Architecting on AWS Certification Quality Control & Inspection 4 — Questions and Answers
Question 1: Which AWS Config aggregator feature allows a security team to view compliance data from all accounts in an AWS Organization from a single account?
- Config multi-account delivery channel
- Organization-level Config aggregator (Correct answer)
- AWS Security Hub cross-account findings
- CloudTrail organization trail
Correct answer: Organization-level Config aggregator
An AWS Config aggregator collects configuration and compliance data from multiple accounts and regions into a single delegated administrator account.
Question 2: A company must prove to auditors that no IAM root account API calls occurred in the past 90 days. Which approach provides this evidence MOST efficiently?
- Query CloudTrail Lake with SQL for root user events (Correct answer)
- Export all CloudTrail logs to S3 and grep manually
- Run an IAM credential report
- Check AWS Trusted Advisor root account activity
Correct answer: Query CloudTrail Lake with SQL for root user events
CloudTrail Lake allows SQL-based queries over event history, making it straightforward to filter for `userIdentity.type = Root` within a date range.
Question 3: AWS Config's `restricted-ssh` managed rule evaluates which resource type?
- IAM policies allowing SSH key use
- EC2 security groups permitting unrestricted inbound SSH (Correct answer)
- Systems Manager Session Manager configurations
- Network ACLs blocking port 22
Correct answer: EC2 security groups permitting unrestricted inbound SSH
The `restricted-ssh` rule flags EC2 security groups that allow inbound traffic from 0.0.0.0/0 or ::/0 on port 22.
Question 4: A company runs containers on Amazon ECS and needs vulnerability scanning for container images at the time of push. Which service integration provides this?
- Amazon Inspector integrated with Amazon ECR (Correct answer)
- AWS Security Hub with ECS findings
- Amazon GuardDuty container protection
- AWS Config with container image rule
Correct answer: Amazon Inspector integrated with Amazon ECR
Amazon Inspector integrates with Amazon ECR to automatically scan container images for software vulnerabilities when they are pushed to a repository.
Question 5: Which metric does the AWS Well-Architected Tool produce after completing a workload review?
- A cost optimization score out of 1000
- A count of high-risk issues (HRIs) per pillar (Correct answer)
- A security posture percentage for each resource
- A Trusted Advisor check count
Correct answer: A count of high-risk issues (HRIs) per pillar
The Well-Architected Tool surfaces High Risk Issues (HRIs) and Medium Risk Issues (MRIs) per pillar, guiding remediation priority.
Question 6: An architect must ensure CloudTrail is enabled in every region for every new account added to an AWS Organization. What is the MOST scalable solution?
- Use an AWS Lambda function triggered by Organizations account creation events
- Create an organization-level CloudTrail trail in the management account (Correct answer)
- Deploy a CloudFormation StackSet with a CloudTrail resource
- Write an SCP that denies API calls unless CloudTrail is enabled
Correct answer: Create an organization-level CloudTrail trail in the management account
An organization-level CloudTrail trail automatically applies to all existing and future member accounts and all regions with a single configuration.
Question 7: GuardDuty finding type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS' indicates what threat?
- An IAM user logged in from an unrecognized IP address
- EC2 instance credentials are being used from outside AWS, suggesting exfiltration (Correct answer)
- A Lambda function exceeded its IAM permissions boundary
- An IAM role was assumed from a non-AWS environment for the first time
Correct answer: EC2 instance credentials are being used from outside AWS, suggesting exfiltration
This GuardDuty finding means credentials issued to an EC2 instance (via instance metadata) are being used from an IP address outside of AWS, a strong indicator of credential theft.
Architecting on AWS Certification Quality Control & Inspection 4
Which AWS Config aggregator feature allows a security team to view compliance data from all accounts in an AWS Organization from a single account?