2.4 - AWS security services (KMS, WAF, Shield, GuardDuty)

AWS Certified Cloud Practitioner objective 2.4 covers the managed security services you should be able to match to a need. AWS Key Management Service (KMS) creates, manages and controls the encryption keys used to encrypt data across AWS services. AWS WAF (web application firewall) helps protect web applications from common exploits such as SQL injection and cross-site scripting by filtering malicious web requests before they reach the app. AWS Shield helps protect applications against DDoS attacks. Amazon GuardDuty uses machine learning to detect threats such as unusual API activity or reconnaissance. For downloading audit evidence like SOC and ISO reports, AWS Artifact is the service. Expect scenario questions that describe encrypting data, blocking web exploits, defending against DDoS or detecting anomalous activity, and ask which AWS security service - KMS, WAF, Shield or GuardDuty - fits.

Memory hook
Manage encryption keys = KMS. Block SQL injection/XSS on web apps = WAF. Defend against DDoS = Shield. ML threat detection (unusual API activity) = GuardDuty. Download audit reports = Artifact.

Practice questions

1. Which service uses machine learning to detect threats such as unusual API activity across your account?

  • AWS Shield
  • AWS WAF
  • Amazon GuardDuty (correct answer)
  • AWS KMS

GuardDuty is a threat-detection service analyzing logs (CloudTrail, VPC Flow, DNS) with ML to flag malicious/anomalous activity. Shield=DDoS, WAF=web filtering, KMS=key management.

2. Which service manages encryption keys used to encrypt data across AWS services?

  • AWS Key Management Service (KMS) (correct answer)
  • Amazon Cognito
  • AWS Config
  • Amazon Macie

AWS KMS creates and controls encryption keys and integrates with services (S3, EBS, RDS…) for encryption at rest. Cognito=user sign-in, Macie=finds sensitive data in S3.

3. Which service helps protect web applications from common exploits like SQL injection at layer 7?

  • Amazon Inspector
  • AWS KMS
  • AWS WAF (correct answer)
  • Amazon Macie

AWS WAF (Web Application Firewall) filters HTTP(S) requests with rules to block SQL injection, XSS, etc., in front of CloudFront/ALB/API Gateway. Shield handles DDoS.

4. Where can you download AWS compliance reports such as SOC and ISO certifications on demand?

  • AWS Artifact (correct answer)
  • AWS Trusted Advisor
  • Amazon CloudWatch
  • AWS Config

AWS Artifact is the self-service portal for on-demand access to AWS security and compliance reports (SOC, ISO, PCI) and agreements. Trusted Advisor gives best-practice checks, not audit reports.

5. Which service records API calls and account activity for governance, auditing and troubleshooting?

  • Amazon CloudWatch
  • AWS Config
  • AWS Trusted Advisor
  • AWS CloudTrail (correct answer)

AWS CloudTrail logs API calls and account activity (who did what, when, from where). CloudWatch focuses on performance metrics and logs; Config tracks resource configuration changes.

6. Which service discovers and protects sensitive data (like PII) stored in Amazon S3?

  • AWS Shield
  • AWS WAF
  • Amazon GuardDuty
  • Amazon Macie (correct answer)

Amazon Macie uses machine learning to find and classify sensitive data (such as PII) in S3. GuardDuty detects threats; Shield handles DDoS; WAF filters web traffic.

Related objectives

Test yourself with the free diagnostic →

All AWS Cloud Practitioner objectives · Get lifetime access