 165. What can restrict AWS accounts within an organization?<\/b><\/h3>\n\n- <\/b> Service Control Policies<\/span>
\n<\/span>2.<\/b> CloudWatch alarms<\/span>
\n<\/span>3.<\/b> ECR lifecycle policies<\/span>
\n<\/span>4.<\/b> CodeBuild projects<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Service Control Policies<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Organizations Service Control Policies, or SCPs, define the maximum available permissions for accounts within an organization or organizational unit. SCPs do not grant permissions directly; instead, they establish guardrails that restrict which AWS actions can be used by principals in affected accounts. For example, an organization can use SCPs to prevent accounts from disabling certain security services or using specific Regions. This makes SCPs useful for centralized governance. IAM policies still determine what individual principals can actually perform, but an SCP can prevent an otherwise permitted action from being available within the account.<\/span><\/p>\nQuestion 166. What stores application secrets centrally?<\/b><\/h3>\n\n- <\/b> AWS Secrets Manager<\/span>
\n<\/span>2.<\/b> Amazon CloudWatch<\/span>
\n<\/span>3.<\/b> AWS CodeDeploy<\/span>
\n<\/span>4.<\/b> Amazon Route 53<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. AWS Secrets Manager<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Secrets Manager provides centralized storage and management for sensitive information such as database credentials, API keys, and other application secrets. Applications and automation systems can retrieve secrets through controlled AWS APIs instead of embedding credentials directly in source code or configuration files. Secrets Manager also supports features such as encryption using AWS KMS and automated secret rotation for supported scenarios. In DevOps environments, integrating Secrets Manager with build and deployment processes helps reduce the risk of exposing credentials in repositories, scripts, or pipeline configuration while providing centralized access control.<\/span><\/p>\nQuestion 167. What identifies a specific secret version in Secrets Manager?<\/b><\/h3>\n\n- <\/b> Version stage<\/span>
\n<\/span>2.<\/b> ECR digest<\/span>
\n<\/span>3.<\/b> Deployment group<\/span>
\n<\/span>4.<\/b> CloudFormation stack ID<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Version stage<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Secrets Manager uses version stages to identify the role of different versions of a secret. Common stages include AWSCURRENT and AWSPREVIOUS, which help applications and rotation workflows determine which secret version should currently be used. During rotation, staging labels can move between versions as the new credential becomes active. This allows applications to retrieve the current secret without having to hard-code a specific version identifier. Version staging is especially useful in automated rotation workflows because the active credential can change while applications continue requesting the current staged version.<\/span><\/p>\nQuestion 168. What encrypts Secrets Manager secret values?<\/b><\/h3>\n\n- <\/b> AWS KMS<\/span>
\n<\/span>2.<\/b> CloudFront<\/span>
\n<\/span>3.<\/b> CodePipeline<\/span>
\n<\/span>4.<\/b> Systems Manager Inventory<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. AWS KMS<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Secrets Manager encrypts secret values at rest using AWS Key Management Service keys. By default, Secrets Manager can use an AWS managed KMS key, while organizations can also configure a customer managed KMS key when they require additional control over key policies and lifecycle management. Access to the secret and the associated encryption key must both be appropriately authorized. Using KMS provides centralized cryptographic controls while Secrets Manager handles secret storage and retrieval. This separation allows organizations to manage sensitive credentials without exposing their plaintext values in application source code or ordinary configuration files.<\/span><\/p>\nQuestion 169. What can store non-secret configuration parameters?<\/b><\/h3>\n\n- <\/b> Systems Manager Parameter Store<\/span>
\n<\/span>2.<\/b> CodeDeploy deployment group<\/span>
\n<\/span>3.<\/b> ECR image digest<\/span>
\n<\/span>4.<\/b> CloudTrail trail<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Systems Manager Parameter Store<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Systems Manager Parameter Store provides centralized storage for configuration parameters and can also store sensitive values as SecureString parameters. It is useful for values such as application settings, environment-specific configuration, URLs, feature settings, and other parameters that should not be hard-coded into applications or deployment scripts. Parameters can be organized using hierarchical names, making it easier to separate values by application and environment. IAM policies control who or what can retrieve parameters. Parameter Store is commonly integrated with CodeBuild, ECS, Lambda, and other AWS services to provide configuration at runtime or during deployment.<\/span><\/p>\nQuestion 170. What creates a CloudWatch metric from matching log text?<\/b><\/h3>\n\n- <\/b> Metric filter<\/span>
\n<\/span>2.<\/b> StackSet<\/span>
\n<\/span>3.<\/b> Deployment group<\/span>
\n<\/span>4.<\/b> IAM role<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Metric filter<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A CloudWatch Logs metric filter searches incoming log events for a defined pattern and publishes the number of matching events as a CloudWatch metric. This allows operational information contained in application logs to become measurable and usable with dashboards and alarms. For example, an organization could create a metric filter that counts occurrences of a particular error message and then configure an alarm when the count exceeds an acceptable threshold. Metric filters are useful when applications already produce meaningful log messages but do not expose dedicated metrics for every operational condition that needs to be monitored.<\/span><\/p>\nQuestion 171. What centralizes AWS API activity records?<\/b><\/h3>\n\n- <\/b> AWS CloudTrail<\/span>
\n<\/span>2.<\/b> AWS CodeArtifact<\/span>
\n<\/span>3.<\/b> Amazon ECR<\/span>
\n<\/span>4.<\/b> AWS AppConfig<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. AWS CloudTrail<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS CloudTrail records API activity and other supported account events, providing visibility into actions performed against AWS resources. CloudTrail records can include information about the identity that made a request, the service involved, the action performed, and other event details. Organizations use these records for auditing, security investigations, troubleshooting, and operational monitoring. In larger environments, an organization trail can provide centralized logging across multiple AWS accounts. Protecting the resulting log files is important because CloudTrail records may contain evidence needed to understand configuration changes or investigate unexpected activity.<\/span><\/p>\nQuestion 172. What lets CloudFormation manage existing resources?<\/b><\/h3>\n\n- <\/b> Resource import<\/span>
\n<\/span>2.<\/b> Deployment alarm<\/span>
\n<\/span>3.<\/b> CodeBuild cache<\/span>
\n<\/span>4.<\/b> ECR replication<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Resource import<\/b><\/p>\n
Explanation:<\/b><\/p>\n
CloudFormation resource import allows supported existing AWS resources to be brought under CloudFormation management without necessarily recreating them. This can help organizations transition manually created infrastructure into an infrastructure-as-code model. During an import operation, the resource must meet the requirements for the relevant resource type and be described appropriately in the CloudFormation template. Once successfully imported, the resource becomes associated with the stack and can be managed through subsequent CloudFormation operations. Resource import can therefore help teams gradually move existing environments toward consistent declarative infrastructure management.<\/span><\/p>\nQuestion 173. What controls parallelism during StackSets operations?<\/b><\/h3>\n\n- <\/b> Operation preferences<\/span>
\n<\/span>2.<\/b> Buildspec phases<\/span>
\n<\/span>3.<\/b> IAM access keys<\/span>
\n<\/span>4.<\/b> ECR lifecycle rules<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Operation preferences<\/b><\/p>\n
Explanation:<\/b><\/p>\n
CloudFormation StackSets operation preferences control how StackSet operations are performed across target accounts and Regions. These settings can influence deployment concurrency and failure behavior, allowing administrators to control how aggressively changes are rolled out. Managing concurrency is important when deploying infrastructure across a large number of accounts because simultaneously changing every environment can increase operational impact. StackSets can use deployment strategies that gradually process targets and stop or continue based on configured failure tolerances. Operation preferences therefore provide important control over the scale and pace of centralized infrastructure deployments.<\/span><\/p>\nQuestion 174. What service can orchestrate multi-step automation workflows?<\/b><\/h3>\n\n- <\/b> Systems Manager Automation<\/span>
\n<\/span>2.<\/b> Amazon Route 53<\/span>
\n<\/span>3.<\/b> ECR<\/span>
\n<\/span>4.<\/b> CloudWatch Dashboard<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Systems Manager Automation<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Systems Manager Automation allows organizations to define and execute automated operational workflows using Automation runbooks. A runbook can contain multiple steps that perform tasks such as modifying AWS resources, running commands, invoking other AWS services, or validating conditions. Automation is useful for repeatable operational procedures because the workflow can be standardized rather than performed manually each time. It can also be invoked by other AWS services and integrated into remediation processes. Organizations can use Automation for deployment-related operations, incident response, patching workflows, infrastructure maintenance, and other routine administrative activities.<\/span><\/p>\nQuestion 175. What feature automatically fixes certain AWS Config violations?<\/b><\/h3>\n\n- <\/b> Config remediation<\/span>
\n<\/span>2.<\/b> CodePipeline approval<\/span>
\n<\/span>3.<\/b> ECR replication<\/span>