I85PREP
⌘ K
AWS CRWT study materials
AWS CRWT study resources

AWS Certified Cloud Practitioner practice questions

One question at a time. Build your AWS CRWT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Concepts

Which cloud benefit is best described as replacing large upfront capital purchases with ongoing pay-as-you-go charges?

  1. Trading capital expense for variable expense Correct answer.
  2. Increasing speed and agility
  3. Benefiting from massive economies of scale
  4. Going global in minutes

Explanation

In a traditional data center you buy servers and storage before you know how much you need, which is a capital expense. Cloud providers bill you for what you consume, so spending becomes a variable operating cost that tracks actual demand. The other listed benefits concern pricing scale, responsiveness, or geographic reach rather than the accounting shift from capex to opex.

Question 2Cloud Concepts

A company stops guessing capacity and instead scales its fleet up and down automatically with traffic. Which cloud advantage does this illustrate?

  1. Benefit from massive economies of scale
  2. Increase speed and agility
  3. Stop guessing capacity Correct answer.
  4. Trade capital expense for variable expense

Explanation

Capacity guessing means buying hardware sized for peak or average demand and living with idle capacity or shortages. Elastic provisioning lets the environment follow real demand closely, so over-provisioning and under-provisioning both disappear. The other options describe cost structure, unit pricing, or provisioning speed instead of capacity matching.

Question 3Cloud Concepts

Which statement correctly distinguishes a public cloud from a private cloud?

  1. A public cloud requires no internet connectivity, while a private cloud requires it
  2. A public cloud is always cheaper, while a private cloud is always more secure
  3. A public cloud is owned by a third-party provider and shared across customers, while a private cloud is dedicated to one organization Correct answer.
  4. A public cloud offers self-service, while a private cloud is only accessible over the internet

Explanation

Deployment models differ mainly by ownership and tenancy. In a public cloud the infrastructure belongs to a provider and serves many customers, whereas a private cloud is provisioned for exclusive use by a single organization. Cost and security outcomes vary by implementation and cannot be asserted categorically.

Question 4Cloud Concepts

An organization runs some workloads in its own data center and others in AWS, with integration between them. Which deployment model is this?

  1. On-premises private cloud
  2. Hybrid Correct answer.
  3. Community
  4. Multi-cloud

Explanation

A hybrid deployment connects cloud resources with existing on-premises infrastructure so the two environments operate together. The defining feature is the combination of cloud and non-cloud infrastructure with some orchestration between them. Multi-cloud refers to using several cloud providers, which is a different concept.

Question 5Cloud Concepts

Which characteristic of cloud computing lets a customer obtain computing resources automatically without human interaction from the provider?

  1. Broad network access
  2. Measured service
  3. On-demand self-service Correct answer.
  4. Resource pooling

Explanation

On-demand self-service means a consumer can provision capabilities such as compute time or storage unilaterally, as needed, without requiring human action by the provider. The other characteristics cover access paths, multi-tenant sharing, and metering rather than self-provisioning.

Question 6Cloud Concepts

Which AWS global infrastructure component is a separate geographic area containing multiple isolated locations called Availability Zones?

  1. Edge location
  2. Availability Zone
  3. Region Correct answer.
  4. Local Zone

Explanation

A Region is a geographic area that contains multiple, isolated Availability Zones connected by low-latency links. Availability Zones are the individual locations inside a Region, not the container of them. Edge locations and Local Zones are separate extensions of the infrastructure.

Question 7Cloud Concepts

Why does AWS design a Region with multiple Availability Zones?

  1. To reduce the number of services available in that Region
  2. To guarantee lower prices than other Regions
  3. To let applications survive the failure of a single data center location Correct answer.
  4. To provide a single shared power source for all zones

Explanation

Availability Zones are physically separated and independently powered, so an application deployed across several zones can keep running when one zone fails. This fault isolation is the primary reason for the multi-zone design. Cost and service catalog differences are not the purpose of zone separation.

Question 8Cloud Concepts

Which AWS tool provides a single, personalized view of cost and usage data along with recommendations to reduce spend?

  1. AWS Cost Explorer Correct answer.
  2. AWS Config
  3. AWS CloudTrail
  4. AWS Trusted Advisor

Explanation

Cost Explorer visualizes historical and forecasted cost and usage, and it surfaces rightsizing and savings plan recommendations. Trusted Advisor inspects best-practice areas including cost optimization but is not the cost visualization tool. CloudTrail and Config record activity and resource state rather than spending.

Question 9Cloud Concepts

A team wants to move a workload to AWS but must keep certain regulated data in its own country. Which factor most directly drives the choice of Region?

  1. The number of Availability Zones in the Region
  2. The latency of the AWS management console
  3. Data residency and compliance requirements Correct answer.
  4. The popularity of the Region among other customers

Explanation

Legal and regulatory obligations often require data to remain within specific national borders, so the Region must be selected where the data is permitted to reside. Zone count, popularity, and console latency do not determine whether storing data there is lawful. Compliance is normally evaluated before performance considerations.

Question 10Cloud Concepts

Which pair of factors should be weighed when choosing between AWS Regions for a latency-sensitive application?

  1. Proximity to end users and service availability in the Region Correct answer.
  2. The color scheme of the console and the number of support plans
  3. The age of the Region and the number of blog posts about it
  4. The billing currency and the number of IAM users

Explanation

Placing resources near users reduces round-trip time, and a Region must offer the specific services the workload depends on. Those two considerations most directly affect performance and feasibility. The other pairs contain irrelevant or administrative details.

Question 11Cloud Concepts

A company wants to reduce latency for users spread across Europe and Asia without managing servers. Which approach best fits the cloud value proposition?

  1. Deploy the application in multiple Regions close to those user populations Correct answer.
  2. Move the workload back on-premises in a single data center
  3. Rely on a single Availability Zone in one Region
  4. Consolidate all resources into one Region and increase instance size

Explanation

The ability to expand into new geographic areas quickly is a core cloud advantage, and serving users from nearby Regions lowers latency. Consolidating into one distant Region or a single zone leaves users far from the application and adds failure risk. On-premises consolidation reverses the reach benefit.

Question 12Cloud Concepts

Which statement about the AWS shared responsibility model is accurate?

  1. AWS is responsible for security of the cloud, and the customer is responsible for security in the cloud Correct answer.
  2. AWS is responsible for all security controls once data is stored in any service
  3. The customer is responsible for the physical security of AWS data centers
  4. Responsibility for patching is always shared equally for every service type

Explanation

The model divides duties: AWS secures the underlying facilities, hardware, and managed service infrastructure, while customers secure what they put in the cloud, such as data, identities, and guest operating systems. The split shifts for managed versus unmanaged services but never removes customer responsibility for their own data and access.

Question 13Cloud Concepts

For an Amazon EC2 instance running a customer-installed operating system, which task belongs to the customer under the shared responsibility model?

  1. Applying security patches to the guest operating system Correct answer.
  2. Managing the network infrastructure between Availability Zones
  3. Maintaining the physical hosts in the data center
  4. Securing the hypervisor layer

Explanation

With infrastructure as a service, the customer controls and must patch the guest operating system and its applications. AWS retains responsibility for facilities, hosts, the virtualization layer, and the network backbone. This division is what distinguishes unmanaged from fully managed services.

Question 14Cloud Concepts

Which AWS offering is a fully managed NoSQL database service that handles provisioning, patching, and scaling of tables?

  1. Amazon DynamoDB Correct answer.
  2. Amazon VPC
  3. Amazon EC2
  4. AWS Identity and Access Management

Explanation

DynamoDB is a managed NoSQL key-value and document database where AWS handles server provisioning, patching, replication, and scaling. EC2 provides raw virtual servers, VPC provides networking, and IAM provides access control. Only DynamoDB is a managed database service in this list.

Question 15Cloud Concepts

A startup needs object storage for static website assets with high durability and no server management. Which service should it choose?

  1. Amazon RDS
  2. Amazon EBS
  3. Amazon S3 Correct answer.
  4. AWS Lambda

Explanation

S3 is managed object storage designed for durable, highly available storage of arbitrary objects such as images and web assets, accessible over HTTP. EBS provides block volumes attached to instances, RDS is a relational database, and Lambda runs code. S3 is the appropriate fit for static objects.

Question 16Cloud Concepts

Which AWS service runs code in response to events without the customer provisioning or managing servers?

  1. AWS Lambda Correct answer.
  2. Amazon ECS on EC2
  3. Amazon EC2 Auto Scaling
  4. AWS Elastic Beanstalk

Explanation

Lambda is a serverless compute service that executes functions when triggered and scales automatically, with no servers for the customer to patch. Auto Scaling adjusts instance counts, Elastic Beanstalk orchestrates provisioned resources, and ECS on EC2 still relies on customer-managed instances. Lambda is the serverless option.

Question 17Cloud Concepts

Which design choice most improves the resilience of a web tier against the loss of one Availability Zone?

  1. Distribute instances across multiple Availability Zones behind a load balancer Correct answer.
  2. Run all instances in one Availability Zone with larger instance types
  3. Use one instance with a very large attached volume
  4. Place all instances in a single subnet of one Availability Zone

Explanation

Spreading instances across independent zones means a zone failure removes only a fraction of capacity, and a load balancer routes traffic to the healthy zones. Concentrating everything in one zone, or relying on a single instance, creates a single point of failure. Size does not substitute for fault isolation.

Question 18Cloud Concepts

Which statement best describes the difference between high availability and fault tolerance?

  1. High availability requires no redundancy, while fault tolerance requires multiple Regions
  2. High availability minimizes downtime with rapid recovery, while fault tolerance continues operating through a failure without interruption Correct answer.
  3. High availability and fault tolerance are identical concepts with different names
  4. Fault tolerance tolerates slower recovery than high availability

Explanation

High availability aims to keep a service reachable by detecting failures and failing over quickly, which may involve brief disruption. Fault tolerance designs the system to keep functioning through a component failure with no interruption. The two differ in the acceptable recovery time and the redundancy required.

Question 19Cloud Concepts

Which AWS service provides a content delivery network that caches content at edge locations close to users?

  1. AWS Global Accelerator
  2. AWS Direct Connect
  3. Amazon Route 53
  4. Amazon CloudFront Correct answer.

Explanation

CloudFront is the content delivery network that stores cached copies at edge locations to reduce latency for viewers. Direct Connect is a dedicated network link, Route 53 is DNS, and Global Accelerator improves routing for traffic without caching content. Only CloudFront is the CDN.

Question 20Cloud Concepts

A media company wants to reduce buffering for viewers on several continents while keeping origin servers in one Region. Which solution addresses the requirement most directly?

  1. Attach larger EBS volumes to the origin servers
  2. Move the origin servers to a single Availability Zone
  3. Increase the size of the origin instances in the single Region
  4. Serve video through Amazon CloudFront with the origin Region as the source Correct answer.

Explanation

A CDN caches content at edge locations near viewers, so requests are served from a nearby point of presence instead of crossing the globe to the origin. Larger instances, zone changes, and volume size affect origin capacity but not the distance content travels. Edge caching is the direct remedy for global latency.

Question 21Cloud Concepts

Which AWS tool reports on whether a workload follows best practices across cost optimization, security, fault tolerance, and performance?

  1. AWS Cost Explorer
  2. AWS CloudFormation
  3. Amazon CloudWatch
  4. AWS Trusted Advisor Correct answer.

Explanation

Trusted Advisor inspects an account and produces recommendations across categories including cost, security, fault tolerance, and performance. Cost Explorer focuses on spending, CloudWatch monitors metrics and logs, and CloudFormation provisions infrastructure as code. Trusted Advisor is the best-practice advisor.

Question 22Cloud Concepts

A company wants to understand which departments drive its AWS spend so it can charge back costs internally. Which capability should it use?

  1. Cost allocation tags combined with cost and usage reporting Correct answer.
  2. A single consolidated bill with no tagging
  3. Trusted Advisor security checks
  4. CloudTrail event history for API calls

Explanation

Cost allocation tags label resources by owner, project, or department, and cost and usage reports aggregate spending by those tags so charges can be attributed and recovered. An untagged consolidated bill hides the breakdown. Audit logs and security checks do not produce cost attribution.

Question 23Cloud Concepts

An architect must design for a workload that tolerates a full Region outage with minimal data loss. Which combination best meets that goal?

  1. Run the application in three Availability Zones of one Region
  2. Deploy a single instance per Availability Zone in one Region
  3. Take daily snapshots of volumes stored in the same Region
  4. Replicate data and run the application in at least two Regions with automated failover Correct answer.

Explanation

Surviving the loss of an entire Region requires resources and data copies outside that Region, plus a tested mechanism to shift traffic and promote replicas. Multi-zone designs protect against zone failures but not Region-wide events. Snapshots stored in the affected Region are also lost with it.

Question 24Cloud Concepts

A regulated bank must keep certain records inside its home country but wants to use managed AWS services for the rest of its platform. Which approach best satisfies both goals?

  1. Keep regulated records only in edge locations
  2. Store all data in the lowest-cost Region regardless of location
  3. Store regulated records in a single Availability Zone of an overseas Region
  4. Store the regulated records in a Region within that country and place other workloads in additional Regions Correct answer.

Explanation

Data residency obligations are met by keeping regulated data in a Region located within the required jurisdiction, while other workloads can use additional Regions for reach or cost. Choosing Regions by price alone or placing regulated data abroad violates the requirement. Edge locations are caching points, not a compliant primary data store.

Question 25Cloud Concepts

Which scenario best demonstrates the cloud advantage of increased speed and agility?

  1. A team negotiates a multi-year contract for discounted compute pricing
  2. A team provisions test environments in minutes, experiments, and tears them down without hardware procurement Correct answer.
  3. A team serves users from edge locations in many countries
  4. A team replicates its data to a second Region for disaster recovery

Explanation

Speed and agility refer to the short time between an idea and a working environment, which enables rapid experimentation and iteration. Contract discounts concern pricing, cross-Region replication concerns resilience, and edge delivery concerns latency. Only the fast provisioning cycle reflects agility.

Question 26Cloud Concepts

Which benefit of cloud computing describes the ability to acquire computing resources in minutes instead of waiting weeks for physical hardware?

  1. Elasticity of demand
  2. Economies of scale
  3. Trade fixed expense for variable expense
  4. Agility and speed of provisioning Correct answer.

Explanation

Cloud agility means new servers, databases, and storage can be provisioned programmatically in minutes, so teams experiment and deliver features faster than with procurement cycles for physical hardware.

Question 27Cloud Concepts

A company wants to stop buying and maintaining its own data center servers and instead pay only for the compute capacity it consumes each month. Which cloud benefit does this illustrate?

  1. Global reach through edge locations
  2. Trade capital expense for variable expense Correct answer.
  3. Improved security through shared responsibility
  4. High availability through multiple Availability Zones

Explanation

Moving from upfront capital purchases to usage-based operational spending is the classic trade of capital expense for variable expense, which shifts financial risk to match actual consumption.

Question 28Cloud Concepts

Which statement describes the AWS Well-Architected Framework?

  1. A certification program for individual cloud engineers
  2. A billing report that lists the cost of every individual AWS resource
  3. A service that automatically rewrites application code for the cloud
  4. A set of design principles and best-practice pillars used to evaluate workloads Correct answer.

Explanation

The Well-Architected Framework organizes guidance into pillars such as operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability, and it is used to review architectures against those best practices.

Question 29Cloud Concepts

Which AWS Cloud Adoption Framework perspective focuses on defining business outcomes, value realization, and organizational alignment?

  1. Operations perspective
  2. Platform perspective
  3. Security perspective
  4. Business perspective Correct answer.

Explanation

The business perspective of the AWS CAF ensures cloud investments map to business value, covering strategy, finance, and stakeholder management rather than technical implementation details.

Question 30Cloud Concepts

A team is deciding whether to migrate a legacy application to AWS or refactor it before moving. Which concept best describes evaluating the application's dependencies, licensing, and business criticality to choose a migration strategy?

  1. Chaos engineering
  2. Edge computing
  3. Portfolio discovery and assessment Correct answer.
  4. Infrastructure as code

Explanation

Migration planning starts with discovering and assessing the application portfolio so each workload can be matched to a strategy such as rehost, replatform, refactor, or retire based on dependencies and business value.

Question 31Cloud Concepts

Which AWS service is designed to help customers estimate the cost of a planned architecture before any resources are deployed?

  1. AWS Cost Explorer
  2. AWS Trusted Advisor
  3. AWS Budgets
  4. AWS Pricing Calculator Correct answer.

Explanation

The AWS Pricing Calculator lets architects model services, quantities, and Regions to produce an upfront cost estimate for a proposed workload before deployment.

Question 32Cloud Concepts

A workload runs on Amazon EC2 instances that must survive the failure of a single data center. Which infrastructure construct should the instances be spread across?

  1. Multiple AWS accounts
  2. Multiple instance types
  3. Multiple edge locations
  4. Multiple Availability Zones Correct answer.

Explanation

An Availability Zone is an isolated data center group within a Region, so distributing instances across several Availability Zones removes a single data center as a point of failure.

Question 33Cloud Concepts

Which AWS global infrastructure feature lets a company place resources in a location dedicated to a single customer for regulatory or isolation reasons?

  1. AWS Local Zones
  2. AWS Outposts
  3. AWS Wavelength
  4. AWS Dedicated Hosts Correct answer.

Explanation

A Dedicated Host is a physical server fully dedicated to one customer, which supports isolation and helps satisfy licensing and compliance requirements tied to physical hardware.

Question 34Cloud Concepts

An application must remain available even if an entire AWS Region becomes unavailable. Which design approach addresses this requirement?

  1. Deploy the workload across two or more Regions with data replication Correct answer.
  2. Deploy all resources in one Availability Zone with frequent snapshots
  3. Deploy the workload in one Region with a larger instance size
  4. Deploy the workload using a single edge location

Explanation

Only a multi-Region architecture with replicated data can continue serving traffic when a whole Region fails, because Regions are independent geographic areas with no shared failure domain.

Question 35Cloud Concepts

Which statement best explains why AWS can offer lower prices as it grows?

  1. Customers must prepay for three years to receive any discount
  2. Prices are set by regulators for each Region
  3. Each customer receives a dedicated physical server
  4. Aggregated demand lowers per-unit infrastructure costs, and savings are passed on Correct answer.

Explanation

Economies of scale mean AWS purchases capacity in very large volumes, reducing the cost per unit, and it passes part of those savings to customers through repeated price reductions.

Question 36Cloud Concepts

A company wants to run a workload without choosing or patching any servers, and it wants the platform to scale automatically. Which cloud computing model fits?

  1. Platform as a Service Correct answer.
  2. Software as a Service
  3. On-premises virtualization
  4. Infrastructure as a Service

Explanation

PaaS abstracts server provisioning and patching so developers deploy code and the platform handles capacity and runtime maintenance, which matches the stated requirement.

Question 37Cloud Concepts

Which cloud characteristic allows a system to automatically add capacity during a traffic spike and remove it afterward?

  1. Multi-tenancy
  2. Elasticity Correct answer.
  3. Durability across Regions
  4. Durability

Explanation

Elasticity is the ability to scale resources out and back in automatically to match current demand, so capacity and cost track actual traffic.

Question 38Cloud Concepts

Under the AWS shared responsibility model, which activity remains the customer's responsibility when using an Amazon RDS database?

  1. Replacing failed storage drives in the server rack
  2. Maintaining the physical security of the data center
  3. Patching the underlying database engine's host operating system
  4. Managing database user accounts and access permissions Correct answer.

Explanation

For managed services such as RDS, AWS operates the infrastructure and engine patching, while the customer controls data, identities, and access permissions, often described as security in the cloud.

Question 39Cloud Concepts

Which AWS support resource provides architectural guidance and best-practice reviews for a company planning its first production deployment?

  1. AWS Skill Builder
  2. AWS Health Dashboard
  3. AWS Marketplace
  4. AWS Support plans with technical account management Correct answer.

Explanation

Higher-tier AWS Support plans include access to solutions architects and technical account managers who review designs and advise on best practices during planning and operations.

Question 40Cloud Concepts

A retailer's traffic triples during a seasonal sale and returns to normal afterward. Which approach best matches cost to this pattern?

  1. Use elastic cloud capacity that scales out for the sale and scales in afterward Correct answer.
  2. Reserve the peak capacity for a three-year term in every Region
  3. Buy enough on-premises servers for peak load and leave them idle otherwise
  4. Run the workload on a single large instance all year

Explanation

Elastic cloud capacity lets the retailer pay for peak resources only during the sale and release them after, avoiding the cost of idle hardware sized for the busiest day.

Question 41Cloud Concepts

Which pair of practices best supports operational excellence in a cloud workload?

  1. Single-person administration and undocumented runbooks
  2. Larger instance sizes and longer backup intervals
  3. Manual change approvals and infrequent deployments
  4. Automated deployments and continuous monitoring with feedback Correct answer.

Explanation

The operational excellence pillar emphasizes automation, small reversible changes, and observability so teams can detect issues quickly and improve processes from real operational data.

Question 42Cloud Concepts

A company must prove to auditors that it inherits certain physical controls from AWS. Which concept explains this arrangement?

  1. The customer must independently certify each data center
  2. Compliance is automatically transferred to the customer's application code
  3. Auditors must physically inspect every AWS Region used
  4. AWS compliance reports and shared responsibility allow customers to inherit AWS controls Correct answer.

Explanation

AWS publishes third-party audit reports and certifications covering its side of the shared responsibility model, so customers can inherit those controls and focus their own audits on workloads and data they control.

Question 43Cloud Concepts

Which scenario best illustrates the cloud benefit of going global in minutes?

  1. A firm reduces its monthly bill by deleting unused volumes
  2. A firm deploys its application to a new Region to serve a nearby customer base Correct answer.
  3. A firm adds a second Availability Zone to an existing Region
  4. A firm replaces its email server with a hosted mailbox service

Explanation

Global reach means a company can deploy workloads into Regions around the world quickly, placing applications close to new customers without building facilities in each country.

Question 44Cloud Concepts

Which design principle from the Well-Architected Framework recommends testing recovery procedures regularly rather than assuming they work?

  1. Stop guessing capacity
  2. Test recovery procedures Correct answer.
  3. Make architectural tradeoffs
  4. Implement security at every layer

Explanation

Reliability guidance recommends simulating failures and validating recovery paths so teams discover broken assumptions before a real outage forces them to.

Question 45Cloud Concepts

A startup wants to minimize upfront cost and avoid long commitments while it validates a product idea. Which purchasing approach aligns best?

  1. A dedicated physical host
  2. Three-year Reserved Instances paid upfront
  3. On-Demand capacity with no long-term commitment Correct answer.
  4. A private data center lease

Explanation

On-Demand pricing charges by usage with no upfront payment or term, which suits uncertain early workloads where demand and lifetime are not yet predictable.

Question 46Cloud Concepts

Which statement correctly distinguishes a Region from an edge location?

  1. A Region contains multiple Availability Zones while edge locations provide low-latency access near users Correct answer.
  2. An edge location contains multiple Availability Zones while a Region is a single data center
  3. Regions and edge locations are the same facility with different billing labels
  4. A Region caches content while an edge location hosts primary databases

Explanation

Regions are geographic areas composed of multiple isolated Availability Zones for running workloads, while edge locations are smaller points of presence used mainly to deliver cached content closer to users.

Question 47Cloud Concepts

A team wants to reduce the risk of a single misconfigured deployment taking down a production service. Which combination of cloud practices best addresses this?

  1. Use infrastructure as code with staged environments and automated rollback Correct answer.
  2. Deploy directly to production from a developer laptop and skip testing
  3. Increase the instance size and remove monitoring
  4. Rely on manual configuration and a single administrator

Explanation

Treating infrastructure as code with separate stages and automated rollback makes changes repeatable and reversible, so a bad deployment can be caught before production or undone quickly.

Question 48Cloud Concepts

Which AWS CAF perspective would primarily address workforce skills, change management, and organizational readiness for cloud adoption?

  1. Governance perspective
  2. Security perspective
  3. People perspective Correct answer.
  4. Platform perspective

Explanation

The people perspective of the AWS CAF covers culture, organizational change, training, and staffing so the workforce can support and sustain the cloud operating model.

Question 49Security and Compliance

Which AWS service is the primary place to centrally store and audit API activity across an AWS account for compliance purposes?

  1. Amazon GuardDuty
  2. AWS Config
  3. Amazon CloudWatch Logs
  4. AWS CloudTrail Correct answer.

Explanation

CloudTrail records API calls and management events and can deliver them to an immutable log archive for audit. CloudWatch Logs stores log data but does not itself capture API activity events. AWS Config tracks resource configuration changes rather than the full API call history.

Question 50Security and Compliance

A security team wants to be alerted when an IAM policy grants wildcard administrative permissions. Which approach best detects this at scale?

  1. Enable S3 Block Public Access on all buckets
  2. Turn on VPC Flow Logs for all subnets
  3. Rotate IAM user access keys every 90 days
  4. Use AWS Config managed rules and IAM Access Analyzer findings Correct answer.

Explanation

AWS Config rules can evaluate IAM policies against desired configuration, and IAM Access Analyzer identifies overly permissive policies. Together they provide scalable detection of wildcard administrative grants. Key rotation and network logging do not evaluate policy content.