Architecting on AWS Certification Codes & Standards Compliance 2 — Questions and Answers
Question 1: A financial services company must ensure all data at rest in S3 is encrypted to meet PCI DSS requirements. Which S3 feature enforces this at the bucket level without modifying application code?
- S3 Versioning
- S3 Default Encryption with SSE-S3 or SSE-KMS (Correct answer)
- S3 Requester Pays
- S3 Transfer Acceleration
Correct answer: S3 Default Encryption with SSE-S3 or SSE-KMS
S3 Default Encryption automatically encrypts all objects stored in a bucket, satisfying PCI DSS encryption-at-rest requirements without application changes.
Question 2: Which AWS service provides a managed way to store, rotate, and audit database credentials to help meet SOC 2 access-control requirements?
- AWS Systems Manager Parameter Store (Standard)
- AWS Secrets Manager (Correct answer)
- AWS IAM Identity Center
- Amazon Cognito
Correct answer: AWS Secrets Manager
AWS Secrets Manager provides automatic rotation, fine-grained access policies, and CloudTrail audit logging for secrets, directly supporting SOC 2 access-control criteria.
Question 3: An architect needs to demonstrate that all API calls to AWS services are logged for a HIPAA audit. Which service should be enabled?
- Amazon CloudWatch Metrics
- AWS CloudTrail (Correct answer)
- Amazon Inspector
- AWS Config
Correct answer: AWS CloudTrail
AWS CloudTrail records all API calls made within an account and delivers log files to S3, providing the audit trail required by HIPAA's audit-control safeguard.
Question 4: A company subject to FedRAMP must use FIPS 140-2 validated encryption endpoints. How should architects configure AWS SDK clients to meet this requirement?
- Enable S3 Transfer Acceleration endpoints
- Use AWS FIPS endpoints for the relevant services (Correct answer)
- Configure SDK retry logic to maximum
- Enable VPC Flow Logs on all subnets
Correct answer: Use AWS FIPS endpoints for the relevant services
AWS publishes FIPS 140-2 validated service endpoints (e.g., s3-fips.us-east-1.amazonaws.com) that SDK clients must explicitly target to meet FedRAMP cryptographic requirements.
Question 5: Under the AWS Shared Responsibility Model, who is responsible for patching the guest operating system on Amazon EC2 instances?
- AWS
- The customer (Correct answer)
- AWS Marketplace vendor
- AWS Support
Correct answer: The customer
The customer is responsible for patching the OS and software running on EC2 instances; AWS only manages the underlying hypervisor and physical infrastructure.
Question 6: Which AWS service continuously evaluates resource configurations against desired compliance rules and can automatically remediate non-compliant resources?
- AWS Trusted Advisor
- AWS Config with Config Rules and Remediation Actions (Correct answer)
- Amazon GuardDuty
- AWS Security Hub
Correct answer: AWS Config with Config Rules and Remediation Actions
AWS Config Rules evaluate resource configurations on change or schedule, and Remediation Actions can invoke SSM Automation to auto-fix non-compliant resources.
Question 7: A healthcare company needs to sign a Business Associate Agreement (BAA) with AWS before storing PHI. Where is this BAA executed?
- By emailing AWS Support directly
- Through AWS Artifact by accepting the AWS BAA agreement (Correct answer)
- By enabling HIPAA mode in the AWS Console
- Automatically when enabling AWS Shield Advanced
Correct answer: Through AWS Artifact by accepting the AWS BAA agreement
AWS Artifact provides on-demand access to AWS compliance reports and agreements, including the HIPAA BAA, which customers accept to cover their use of HIPAA-eligible services.
Architecting on AWS Certification Codes & Standards Compliance 2
A financial services company must ensure all data at rest in S3 is encrypted to meet PCI DSS requirements.
Which S3 feature enforces this at the bucket level without modifying application code?