Architecting on AWS Certification Codes & Standards Compliance 3 — Questions and Answers
Question 1: An architect is designing a multi-region architecture to meet GDPR data residency requirements. Which AWS feature most directly restricts where data is replicated?
- AWS Organizations Service Control Policies (SCPs) denying actions outside allowed regions (Correct answer)
- Amazon Route 53 latency-based routing
- AWS Global Accelerator
- Amazon CloudFront geo-restriction
Correct answer: AWS Organizations Service Control Policies (SCPs) denying actions outside allowed regions
SCPs can deny API actions (like S3 replication or EC2 launch) to non-approved regions, enforcing GDPR data residency at the account or OU level.
Question 2: Which AWS compliance program specifically addresses cloud security for US federal government workloads and maps controls to NIST SP 800-53?
- PCI DSS
- ISO 27001
- FedRAMP (Correct answer)
- CSA STAR
Correct answer: FedRAMP
FedRAMP is the US government's standardized approach to cloud security assessment based on NIST SP 800-53 controls, required for federal agencies using cloud services.
Question 3: A company must prove separation of duties between developers and production environments for SOX compliance. Which IAM approach best enforces this?
- Granting developers AdministratorAccess with MFA
- Using separate AWS accounts per environment with least-privilege cross-account roles (Correct answer)
- Enabling IAM Access Analyzer
- Using resource-based policies on all S3 buckets
Correct answer: Using separate AWS accounts per environment with least-privilege cross-account roles
Separate AWS accounts create hard boundaries between environments, and cross-account roles with least-privilege permissions enforce SOX separation-of-duties requirements.
Question 4: Which AWS service aggregates security findings from GuardDuty, Inspector, and Macie into a single dashboard for compliance reporting?
- AWS CloudWatch Dashboards
- AWS Security Hub (Correct answer)
- AWS Trusted Advisor
- Amazon Detective
Correct answer: AWS Security Hub
AWS Security Hub collects and normalizes findings from multiple AWS security services and partner tools, providing a unified compliance and security posture view.
Question 5: Under PCI DSS Requirement 10, cardholder data environment (CDE) activity must be logged and protected. Which combination best satisfies this on AWS?
- CloudTrail + S3 with MFA Delete and Object Lock (Correct answer)
- VPC Flow Logs + CloudWatch Logs only
- AWS Config + Trusted Advisor
- AWS Shield + WAF access logs
Correct answer: CloudTrail + S3 with MFA Delete and Object Lock
CloudTrail captures API activity for the CDE, while S3 Object Lock (WORM) and MFA Delete prevent log tampering, meeting PCI DSS Requirement 10 integrity controls.
Question 6: A company must conduct vulnerability assessments of its EC2 instances as required by ISO 27001. Which AWS service automates this without deploying a third-party scanner?
- AWS Trusted Advisor
- Amazon Inspector (Correct answer)
- AWS Config
- Amazon Macie
Correct answer: Amazon Inspector
Amazon Inspector automatically discovers and scans EC2 instances and container images for software vulnerabilities and unintended network exposure, supporting ISO 27001 vulnerability management.
Question 7: Which AWS tool provides downloadable SOC 2 Type II reports and ISO 27001 certificates for use in customer audits?
- AWS Trusted Advisor
- AWS Well-Architected Tool
- AWS Artifact (Correct answer)
- AWS Audit Manager
Correct answer: AWS Artifact
AWS Artifact is a self-service portal where customers can download AWS compliance reports such as SOC 2 Type II, ISO certifications, and PCI AOC documents.
Architecting on AWS Certification Codes & Standards Compliance 3
An architect is designing a multi-region architecture to meet GDPR data residency requirements.
Which AWS feature most directly restricts where data is replicated?