Parameter Store SecureString Quiz

What you'll be asked

1. Which AWS service is primarily used to encrypt the values stored in a Parameter Store 'SecureString' parameter?
2. When retrieving a SecureString parameter using the AWS CLI, which flag must be explicitly included to decrypt the value before it is displayed?
3. An application running on an EC2 instance needs to read a SecureString. What is the minimum IAM permission required for the instance role to successfully retrieve the decrypted value?
4. Which of the following is a key architectural advantage of using SecureString parameters in Parameter Store over simply storing secrets in environment variables?
5. You are attempting to retrieve a SecureString parameter encrypted with a Customer Managed Key (CMK) in a different AWS account. The IAM policy grants 'ssm:GetParameter' and 'kms:Decrypt', yet the call fails. What is the most likely cause?

Answers and explanations come after you submit.