A company wants developers to assume short-lived credentials when accessing AWS from a corporate SAML identity provider. What is the BEST approach?

• Create IAM users with access keys for each developer
• Use IAM roles with trust policy for SAML federation (or IAM Identity Center)
• Store shared root account credentials in Secrets Manager
• Attach AdministratorAccess policy to all developers

Which statement about Security Groups and Network ACLs is CORRECT?

• Security groups are stateless; NACLs are stateful
• Security groups support deny rules explicitly
• Security groups are stateful; NACLs are stateless
• NACLs attach to EC2 instances directly

An application in a private subnet must read objects from S3 without using the public internet. What should you add?

• Internet Gateway in the private subnet
• VPC gateway endpoint for S3
• Public NAT Gateway only
• AWS Direct Connect mandatory for S3

You need audit trails of who used a customer managed KMS key to decrypt S3 objects. Which S3 encryption option aligns best?

• SSE-S3 with bucket key only
• No encryption — bucket policy is enough
• SSE-KMS with a customer managed CMK
• Client-side encryption with keys stored in the application repo

Which service provides intelligent threat detection from VPC Flow Logs and CloudTrail without installing agents?

• AWS WAF
• Amazon GuardDuty
• AWS Config
• AWS Trusted Advisor