Architecting on AWS Certification Quality Control & Inspection 5 — Questions and Answers
Question 1: A company wants to enforce a maximum 90-day rotation policy for all IAM access keys organization-wide. Which combination BEST achieves continuous enforcement?
- IAM password policy with key rotation setting
- AWS Config rule `access-keys-rotated` with an SCP blocking old keys
- AWS Config rule `access-keys-rotated` triggering an SNS alert to the security team (Correct answer)
- GuardDuty finding for stale credentials
Correct answer: AWS Config rule `access-keys-rotated` triggering an SNS alert to the security team
The `access-keys-rotated` Config managed rule checks key age and can trigger SNS notifications to alert the security team when keys exceed 90 days.
Question 2: Which AWS service can automatically remediate a non-compliant resource by invoking an AWS Systems Manager Automation document?
- Amazon EventBridge with Lambda
- AWS Config automatic remediation (Correct answer)
- AWS Security Hub automated response
- Amazon Inspector remediation action
Correct answer: AWS Config automatic remediation
AWS Config supports automatic remediation by associating a Config rule violation with an SSM Automation document that corrects the resource.
Question 3: A team uses AWS CodePipeline and wants to block deployments if the container image has critical CVEs. Which integration achieves this quality gate?
- Amazon Inspector scan results gating CodePipeline via Lambda (Correct answer)
- AWS Security Hub blocking pipeline stages
- CloudTrail detecting image push events
- AWS Config halting CodePipeline on non-compliant images
Correct answer: Amazon Inspector scan results gating CodePipeline via Lambda
A Lambda function can query Amazon Inspector findings for the image and return a failure status to CodePipeline if critical CVEs are present, acting as a deployment gate.
Question 4: Which AWS service uses machine learning to establish a baseline of normal API call behavior and alerts on anomalous patterns like unusual data access volume?
- AWS Config
- Amazon GuardDuty (Correct answer)
- AWS Trusted Advisor
- Amazon Macie
Correct answer: Amazon GuardDuty
Amazon GuardDuty uses ML on CloudTrail, VPC Flow Logs, and DNS logs to detect anomalous behavior such as unusual API calls or data exfiltration patterns.
Question 5: A customer needs to demonstrate SOC 2 compliance to an auditor. Which AWS service maps AWS controls to SOC 2 requirements and continuously collects evidence?
- AWS Security Hub with SOC 2 standard
- AWS Audit Manager with the SOC 2 framework (Correct answer)
- AWS Config with a SOC 2 conformance pack
- Amazon Inspector with compliance reports
Correct answer: AWS Audit Manager with the SOC 2 framework
AWS Audit Manager provides a prebuilt SOC 2 framework that maps AWS controls to SOC 2 criteria and automatically collects evidence for auditors.
Question 6: What does the AWS Config rule `cloudtrail-enabled` check?
- That CloudTrail delivers logs to an encrypted S3 bucket
- That at least one multi-region CloudTrail trail is active in the account (Correct answer)
- That CloudTrail log file integrity validation is enabled
- That CloudTrail Insights is turned on for anomaly detection
Correct answer: That at least one multi-region CloudTrail trail is active in the account
The `cloudtrail-enabled` managed rule verifies that at least one multi-region CloudTrail trail exists and is logging API activity.
Question 7: An architect is designing a quality inspection pipeline for infrastructure-as-code. Which tool scans CloudFormation templates for security misconfigurations BEFORE deployment?
- AWS Config pre-deployment rule
- AWS CloudFormation Guard (cfn-guard) (Correct answer)
- Amazon Inspector template scan
- AWS Trusted Advisor IaC check
Correct answer: AWS CloudFormation Guard (cfn-guard)
AWS CloudFormation Guard is an open-source policy-as-code tool that evaluates CloudFormation templates against custom rules before they are deployed.
Architecting on AWS Certification Quality Control & Inspection 5
A company wants to enforce a maximum 90-day rotation policy for all IAM access keys organization-wide.
Which combination BEST achieves continuous enforcement?