Architecting on AWS Certification Safety Practices & PPE 5 — Questions and Answers
Question 1: An architect is designing a VPC and wants to add an extra layer of stateless traffic filtering at the subnet boundary. Which AWS component provides this?
- Security groups
- Network Access Control Lists (NACLs) (Correct answer)
- VPC endpoints
- Transit Gateway
Correct answer: Network Access Control Lists (NACLs)
NACLs are stateless firewalls that operate at the subnet level, filtering both inbound and outbound traffic based on rules.
Question 2: Which AWS service enables centralized management of firewall rules across multiple accounts and VPCs in an AWS Organization?
- AWS WAF standalone
- AWS Firewall Manager (Correct answer)
- AWS Network Firewall
- VPC Security Groups
Correct answer: AWS Firewall Manager
AWS Firewall Manager provides centralized administration and enforcement of firewall rules across an AWS Organization from a single account.
Question 3: A company processes payment data and must meet PCI DSS compliance. Which AWS tool provides compliance reports and attestations to verify AWS infrastructure meets this standard?
- AWS Artifact (Correct answer)
- AWS Config
- AWS Security Hub
- Amazon Macie
Correct answer: AWS Artifact
AWS Artifact provides on-demand access to AWS compliance reports, including PCI DSS Attestations of Compliance, for audit and compliance verification.
Question 4: Which encryption option for S3 allows the customer to provide and manage their own encryption keys outside of AWS, while AWS performs the encryption?
- SSE-S3
- SSE-KMS
- SSE-C (Server-Side Encryption with Customer-Provided Keys) (Correct answer)
- Client-side encryption
Correct answer: SSE-C (Server-Side Encryption with Customer-Provided Keys)
SSE-C lets customers provide their own encryption keys with each request; AWS uses the key to encrypt/decrypt but never stores it.
Question 5: An application team wants to receive automated alerts when a root account login is detected in their AWS account. Which combination of services achieves this?
- Enable AWS Config and set up a managed rule for root login
- Use AWS CloudTrail with CloudWatch alarms filtering for root login events (Correct answer)
- Configure Amazon Inspector to monitor IAM activity
- Set up Amazon GuardDuty email notifications for all events
Correct answer: Use AWS CloudTrail with CloudWatch alarms filtering for root login events
CloudTrail logs the root login event and a CloudWatch metric filter plus alarm can trigger an SNS notification when a root account sign-in is detected.
Question 6: Which AWS feature restricts the maximum permissions that an IAM entity (user or role) can have, even if their policy grants more?
- IAM permission boundaries (Correct answer)
- Service Control Policies
- Resource-based policies
- IAM Access Analyzer
Correct answer: IAM permission boundaries
Permission boundaries set the maximum permissions an IAM entity can have; the effective permissions are the intersection of the boundary and identity-based policies.
Question 7: A solutions architect wants to prevent accidental deletion of critical S3 objects by requiring a separate authorization step before permanent deletion. Which S3 feature achieves this?
- S3 Versioning with MFA Delete enabled (Correct answer)
- S3 Object Lock in Governance mode
- S3 Cross-Region Replication
- S3 Lifecycle policies
Correct answer: S3 Versioning with MFA Delete enabled
S3 MFA Delete requires a valid MFA token before permanently deleting object versions, adding a mandatory second factor for destructive operations.
Architecting on AWS Certification Safety Practices & PPE 5
An architect is designing a VPC and wants to add an extra layer of stateless traffic filtering at the subnet boundary.
Which AWS component provides this?