Architecting on AWS Certification Safety Practices & PPE 3 — Questions and Answers
Question 1: Which principle should guide IAM policy design to minimize the risk of accidental or malicious misuse of AWS resources?
- Principle of separation of duties
- Principle of least privilege (Correct answer)
- Principle of defense in depth
- Principle of need to know
Correct answer: Principle of least privilege
The principle of least privilege means granting only the permissions required to perform a task, reducing the attack surface.
Question 2: A workload processes highly sensitive PII data. The architect wants to ensure data in transit between services is always encrypted. Which approach satisfies this for an HTTPS API endpoint?
- Deploy behind an Application Load Balancer with an SSL/TLS certificate (Correct answer)
- Use VPC peering instead of public endpoints
- Enable AWS Shield Advanced
- Configure security groups to allow only port 443
Correct answer: Deploy behind an Application Load Balancer with an SSL/TLS certificate
An ALB with an SSL/TLS certificate terminates HTTPS connections, ensuring all data in transit to the endpoint is encrypted.
Question 3: Which AWS service provides a centralized view of security alerts and compliance status across multiple AWS accounts and services?
- AWS Config
- Amazon Inspector
- AWS Security Hub (Correct answer)
- Amazon GuardDuty
Correct answer: AWS Security Hub
AWS Security Hub aggregates, organizes, and prioritizes security findings from multiple AWS services into a single dashboard.
Question 4: An organization wants to detect and classify sensitive data (such as PII or financial data) stored across thousands of S3 buckets. Which AWS service automates this?
- Amazon Inspector
- Amazon Macie (Correct answer)
- AWS Glue DataBrew
- AWS Config
Correct answer: Amazon Macie
Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data stored in Amazon S3.
Question 5: A company must ensure that all API calls to AWS services are logged for compliance and forensic analysis. Which service provides this audit trail?
- Amazon CloudWatch Logs
- AWS CloudTrail (Correct answer)
- AWS Config
- VPC Flow Logs
Correct answer: AWS CloudTrail
AWS CloudTrail records all API calls made in an AWS account, providing an audit trail of who did what and when.
Question 6: Which AWS KMS feature allows you to automatically rotate cryptographic keys on a yearly basis without changing the key ID or ARN used by applications?
- KMS key deletion
- KMS key alias rotation
- KMS automatic key rotation (Correct answer)
- KMS key import
Correct answer: KMS automatic key rotation
KMS automatic key rotation rotates the backing key material annually while keeping the same KMS key ID, so no application changes are needed.
Question 7: A security policy requires that no EC2 instance should be able to communicate directly with the internet. Which VPC component enforces this at the subnet level?
- Security group with no outbound rules
- Network ACL blocking all internet traffic
- Placing instances in a private subnet with no internet gateway route (Correct answer)
- Using VPC endpoints only
Correct answer: Placing instances in a private subnet with no internet gateway route
Private subnets have no route to an internet gateway, preventing direct internet communication by design.
Architecting on AWS Certification Safety Practices & PPE 3
Which principle should guide IAM policy design to minimize the risk of accidental or malicious misuse of AWS resources?