Architecting on AWS Certification Codes & Standards Compliance 5 — Questions and Answers
Question 1: A company must detect and classify sensitive data (PII, PHI) stored in S3 to meet GDPR data inventory requirements. Which AWS service automates this classification?
- AWS Config
- Amazon Macie (Correct answer)
- Amazon Inspector
- AWS Glue Data Catalog
Correct answer: Amazon Macie
Amazon Macie uses machine learning to automatically discover and classify sensitive data such as PII and PHI in S3, supporting GDPR data inventory and mapping obligations.
Question 2: Which AWS Organizations feature can enforce that all new accounts in the organization automatically have AWS Config enabled, supporting ongoing compliance posture?
- AWS Budgets alerts
- CloudFormation StackSets deployed via AWS Organizations (Correct answer)
- AWS Trusted Advisor notifications
- Amazon EventBridge cross-account rules
Correct answer: CloudFormation StackSets deployed via AWS Organizations
CloudFormation StackSets with AWS Organizations integration can automatically deploy baseline stacks (enabling Config, CloudTrail, etc.) to new accounts as they join the organization.
Question 3: An architect is designing a solution where database encryption keys must be stored in hardware that the customer exclusively controls, not AWS, to meet strict regulatory requirements. Which service satisfies this?
- AWS KMS with AWS-managed keys
- AWS CloudHSM with customer-managed HSM partitions (Correct answer)
- AWS Secrets Manager
- AWS KMS with customer-managed keys (CMKs)
Correct answer: AWS CloudHSM with customer-managed HSM partitions
AWS CloudHSM provides dedicated, single-tenant HSM hardware where the customer holds exclusive control of the key material, meeting regulations that prohibit multi-tenant key storage.
Question 4: Which ISO standard specifically covers cloud-specific information security controls that complement ISO 27001, and for which AWS holds certification?
- ISO 9001
- ISO 27017 (Correct answer)
- ISO 14001
- ISO 31000
Correct answer: ISO 27017
ISO 27017 provides cloud-specific guidance extending ISO 27001 controls for cloud service providers and customers, and AWS maintains certification for this standard.
Question 5: A company must demonstrate that its AWS environment meets the CIS AWS Foundations Benchmark. Which AWS service provides a scored compliance check against this benchmark out of the box?
- AWS Trusted Advisor
- Amazon Inspector
- AWS Security Hub with CIS AWS Foundations Benchmark standard enabled (Correct answer)
- AWS Config Conformance Packs
Correct answer: AWS Security Hub with CIS AWS Foundations Benchmark standard enabled
AWS Security Hub includes the CIS AWS Foundations Benchmark as a built-in security standard, automatically running checks and producing a compliance score.
Question 6: Under SOC 2 Trust Services Criteria, which AWS service most directly supports the 'Availability' criterion by providing automated failover and uptime monitoring?
- Amazon Route 53 with health checks and DNS failover (Correct answer)
- AWS Cost Explorer
- Amazon Macie
- AWS Trusted Advisor cost checks
Correct answer: Amazon Route 53 with health checks and DNS failover
Route 53 health checks continuously monitor endpoint availability and automatically failover DNS to healthy endpoints, directly supporting SOC 2 Availability criteria.
Question 7: An e-commerce company needs to ensure its payment page is in scope for PCI DSS but wants to minimize scope for the rest of its AWS environment. Which architecture approach achieves this?
- Deploy all components in a single VPC with strict NACLs
- Isolate payment processing to a dedicated AWS account with no connectivity to non-CDE accounts (Correct answer)
- Use S3 server-side encryption for payment data only
- Enable AWS Shield Advanced on the payment load balancer
Correct answer: Isolate payment processing to a dedicated AWS account with no connectivity to non-CDE accounts
Isolating the CDE into a dedicated AWS account with no peering or cross-account access to non-CDE resources minimizes PCI DSS scope to just that account.
Architecting on AWS Certification Codes & Standards Compliance 5
A company must detect and classify sensitive data (PII, PHI) stored in S3 to meet GDPR data inventory requirements.
Which AWS service automates this classification?