Architecting on AWS Certification Codes & Standards Compliance 3

Question 1

An architect is designing a multi-region architecture to meet GDPR data residency requirements. Which AWS feature most directly restricts where data is replicated?

Accepted Answer

AWS Organizations Service Control Policies (SCPs) denying actions outside allowed regions

Answer

SCPs can deny API actions (like S3 replication or EC2 launch) to non-approved regions, enforcing GDPR data residency at the account or OU level.

Question 2

Which AWS compliance program specifically addresses cloud security for US federal government workloads and maps controls to NIST SP 800-53?

Accepted Answer

FedRAMP

Answer

FedRAMP is the US government's standardized approach to cloud security assessment based on NIST SP 800-53 controls, required for federal agencies using cloud services.

Question 3

A company must prove separation of duties between developers and production environments for SOX compliance. Which IAM approach best enforces this?

Accepted Answer

Using separate AWS accounts per environment with least-privilege cross-account roles

Answer

Separate AWS accounts create hard boundaries between environments, and cross-account roles with least-privilege permissions enforce SOX separation-of-duties requirements.

Question 4

Which AWS service aggregates security findings from GuardDuty, Inspector, and Macie into a single dashboard for compliance reporting?

Accepted Answer

AWS Security Hub

Answer

AWS Security Hub collects and normalizes findings from multiple AWS security services and partner tools, providing a unified compliance and security posture view.

Question 5

Under PCI DSS Requirement 10, cardholder data environment (CDE) activity must be logged and protected. Which combination best satisfies this on AWS?

Accepted Answer

CloudTrail + S3 with MFA Delete and Object Lock

Answer

CloudTrail captures API activity for the CDE, while S3 Object Lock (WORM) and MFA Delete prevent log tampering, meeting PCI DSS Requirement 10 integrity controls.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Codes & Standards Compliance 3