Master AWS Certifications with Confidence

Amazon Elastic File System (Amazon EFS)

Amazon Elastic Block Store (Amazon EBS)

Amazon S3

AWS Storage Gateway

1 year

2 years

3 years

5 years

Group members are permitted any Amazon S3 action within the us-west-2 Region. Statements after the Allow permission are not applied.

Group members are denied any Amazon S3 permissions in the us-west-2 Region unless they are logged in with multi-factor authentication (MFA).

Group members are allowed the s3:DeleteObject and s3:PutObject permissions for all Regions when logged in with multi-factor authentication (MFA). Group members are permitted any other Amazon S3 action.

Group members are allowed the s3:DeleteObject and s3:PutObject permissions for the us-west-2 Region only when logged in with multi-factor authentication (MFA). Group members are permitted any other Amazon S3 action within the us-west-2 Region.

Use Amazon RDS to store the data. Use SQL to query relationships and detect fraud.

Use Amazon Neptune to store the data. Use SPARQL to traverse relationships and identify fraudulent patterns.

Use Amazon Redshift to store the data. Use SQL to analyze large datasets for fraud detection.

Use Amazon DynamoDB to store the data. Use PartiQL to query transactional data for anomalies.

Create a management account. Set up an Amazon S3 bucket for the finance team. Use AWS Cost Explorer to generate monthly reports and store them in the S3 bucket.

Create a management account. Establish an AWS Organizations organization with all features enabled. Invite all existing accounts to join the organization and ensure they accept the invitations.

Create an organizational unit (OU) for all development teams. Develop a service control policy (SCP) permitting resource creation solely in US Regions. Attach the SCP to the OU.

Create an OU for all development teams. Develop an SCP that explicitly denies resource creation in non-US Regions. Attach the SCP to the OU.

Create an IAM role in the management account with permissions to access the Billing Dashboard. Grant the finance team permission to assume the role. Use AWS Cost Explorer and the Billing Dashboard for cost analysis.

Create an IAM role in every AWS account with permissions to access the Billing Dashboard. Grant the finance team permission to assume each role.

The financial institution should share their root account credentials with the auditor to allow full access during the compliance review.

The financial institution should create an IAM user with read-only permissions and provide the access keys to the auditor for temporary use.

The financial institution should create an IAM role with necessary permissions and allow audit-org to assume the role using its ARN without additional safeguards.

The financial institution should create an IAM role with required permissions, configure the role's trust policy to include audit-org's account ID and a unique external ID, and provide both to the auditor for role assumption.

Store the credentials in AWS Systems Manager Parameter Store. Configure the parameter to reference the RDS database. Encrypt the parameter using the default AWS KMS key. Enable scheduled rotation using a custom Lambda function. Retrieve the parameter in the Lambda function to connect to the database.

Encrypt the credentials with a customer-managed AWS KMS key. Store the encrypted credentials in Amazon S3. Create a secondary Lambda function to rotate the credentials weekly. Use an Amazon EventBridge scheduled rule to trigger rotation. Update the RDS database credentials manually. Decrypt the credentials in the primary Lambda function to access the database.

Store the credentials in AWS Secrets Manager. Set the secret type to 'Credentials for Amazon RDS database' and select the PostgreSQL instance. Encrypt the secret with the default AWS KMS key. Enable automatic rotation configured for the secret. Retrieve the secret directly in the Lambda function to connect to the database.

Encrypt the credentials using AWS KMS and store them in an Amazon ElastiCache cluster. Develop a custom rotation mechanism using a Step Function workflow triggered by Amazon EventBridge. Update the RDS database credentials and ElastiCache entries during rotation. Decrypt the credentials in the Lambda function to establish database connections.

Set the Origin's HTTP Port to 443.

Use AWS Secrets Manager to encrypt traffic between CloudFront and the origin server.

Set the Origin Protocol Policy to 'HTTPS Only'.

Set the Viewer Protocol Policy to 'HTTPS Only' or 'Redirect HTTP to HTTPS'.

Enable the CloudFront option to enforce secure TLS versions.