Understand AWS Cloud security, governance, and compliance concepts.

Objective 2.2 sits in Security and Compliance, which carries 30% of the Cloud Practitioner exam. The questions below are original, written from the official objective title above, and each explanation cites the Amazon Web Services (AWS) page it rests on.

Objective title verbatim from the official objectives. Amazon Web Services (AWS) exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-2Security and ComplianceModerate

An auditor needs to see what an S3 bucket's settings were three months ago and what has changed since. Which service holds that history?

AWS ConfigCorrect · your answerCorrect. It shows how resources were configured in the past so you can see how configurations and relationships change over time.

AWS CloudTrailCloudTrail records the API calls that changed the bucket, which tells you who acted. The resulting settings are not what it stores.

Amazon CloudWatchCloudWatch collects metrics and logs about how a resource performs. Request counts tell an auditor nothing about what the bucket policy said.

AWS Trusted AdvisorTrusted Advisor checks an account against current best practice. It reports today's position and keeps no dated record.

Correct.

Checked against docs.aws.amazon.com, August 2026

Concept

Two questions get mixed up here: what a resource looks like now, and what it looked like then. The second needs something that records state rather than activity.

Why A

A recorder keeps each resource as it changes, so you can pull the settings as they stood on a date and see what moved between then and now.

Source

To demonstrate compliance, you need access to the historical configurations of your resources. This information is provided by AWS Config…

AWS Docs: What is AWS Config, checked August 2026

#aws-config#governance#audit

Now you: objective 2.2 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-2Security and ComplianceEasy

A bucket disappears overnight and the team needs to know which principal called the delete. Which service records that?

Sample question 2 of 3

2-2Security and ComplianceHard

An SCP on an OU allows every S3 action, but a user in that account still cannot list buckets. Why?

Sample question 3 of 3

2-2Security and ComplianceModerate

A deny all SCP is attached to the organization root by mistake. Whose access is unaffected?

That’s 3 of the full Cloud Practitioner bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

A worked example

Now you: objective 2.2 questions

Read the sources

More objectives in Security and Compliance