Intermediate practice exam 1

Explanation

Answer: C. AWS states directly that customer responsibility is determined by the AWS Cloud services the customer selects. A workload on Amazon EC2 leaves the customer managing a guest operating system, while the same workload built on an abstracted service leaves the customer managing little beyond data and access.

• A. Customers retain ownership and control of their content in every AWS service. AWS operates the service, not the data inside it.
• B. A fixed split would contradict the whole design of the model, which is explicitly service dependent.
• D. Physical and environmental security is an inherited control that the customer receives wholly from AWS.

Explanation

Answer: B. CloudTrail separates management events, which describe operations on resources themselves and are recorded by default, from data events, which describe operations performed on data within a resource. Amazon S3 object-level activity is a data event, so it must be explicitly selected on a trail or event data store and is billed separately because of its volume.

• A. Event history shows the last 90 days of management events. Data events never appear there.
• C. CloudTrail Insights analyzes recorded activity to detect unusual call rates or error rates. It surfaces anomalies rather than capturing a new class of events.
• D. An organization trail applies a trail's configuration across the accounts in an organization, but it still logs only the event types that trail has been configured to record.

Explanation

Answer: D. The two answer different questions and are usually enabled together. Config produces configuration items describing a resource's state and relationships at a point in time and can evaluate that state against rules, while CloudTrail produces events naming the identity, time, source IP address, and parameters of each API call.

• A. This reverses the two services. Recording API calls is the defining function of CloudTrail.
• B. Neither service monitors performance. That is the role of Amazon CloudWatch.
• C. Their data is fundamentally different in kind: configuration state versus request activity. Retention is not the distinction.

Explanation

Answer: A. An aggregator collects AWS Config configuration and compliance data from multiple accounts and Regions into a single account, so a governance team can review resource inventory and rule compliance across the estate without signing in to each account.

• B. AWS Artifact agreements are legal documents accepted on behalf of an organization. They are unrelated to configuration compliance.
• C. An organization trail centralizes CloudTrail API activity, not configuration state and rule compliance.
• D. A CloudWatch dashboard visualizes metrics and logs. It has no view of Config rule evaluations across accounts.

Explanation

Answer: C. A conformance pack packages Config rules and their remediation actions together so an organization can apply a consistent compliance baseline, for example one aligned to a regulatory framework, to an account or across an organization, and track compliance for the pack as a whole.

• A. Blocking API calls before they succeed is what a service control policy does. AWS Config is a detective control that evaluates resources after they exist.
• B. AWS audit reports are obtained from AWS Artifact and attest to AWS's controls, not to the customer's resource configurations.
• D. Managed rule groups that filter web requests belong to AWS WAF, which inspects HTTP traffic rather than resource configuration.