Exam Bundle

S3 bucket policy: Defines resource-level permissions for an S3 bucket. This does not address the need for An owner of an eligible AWS account must change the existing root user password through account settings. The appropriate Account root user applies because Updating the root user password requires root authentication for eligible standalone accounts; ordinary IAM users or roles cannot do it.

Ordinary IAM user is a routine account identity and does not perform root-user-only account administration. This does not address the need for An owner of an eligible AWS account must change the existing root user password through account settings. The appropriate Account root user applies because Updating the root user password requires root authentication for eligible standalone accounts; ordinary IAM users or roles cannot do it.

EC2 instance role grants compute permissions but cannot substitute for root-only account-level identity actions. This does not address the need for An owner of an eligible AWS account must change the existing root user password through account settings. The appropriate Account root user applies because Updating the root user password requires root authentication for eligible standalone accounts; ordinary IAM users or roles cannot do it.

Public access policy grants access outside the intended private trust boundary. That does not meet the requirement: A company needs analysts in one AWS account to inspect a role-authorized resource in another account.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. That does not meet the requirement: A company needs analysts in one AWS account to inspect a role-authorized resource in another account.

Static credentials in scripts: Place long-lived API secrets in automation instead of temporary role credentials. That does not meet the requirement: A company needs analysts in one AWS account to inspect a role-authorized resource in another account.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. This does not address the need for A company needs analysts in one AWS account to inspect a role-authorized resource in another account. The appropriate Cross-account IAM role applies because Cross-account role assumption supplies scoped, temporary permissions between accounts.

Public access policy grants access outside the intended private trust boundary. This does not address the need for A company needs analysts in one AWS account to inspect a role-authorized resource in another account. The appropriate Cross-account IAM role applies because Cross-account role assumption supplies scoped, temporary permissions between accounts.

Static credentials in scripts: Place long-lived API secrets in automation instead of temporary role credentials. This does not address the need for A company needs analysts in one AWS account to inspect a role-authorized resource in another account. The appropriate Cross-account IAM role applies because Cross-account role assumption supplies scoped, temporary permissions between accounts.

Public access policy grants access outside the intended private trust boundary. That does not meet the requirement: Consider this AWS requirement: A security team centrally accesses many subsidiary accounts without issuing permanent user keys per account.

Static credentials in scripts: Place long-lived API secrets in automation instead of temporary role credentials. That does not meet the requirement: Consider this AWS requirement: A security team centrally accesses many subsidiary accounts without issuing permanent user keys per account.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. That does not meet the requirement: Consider this AWS requirement: A security team centrally accesses many subsidiary accounts without issuing permanent user keys per account.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. This does not address the need for A security team centrally accesses many subsidiary accounts without issuing permanent user keys per account. The appropriate Cross-account IAM role applies because Cross-account role assumption supplies scoped, temporary permissions between accounts.

Static credentials in scripts: Place long-lived API secrets in automation instead of temporary role credentials. This does not address the need for A security team centrally accesses many subsidiary accounts without issuing permanent user keys per account. The appropriate Cross-account IAM role applies because Cross-account role assumption supplies scoped, temporary permissions between accounts.

Public access policy grants access outside the intended private trust boundary. This does not address the need for A security team centrally accesses many subsidiary accounts without issuing permanent user keys per account. The appropriate Cross-account IAM role applies because Cross-account role assumption supplies scoped, temporary permissions between accounts.

AWS CloudTrail records API requests and account management events. That does not meet the requirement: An application stores database credentials and wants managed secret retrieval and rotation support.

AWS KMS only manages encryption keys, not credential lifecycle or secret rotation. That does not meet the requirement: An application stores database credentials and wants managed secret retrieval and rotation support.

Amazon CloudWatch: CloudWatch collects operational metrics and logs and supports alarms and dashboards. That does not meet the requirement: An application stores database credentials and wants managed secret retrieval and rotation support.

AWS CloudTrail records API requests and account management events. This does not address the need for An application stores database credentials and wants managed secret retrieval and rotation support. The appropriate AWS Secrets Manager applies because Secrets Manager stores, retrieves and supports rotation for supported credentials and other secrets.

AWS KMS only manages encryption keys, not credential lifecycle or secret rotation. This does not address the need for An application stores database credentials and wants managed secret retrieval and rotation support. The appropriate AWS Secrets Manager applies because Secrets Manager stores, retrieves and supports rotation for supported credentials and other secrets.

Amazon CloudWatch: CloudWatch collects operational metrics and logs and supports alarms and dashboards. This does not address the need for An application stores database credentials and wants managed secret retrieval and rotation support. The appropriate AWS Secrets Manager applies because Secrets Manager stores, retrieves and supports rotation for supported credentials and other secrets.

AWS CloudTrail records API requests and account management events. That does not meet the requirement: A technical reviewer evaluates this need: A service needs controlled access to API secrets with lifecycle and rotation capabilities.

AWS KMS only manages encryption keys, not credential lifecycle or secret rotation. That does not meet the requirement: A technical reviewer evaluates this need: A service needs controlled access to API secrets with lifecycle and rotation capabilities.

Amazon CloudWatch: CloudWatch collects operational metrics and logs and supports alarms and dashboards. That does not meet the requirement: A technical reviewer evaluates this need: A service needs controlled access to API secrets with lifecycle and rotation capabilities.

AWS CloudTrail records API requests and account management events. This does not address the need for A service needs controlled access to API secrets with lifecycle and rotation capabilities. The appropriate AWS Secrets Manager applies because Secrets Manager stores, retrieves and supports rotation for supported credentials and other secrets.

AWS KMS only manages encryption keys, not credential lifecycle or secret rotation. This does not address the need for A service needs controlled access to API secrets with lifecycle and rotation capabilities. The appropriate AWS Secrets Manager applies because Secrets Manager stores, retrieves and supports rotation for supported credentials and other secrets.

Amazon CloudWatch: CloudWatch collects operational metrics and logs and supports alarms and dashboards. This does not address the need for A service needs controlled access to API secrets with lifecycle and rotation capabilities. The appropriate AWS Secrets Manager applies because Secrets Manager stores, retrieves and supports rotation for supported credentials and other secrets.

AWS IAM Identity Center: IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps. That does not meet the requirement: A team needs hierarchical application configuration values and optional protected parameters.

AWS CloudTrail records API requests and account management events. That does not meet the requirement: A team needs hierarchical application configuration values and optional protected parameters.

AWS Artifact supplies compliance reports and agreements. That does not meet the requirement: A team needs hierarchical application configuration values and optional protected parameters.

AWS IAM Identity Center: IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps. This does not address the need for A team needs hierarchical application configuration values and optional protected parameters. The appropriate SSM Parameter Store applies because Parameter Store manages configuration and SecureString parameters; it is not a general audit-event service.

AWS Artifact supplies compliance reports and agreements. This does not address the need for A team needs hierarchical application configuration values and optional protected parameters. The appropriate SSM Parameter Store applies because Parameter Store manages configuration and SecureString parameters; it is not a general audit-event service.

AWS CloudTrail records API requests and account management events. This does not address the need for A team needs hierarchical application configuration values and optional protected parameters. The appropriate SSM Parameter Store applies because Parameter Store manages configuration and SecureString parameters; it is not a general audit-event service.