A company operates 30 AWS accounts across several AWS Regions and wants one central view of resource configuration and compliance for all of them. Which capability provides this?
Intermediate · Choose one
Explanation
Answer: A. An aggregator collects AWS Config configuration and compliance data from multiple accounts and Regions into a single account, so a governance team can review resource inventory and rule compliance across the estate without signing in to each account.
B. AWS Artifact agreements are legal documents accepted on behalf of an organization. They are unrelated to configuration compliance.
C. An organization trail centralizes CloudTrail API activity, not configuration state and rule compliance.
D. A CloudWatch dashboard visualizes metrics and logs. It has no view of Config rule evaluations across accounts.
32
What is an AWS Config conformance pack?
Intermediate · Choose one
Explanation
Answer: C. A conformance pack packages Config rules and their remediation actions together so an organization can apply a consistent compliance baseline, for example one aligned to a regulatory framework, to an account or across an organization, and track compliance for the pack as a whole.
A. Blocking API calls before they succeed is what a service control policy does. AWS Config is a detective control that evaluates resources after they exist.
B. AWS audit reports are obtained from AWS Artifact and attest to AWS's controls, not to the customer's resource configurations.
D. Managed rule groups that filter web requests belong to AWS WAF, which inspects HTTP traffic rather than resource configuration.
33
According to the AWS penetration testing policy, what may a customer do without requesting prior approval from AWS?
Intermediate · Choose one
Explanation
Answer: B. AWS permits customers to carry out security assessments against a published list of services for resources they own, without prior approval. The list has expanded over time and includes Amazon EC2, Amazon RDS, Amazon CloudFront, Amazon API Gateway, AWS Lambda, Amazon ECS, AWS Fargate, and others.
A. Denial of service and simulated denial of service testing appear on the prohibited activities list in the penetration testing policy. DDoS simulation is governed by a separate AWS policy that requires an AWS pre-approved DDoS test partner and published traffic thresholds, and anything outside that requires a Simulated Events form submitted in advance.
C. The policy covers only resources the customer owns. Testing AWS's own infrastructure or other tenants is never permitted.
D. Testing another customer's infrastructure is out of scope of the policy entirely, and AWS does not grant consent on another customer's behalf.
34
A company must encrypt objects in an Amazon S3 bucket with a key that the company creates, can disable centrally at any moment without changing the application, and whose every use is recorded in AWS CloudTrail. Which option meets all three requirements?
Intermediate · Choose one
Explanation
Answer: C. A customer managed key is created and owned by the customer, who controls its key policy, can enable or disable it and schedule its deletion, and sees every cryptographic operation against it as a CloudTrail event. Disabling the key immediately stops objects protected by it from being decrypted, without touching the application.
A. SSE-S3 uses keys that Amazon S3 owns and manages. The customer cannot disable them, set a policy on them, or audit their individual use.
B. A Config rule reports whether encryption is configured. It is a detective check and provides no key control at all.
D. With SSE-C the customer holds the key outside AWS and must send it with every request, so there is no central place to disable it and no AWS-side audit trail of key usage.
35
An auditor asks a company to show both how its AWS resources were configured over the past year and which identity changed them. Which TWO services should the company use? (Choose TWO.)
Intermediate · Select 2 answers
Explanation
Answer: C and E. The two services are complementary halves of an audit trail. AWS Config keeps the configuration history of each resource, answering what the resource looked like and when it changed, while AWS CloudTrail records the API calls, answering which principal made the change, from where, and with what parameters.
A. AWS Artifact provides AWS's own audit reports and agreements. It contains no information about the customer's resources.
B. Amazon Inspector reports software vulnerabilities and unintended network exposure in workloads, which is a different question from who changed what.
D. Amazon CloudWatch collects metrics, logs, and alarms describing how systems are performing. It holds neither configuration history nor a record of API callers.
36
Which TWO statements about AWS Key Management Service keys are correct? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: A and D. The three key types differ in who creates and controls them. AWS managed keys are created by a service for use on the customer's behalf, are visible in the account, cannot be modified, and are rotated by AWS annually. Customer managed keys give the customer full lifecycle control, including the key policy, enabling and disabling, rotation settings, and scheduled deletion.
B. AWS owned keys belong to an AWS service and are used across many accounts. They are not in the customer's account and cannot be viewed, audited, or managed by the customer.
C. AWS KMS is integrated with a wide range of services, including Amazon EBS, Amazon RDS, AWS Secrets Manager, and Amazon DynamoDB, and can also be called directly to encrypt small amounts of data.
E. Rotation creates new backing key material while the key ID and ARN stay the same, so applications continue to work unchanged and older data is still decryptable with the retained material.
37
An organization must ensure that identities outside the organization cannot access its Amazon S3 buckets, regardless of the bucket policies that individual account owners write. Which AWS Organizations policy type is designed for this?
Hard · Choose one
Explanation
Answer: D. Resource control policies set the maximum permissions available on the resources in an organization's accounts, which lets a central team restrict access by external principals even when a local bucket policy tries to grant it. Like service control policies, they grant nothing on their own and do not apply to the management account's resources.
A. A service control policy caps what the principals inside the organization's member accounts may do. It does not constrain an external principal reaching a resource through a resource-based policy.
B. A permissions boundary applies to a single IAM user or role in one account, so it cannot express an organization-wide rule about who may reach a resource.
C. A conformance pack detects and can remediate non-compliant configurations after the fact. It is not an authorization control evaluated on each request.
38
A regulator requires a company to keep a searchable record of AWS API activity for seven years. Which approach meets the requirement?
Hard · Choose one
Explanation
Answer: D. Long-term retention requires the customer to direct events somewhere durable. A trail writes events continuously to an S3 bucket the customer controls and retains for as long as its lifecycle policy says, while a CloudTrail Lake event data store keeps events in a queryable store with retention that can be configured for many years.
A. AWS Config records resource configuration state, not API calls, so it cannot serve as the API activity record an auditor is asking for.
B. CloudWatch metrics are numeric time series about performance and utilization. They contain no record of who called which API.
C. Event history is limited to the last 90 days of management events in each Region. It is free and requires no setup, but it cannot satisfy a multi-year requirement.
39
In AWS Control Tower, what characterizes a detective control?
Hard · Choose one
Explanation
Answer: A. AWS Control Tower groups controls, formerly called guardrails, by behavior. A detective control inspects resources that already exist, is implemented with AWS Config rules, and surfaces a clear or in-violation status on the dashboard so an owner can act.
B. Evaluating resources before they are provisioned and refusing non-compliant ones describes a proactive control, implemented with CloudFormation hooks.
C. Blocking the call before it succeeds describes a preventive control, implemented with policies such as service control policies.
D. Detection and remediation are separate. A detective control reports the violation; automatic correction requires a remediation action the customer configures.
40
Which statement about default encryption at rest in AWS is correct?
Hard · Choose one
Explanation
Answer: B. The two services behave differently and are often confused. Amazon S3 applies server-side encryption with S3 managed keys to every new object upload as a baseline that cannot be turned off, at no extra cost. Amazon EBS encryption is a choice made when a volume is created, and an account can set encryption by default as a per-Region setting so new volumes are always encrypted.
A. This reverses the two behaviors. Bucket-level default encryption is no longer a prerequisite for new S3 objects to be encrypted.
C. This is true of Amazon S3 but not of Amazon EBS, where encryption by default must be enabled by the customer in each Region.
D. Neither service requires a customer managed key. Amazon S3 uses S3 managed keys by default, and Amazon EBS can use the AWS managed key for EBS.