Mixed practice exam 3

Explanation

Answer: C. Using an AWS service to perform a task does not move that task across the responsibility boundary. Patch Manager automates a job the customer owns: the customer still defines the patch baseline, the maintenance window, and the approval rules, and bears the consequence if a patch is never applied.

• A. No AWS management tool transfers accountability. The distinction is between who operates the layer and who merely automates work within it.
• B. The origin of the Amazon Machine Image does not change the boundary. Once an instance is running, its guest operating system belongs to the customer.
• D. Auto Scaling changes how instances are replaced, not who is responsible for the software inside them.

Explanation

Answer: A and D. Each step up the abstraction ladder hands AWS more of the undifferentiated operational work. Amazon EKS runs and patches the control plane, and Fargate removes the worker nodes the customer would otherwise have to patch and size. Both were previously the customer's to operate on self-managed Kubernetes.

• B. Authorization for the customer's workloads is always a customer decision. Managed compute changes where the pod runs, not what it is permitted to do.
• C. Container images are software the customer supplies, so their content and vulnerabilities stay with the customer on every platform.
• E. Kubernetes RBAC is configuration inside the cluster the customer defines. Amazon EKS operates the control plane but does not decide who may do what within it.

Explanation

Answer: A. Compliance follows the same boundary as security. AWS's attestations let a customer inherit and evidence the infrastructure controls rather than testing them, which shortens an audit considerably, but the controls the customer owns, such as access management, encryption choices, logging, and application security, must still be implemented and evidenced by the customer.

• B. Support plans affect the technical assistance a customer receives. They have no bearing on which compliance obligations the customer carries.
• C. AWS Artifact is where a customer downloads AWS audit reports and accepts agreements such as a Business Associate Addendum. Accepting an agreement does not certify the customer's own application.
• D. AWS compliance programs cover services across Regions worldwide, with the scope for each program published by AWS. Geography is not the flaw in the reasoning.

Explanation

Answer: D. Amazon CloudWatch Logs centralizes logs from instances, containers, Lambda functions, and AWS services into log groups and log streams, where they can be searched with CloudWatch Logs Insights, filtered into metrics, and used to trigger alarms. It is the destination for logs the customer's own software writes.

• A. AWS CloudTrail records AWS API activity, meaning which principal called which AWS service. It does not collect the logs an application writes inside an instance.
• B. AWS Artifact is a portal for AWS compliance reports and agreements and holds no customer telemetry at all.
• C. AWS Config records the configuration state of AWS resources and evaluates it against rules. It is not a log aggregation service.

Explanation

Answer: D. Encryption in transit protects data on the wire, so that anyone able to observe the network sees only ciphertext. On AWS this is implemented with TLS, which every AWS service endpoint supports and which the customer also applies between their own tiers.

• A. Key material inside AWS KMS is protected by the hardware security modules AWS operates. That protection is part of the service, not what the term in transit describes.
• B. Protecting stored data is encryption at rest, a separate control implemented with features such as Amazon EBS volume encryption or Amazon S3 server-side encryption.
• C. Archived objects are stored data, so they are covered by encryption at rest. They are in transit only while being uploaded or retrieved.

Explanation

Answer: A. AWS KMS is the managed key service integrated with most AWS services that encrypt data at rest. Keys are created and used inside hardware security modules AWS operates, access is governed by a key policy plus IAM, and every use of a key can be recorded in AWS CloudTrail.

• B. AWS Artifact distributes AWS compliance documentation and has no cryptographic function.
• C. AWS Certificate Manager provisions and renews the TLS certificates that protect data in transit. It manages certificates, not the keys that encrypt stored data.
• D. AWS Secrets Manager stores and rotates secrets such as database credentials. It uses KMS keys to protect those secrets rather than being the key service itself.

Explanation

Answer: C. A flow log records details about accepted and rejected traffic at the network interface, subnet, or VPC level, including source and destination addresses and ports, protocol, packet and byte counts, and the action taken. It is collected outside the traffic path, so it does not affect throughput or latency, and can be delivered to CloudWatch Logs, Amazon S3, or Amazon Data Firehose.

• A. Vulnerability discovery is the role of Amazon Inspector. Flow logs report connections, not the software running on an instance.
• B. Configuration state over time is what AWS Config records. Flow logs say nothing about how a resource is configured.
• D. API activity is recorded by AWS CloudTrail. Flow logs describe packets on the network rather than calls to AWS services.

Explanation

Answer: C. AWS maintains a large portfolio of certifications and attestations covering the infrastructure and services it operates. Customers inherit those controls and can evidence them to auditors using the reports in AWS Artifact instead of building and assessing an equivalent control set themselves.

• A. AWS recommends encrypting data in transit and at rest as a defense-in-depth measure, and many regulations require it regardless of network ownership.
• B. Access control over customer content is a core customer responsibility in every AWS service, and one of the most common causes of real incidents.
• D. Legal and regulatory accountability stays with the organization that collects and processes the data. AWS provides evidence about its own controls.

Explanation

Answer: B. CloudTrail separates management events, which describe operations on resources themselves and are recorded by default, from data events, which describe operations performed on data within a resource. Amazon S3 object-level activity is a data event, so it must be explicitly selected on a trail or event data store and is billed separately because of its volume.

• A. Event history shows the last 90 days of management events. Data events never appear there.
• C. CloudTrail Insights analyzes recorded activity to detect unusual call rates or error rates. It surfaces anomalies rather than capturing a new class of events.
• D. An organization trail applies a trail's configuration across the accounts in an organization, but it still logs only the event types that trail has been configured to record.

Explanation

Answer: D. The two answer different questions and are usually enabled together. Config produces configuration items describing a resource's state and relationships at a point in time and can evaluate that state against rules, while CloudTrail produces events naming the identity, time, source IP address, and parameters of each API call.

• A. This reverses the two services. Recording API calls is the defining function of CloudTrail.
• B. Neither service monitors performance. That is the role of Amazon CloudWatch.
• C. Their data is fundamentally different in kind: configuration state versus request activity. Retention is not the distinction.