Security keywords

20 timed questions (~32 min, ~96 sec each). Underline force words before picking. Pair with the night guide.

1. 1.Block SQLi on ALBs across many accounts.

   A.WAF managed SQLi + Firewall ManagerB.GuardDuty + Security HubC.Macie + Audit ManagerD.Network Firewall attached like a web ACL to ALB

2. 2.Large DDoS on ELB/CloudFront apps.

   A.Shield AdvancedB.WAF aloneC.SG+NACL aloneD.Firewall Manager as DDoS mitigator only

3. 3.Discover PII privacy issues in S3.

   A.MacieB.PollyC.KendraD.Fraud Detector

4. 4.Customer keys; purge material from KMS; audit ≠ CloudTrail.

   A.KMS custom key store + CloudHSMB.AWS owned keys + CloudHSM storyC.Custom key store with material in S3D.AWS managed keys only

5. 5.Encrypt EKS secrets in etcd.

   A.EKS secrets encryption with CMKB.Secrets Manager replaces etcd encryptionC.Account EBS default encryption onlyD.EBS CSI as etcd encryption

6. 6.IPv6 outbound only + traffic inspection.

   A.NAT Gateway for IPv6 egress-onlyB.Egress-only IGW + Network FirewallC.Public IGW + Traffic Mirroring as filterD.PrivateLink + GuardDuty filtering

7. 7.SSH only from 110.238.98.71.

   A.Inbound UDP 22 /32B.Inbound TCP 22 /32C.Outbound TCP 22D.Outbound UDP 22 to 0.0.0.0/0

8. 8.Auditor needs AWS compliance reports.

   A.IAMB.ArtifactC.Inspector assessment zip of all SOCD.Security Hub as document vault

9. 9.Master key + plaintext never sent to AWS for S3.

   A.SSE-KMSB.Client-side encryption with client master keyC.SSE-CD.Client-side with KMS key id to AWS

10. 10.Private path to S3/DynamoDB; no NAT.

    A.Encryption at restB.VPC endpointsC.Direct Connect as in-VPC private endpointD.VPN CloudHub

11. 11.Detection vs prevention — GuardDuty is?

    A.Prevention that blocks SQLiB.WAF replacementC.Threat detectionD.Object Lock mode

12. 12.Multi-account reuse of WAF rules — add?

    A.Only MacieB.Only Security HubC.Firewall ManagerD.Only Artifact

13. 13.Encryption at rest fixing private routing?

    A.TrueB.True for DynamoDB onlyC.False — different requirementD.True if SSE-S3

14. 14.Network Firewall primary association model?

    A.Attach like WAF web ACL to ALB listenersB.S3 bucket resource policy engineC.VPC traffic filtering / inspectionD.Replace security groups entirely

15. 15.Redis AUTH long-lived password needs?

    A.IAM auth token onlyB.At-rest encryption aloneC.auth-token (+ transit encryption as required)D.Macie

16. 16.Corporate AD groups already assign roles; console access via federation.

    A.Lambda authorizer onlyB.Create 1200 IAM usersC.Simple AD always required over ConnectorD.AD Connector + IAM roles

17. 17.First question on a security stem?

    A.Is Purple the brand color?B.What is the company ticker symbol?C.How many AZs does S3 have?D.Block or detect?

18. 18.Macie vs WAF for SQLi on ALB?

    A.Macie blocks SQLiB.Neither existsC.They are identicalD.WAF blocks; Macie is S3 sensitive-data discovery

19. 19.Shield Advanced vs WAF — volumetric DDoS keyword favors?

    A.EBS snapshotsB.MacieC.ArtifactD.Shield Advanced

20. 20.EBS encryption alone encrypts EKS etcd secrets?

    A.Yes alwaysB.Yes if gp3C.Yes if io2D.No — need EKS secrets encryption