Practice Test #1

IAM Access Analyzer finds unintended access paths and external access from policies. It does not produce a per-user CSV of password change dates and access key ages. Trap: The word Analyzer sounds audit-related, but the required evidence is credential metadata for every IAM user.

AWS Artifact provides AWS compliance reports and agreements. It does not report the lab's IAM users, password dates, or active access keys. Trap: Artifact is compliance-related, but it is about AWS documentation rather than your account's credential inventory.

AWS Audit Manager helps collect evidence for broader compliance frameworks, but it is not the direct tool for exporting IAM user password and access key details. Trap: Audit Manager sounds close because an auditor is involved, but the prompt asks for a specific IAM CSV.

AWS IAM Access Analyzer helps identify unintended access by analyzing permissions and resource policies. It does not inspect CSV or JSON object contents for names or credit card numbers. Trap: It is security-related and can analyze S3 access, but the scenario asks for content classification.

Amazon GuardDuty is a threat detection service for suspicious activity and malicious behavior. It creates findings, but not sensitive data findings by scanning S3 object contents. Trap: The word findings may sound like GuardDuty, but the clue is PII and PCI discovery inside objects.

Amazon Inspector focuses on vulnerability management for resources such as EC2 instances, container images, and Lambda functions. It is not an S3 data classification service. Trap: Inspector sounds like it inspects things, but it inspects workload vulnerabilities rather than file contents in S3.

The AWS Encryption SDK helps applications perform client-side encryption, but it does not provide a managed secret store, ECS runtime retrieval, IAM permissions per secret, or automatic rotation. Trap: The KMS encryption clue makes cryptography tools tempting, but the scenario is asking for secret lifecycle management.

AWS Security Hub aggregates and prioritizes security findings. It does not store API keys or database passwords for ECS tasks to retrieve. Trap: It is a security service, but it is for security posture and findings, not application credential storage.

AWS Artifact provides access to AWS compliance reports and agreements. It is not a runtime secret storage or rotation service. Trap: Compliance wording sometimes points to Artifact, but there is no audit report or agreement requirement here.

Network ACLs filter at the subnet boundary and use CIDR-based rules. They cannot directly reference specific application instances or an application security group. Trap: NACLs sound like VPC network security, but the prompt asks for specific app-tier instances without subnet changes.

AWS WAF protects HTTP and HTTPS web requests for services such as CloudFront or Application Load Balancer. It does not control private PostgreSQL-style TCP traffic between EC2 instances. Trap: WAF is a security service, but TCP 5432 is not a web request inspection use case.

Amazon GuardDuty detects threats and produces findings. It is not an inline firewall that can allow or deny traffic to the database tier. Trap: Threat detection can report suspicious traffic, but it does not enforce this access rule.

Amazon FSx for Lustre is a high-performance file system for workloads such as HPC and media processing, not the lowest-cost place to retain rarely accessed footage for years. Trap: Video files can sound like a file-system problem, but the scenario is archive retention, not active rendering or analytics.

Amazon EBS is block storage for EC2 instances and is priced for attached, active workloads rather than multi-year archive storage. Trap: EBS can store large volumes, but it is not a cost-effective legal archive for rarely retrieved objects.

Amazon EFS provides shared file storage for applications that need file semantics and ongoing access, which is not the cheapest fit for a rarely accessed archive. Trap: Shared file storage may feel natural for footage, but the access pattern is long-term retention with very rare restores.

Amazon DynamoDB is a key-value and document database that can deliver very low latency for modeled access patterns, but deep multi-entity graph traversal usually requires extra application logic or multiple lookups. Trap: DynamoDB is tempting because it is fast at scale, but the keyword here is graph queries across relationships.

Amazon Timestream is designed for time-series data such as metrics and events. It is not the purpose-built service for traversing permit, vehicle, address, and payment relationships. Trap: Real-time systems may generate time-stamped events, but the question asks for graph relationship queries, not time-series analysis.

Amazon Forecast creates predictions from historical time-series data. It does not store or query graph relationships for low-latency abuse detection. Trap: Forecast may sound useful for analytics, but prediction is not the same as real-time graph traversal.

Amazon VPC creates isolated networking environments. It does not provide employee single sign-on, corporate directory integration, or cross-account permissions. Trap: VPC is foundational in AWS accounts, but the scenario is about identity and authorization.

Amazon GuardDuty detects threats from logs and findings. It does not authenticate employees or assign account-specific permissions. Trap: It is a security service, but it is for detection rather than access management.

Amazon Cognito manages sign-up and sign-in for application users. It is not the standard service for workforce access to multiple AWS accounts in Organizations. Trap: Cognito can federate users, but the exam separates customer app identity from employee AWS account access.

Amazon Cognito manages user sign-up, sign-in, federation, and app identity. It does not record EC2 or RDS configuration changes or produce compliance history. Trap: It is a security service, but this scenario is about infrastructure audit evidence, not application authentication.

Amazon FSx provides managed file systems. It could store files, but it does not generate configuration timelines or compliance reports for AWS resources. Trap: The word retain may sound like storage, but the missing capability is automated configuration recording and compliance evaluation.

Amazon Inspector performs vulnerability management for workloads such as EC2, container images, and Lambda. It is not the authoritative source for configuration-change history or compliance snapshots. Trap: Inspector is audit-adjacent because it improves security posture, but the prompt asks for configuration records and reports, which is AWS Config.

AWS provides VPC network ACLs and security groups, but the customer configures their rules to match application access needs. Trap: The controls are AWS features, but using them correctly is still customer responsibility.

Client-side encryption on mobile or desktop devices is implemented in customer-controlled applications and endpoints, not by AWS by default. Trap: AWS offers encryption services, but this clue says the encryption happens on client devices.

Creating IAM identities, assigning permissions, and enforcing MFA are customer identity administration tasks. Trap: AWS operates the IAM service, but customers define their users, groups, policies, and authentication requirements.