Architecting on AWS Certification Safety Practices & PPE 2 — Questions and Answers
Question 1: Which AWS service provides automated security assessments to identify vulnerabilities and deviations from best practices in EC2 instances and applications?
- AWS Config
- Amazon Inspector (Correct answer)
- AWS Trusted Advisor
- Amazon GuardDuty
Correct answer: Amazon Inspector
Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices.
Question 2: A company wants to ensure that no S3 bucket is ever made publicly accessible. Which AWS mechanism enforces this across an entire AWS account?
- S3 bucket policies
- S3 Access Control Lists
- S3 Block Public Access account-level settings (Correct answer)
- AWS Config managed rule
Correct answer: S3 Block Public Access account-level settings
S3 Block Public Access at the account level overrides any bucket-level or object-level ACL settings that would otherwise allow public access.
Question 3: Which AWS feature allows you to define guardrails that prevent member accounts in an AWS Organization from performing unsafe or non-compliant actions?
- IAM permission boundaries
- AWS Service Control Policies (SCPs) (Correct answer)
- AWS Config rules
- AWS Control Tower drift detection
Correct answer: AWS Service Control Policies (SCPs)
Service Control Policies (SCPs) act as guardrails that restrict what actions can be performed in member accounts, regardless of their IAM policies.
Question 4: An architect needs to protect sensitive data in an RDS database so that even if the storage media is stolen, the data remains unreadable. Which approach should be used?
- Enable RDS encryption at rest using AWS KMS (Correct answer)
- Enable RDS Multi-AZ deployment
- Use RDS read replicas
- Enable RDS automated backups
Correct answer: Enable RDS encryption at rest using AWS KMS
RDS encryption at rest using AWS KMS encrypts the underlying storage so data is unreadable without the decryption key.
Question 5: Which AWS Well-Architected Framework pillar specifically addresses the ability to protect information, systems, and assets while delivering business value?
- Reliability
- Performance Efficiency
- Security (Correct answer)
- Operational Excellence
Correct answer: Security
The Security pillar of the AWS Well-Architected Framework covers protecting information, systems, and assets through risk assessments and mitigation strategies.
Question 6: A developer accidentally committed AWS access keys to a public GitHub repository. What is the FIRST action an architect should take?
- Rotate the access keys immediately (Correct answer)
- Delete the GitHub repository
- Enable MFA on the IAM user
- Review CloudTrail logs for unauthorized use
Correct answer: Rotate the access keys immediately
Immediately rotating (deactivating and replacing) the exposed access keys stops further unauthorized use before investigating the impact.
Question 7: Which AWS service uses machine learning to continuously monitor AWS accounts for unusual activity and unauthorized behavior, acting as a threat detection service?
- AWS Security Hub
- Amazon Macie
- Amazon GuardDuty (Correct answer)
- AWS Shield
Correct answer: Amazon GuardDuty
Amazon GuardDuty is a managed threat detection service that uses ML to analyze CloudTrail, VPC Flow Logs, and DNS logs for malicious or unauthorized behavior.
Architecting on AWS Certification Safety Practices & PPE 2
Which AWS service provides automated security assessments to identify vulnerabilities and deviations from best practices in EC2 instances and applications?