AWS Certified Cloud Practitioner (CLF-C02) | Domain 2 Identity, Detection and Compliance Questions 03

The answer is the shared responsibility model, which divides responsibility for security in the cloud between AWS and the customer according to what each one covers.

The answer is IAM roles, which grant temporary permissions to AWS services and users without embedding long-lived access keys.

The answer is IAM policies, the documents that define in JSON the actions, resources and conditions to allow or deny.

The answer is AWS IAM Identity Center, the service that manages employee access to several AWS accounts and supported applications in one place.

The answer is AWS Organizations, the service that groups several AWS accounts into organisational units and manages policy and billing centrally.

The answer is service control policies, which set the maximum IAM permissions available in the accounts of an organisation.

The answer is AWS KMS, the service that creates and manages encryption keys and integrates with encryption in AWS services.

The answer is AWS Secrets Manager, the service that stores secrets such as database credentials and supports rotating them automatically.

The answer is AWS Certificate Manager, the service that manages the issue, deployment and renewal of the TLS certificates used with supported AWS services.

The answer is AWS Shield Standard, which protects against common network and transport layer DDoS attacks at no additional charge.

The answer is AWS WAF, the service that inspects web requests according to rules and blocks SQL injection and the like.

The answer is Amazon GuardDuty, the managed service that analyses AWS logs and threat intelligence to detect threats.

The answer is Amazon Inspector, the service that continuously finds vulnerabilities in EC2 instances, container images, Lambda functions and the like.

The answer is Amazon Macie, the service that uses machine learning and other techniques to discover and protect sensitive data in S3.

The answer is AWS Security Hub, the service that aggregates the findings of several AWS security services and gives visibility into your posture.

The answer is AWS Artifact, the service that gives on-demand access to AWS compliance reports and some agreements.

The answer is AWS CloudTrail, the service that records the API calls and user activity carried out in an AWS account.

The answer is AWS Config, the service that records the history of configuration changes to AWS resources and evaluates compliance with rules.

The answer is Amazon Cognito, the service that provides end-user authentication and a user directory for web and mobile applications.