Architecting on AWS Certification Quality Control & Inspection 3 — Questions and Answers
Question 1: An organization wants to enforce that all new AWS resources are tagged with a 'CostCenter' tag before they can be created. Which mechanism achieves this preventatively?
- AWS Config tag compliance rule
- Service Control Policy (SCP) with a tag condition (Correct answer)
- AWS Cost Explorer tag enforcement
- CloudWatch Events tag alarm
Correct answer: Service Control Policy (SCP) with a tag condition
An SCP with an aws:RequestTag condition key denies resource creation if the required tag is absent, preventing non-compliant resources from ever existing.
Question 2: A developer accidentally deletes a CloudTrail trail. Which service can detect this and automatically recreate it?
- AWS GuardDuty
- AWS Config with auto-remediation using SSM Automation (Correct answer)
- Amazon Inspector
- AWS Audit Manager
Correct answer: AWS Config with auto-remediation using SSM Automation
An AWS Config rule can detect that a CloudTrail trail is missing and trigger an SSM Automation document to recreate it automatically.
Question 3: Which AWS CloudTrail feature ensures that log files have not been tampered with after delivery to S3?
- CloudTrail Insights
- Log file integrity validation (Correct answer)
- CloudTrail Lake immutable queries
- S3 Object Lock
Correct answer: Log file integrity validation
CloudTrail log file integrity validation creates a digitally signed digest file every hour so you can verify logs were not altered or deleted.
Question 4: AWS Trusted Advisor's 'Security' category flags which of the following issues? (Choose the BEST match)
- EC2 instance right-sizing opportunities
- S3 buckets with public read or write access enabled (Correct answer)
- RDS query performance regressions
- Lambda cold start latencies
Correct answer: S3 buckets with public read or write access enabled
Trusted Advisor's Security checks include identifying S3 buckets with public access, exposed access keys, and overly permissive security groups.
Question 5: A conformance pack in AWS Config is BEST described as:
- A set of AWS Config rules bundled with remediation actions as a deployable template (Correct answer)
- A dashboard of security scores across AWS accounts
- A collection of CloudWatch alarms for resource monitoring
- An IAM permission boundary for compliance teams
Correct answer: A set of AWS Config rules bundled with remediation actions as a deployable template
A conformance pack is a YAML template that groups multiple Config rules and optional remediation actions for deployment across an organization.
Question 6: Which AWS service enables forensic investigation of security incidents by visualizing relationships between resources, IPs, and user accounts over time?
- AWS Security Hub
- Amazon Detective (Correct answer)
- Amazon Inspector
- AWS CloudTrail Lake
Correct answer: Amazon Detective
Amazon Detective automatically collects log data and uses ML to build an interactive graph model for investigating and visualizing security incidents.
Question 7: An architect needs patch compliance reporting for 500 EC2 instances across multiple regions. Which service provides a unified patch compliance dashboard?
- Amazon Inspector
- AWS Systems Manager Patch Manager (Correct answer)
- AWS Config patch rule
- AWS Security Hub patch standard
Correct answer: AWS Systems Manager Patch Manager
AWS Systems Manager Patch Manager scans instances and reports patch compliance status in a centralized compliance dashboard.
Architecting on AWS Certification Quality Control & Inspection 3
An organization wants to enforce that all new AWS resources are tagged with a 'CostCenter' tag before they can be created.
Which mechanism achieves this preventatively?