Codes & Standards Compliance Flashcards
7 cards from real Architecting on AWS Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Codes & Standards Compliance flashcards as text
A company must detect and classify sensitive data (PII, PHI) stored in S3 to meet GDPR data inventory requirements. Which AWS service automates this classification?
Answer: Amazon Macie
Amazon Macie uses machine learning to automatically discover and classify sensitive data such as PII and PHI in S3, supporting GDPR data inventory and mapping obligations.
Which AWS Organizations feature can enforce that all new accounts in the organization automatically have AWS Config enabled, supporting ongoing compliance posture?
Answer: CloudFormation StackSets deployed via AWS Organizations
CloudFormation StackSets with AWS Organizations integration can automatically deploy baseline stacks (enabling Config, CloudTrail, etc.) to new accounts as they join the organization.
An architect is designing a solution where database encryption keys must be stored in hardware that the customer exclusively controls, not AWS, to meet strict regulatory requirements. Which service satisfies this?
Answer: AWS CloudHSM with customer-managed HSM partitions
AWS CloudHSM provides dedicated, single-tenant HSM hardware where the customer holds exclusive control of the key material, meeting regulations that prohibit multi-tenant key storage.
Which ISO standard specifically covers cloud-specific information security controls that complement ISO 27001, and for which AWS holds certification?
Answer: ISO 27017
ISO 27017 provides cloud-specific guidance extending ISO 27001 controls for cloud service providers and customers, and AWS maintains certification for this standard.
A company must demonstrate that its AWS environment meets the CIS AWS Foundations Benchmark. Which AWS service provides a scored compliance check against this benchmark out of the box?
Answer: AWS Security Hub with CIS AWS Foundations Benchmark standard enabled
AWS Security Hub includes the CIS AWS Foundations Benchmark as a built-in security standard, automatically running checks and producing a compliance score.
Under SOC 2 Trust Services Criteria, which AWS service most directly supports the 'Availability' criterion by providing automated failover and uptime monitoring?
Answer: Amazon Route 53 with health checks and DNS failover
Route 53 health checks continuously monitor endpoint availability and automatically failover DNS to healthy endpoints, directly supporting SOC 2 Availability criteria.
An e-commerce company needs to ensure its payment page is in scope for PCI DSS but wants to minimize scope for the rest of its AWS environment. Which architecture approach achieves this?
Answer: Isolate payment processing to a dedicated AWS account with no connectivity to non-CDE accounts
Isolating the CDE into a dedicated AWS account with no peering or cross-account access to non-CDE resources minimizes PCI DSS scope to just that account.