Architecting on AWS Certification Codes & Standards Compliance 2

Question 1

A financial services company must ensure all data at rest in S3 is encrypted to meet PCI DSS requirements. Which S3 feature enforces this at the bucket level without modifying application code?

Accepted Answer

S3 Default Encryption with SSE-S3 or SSE-KMS

Answer

S3 Default Encryption automatically encrypts all objects stored in a bucket, satisfying PCI DSS encryption-at-rest requirements without application changes.

Question 2

Which AWS service provides a managed way to store, rotate, and audit database credentials to help meet SOC 2 access-control requirements?

Accepted Answer

AWS Secrets Manager

Answer

AWS Secrets Manager provides automatic rotation, fine-grained access policies, and CloudTrail audit logging for secrets, directly supporting SOC 2 access-control criteria.

Question 3

An architect needs to demonstrate that all API calls to AWS services are logged for a HIPAA audit. Which service should be enabled?

Accepted Answer

AWS CloudTrail

Answer

AWS CloudTrail records all API calls made within an account and delivers log files to S3, providing the audit trail required by HIPAA's audit-control safeguard.

Question 4

A company subject to FedRAMP must use FIPS 140-2 validated encryption endpoints. How should architects configure AWS SDK clients to meet this requirement?

Accepted Answer

Use AWS FIPS endpoints for the relevant services

Answer

AWS publishes FIPS 140-2 validated service endpoints (e.g., s3-fips.us-east-1.amazonaws.com) that SDK clients must explicitly target to meet FedRAMP cryptographic requirements.

Question 5

Under the AWS Shared Responsibility Model, who is responsible for patching the guest operating system on Amazon EC2 instances?

Accepted Answer

The customer

Answer

The customer is responsible for patching the OS and software running on EC2 instances; AWS only manages the underlying hypervisor and physical infrastructure.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Codes & Standards Compliance 2