SCS-C03 practice questions
AWS · SCS-C03 · 300 questions
Original practice questions for the AWS Certified Security - Specialty (SCS-C03) exam, covering every domain of the official exam outline.
This course contains the use of artificial intelligence.
About the SCS-C03 exam
- Questions
- 65 questions: 50 scored + 15 unscored
- Passing score
- 750 on a 100-1,000 scaled score (compensatory)
- Format
- Multiple choice, multiple response, ordering, matching
Schedule this exam The certification this earns
Exam details published by the vendor, checked 3 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Detection (16%) · 48 questions
- A retail enterprise with 45 AWS accounts in Organizations needs tamper-evident audit trails for all Regions, centralized in a log archive account, with KMS encryption and log file validation enabled. Security requires no gaps from new accounts or Regions. Which CloudTrail logging design ensures complete organization coverage?
- An e-commerce platform runs checkout microservices on ECS behind an ALB across two Regions, requiring early warning when latency rises or tasks become unhealthy before customers notice failures. The team already collects metrics but lacks proactive workload health signals. Which monitoring strategy should the engineer implement for workload health?
- A bank is moving 120 workloads with PCI card data, customer PII, and public marketing sites to AWS. Security must decide what to log, alarm depth, and retention before enabling tools. Which analysis best determines monitoring requirements for these varied workloads?
- A SaaS company stores 90 days of VPC Flow Logs and CloudTrail in S3 and must hunt lateral movement across 40 accounts by joining IP, user, and Security Hub findings with SQL. Which log analysis approach should the analyst choose to correlate petabyte-scale history cost-effectively?
- A fintech with 60 AWS accounts must detect anomalous S3 access, Malware findings, and PII exposure in logs through centralized dashboards and alerts without deploying agents. Which monitoring architecture should the detection engineer implement for agentless anomaly visibility?
- A telehealth startup runs an appointment API on API Gateway with a Node.js Lambda integration function. After a least-privilege role tightening, API Gateway execution logs stream to CloudWatch Logs but the integration Lambda emits no log streams despite successful invocations with 200 responses. Retention and encryption settings are unchanged. Which permission failure should the engineer verify first to restore Lambda function logging?
- A global retailer with 60 AWS accounts needs a single queryable inventory of CloudTrail, VPC flow, Route 53, and Security Hub findings for threat hunting, with automatic normalization and retention for analysts. Regional collectors currently create blind spots. Which solution should the security team deploy to aggregate security and monitoring events?
- A healthcare holding company must aggregate CloudTrail, VPC flow, and Route 53 logs from 100 accounts into an immutable lake for 7-year retention, with automated normalization and forwarding to Splunk. Analysts need unified querying without managing pipelines per source. Which log lake integration design meets these centralization needs?
- A global video streaming company runs stateless transcoders on ECS Fargate behind a Network Load Balancer in two Regions. Viewers reported buffering during an AZ impairment that target health stayed green through. They need synthetic transactions, per-AZ visibility, and paging on failure. Which workload health-check design gives earliest warning of endpoint impairment?
- A manufacturing enterprise with 120 accounts must continuously assess CIS compliance, auto-remediate noncompliant S3 public access, and produce executive posture reports across regions. Which automation set should the security team deploy for continuous assessment and reporting?
- A logistics company runs 50 tracking instances using the unified CloudWatch agent for syslog and memusedpercent. After centralizing the agent JSON in SSM Parameter Store and redeploying with SSM, memory metrics arrive but /var/log/messages stops appearing and the agent log shows no file error. The instance profile is unchanged. Which remediation should the operator apply to restore syslog delivery via the CloudWatch agent configuration?
- A fintech runs workloads in three accounts sending CloudTrail, VPC flow, and WAF logs to a central S3 bucket. Analysts need parsed fields, a common schema, cross-source correlation, and persistent dashboards for threat hunting. Which log normalization and correlation architecture should the team implement?
- A healthcare startup must centralize logs for HIPAA audit across 15 accounts: all management API activity, VPC traffic metadata, and Route 53 DNS queries must be immutable for one year and searchable for incidents. Which log ingestion and storage design should the architect choose to meet the logging requirements?
- A retail company runs isolated app VPCs peered to a central inspection VPC with AWS Direct Connect to stores. The SOC suspects port scanning between tiers and DNS data exfiltration to external domains, but has only CloudTrail management events. Visibility must cover east-west packet rejects and resolver queries. Which logging combination should the detection engineer enable to expose lateral movement and tunneling?
- A fintech centralizes CloudTrail, VPC Flow Logs, and GuardDuty findings in an S3 log archive across three Regions. Analysts need ad hoc SQL joins across months of data without managing servers or moving data. Which solution should the detection architect select to analyze centralized logs for threats?
- A payments startup runs a PCI card processor with DynamoDB, a marketing blog on S3, and dev sandboxes that change daily. Budget is tight and alert fatigue is high. Which workload analysis method should the detection engineer use to define right-sized monitoring and alerting requirements?
- A holding company with 60 AWS accounts needs a single view of GuardDuty, Inspector, and Macie findings plus centralized CloudTrail and Config history for threat hunting. Regional analysts require local access to aggregated data. Which monitoring aggregation design centralizes security and monitoring events for organization-wide alerting?
- A media company with 50 accounts stores PII in S3 and needs early warning of anomalous access plus a unified view of sensitive-data and threat findings. The SOC wants dashboards and alerts without building pipelines per account. Which monitoring design should the engineer implement to centralize anomalous-data detection with dashboards?
- A holding company with 60 AWS accounts needs weekly evidence that S3 buckets stay private, EBS volumes are encrypted, and IAM Access Keys rotate, plus automatic tickets for failures across all OUs. Central security wants managed rules without custom Lambda. Which automation solution provides regular assessments and investigations for this organization?
- A fintech aggregates CloudTrail, VPC flow logs, and WAF logs in S3 but analysts struggle with different formats and slow Athena queries during triage. They need normalized fields and fast correlation dashboards. Which log normalization design provides correlated search for triage?
- A retail company with 40 AWS accounts in Organizations must retain all management and data events centrally, prevent member accounts from disabling logging, and forward logs to a security SIEM. Auditors require one consistent trail definition. Which logging configuration should the engineer implement to centralize AWS service activity across the organization?
- A retail platform runs 200 EC2 instances behind an ALB and needs early warning of impaired hosts, failed health checks, and reboot events with actionable alerts. Which workload monitoring strategy provides comprehensive resource health checks with automated alerting?
- A fintech startup stores cardholder exports in S3 and runs 40 accounts under Organizations. Risk wants early warning of anomalous PII exposure, unusual API activity, and centralized queryable findings for audit. Data must stay queryable for threat hunting. Which anomalous-data detection design meets audit and hunting needs?
- A media company runs REST APIs on API Gateway with Lambda integrations and CloudFront delivery. Engineers see 502 errors but API Gateway execution logs and Lambda CloudWatch logs are missing, while access logs exist. Which logging configuration review best troubleshoots the missing functionality and permissions for diagnostics?
- A gaming company with 40 accounts and three Regions needs one security dashboard, long-term log retention, and automated response to GuardDuty and Config findings. Which architecture best aggregates security and monitoring events centrally?
- A logistics company with 40 accounts needs weekly checks for public S3 buckets, unencrypted EBS volumes, and open security groups, auto-remediation for critical drifts, consolidated scores, and evidence for auditors. Which automation should the engineer deploy to perform regular assessments?
- A logistics firm with shared transit gateway and Route 53 Resolver sees data exfiltration via DNS tunneling and lateral movement between VPCs, but has only VPC flow logs centrally. Security wants hub-level visibility of routed inter-VPC traffic from the transit gateway itself rather than per-VPC logging. Which log-source design detects DNS tunneling and cross-VPC threats effectively?
- A global enterprise aggregates CloudTrail, VPC, and Security Hub findings into OCSF, needs 7-year retention, and must feed a third-party SIEM without custom parsers. Security teams need delegated administration and automatic collection from new accounts. Which log storage and data lake integration should the architect implement for centralized analytics?
- A gaming company with ALB, CloudTrail, VPC Flow Logs, and EKS must retain 7 years of audit logs for regulators, enable SQL analysis of security events, and keep hot investigation data queryable for 90 days cost-effectively. Which log ingestion and storage design meets these requirements?
- A logistics company reports missing application logs from EC2 fleet running CloudWatch Agent, with gaps after an AMI update. The agent status is healthy but log groups lack recent events, suggesting config or IAM issues. Which remediation step best troubleshoots the CloudWatch Agent misconfiguration causing missing logs?
- A bank with 60 AWS accounts in Organizations must retain all management events for 7 years, prevent member admins from disabling logging, and centralize trails in a dedicated log archive account with KMS encryption. Auditors will verify completeness across regions. Which CloudTrail design should the team configure to ensure tamper-resistant organization coverage?
- A retailer's security team stores VPC flow logs, CloudTrail, and WAF logs in S3 across 25 accounts totaling terabytes per month. Analysts must run ad hoc SQL joins to trace an attacker IP across services for the past 90 days without moving data or provisioning servers. Which log analysis approach best meets scale and flexibility?
- A fintech with 60 accounts must spot credential theft and anomalous access to S3 buckets holding transaction exports, identify which exports hold sensitive data, centralize findings for analysts with long-term normalized retention for cross-account SQL analytics, and trigger alerts with visual trends. Which detection, aggregation, and dashboard design provides organization-wide anomaly visibility?
- A logistics company runs ALB, CloudFront, WAF, Route 53, and EKS microservices across two Regions, and the SOC needs centralized request, DNS, and Kubernetes audit trails for threat hunting with 1-year retention and low operational overhead. Which log source and storage combination provides complete coverage with minimal management?
- After a production outage, an API team finds API Gateway access logs in CloudWatch but no execution logs for 5xx errors from a REST API integrated with Lambda. The stage was recently redeployed, and engineers suspect missing permissions or disabled detailed logging. Which logging configuration review restores API Gateway execution logging?
- A media streaming platform runs CloudFront, API Gateway, Lambda, and DynamoDB with strict latency SLOs and needs to decide log sources, metrics, and retention before building dashboards. Architects must map critical user journeys to observability inputs and compliance needs. Which analysis approach best determines monitoring requirements for the workload?
- A healthcare organization with 80 accounts must continuously check CIS Benchmark drift, centralize compliance scores, and auto-remediate noncompliant S3 encryption and disabled logging. Which assessment and remediation automation meets continuous compliance needs?
- A multinational with 200 accounts generates CloudTrail, VPC flow, and GuardDuty findings across regions and needs a normalized queryable data lake with 7-year retention that analysts can join with Splunk without building ETL pipelines. Storage costs and schema management are concerns. Which log storage and integration design should the team implement to centralize security telemetry?
- A fintech runs payment workers on ECS Fargate behind an ALB and needs early warning for task crashes, target health shifts, and queue backlogs before customer impact. Leadership wants health-aware dashboards with paging only on actionable failures. Which workload monitoring strategy best provides resource health visibility?
- A regulated fintech operates 40 AWS accounts under AWS Organizations with a dedicated log archive account. Auditors require immutable API history for all Regions, centralized storage, and tamper detection. Which CloudTrail design should the security engineer deploy to meet centralized organization logging?
- A global logistics firm centralizes CloudTrail, VPC flow logs, and custom JSON app logs from 40 accounts into a central S3 bucket. Analysts need normalized fields, fast full-text search, and unified dashboards to correlate threats quickly without analysts writing separate queries for each log source. Which logging solution best normalizes, parses, and correlates diverse logs for rapid hunting?
- A retail fleet of Amazon EC2 instances stopped sending application logs to CloudWatch Logs after an AMI update, the agent is running, but the log group is empty and metrics are missing. The config file path changed and IAM permissions were narrowed. Which troubleshooting step restores missing logs from the CloudWatch agent configuration?
- A retail enterprise runs 60 accounts across three Regions, security analysts miss threats scattered in GuardDuty, WAF, and CloudTrail, and leadership wants one prioritized view with automated enrichment. Which aggregation design should the architect implement to centralize security findings and monitoring events?
- A gaming company with 40 VPCs attached to Transit Gateway suspects malware using DNS tunneling for exfiltration plus lateral movement between VPCs. Flow data and DNS visibility are incomplete and central logging is required, and the team wants hub-level visibility of routed inter-VPC traffic rather than enabling logs in all 40 VPCs. Which log source combination detects tunnel exfiltration and cross-VPC movement?
- A logistics company is migrating 200 EC2 instances, serverless APIs, and Aurora databases to AWS, and needs to define what to monitor for security, including authentication failures, privilege use, and data access anomalies across all layers. Budgets are limited. Which approach best analyzes workloads to determine monitoring requirements for alerting design?
- A logistics firm runs EKS, Lambda, and RDS across three Regions and must centralize API audit trails, Kubernetes control-plane logs, and database activity streams for threat hunting with 1-year retention. Which log source selection meets audit, container, and database coverage?
- A media company stores a year of CloudTrail and VPC flow logs in S3 totaling 8 TB and must find which IAM principal deleted production buckets and trace lateral movement quickly without moving data. Which log analysis approach should the analyst use to query findings efficiently?
- A multinational needs to centralize CloudTrail, VPC flow, and Route 53 logs from 60 accounts into OCSF format for Splunk analysis with 7-year retention and least operational overhead. Which log lake design should the team deploy to integrate third-party tools?
Incident Response (14%) · 42 questions
- A fintech runs 400 EC2 instances handling payments and must pass an audit showing a repeatable malware response. The CISO requires centralized incident tracking, automated isolation steps every analyst follows, and isolated forensic analysis of disk artifacts. Which approach to response plans and runbooks meets all three needs?
- A SaaS company sees GuardDuty malware findings on production EC2 hosts. Leadership requires automatic isolation within minutes, forensic disk capture for legal hold, and a tracked approval before rejoining fleet. Which automated remediation design satisfies the incident response requirement?
- At 02:00 UTC GuardDuty flags an EC2 web server mining crypto, with outbound connections to an unknown IP and IAM role credentials used from that IP. The runbook requires stopping spread, preserving forensics, and restoring service. Which containment and recovery sequence should the responder execute first to isolate the threat?
- A SaaS company must cut mean time to respond for ransomware in three AWS Regions, requiring pre-provisioned forensic jump access, isolated evidence storage with Object Lock, and pre-deployed GuardDuty, Security Hub, and Detective. Legal requires tested runbooks and no production credential reuse. Which incident preparation design meets these readiness requirements?
- A retail platform suffered checkout fraud spanning ALB access logs, WAF logs, and application JSON logs in CloudWatch, and analysts must run ad-hoc joins by IP and trace ID across all three sources for the last 7 days. Which log search and correlation approach should the responder choose to investigate this fraud event?
- After GuardDuty flags cryptocurrency mining on an EC2 instance, the IR team must determine the initial access vector, lateral movement, and whether other accounts were touched during a 14-day window. VPC flow logs and CloudTrail are voluminous. Which method should the responder use to conduct root cause analysis?
- A fintech company suspects an EC2 web fleet was compromised overnight. Legal requires tamper-evident system and application logs preserved for investigation with clear chain of custody and no modification for one year. Which forensic log preservation strategy should the responder implement to retain admissible system and application evidence?
- A fintech startup runs production in three AWS accounts with GuardDuty disabled and no forensic process. The CISO requires isolated forensic analysis, pre-provisioned emergency access, and always-on detective tooling before launch. Which preparedness design provisions access and security tooling to meet incident readiness?
- A 200-person fintech runs a trading API on EKS across two Regions with DynamoDB global tables. Auditors require quarterly proof that pod-isolation and Regional failover playbooks meet a 1-hour RTO. Testing must not disrupt live trading and must produce repeatable pass/fail evidence. Which testing procedure should the security lead recommend to validate the incident response plan's containment and recovery effectiveness?
- A fintech runs 200 EC2 instances in one account. GuardDuty reports UnauthorizedAccess:EC2/MaliciousIPCaller.Custom for one instance, and Security Hub shows a related high-severity finding. The instance processes payments and shares a VPC with other workloads. Which validation workflow should the responder execute to assess the scope and impact of the GuardDuty finding?
- A GuardDuty finding flags an EC2 instance communicating with a known malicious IP, followed by unusual IAM calls. The responder must reconstruct the timeline, lateral movement, and affected users quickly without manually joining CloudTrail and VPC logs. Which root cause analysis method should the responder use?
- A retail company needs faster EC2 malware response with consistent isolation steps, assigned owners, and timeline tracking across shifts. Analysts currently use chat messages and manual console clicks with no audit trail. Which runbook design should the incident lead adopt to standardize response tracking with automated isolation?
- An online gaming studio runs matchmaking on EC2 Auto Scaling groups across three AZs. Security requires that suspected compromised hosts be isolated automatically, have EBS snapshots captured for forensics with chain-of-custody tags, and notify moderators for approval before termination. Which automated remediation design should the architect implement to contain EC2 incidents forensically?
- A logistics company suffered slow containment because no forensic accounts, tools, or network captures existed before a ransomware event. Leadership now requires pre-staged isolation capability, immutable logs, and ready analyst access for the next incident. Which preparedness setup should the architect implement to enable rapid forensic-ready response?
- A fintech exchange faces stolen IAM keys used to launch mining EC2 instances across two accounts. Leadership wants defined responder roles, isolated forensic examination without contaminating evidence, tracked containment tasks, and post-incident analysis of large CloudTrail datasets. Auditors require repeatable runbooks. Which response plan should the incident lead implement to coordinate roles, forensics, and lessons learned?
- A bank rehearses ransomware containment quarterly but has never tested backup restores or network isolation under load. Regulators demand evidence that the IR plan actually works during realistic failures. Which testing procedure validates the effectiveness of the incident response plan under controlled disruption?
- An e-commerce EC2 fleet in an Auto Scaling group shows ransomware behavior on two instances, with GuardDuty Malware Protection findings and suspicious outbound traffic. The team must stop spread, preserve forensics, and restore service within two hours without losing customer data. Which containment and recovery sequence should the responder execute to handle affected resources?
- After a credential leak, a gaming studio sees odd Lambda invocations, S3 access, and login spikes but cannot connect events across CloudTrail, VPC, and app logs. Analysts need unified search and timeline correlation. Which log search and correlation approach should the responder deploy to trace the attack chain?
- A SaaS startup must improve readiness for EC2 ransomware containment with isolated forensics, pre-approved responder access, and deployed investigation tooling before any incident occurs. Limited staff need automated isolation and evidence collection. Which incident preparation approach using AWS capabilities best meets these readiness requirements?
- A healthcare SaaS must prove its ransomware runbook for EC2 and RDS actually restores service within four hours, but leadership forbids disrupting production. The plan requires isolated testing of containment, backup restore, and failover steps with measured results. Which procedure validates the effectiveness of this incident response plan?
- A regional bank SOC gets a GuardDuty finding for anomalous GetSecretValue and DescribeInstances calls from a production app role, followed by failed console logins in staging. Analysts must identify the originating principal, build a full event timeline, and assess cross-account scope without manually querying raw logs. Which root cause analysis method best traces the initial compromise and blast radius?
- A logistics firm runs critical billing APIs on EC2. Auditors require that leaked IAM access keys be neutralized within minutes without human approval, with full audit trail and stakeholder notice. Manual rotation missed a prior leak for hours. Which automated remediation workflow neutralizes exposed IAM keys within minutes?
- GuardDuty reports cryptocurrency mining on an EC2 instance and Security Hub shows an associated IAM credential leak, but the owner claims both are test activity. Which validation workflow best assesses the true scope and impact of the security event?
- A gaming studio suspects EC2 cryptomining, must preserve memory, disk, and application logs for legal review, maintain chain of custody, and avoid altering the suspect host. Which forensic log capture design preserves admissible artifacts safely?
- An online learning platform runs 80 EC2 instances for virtual labs. Security requires GuardDuty EC2 findings to trigger isolation within minutes, capture disk evidence automatically, open a ticket, and avoid manual logins. Which automated remediation workflow isolates the host and preserves forensic evidence within minutes?
- A regional bank runs payment APIs in two Availability Zones and must prove its incident response runbook restores service within 15 minutes without causing data loss. Leadership wants controlled disruption testing plus a resilience score before the next audit. Which testing procedure best validates the incident response plan's effectiveness?
- After a credential-stuffing alert, a retailer sees failed logins in its ecommerce app logs, suspicious AssumeRole calls in CloudTrail, and anomalous egress in VPC Flow Logs across three accounts. Analysts need one timeline correlating application events with AWS API and network telemetry for the same identities and IPs. Which log search and correlation approach builds that unified timeline?
- A retailer finds an EC2 web server mining cryptocurrency, still connected to an RDS database with customer orders. The team must stop lateral movement, preserve evidence, eradicate the miner, and restore service quickly. Which containment, eradication, and recovery sequence meets all goals?
- A gaming startup suspects an EC2 instance was compromised via a web app, and legal requires bit-for-bit disk copies plus volatile memory and instance metadata preserved in a separate forensic account with chain of custody. The instance must stay isolated but running. Which forensic log and artifact capture plan preserves admissible evidence?
- A bank's SOC handles EC2 malware alerts inconsistently, with analysts using manual console steps for isolation and evidence collection. Regulators require documented, repeatable runbooks with assigned tasks, timelines, and forensic notes. Which design delivers consistent response plans and trackable execution?
- An e-commerce platform sees GuardDuty EC2 malware findings at night and needs automatic isolation, forensic snapshot capture, and tagging for investigation without waiting for on-call approval. The workflow must be auditable and retry on API throttling. Which automated remediation design best contains the compromised EC2 incident?
- A gaming studio suspects EC2 instances are mining cryptocurrency and must preserve volatile memory, disk snapshots, and OS and application logs as court-admissible evidence while keeping production running. Chain of custody and timestamps are critical. Which forensic artifact collection approach should the responder execute to ensure complete preservation?
- A logistics firm with 15 AWS accounts has no standing incident capability. Past events stalled waiting for access approvals and missing forensic tools. Leadership wants pre-staged access, tooling, and evidence storage ready before the next incident. Which preparedness design best ensures rapid response?
- After GuardDuty alerts on unusual API calls from a finance analyst's credentials, the IR team must map accessed S3 buckets, EC2 instances, and IP history to find how the credentials were abused. Which root cause analysis method reconstructs the attack timeline fastest?
- Security Hub aggregates a GuardDuty CryptoCurrency mining finding and a Macie sensitive-data finding for the same production EC2 instance that processes payment files. Leadership needs confirmed scope, data impact, and attacker path before containment. Which finding-validation workflow assesses the scope and impact of this security event?
- After a credential leak, a media firm sees suspicious AssumeRole and S3 data access across CloudTrail, GuardDuty, and app logs in CloudWatch, and analysts must link the IAM principal to API calls and WAF blocks in one timeline without exporting CSVs manually. Which search and correlation method builds a unified incident timeline?
- A fintech startup detects cryptomining on a payment EC2 instance, must preserve memory, disk, and VPC flow context for legal review, and keep evidence isolated from production tampering. Which forensic preservation workflow should the responder execute to capture isolated system and application logs?
- A media firm detected cryptomining on three EC2 instances in a public subnet, with suspicious outbound connections and a potentially exposed key pair. The workload must stay online for forensics, stop lateral movement, remove the miner, and restore clean operation. Which incident response sequence contains and eradicates the threat while enabling recovery?
- A fintech must formalize card-data breach response with assigned roles, isolated forensic notebooks, and tracked tasks that auditors can review after each drill. Which response plan and runbook design meets isolation, accountability, and auditability?
- A GuardDuty finding flags EC2 credential exfiltration and Security Hub shows a critical S3 public exposure in prod. The SOC must confirm true positives, scope, and blast radius before containment during an active alert. Which validation workflow should the responder follow to assess event impact?
- After a stolen access key alert, a retailer must trace the key's use across CloudTrail, WAF, and custom app logs in CloudWatch to map accessed buckets, IPs, and follow-on calls within hours. Which search and correlation workflow should the responder execute to reconstruct the security event timeline?
- A logistics company documented a ransomware containment runbook for EBS-backed fleets but has never executed it, and leaders doubt backup restores and IAM lockdown steps work under stress. The team needs controlled failure drills with measured recovery. Which testing control validates the response plan under realistic failure?
Infrastructure Security (18%) · 54 questions
- A manufacturer runs zero-trust access from factory tablets to an analytics workload in AWS, with no VPN, a strict contractor BYOD policy, and a requirement for per-request identity and device posture checks. Tablets already use an identity provider for SSO. Which control should the architect implement to secure hybrid-to-AWS application communication?
- A fintech runs 60 Amazon ECS services from shared Docker base images and EC2 Auto Scaling groups needing CIS-hardened AMIs, vulnerability scans, and versioned pipelines. Auditors require reproducible builds, mandatory Inspector findings review, and no manual golden-image edits. Which hardened image pipeline satisfies these build controls?
- A global gaming studio launching a tournament site expects volumetric DDoS, bot account creation, and application exploits. Leadership wants a threat-informed edge plan that separates network-layer from application-layer controls before buying services. Which edge security strategy aligns controls to anticipated threats?
- A fintech startup hosts Python code in GitHub repositories and must block merges when secrets or critical vulnerabilities appear, with findings visible to developers in pull requests. Which pipeline security tool configuration should the platform engineer implement to discover vulnerabilities during code review?
- A global media site behind CloudFront and WAF faces credential stuffing from rotating IPs in two sanctioned countries, plus bots that rotate user agents but share TLS fingerprints. Which edge rule set should the engineer deploy to block geography and fingerprint bots while limiting login abuse?
- A fintech VPC hosts payment APIs that must allow HTTPS only from approved partner CIDRs, deny all other ingress, log rejected traffic, and filter outbound malicious domains. State checks show security groups alone are insufficient. Which network control design permits and prevents traffic as required?
- A travel company sends CloudFront, WAF, and third-party firewall logs to its data lake, needs normalized OCSF security telemetry for SIEM queries, and must keep edge dashboards current. Which edge-to-lake integration should the engineer configure to normalize OCSF telemetry?
- A manufacturer must connect a factory to two AWS Regions with dedicated 10-Gbps throughput, consistent low latency, and link-layer encryption for OT data. Internet-based VPN jitter is unacceptable and compliance mandates encrypted private lines. Which hybrid connectivity design provides secure connectivity as required?
- A logistics company runs delivery-route EC2 instances reading SQS and writing DynamoDB, plus ECS Fargate tasks pulling ECR and writing CloudWatch Logs. Credentials were found hardcoded in user data and task definitions. Which role assignment eliminates static keys while granting least-privilege workload access?
- A travel company launches a Bedrock chatbot that summarizes bookings and calls booking APIs, facing prompt injection and excessive agency risks from OWASP LLM Top 10. Which guardrail implementation should the security engineer apply to constrain the generative AI application behavior?
- A payment processor must isolate cardholder databases in private subnets with no internet egress, while containing lateral movement between application tiers and inspecting all inbound and outbound internet traffic. Compliance requires distinct controls for traffic entering or leaving versus tier-to-tier flows. Which design should the architect implement for network segmentation?
- A public web app on CloudFront with an ALB origin faces SQL injection, XSS, and bot scraping that bypassed basic filters. The team needs managed OWASP coverage, bot mitigation, and hardened browser headers. Which edge protection implementation best addresses these threats?
- A healthcare company must prove that production databases accept traffic only from approved application tiers and has hundreds of sprawling security groups. Auditors require evidence of unintended reachable paths before migration. Which control should the engineer use to identify unnecessary network access with reachable-path evidence?
- A SaaS company ships microservices as ECR container images and Python Lambda functions updated daily. Security requires continuous detection of known CVEs in images and function dependencies plus runtime threat detection without agents on Lambda. Which control should the security architect implement to scan compute for vulnerabilities?
- A global streaming service behind CloudFront and ALB faces credential-stuffing bursts from specific countries and rotating IPs, plus scrapers mimicking browsers. The team must block high-risk geographies, throttle login abuse, and challenge suspicious fingerprints without blocking legitimate viewers. Which edge control design meets these layered requirements?
- A SaaS company builds 40 golden AMIs and 25 container images monthly across three Regions. Images must start from CIS-hardened baselines, install CrowdStrike and CloudWatch agent, pass vulnerability scans, and distribute only approved versions. Which hardened image approach should the platform team implement to secure compute workloads?
- A three-tier VPC hosts public ALBs, private app servers, and databases. Policy requires stateful host filtering, subnet-level denial of a scanner CIDR, and centralized stateful egress URL filtering for malware domains. Which network control combination should the engineer troubleshoot and apply?
- A hospital keeps patient portals on private ALBs in AWS while clinicians work from home and branch clinics without VPN clients. Security requires identity-aware, device-posture checks before reaching apps over the internet. Which hybrid connectivity control should the network architect configure to enforce Zero Trust access to private workloads?
- A logistics firm runs EC2 workers that must read from S3 and pull from ECR, plus ECS Fargate tasks that must read Secrets Manager and write to DynamoDB. Credentials must never be stored on hosts, and each workload must receive only its own permissions. Which role design should the architect implement to authorize compute workloads?
- A global ticket retailer faces Layer 3 floods, Layer 7 SQL injection, and scalper bots during on-sales that crashed checkout last season. The board requires edge protection that absorbs floods with 24/7 DDoS response team access and DDoS cost protection, filters exploits, and manages bots close to users. Which edge security strategy should the architect select to counter DDoS, injection, and bots?
- A manufacturer must link a factory to AWS production VPCs and to analytics running in Google Cloud. Factory control traffic needs consistent private throughput to AWS, link-layer encryption on dedicated circuits, dynamic routing with failover, plus encrypted connectivity to Google Cloud without leased lines. Which secure connectivity architecture should the network security engineer design for hybrid and multi-cloud links?
- A healthcare provider runs Amazon EC2 fleets and container hosts across prod and staging. Compliance requires timely OS patches with maintenance windows, staged rollouts, and proof that hosts remain vulnerability-free. Which solution should the platform team deploy to patch compute and maintain continuous compliance?
- A media company runs CloudFront with AWS WAF and uses a third-party SIEM that only parses OCSF. The security team must centralize WAF findings for the SIEM without custom parsing, retain raw logs for 90 days, and keep query costs low. Which integration should the engineer configure to meet the OCSF ingestion requirement?
- A healthcare SaaS runs a 3-tier app in one VPC and must keep PHI databases offline, inspect app-tier east/west traffic, and filter north/south internet traffic centrally. Which segmentation design provides the required north/south and east/west protections with isolated subnets?
- A manufacturing firm connects factory tablets over the internet to private apps in AWS without VPN clients, requiring identity-aware access, device posture checks, and no inbound hybrid firewall openings. Headquarters uses Direct Connect for office traffic. Which hybrid access design meets the tablet workload communication requirements?
- A media site on CloudFront and ALB origin faces SQL injection, XSS, and bot-driven credential stuffing during launches, with legitimate global traffic spikes. The team must filter OWASP Top 10 threats at the edge without building custom proxies. Which network edge protection control blocks these application-layer attacks?
- A SaaS team ships ECR container images weekly and runs Python Lambda functions processing payments. Leadership requires continuous known-vulnerability scanning for images and function code plus runtime threat detection for containers and functions, with AWS managing any agents. Which scanning control should the team implement for container and serverless compute security?
- A bank audit found 400 security group rules with 0.0.0.0/0 SSH and unused cross-VPC paths that must be removed without breaking approved Verified Access connections. Which method best identifies unnecessary network access for safe removal?
- A bank prohibits SSH keys and bastion hosts for 200 Linux EC2 instances in private subnets, requires MFA-backed audited shell access, and must log every command centrally. Which administrative access design meets strict no-inbound access requirements?
- A bank must produce CIS-hardened EC2 AMIs and EKS container images monthly, embed CrowdStrike and CloudWatch agents, scan for CVEs before distribution, and share only approved images to 20 workload accounts. Which pipeline should the engineer implement to secure compute workloads?
- An online gaming platform runs web front ends, game logic, and player databases in one flat VPC, with lateral movement risk between tiers and internet exposure of databases. Compliance requires isolated subnets and controlled east-west traffic with north-south filtering. Which network segmentation design meets these security requirements?
- A multiplayer game studio launches a global leaderboard API on an ALB with login and matchmaking. Threat modeling anticipates UDP volumetric floods, Layer 7 fake-client bots inflating scores, and SQL injection on login. Investors require always-on mitigation with low latency and automatic burst scaling at the edge. Which edge security strategy should the architect select to counter the anticipated volumetric, bot, and injection threats?
- A company runs 500 Amazon EC2 instances and container hosts across production that miss patches, causing audit failures. Maintenance cannot cause downtime and must validate fixes continuously. Which patch deployment approach should the team implement to automate updates with continuous validation across compute?
- A data platform runs ETL jobs on EC2, nightly Glue transforms scheduled by EventBridge, and ECS Fargate tasks pulling from ECR and S3. Each workload overuses one shared IAM role and auditors demand scoped credentials with automatic rotation. Which role assignment should the engineer apply to authorize compute workloads?
- A fintech startup builds a Java microservice with AWS CodePipeline and CodeBuild from GitHub pull requests. Auditors require SAST for code vulnerabilities and hardcoded secrets on every pull request, with developer-friendly fix guidance before merge. Builds already scan container images. Which pipeline scan configuration discovers and remediates code vulnerabilities earliest?
- A global ticket retailer faces bot-driven credential stuffing from specific countries during on-sales, with attackers rotating IPs and JA3 fingerprints to evade simple blocks. The app runs behind CloudFront and must allow legitimate fans worldwide while throttling bots. Which edge control design should the architect implement to enforce geolocation and fingerprint-aware throttling?
- A startup runs 80 EC2 instances in private subnets with open SSH security groups and shared key pairs for vendor support. Auditors demand no inbound SSH, no long-lived credentials, and full session auditing. Developers still need on-demand shell access. Which administrative access design satisfies all constraints?
- A media company serves a global news portal via CloudFront to an ALB origin, facing SQL injection, XSS, and credential-stuffing bursts that bypass security groups. It needs OWASP Top 10 filtering, bot throttling, and hardened response headers. Which edge protection configuration blocks these application threats?
- A healthcare startup launches a Bedrock-powered triage chatbot that summarizes patient messages and calls Lambda tools. Pen tests show prompt injection can override safety instructions and elicit disallowed medical advice, plus sensitive data leaks into outputs. The app already uses IAM and KMS encryption. Which generative AI guardrail addresses OWASP LLM prompt injection and sensitive-data disclosure?
- A media company behind CloudFront and WAF sends logs to a partner SIEM that requires normalized Open Cybersecurity Schema Framework events and must correlate edge blocks with origin ALB latency without custom parsers. Ingest delays must stay low during live streams. Which integration approach should the engineer configure to streamline edge and third-party analytics?
- A bank's VPC has 300 security groups after rapid migration, with auditors flagging overly permissive SSH and database paths that bypass the jump host and Verified Access design. The team needs proof of reachable ports from the internet and unused rules. Which control best identifies unnecessary network access for remediation?
- A retail platform deploys 80 Lambda functions and ECS Fargate containers from ECR with weekly releases, and security must continuously detect OS and code CVEs in images and function packages plus flag anomalous runtime behavior without installing or managing agents themselves. Which scanning and monitoring pairing finds image flaws and runtime threats with no agent management?
- A fintech runs web, app, and database tiers in private subnets across two AZs, must allow outbound HTTPS only to approved payment APIs by domain, block all other egress, and log flow decisions centrally. Security groups cannot filter by domain and NACLs are stateless. Which network control provides stateful domain-based egress filtering for the workloads?
- A fintech startup deploys Python microservices through CodePipeline to Lambda and ECR. Audits found hardcoded secrets and injection flaws reaching production, and the team needs automated code findings with severity gating before deploy. Which pipeline vulnerability scanning control discovers code flaws before deployment?
- A global ticket marketplace faces credential stuffing bursts, Layer 7 DDoS during on-sales, and scraper bots copying prices, needs low latency in 20 countries, and must keep origin costs stable. Which edge security strategy should the architect select to counter volumetric and bot-driven application threats?
- A SaaS provider operates 120 Amazon Linux and Windows EC2 instances in Auto Scaling groups across two Regions. Leadership requires automated patch installation without disrupting releases, standardized patch approvals, and continuous validation for SOC 2 reporting. Which automated patching design should the engineer deploy to maintain compliant compute images with continuous validation?
- A global ticket marketplace behind CloudFront and WAF faces bot scalpers from two sanctioned countries using rotating IPs and spoofed headers that pass simple IP-based rate limits. Which edge control design blocks sanctioned geographies while throttling sophisticated bots?
- A healthcare startup builds Docker apps on EC2 and ECS from manually patched images, causing inconsistent CIS benchmarks and vulnerable packages in production. Builds must be repeatable, tested, and patched automatically. Which hardened image approach should the platform team implement to embed security controls consistently?
- A media company fronts APIs with CloudFront and WAF and must stream WAF detections to its third-party SIEM in a normalized vendor-neutral schema for unified correlation with other clouds. Which edge integration delivers normalized detections to the SIEM?
- A bank operates isolated EC2 instances in private subnets with no internet, where developers currently share SSH keys via bastion hosts violating audit. They need audited shell access without opening inbound ports or managing keys. Which administrative access method should the architect configure for secure compute?
- A travel company launches a Bedrock chatbot that summarizes bookings and calls tools to refund tickets. Testers bypassed safety prompts with jailbreaks, leaked PII in outputs, and triggered disallowed refund actions. Which generative AI guardrail control mitigates prompt injection and unsafe tool use?
- A logistics firm runs shipment APIs on EC2, order workers on ECS Fargate, and image builds with CodeBuild, and developers confused task roles with execution roles causing S3 denials and over-permissive keys. Which role mapping should the architect enforce to authorize each compute workload with least privilege?
- A media streaming site on CloudFront and ALB suffers SQL injection probes, XSS in comments, and bot scraping of video metadata, must stay online during flash sales, and needs managed patching of attack signatures. Which network edge protection should the engineer implement to block OWASP Top 10 and bot threats?
- A bank must connect its on-premises data center to two AWS Regions with consistent private connectivity, encrypted traffic over dedicated links, sub-second failover, and BGP routing. Internet-based tunnels alone violate policy. Which hybrid connectivity design meets the encrypted dedicated-link requirements for the bank?
Identity and Access Management (20%) · 60 questions
- A regional hospital runs clinician portals on AWS with 400 staff using corporate Microsoft Entra ID, plus a patient mobile app needing social sign-up and MFA. Policy requires workforce SSO with short-lived AWS access and separate customer identities with adaptive auth. Which authentication solution meets both human identity needs with least custom code?
- A regional bank federates on-premises AD through AWS Directory Service to IAM Identity Center, and tellers suddenly receive access-denied errors when requesting AWS access via permission sets. Group memberships look correct in AD, and the issue started after an AD trust change. Which troubleshooting approach should the engineer use first to isolate the authentication failure?
- A SaaS company runs 200 project environments where engineers change teams monthly, each project uses resources tagged ProjectID, and engineers carry matching job-project attributes from Identity Center. Which authorization strategy should the IAM architect implement to grant project access without updating policies on every transfer?
- A retailer has 2,000 corporate staff federated in Okta and 500,000 shoppers using a new mobile app with social logins. Staff need AWS console access by department, shoppers need scoped API access, and security forbids long-lived keys. Which identity design satisfies both human and customer authentication needs?
- Helpdesk reports finance users get AccessDenied when assuming an IAM Identity Center permission set to reach a production account, while CloudTrail shows no AssumeRole events. SSO logins succeed and other teams work. Which authentication troubleshooting check should the engineer perform first to diagnose the missing permission set assignment?
- Developers report an EC2 application role gets AccessDenied when calling kms:Decrypt, though the identity policy allows it. The role was recently refactored with SCPs and permission boundaries. Which authorization analysis method pinpoints the cause of the failure?
- A SaaS company needs fine-grained tenant authorization for a document API, with developers defining policies in code, plus temporary on-premises build agents accessing S3 without stored long-term keys. The design must separate policy management from application code. Which authorization approach should the architect evaluate for human, application, and system access?
- An audit finds a marketing S3 bucket policy grants s3:GetObject to an unknown external account and several IAM roles have unused EC2 and IAM permissions. The CISO wants prioritized fixes for external and unused access. Which authorization review method best corrects the unintended privileges?
- A media firm lets external editors upload 5-GB raw videos directly to S3 without AWS credentials, with uploads limited to one prefix, content-type, and 15 minutes. The app runs on EC2 and must avoid proxying bytes or sharing long-lived keys. Which temporary credential mechanism grants scoped direct upload access?
- A media studio hires freelance editors who need project- and rating-based access to video assets, runs a thumbnail service on Amazon EKS needing S3 access, and operates an on-premises render farm that must call Amazon Rekognition without long-term keys. Access must be attribute-driven for humans, short-lived for workloads, and certificate-based for servers. Which authorization design should the security architect select to satisfy human, application, and system access?
- A startup with a single standalone AWS account (no AWS Organizations) grants developers permissions to launch approved analytics services but a misconfigured policy once allowed iam:CreateUser in production, and contractors need temporary scoped-down access via federation. Which least-privilege control set should the IAM lead implement to contain delegation risk?
- A photo-sharing app lets authenticated users upload directly to S3 and lets support view private objects for 15 minutes without IAM credentials. The design must avoid long-lived keys and enforce least privilege per object. Which temporary credential mechanism meets both upload and support needs?
- An edtech startup offers a student mobile app using an Amazon Cognito User Pool federated to a university SAML identity provider. After updating SAML attribute mappings, many students face login redirects that fail with token errors while native test users still sign in. CloudTrail is enabled. Which troubleshooting sequence should the engineer follow to diagnose Cognito authentication failures?
- A SaaS company has 40 product teams deploying EC2 and S3 resources tagged Project=Alpha or Beta. Engineers switch projects often, and operators want single roles with access scoped automatically by project without creating new policies per team. Which ABAC and RBAC authorization strategy should the architect design?
- Employees using IAM Identity Center federated to AWS Managed Microsoft AD report intermittent Access Denied when assuming a permission set, while others succeed. Directory health checks pass. Which troubleshooting approach isolates the authentication failure for federated permission set assumptions?
- A SaaS provider has 40 projects with developers rotating frequently and needs access to EC2 and S3 limited to resources tagged with their assigned project. Maintaining separate IAM roles per project is overwhelming administrators. Developers sign in through federation from the corporate identity provider and use temporary credentials. Which authorization design should the architect implement to enforce project-based access using resource tags?
- A retailer runs corporate AWS access for 800 employees with Okta, a customer mobile app with 200,000 users, and EC2 microservices calling DynamoDB. Password sprawl and hard-coded keys caused incidents. Which identity architecture should the architect implement to provide phishing-resistant workforce, customer, and workload authentication?
- Developers report a Lambda execution role receives AccessDenied for s3:GetObject on arn:aws:s3:::reports-q4/ despite an attached IAM policy allowing it. The bucket policy was recently updated, and an SCP now restricts S3 in non-logging accounts. Which diagnostic method should the engineer use to pinpoint the cause of the authorization failure?
- A SaaS company grants developers AWS access, microservices API access, and on-premises servers access to S3 without long-lived keys. Access must scale by team attributes and support fine-grained policy decisions. Which authorization design unifies human, application, and system access with least privilege?
- A logistics firm runs a customer portal on AWS and on-premises barcode scanners that upload to S3. It needs temporary AWS credentials for scanners without stored keys plus fine-grained portal authorization by team and shipment. Which design should the architect adopt to enforce authorization for system and human access?
- After a reorganization, auditors flag an IAM role allowing s3:Get on finance buckets to all developers, plus an S3 bucket policy granting internet read. The company must find all externally accessible resources and remove unused permissions without breaking jobs. Which remediation approach should the engineer take to correct unintended permissions?
- A media company lets external editors upload large videos directly to S3 and lets a partner analytics role read specific prefixes for two hours. Long-lived access keys were leaked last month. Which temporary credential mechanism should the engineer configure to enable secure time-bound uploads and cross-account reads?
- A startup lets product teams create IAM roles for microservices but two teams escalated to admin by attaching AdministratorAccess. Security must allow delegation while capping maximum permissions and scoping session privileges. Which least-privilege design should the engineer enforce to allow safe role delegation?
- A platform team grants federated contractors admin-like roles for deployments but must cap maximum privileges and scope each session to a single microservice without rewriting identity policies per request. Which least-privilege IAM policy combination should the architect interpret and implement?
- A DevOps engineer receives AccessDenied on s3:PutObject to a data lake bucket despite an IAM identity policy allowing it. The bucket policy, SCPs, and permission boundaries may also apply, and the team needs the exact denying statement. Which authorization analysis tool should the engineer use first to pinpoint the cause of the failure?
- A fintech has 400 developers across payments and lending projects who assume one Developer role to access S3 buckets and DynamoDB tables. Access must auto-adjust when engineers change projects, tags carry project and clearance, and no policy update is needed for joins. Which authorization strategy should the architect implement to enforce project-based access?
- Developers report AccessDenied when calling s3:GetObject on arn:aws:s3:::app-data/ despite an attached IAM policy allowing it, and the bucket has no restrictive policy. The team suspects an explicit deny from an SCP or permissions boundary. Which authorization failure analysis tool pinpoints the cause of this denial?
- A media company has 400 editors across brands using one portal role, needs brand-level access to S3 prefixes, must avoid creating 40 IAM roles, and wants access to follow project tags automatically. Which authorization strategy enforces scalable brand-level access with tags?
- A healthcare company has 800 employees needing SSO to AWS accounts, plus a patient mobile app needing sign-up, MFA, and short-lived AWS API access for 200,000 external users without IAM users. Which identity design correctly assigns human, application, and system authentication for workforce and customer access?
- After migrating to IAM Identity Center, helpdesk staff cannot activate MFA for some users, federated Cognito logins fail intermittently, and CloudTrail shows AccessDenied on directory calls. Which troubleshooting approach best isolates the authentication failure source?
- An audit finds an S3 bucket policy and an EC2 instance role that both grant s3: to the public and to all principals, created during a migration. Security must identify every unintended external access path and remove it without breaking legitimate workloads. Which approach investigates and corrects these unintended privileges?
- A retail company discovers an S3 bucket allows public reads due to an overly broad bucket policy and IAM role trust drift. The security team must find all unintended cross-account and public grants across IAM, S3, and KMS. Which service should the team use to investigate and correct the excessive privileges?
- A logistics partner needs one-time download of invoices from a private S3 bucket for 30 minutes without creating IAM users, while an analytics app needs scoped AWS API access from its EC2 role. Which temporary credential mechanism should the engineer implement to grant least-privilege short-lived access?
- A media firm needs editors to access S3 prefixes by project, EC2 workloads to fetch S3 without keys, and on-premises servers to use AWS APIs without stored secrets. Which authorization design best controls human, application, and system access appropriately?
- A startup grants developers broad IAM access for speed, had privilege escalation via iam:PassRole, and needs least privilege without blocking deployments. New guardrails must limit role passing and scope actions. Which least-privilege design prevents escalation while enabling delivery?
- A startup grants developers broad IAM roles for velocity, but a breach review requires least privilege without breaking deployments, temporary elevation for on-call, and guardrails preventing privilege escalation. Which policy mechanism should the architect implement to enforce least privilege?
- A SaaS company with 200 engineers runs 50 projects tagged Project=Alpha, Beta, and more, with developers federated via Okta constantly joining teams. Static per-project IAM roles cause delays and privilege sprawl. Which ABAC and role strategy grants project access dynamically based on tags?
- Developers report an EC2 deployment role receives AccessDenied when calling s3:PutObject to a vendor bucket despite an allow in its identity policy, and the security engineer must pinpoint whether an SCP, permission boundary, or resource policy blocks it without changing production. Which authorization analysis approach pinpoints the blocking policy type?
- A healthcare SaaS has 800 employees using Microsoft Entra ID and 50,000 patients needing self-registration with MFA and social login for a mobile app backed by API Gateway. Both groups need audited access without long-lived credentials in code. Which identity architecture should the engineer establish to separate workforce and customer authentication?
- Employees federated through IAM Identity Center suddenly cannot access AWS accounts via permission sets, while direct IAM users still work. Helpdesk reports No access errors after IdP certificate renewal. Failed sign-ins started within the hour. Which troubleshooting path isolates the authentication failure fastest?
- A developer with PowerUserAccess receives AccessDenied on s3:PutObject to a data-lake bucket despite an attached allow policy, and the error mentions an explicit deny. The bucket policy, SCPs, permission boundaries, and session policies could all contribute. Which authorization analysis method pinpoints the cause of this authorization failure?
- A logistics company has corporate staff using Okta, delivery drivers using mobile phones with social logins, and microservices calling AWS APIs from ECS tasks. Access must federate human identities centrally while giving apps scalable customer auth without long-lived keys. Which identity architecture best supports human, app, and system authentication needs?
- During a quarterly review, a bank finds an S3 bucket policy and an IAM role trust policy that allow access from an external partner account that was offboarded last year. Hundreds of buckets exist, and manual review misses cross-account grants. Which investigation approach finds and corrects these unintended external authorizations?
- A manufacturer runs Linux servers on-premises that upload telemetry to S3 daily. Security forbids long-lived AWS access keys, requires short-lived credentials tied to server identity, and needs automatic rotation. Which authorization approach best grants application access without stored secrets?
- An auditor flags an S3 bucket allowing public reads via an access point policy attached during a migration, and the platform team manages 300 buckets and needs to find all similar unintended external access paths and fix them centrally. Which investigation and remediation workflow corrects unintended public exposure at scale?
- A platform team lets product engineers create IAM roles for Lambda functions, but a recent review found wildcard permissions and privilege escalation via iam:PassRole. Engineers need flexibility without exceeding approved limits. Which least-privilege combination safely delegates role creation?
- A logistics platform lets external drivers upload delivery photos directly to S3 for 10 minutes and lets dispatchers query DynamoDB via a web app using corporate SSO, with no long-lived AWS keys on devices. Uploads must be scoped to one driver folder. Which temporary credential mechanism should the developer configure to grant least-privilege short-lived access?
- A photo-sharing app lets authenticated users upload directly to S3 and lets partner analytics assume limited read access for one hour without creating IAM users. Mobile clients cannot hold long-term secrets and uploads must not proxy through backend servers. Which temporary credential mechanism best enables secure delegated access?
- A healthcare company manages 400 developers across 30 projects using separate IAM roles per project, and role sprawl causes frequent policy updates. New projects must auto-grant access when job function and project tags match resource tags. Which authorization strategy enforces scalable project access with tags?
- A healthcare company has 800 corporate staff using Microsoft Entra ID and a patient mobile app with 200,000 users needing social login and MFA. Workforce SSO and customer identities must stay separate with centralized workforce access. Which identity design should the architect choose for human authentication?
- A 2,000-person healthcare company uses a corporate SAML identity provider, needs centralized AWS console and CLI access with job-function permission sets, automated provisioning and deprovisioning, and MFA enforced by the IdP. Local IAM users create sprawl. Which identity solution centralizes human authentication with federated single sign-on for the organization?
- A developer assumes a cross-account role and receives AccessDenied on dynamodb:Query, and the team must determine whether the identity policy, SCP, or resource policy caused the denial without changing permissions. Which diagnostic approach pinpoints the authorization failure cause?
- A university portal uses Amazon Cognito user pools federated to on-premises Active Directory for student logins. After an AD trust change, students report invalid-token and refresh failures, helpdesk sees Cognito authentication errors but no clear cause, and admins changed app client settings recently. Directory sync appears stale. Which troubleshooting sequence should the engineer follow to diagnose the federated authentication failures?
- Employees assigned an IAM Identity Center permission set receive Unexpected SSO failures after a scope change, while direct IAM users still sign in successfully. The team must pinpoint whether the failure is federation, permission set, or directory sync. Which troubleshooting sequence should the engineer follow to isolate the authentication failure?
- A fintech app needs fine-grained user actions like transfer:approve for tellers versus managers, with policy simulation and audit trails, without embedding complex checks in code across microservices. Thousands of decisions per second must scale. Which authorization approach should the architect design to externalize human and application access decisions?
- A SaaS firm lets support engineers assume a troubleshooting role via IAM Identity Center, but engineers can attach broad policies and escalate beyond ticket scope. The CISO wants maximum permissions capped and per-session scoping to single customer IDs. Which least-privilege control caps role power and session scope?
- A university research portal lets enrolled students download large private datasets from S3 for one hour, without creating IAM users, while backend jobs need short-lived cross-account access to process uploads. Direct bucket policies are too broad. Which temporary credential mechanism grants scoped time-limited access for both use cases?
- A SaaS startup authorizes warehouse staff via Identity Center, partner microservices via IAM roles, and connected forklifts via certificates, needs fine-grained document approvals, and wants consistent policy evaluation. Which authorization design should the architect choose for human, workload, and device access?
- An analytics team discovers an S3 bucket policy unexpectedly allows a partner account full s3: access, and security must identify the exposure scope and remove only the unintended grant without breaking legitimate analytics reads. Which remediation workflow corrects the excessive privilege accurately?
- A media firm shares 50GB video previews with external partners for 48 hours without creating IAM users, while an EC2 app needs S3 access without static keys. Which temporary credential mechanisms should the architect configure for secure access?
Data Protection (18%) · 54 questions
- A regional clinic migrates patient records to Amazon RDS for PostgreSQL and Amazon S3. Compliance requires encryption at rest with customer-controlled keys, annual rotation without re-encrypting data, and separate audit of key use in CloudTrail. Which encryption control meets the data-at-rest requirement?
- A regional bank encrypts loan archives with KMS in eu-central-1 and must retain keys for 7 years, prove external HSM origin, and crypto-shred data on regulator order without deleting audit history. Which key-material property should the architect validate to confirm imported key material fits the retention requirement?
- A healthcare portal on an Application Load Balancer must enforce encrypted browser connections, block deprecated TLS versions, and automatically redirect cleartext requests. Auditors will test the listener configuration and cipher negotiation. Which ELB mechanism enforces encrypted transit for this workload?
- A healthcare company must replicate encrypted EBS volumes and RDS snapshots to a second Region, retain immutable backups for 90 days against ransomware, and automatically expire old recovery points. Which backup design should the storage architect implement to meet ransomware protection?
- A bank migrates a payment API behind an Application Load Balancer and must enforce TLS 1.2 or higher, forward secrecy, and redirect all port 80 traffic, with quarterly proof that weak ciphers are disabled. Auditors require centrally managed ELB configuration and TLS policy evidence. Which ELB encryption enforcement control satisfies these transit requirements?
- A government agency must use KMS keys in AWS but retain key material generated in its on-premises HSM to meet sovereignty rules, accepting manual rotation every year with defined expiration. The architect must explain key origin trade-offs to approvers. Which statement correctly describes the control for imported versus AWS-generated key material?
- A healthcare platform logs PHI in CloudWatch Logs and publishes order alerts via SNS where email bodies must hide patient IDs but retain auditability. Which data protection configuration should the engineer implement to mask sensitive data in transit through logs and notifications?
- A SaaS firm hosts an internal risk-scoring API in a service VPC that three client VPCs must reach without traversing the internet, using private DNS and endpoint policies. Client networks overlap in CIDR ranges. Which private access design meets these constraints?
- A healthcare contact center logs caller verification details to CloudWatch Logs and publishes appointment reminders through SNS, but auditors flagged national IDs and phone numbers appearing in plaintext. The team must redact PII automatically using managed detection rather than hand-written parsing code. Which control should the engineer configure to mask sensitive data?
- A brokerage must retain trade confirmations in S3 for seven years, prevent deletion or overwrite even by admins, provide legal-hold capability, and prove integrity for regulators. Versioning alone failed audit. Which data-integrity mechanism enforces the retention requirement?
- A payment service stores 150 database and API credentials in AWS, requires automatic rotation every 30 days, must avoid code changes for new passwords, and needs audit trails for each retrieval. Which secrets design should the architect implement to manage rotation without application redeploys?
- A biotech firm hosts genomic APIs on private EC2 subnets that partner labs must reach without traversing the internet, with no inbound VPC changes per partner and private DNS for AWS services. Partners use separate AWS accounts and require scalable private connectivity. Which secure private access design meets these isolation needs?
- A regulated bank generates AES-256 keys in its on-premises HSM and requires that AWS never persist the plaintext key material, that the bank retains exclusive control of rotation, and that KMS-encrypted EBS volumes remain usable. Which key management design should the engineer select to manage imported and external key material?
- A regional bank stores loan records in S3 that must remain unchangeable for seven years, then move to cheaper storage and expire safely. Auditors require WORM enforcement plus automated transitions without custom code. Which lifecycle and retention design should the architect implement to satisfy immutable long-term record keeping?
- A genomics lab processes sensitive datasets on Amazon EMR with multi-node Spark clusters in a single VPC. Compliance mandates that all inter-node shuffle and HDFS replication traffic be encrypted in transit using certificates that EMR provisions to every node without custom code. Which control should the data engineer configure for inter-resource encryption in transit?
- A healthcare analytics team runs Amazon EKS with sensitive genomics traffic between pods across nodes and to RDS. Compliance requires encryption of all inter-node and pod-to-pod transit with mutual authentication, without managing certificates manually. Which inter-resource encryption design secures EKS transit traffic as required?
- A retailer encrypts S3 and EBS in us-east-1 and eu-west-1 with low-latency local decryption and centrally managed rotation, plus mutual TLS for internal services with private certificates. Which key and certificate management design should the security architect implement?
- A bank must encrypt Aurora data in us-east-1 and eu-west-1 under centralized control, allow independent regional decryption during an outage, and issue private mTLS certificates for microservices. Auditors require customer-managed key material. Which key and certificate plan should the security architect select to meet multi-Region resilience?
- A law firm stores case files on EFS and S3 and fears ransomware could encrypt primary data and backups together. Partners require immutable, cross-Region copies with tested restores and minimal RPO. Which backup and replication design should the engineer implement to ensure recoverable isolated copies?
- A payment processor must encrypt cardholder data in Aurora and S3 with distinct keys per environment, annual rotation, and immediate revocation on breach, while meeting PCI DSS key management evidence needs. Which data-at-rest encryption design satisfies these strict key lifecycle requirements?
- A regional bank runs a customer portal on an Application Load Balancer with EC2 targets. Auditors require TLS 1.2 or higher for all connections, HTTP must redirect to HTTPS, and weak ciphers must be disabled at the load balancer. Which ELB security policy control enforces encrypted-only access to the portal?
- A fintech runs a customer portal on EC2 behind an Application Load Balancer that currently accepts HTTP on port 80 and HTTPS with an old TLS policy. Auditors require encrypted client connections with TLS 1.2 or higher and no plain HTTP access. Which ELB security policy control enforces encryption for load balancer connections?
- A health analytics SaaS stores each clinic's reports in one S3 bucket with separate prefixes, must isolate encryption per tenant for offboarding, retain central KMS audit, and block unencrypted uploads. Which encryption-at-rest design meets all three tenant-isolation requirements?
- A regulated bank migrates HSM-backed keys to AWS KMS. Policy requires the bank to generate key bytes on-premises, control rotation timing, and prove deletion by expiring material, while another workload allows AWS to fully manage randomness and rotation. Which key-origin design correctly reflects the difference between imported and AWS-generated key material?
- A fintech startup stores 80 database passwords and third-party API keys in code and needs encrypted storage, distinct access control, and automatic 30-day rotation without code changes. Which secrets management design meets encrypted storage and automatic rotation requirements?
- A brokerage must keep trade confirmations in S3 immutable for seven years, allow no deletion even by admins, prove integrity to regulators, and keep prior versions if overwritten. Which data-integrity design guarantees provable immutability for compliance?
- A pharmaceutical company must retain clinical trial records in S3 for seven years, prevent deletion by any user including admins, detect accidental overwrites, and prove file authenticity for FDA audits. Which data-at-rest control set should the architect implement to guarantee record integrity?
- A fintech app writes account numbers to CloudWatch Logs and publishes order alerts via SNS that sometimes include emails. Compliance requires automatic redaction in logs and topics with audits of detected identifiers. Which masking control should the engineer implement to protect sensitive data in transit through logs and notifications?
- A healthcare startup hosts patient APIs on private subnets with no internet gateways, and partner clinics need secure private connectivity without traversing the public internet or managing VPNs. Traffic must stay on private networks with endpoint policies. Which private access design provides secure connectivity to the APIs?
- A bank runs payment APIs in a private VPC without internet egress and must let on-premises analysts query them over Direct Connect without exposing traffic to the public internet, using private DNS. The solution must avoid VPN operational overhead and scale automatically. Which secure private access design connects analysts to these VPC resources?
- A retail bank runs Amazon EMR with 20 worker nodes to score card transactions. Auditors require shuffle and RPC traffic between nodes to be TLS-encrypted, S3 spill data to use KMS, and settings to be reusable across clusters. Which inter-node encryption control provides compliant EMR transit protection?
- An insurance firm stores claims in S3 Standard, needs automatic transition to cheaper storage after 90 days, immutable retention for 3 years, and deletion after 7 years to limit liability. Which lifecycle design automates cost savings with compliant retention?
- A regional bank stores 40 TB of loan records in S3 Standard that auditors must be able to read but no one can delete for 7 years, and finance requires lower storage cost after 90 days without manual jobs. Versioning is enabled. Which S3 retention and lifecycle design meets the immutability and cost requirements?
- A pharmaceutical firm must generate AES-256 keys in its on-premises HSM for regulatory custody, use them in KMS for S3 encryption, rotate the material every year, and retain AWS audit trails of expiration. Which imported key material and rotation design satisfies the custody and rotation mandate?
- A healthcare SaaS encrypts PHI client-side with the AWS Encryption SDK using a KMS key in us-east-1 and stores the ciphertext in S3. It is expanding to eu-west-1 for disaster recovery, and replicated ciphertext must be decryptable in either Region without re-encrypting data or managing separate keys per Region. Which key strategy meets cross-Region decryptability with centralized control?
- A genomics firm runs Spark jobs on Amazon EMR handling PHI across three subnets, requiring that shuffle and node-to-node traffic remain encrypted without managing certificates on each host. Auditors require native inter-node encryption using KMS-backed keys. Which inter-resource encryption configuration meets the in-transit protection requirement?
- A healthcare startup stores patient records in S3 and RDS and must enforce distinct KMS keys per environment, automatic key rotation, and auditable decryption denials for HIPAA. Operations wants no application code changes for encryption handling. Which at-rest encryption design satisfies the regulatory isolation and auditability requirement?
- A 200-person SaaS firm keeps customer PostgreSQL on EC2 and file assets in S3, and after a ransomware scare must ensure encrypted cross-Region backups with air-gapped recovery, point-in-time restore, and tested restores without managing scripts. Which backup and replication design gives resilient ransomware protection?
- A genomics startup stores 20 TB of sequencing data in S3 and RDS snapshots, subject to HIPAA and customer-managed key rotation with per-project key isolation and audit of every decrypt call. The team wants envelope encryption without managing key storage. Which data-at-rest encryption design should the architect implement to meet isolation and auditability mandates?
- A startup security lead must explain to auditors why some KMS keys show automatic rotation while others need manual handling for an S3 archive. The archive uses customer-supplied key material from a partner HSM. Which distinction between AWS generated and imported key material is accurate for the audit?
- A payment app behind an Application Load Balancer must enforce encrypted browser connections using only strong TLS, automatically redirect HTTP to HTTPS, and pass audits proving weak ciphers are disabled. Users connect globally with modern browsers. Which load balancer control best enforces encrypted connectivity?
- A regional hospital runs encrypted EBS volumes and RDS databases supporting emergency care. Ransomware drills require immutable, cross-Region backups with air-gapped retention, lifecycle management, and quarterly restore testing without custom snapshot scripts. Which backup design provides secure replication and ransomware-resilient recovery?
- A regional bank stores signed loan agreements in S3 and must keep every final version immutable for seven years for regulators, while allowing deletion of incomplete uploads. Legal holds are applied during disputes. Which integrity control should the engineer configure to enforce immutable retention with version protection?
- A healthcare SaaS logs patient emails and national IDs to CloudWatch Logs and forwards alerts through SNS to an on-call topic, and compliance requires automatic masking in both places with an audit finding for each match. Which masking control satisfies both log and messaging requirements?
- A clinical trial firm stores signed consent PDFs in S3, must prove no file was altered for seven years, allow legal holds during disputes, and still permit new versions for corrections. Which integrity mechanism should the engineer configure to preserve evidentiary records while allowing corrections?
- A bank hosts a payments API on private ALBs in a service VPC and must let two partner VPCs call it without internet, public IPs, or transitive routing. Compliance requires private DNS names and a provider-controlled list of which partner accounts may connect. Which private connectivity control enables secure partner access to the API?
- A payments startup stores database passwords and third-party API keys in Lambda environment variables with manual rotation causing outages. They need automatic rotation, fine-grained audit, and no code changes for retrieval. Which secrets design should the team adopt to manage credential rotation securely?
- A SaaS startup stores database passwords and third-party API keys in environment variables, needs encrypted storage, automatic rotation every 30 days without code changes, and audit trails of retrieval. Developers share secrets manually. Which secrets management design enables encrypted storage with automatic rotation for the credentials?
- A payment processor must meet a regulator requiring payment keys be generated in its on-premises HSM, usable in AWS KMS for EBS and S3 encryption, automatically expiring yearly, with immediate revocation on demand. Cloud-only keys are rejected. Which imported key material design satisfies regulatory control and revocation?
- A genomics lab runs EMR on EC2 with Spark shuffling sensitive data between nodes across AZs and must encrypt all inter-node traffic with TLS using a reusable cluster-level setting, without hand-building a certificate authority (EMR release 7.11 or later). Which inter-resource encryption control secures EMR node traffic?
- A bank must issue private TLS certificates for internal services in eu-west-1 and us-east-1 from a bank-controlled private CA, with automatic certificate renewal and distinct trust per Region to limit blast radius. Which certificate authority design meets control, renewal, and isolation?
- A biotech firm keeps research data in S3 Standard for 90 days, then rarely accesses it for six years under a legal retention mandate that blocks deletion, while minimizing cost. Version churn is high. Which automatic lifecycle and retention solution should the engineer design to meet compliance and cost goals?
- A government contractor must use KMS keys with key material generated in its on-premises HSM, retain control over material lifetime, support manual rotation annually, and optionally enforce that AWS never stores material durably. Cloud-generated keys are prohibited. Which imported key material design meets the external control requirements for the workload?
- A gaming studio keeps player replays in S3 Standard, must move idle objects to cheaper tiers after 90 days, retain tournament highlights for three years immutably, and auto-delete drafts after one year. Which lifecycle and retention solution should the engineer design to optimize cost with compliant retention?
Security Foundations and Governance (14%) · 42 questions
- A financial holding company uses AWS Organizations with 40 member accounts and must prevent data leaving its boundary, block members from opting out of AI service data protections, and still allow central security to audit all resources. Which organization policy combination should the platform team deploy to enforce these guardrails?
- A bank must ensure no S3 buckets allow public access and must auto-fix violations within 15 minutes with alerts to the security team. Auditors require history of evaluations and fixes. Which compliance detection and remediation design meets the governance requirement?
- A fintech startup preparing for SOC 2 must prove its multi-account landing zone follows AWS security best practices for logging, encryption, and least privilege, with documented remediation ownership. Leadership wants a repeatable review tied to the Well-Architected Security pillar. Which method should the security lead use to evaluate architecture compliance?
- A retail enterprise with 120 accounts in Organizations needs consistent WAF rules on internet-facing ALBs and centrally managed VPC security groups without local edits. Which central policy deployment approach should the security architect implement to enforce firewall protections from the management account?
- A holding company with 60 AWS accounts in five subsidiaries needs centralized billing, separate guardrails per subsidiary, and automated provisioning of new accounts with baselines. The landing zone must scale without email juggling. Which Organizations deployment meets these governance goals?
- A global manufacturer with 80 Organizations member accounts must eliminate standalone root passwords, enforce MFA on every root, and retain a tested emergency access path if Identity Center fails. The CISO requires centralized root credential governance and auditable break-glass use. Which root user management strategy meets these governance goals?
- A media group with 60 Organizations accounts needs to share inspection VPC subnets and approved Service Catalog portfolios without copying templates or peering each VPC. Which secure sharing mechanism should the cloud team implement to distribute resources across accounts centrally?
- A fintech startup has 12 AWS accounts created manually with separate bills and no consistent guardrails. Leadership requires centralized billing, grouped workloads by environment, and preventive controls that block disallowed Regions. Which Organizations configuration should the architect implement to centralize account deployment with preventive guardrails?
- A SaaS company that already has AWS Audit Manager set up in its organization must demonstrate SOC 2 controls each quarter across 12 AWS accounts. The GRC team needs automatically collected configuration evidence mapped to a framework and auditor-ready reports without manual screenshots. Which audit evidence collection service should the compliance lead select to streamline recurring SOC 2 assessments?
- A retail enterprise with 40 existing AWS accounts wants standardized baselines, required guardrails, and a custom rule blocking non-approved Regions. New acquisitions must enroll with networking baselines automatically. Which Control Tower strategy deploys mandatory, optional, and custom controls across new and existing environments?
- A holding company uses AWS Organizations with 60 member accounts and a dedicated Security OU. It must centrally manage GuardDuty, Security Hub and Macie detective findings, keep member data local, and avoid using long-term access keys for administration. Which delegation approach should the architect implement to centrally manage security services?
- A retail enterprise manages 80 AWS accounts under AWS Organizations with separate dev, test, and prod OUs. Platform teams must roll out identical VPC, logging, and guardrails quickly and keep them consistent after changes. Which approach should the cloud architect choose to deploy cloud resources consistently and securely across accounts?
- A manufacturing firm has 30 existing AWS accounts in an organization and wants standardized baselines, new accounts via self-service, plus stronger logging controls beyond defaults and custom encryption checks. Engineers fear migration downtime for existing workloads. Which Control Tower approach should the lead adopt to govern new and existing accounts centrally?
- An auditor requires continuous detection of public S3 buckets and unencrypted EBS volumes, automatic remediation where safe, and Slack plus email alerts for owners. The platform team must prove history and compliance trends. Which compliance evaluation and notification design should the team deploy?
- A logistics firm is preparing for a customer security review and wants a structured gap assessment of its multi-account architecture against AWS security best practices with prioritized improvements. Which evaluation service should the security architect use to benchmark architecture maturity and track remediation?
- An enterprise manages 120 AWS accounts in Organizations and must prevent routine root use, enforce phishing-resistant MFA for any root access, and allow emergency access within one hour with full auditability. Which root credential strategy should the security team implement to manage AWS account root user credentials?
- A multinational must block public S3 access org-wide, restrict IAM to trusted Regions, and prevent training AI models on sensitive data, while allowing security teams to retain detective access. Which organization policy combination enforces these permission guardrails with least operational friction?
- A university operates AWS workloads for engineering, biology, and finance across dev and prod, needing chargeback by department and cost center plus automated cleanup of temporary lab environments. Which tagging strategy should the governance team implement to organize resources into groups for management?
- A retail enterprise runs 60 AWS accounts with VPCs that need identical WAF rules and Security Groups baseline, plus automatic remediation when teams drift. Central security wants single-pane enforcement without logging into accounts. Which centralized deployment strategy enforces consistent network protection centrally?
- A financial services group operates 150 AWS accounts with strict regulators requiring consistent detective controls and no local security opt-outs. They designated a security tooling account and use Control Tower. They must enforce GuardDuty, Inspector, and Security Hub everywhere from one place. Which delegated-administration strategy enforces centralized security service control?
- An existing AWS Audit Manager customer, a fintech company, must prove PCI DSS controls on EC2, RDS, and IAM to external auditors with organized control-mapped evidence, auditor-ready reports, and continuous collection. Manual screenshots are no longer accepted. Which audit evidence service combination should the compliance team use to demonstrate resource compliance?
- A regulated enterprise with 120 AWS accounts must block all IAM users from disabling CloudTrail, prevent data exfiltration to external S3 buckets, and centrally restrict AI services from training on content. Only the break-glass admin role may bypass controls. Which organization policy strategy manages these permissions centrally?
- A platform team must deploy guardrail VPCs, roles, and Config rules identically to 60 Organization accounts, prevent drift, and promote changes through dev to production with approvals. Manual console work caused inconsistency. Which IaC deployment strategy should the architect implement to deploy cloud resources consistently and securely across accounts?
- A logistics company with 60 AWS accounts in one payer needs isolated production, stage, and sandbox environments, centrally enforced guardrails, and consolidated billing. Which Organizations deployment best provides delegated structure with centralized governance?
- A regional bank with 40 existing AWS accounts in Organizations wants a governed landing zone with preventive controls, centralized logging, and enrollment of current workloads without recreation plus a custom check for approved regions. Which Control Tower approach meets all landing zone enrollment and control requirements?
- A 400-person fintech runs 60 AWS accounts for payments, analytics, and dev sandboxes under Organizations. Finance must allocate spend by department and environment, and security must find all prod databases quickly. Tagging is inconsistent and manual. Which tagging control best delivers consistent grouping for management?
- A SaaS company with 40 AWS accounts must demonstrate alignment to AWS security best practices for SOC 2, with prioritized remediation tracked by workload owners across business units. Reviews must be repeatable each quarter without hiring external assessors. Which control should the auditor test first to confirm architecture compliance with security best practices?
- A platform team manages 60 member accounts in AWS Organizations and must distribute approved golden VPCs, license-included AMIs, and Service Catalog portfolios from a central shared-services account. Each product must remain centrally versioned, least-privilege accessible, and auditable without copying templates manually. Which cross-account sharing approach securely distributes centrally governed resources?
- A fintech company runs 45 AWS accounts in Organizations where each member root user still has a long-term password. Auditors require removal of standalone root credentials, MFA-protected privileged access, and a documented emergency path with full audit trails. Which root-management approach should the security architect implement to centralize member root control and break-glass recovery?
- A retail enterprise with 120 accounts in AWS Organizations wants GuardDuty, Security Hub, and Macie managed centrally, with findings aggregated in a security account and policies preventing members from disabling them. Local teams should retain read-only visibility. Which delegated administration strategy should the governance team implement to centralize security services?
- A SaaS company with 200 accounts must detect publicly readable S3 buckets and unencrypted EBS volumes, auto-remediate them, and notify platform teams within minutes. Audits demand evidence of rule evaluations and change history across the organization. Which compliance detection and remediation design meets these notification needs?
- A fintech with 25 AWS accounts needs VPCs, KMS keys, and Config rules deployed identically in each Region, with peer-reviewed changes, drift detection, and automatic rollback on failure while avoiding console click-ops. Which IaC deployment strategy delivers consistent secure baselines across accounts?
- A university system with 40 AWS accounts in Organizations struggles with inconsistent WAF rules, open security groups, and divergent firewall policies. Central security must enforce baseline protections automatically, including remediation of drift. Which centralized control best deploys and enforces network protections?
- A regulated bank is consolidating 40 standalone AWS accounts after an acquisition, needs delegated admin for audit, requires preventive guardrails on production OUs, and must automate future account creation with baselines. Which Organizations design should the architect deploy to centrally provision accounts with preventive guardrails?
- A university system manages 65 research AWS accounts under Organizations with HIPAA data. Leadership requires central prevention of accounts leaving the organization, blocking S3 buckets from accepting public cross-account access, and requiring encryption on every new EBS volume without touching member-account roles. Which centralized organization policy combination should the governance team deploy to enforce the permission and configuration mandates?
- A regional healthcare network manages 25 AWS Organizations member accounts for clinics. Auditors require no standing root passwords, centrally enforced MFA, prevention of member recovery, and a logged emergency access path. Which centralized root credential strategy removes standing access while preserving audited emergency use?
- A public company must prove quarterly patch, encryption, and access controls across 80 accounts, continuously evaluate and collect control evidence mapped to a framework, and share compliance reports with auditors without giving console access. Manual screenshots are failing. Which approach automates evidence collection and organization for compliance reviews?
- A retailer with 40 accounts needs identical VPC baselines, guardrails, and encryption defaults deployed from a security admin account, with drift detection and versioned rollbacks. Local console changes have caused outages. Which deployment strategy should the architect choose to deliver consistent secure infrastructure across accounts?
- A media company manages 2,000 EC2, S3, and RDS resources across video and audio teams in production, staging, and development. Finance needs cost allocation by department and cost center, and security needs consistent grouping for access controls. Which tagging strategy should the governance lead enforce to organize resources by department and environment for management?
- A biotech company has 12 standalone AWS accounts running lab workloads that must stay in place. It plans 30 new project accounts over the next year that need standardized baselines. Security requires centralized governance, an elective detective control for exposed snapshots, and a custom control blocking non-approved Regions. Which Control Tower enrollment and control strategy meets all account and governance requirements?
- A holding company with 80 member accounts must enforce GuardDuty, Security Hub, and Macie findings centrally while letting each subsidiary view only its own findings and preventing members from disabling the services. Which delegated administration design achieves central control with scoped visibility?
- A media group with 20 accounts needs to share approved machine images and a central transit gateway with spoke accounts without copying resources or granting admin rights. They require scalable, auditable sharing with account-level control. Which cross-account sharing control distributes resources securely?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Amazon Web Services, Inc. and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Amazon Web Services, Inc..