Architecting on AWS Certification Codes & Standards Compliance 4 — Questions and Answers
Question 1: An architect needs to automate evidence collection for PCI DSS, HIPAA, and NIST 800-53 frameworks continuously. Which AWS service is purpose-built for this?
- AWS Config
- AWS Audit Manager (Correct answer)
- AWS Security Hub
- Amazon Inspector
Correct answer: AWS Audit Manager
AWS Audit Manager continuously collects evidence from AWS services, maps it to compliance frameworks like PCI DSS and HIPAA, and generates audit-ready reports.
Question 2: A company uses AWS Organizations and wants to prevent any member account from disabling CloudTrail. Which is the most scalable enforcement mechanism?
- IAM permission boundaries on each account's root user
- An SCP denying cloudtrail:StopLogging and cloudtrail:DeleteTrail across the organization (Correct answer)
- AWS Config rule in each account
- CloudWatch Events alarm per account
Correct answer: An SCP denying cloudtrail:StopLogging and cloudtrail:DeleteTrail across the organization
An SCP applied at the organization root or OU level preventively blocks cloudtrail:StopLogging and cloudtrail:DeleteTrail for all member accounts, regardless of IAM policies.
Question 3: Which encryption standard must AWS KMS CMKs use to comply with FIPS 140-2 Level 2, as required by many US government frameworks?
- 3DES with 112-bit keys
- AES-256 with validated HSMs (Correct answer)
- RSA-1024
- Blowfish-128
Correct answer: AES-256 with validated HSMs
AWS KMS uses AES-256 on FIPS 140-2 Level 2 validated hardware security modules (HSMs), meeting federal cryptographic standards.
Question 4: A retail company processing credit cards must segment its CDE from other systems per PCI DSS Requirement 1. Which AWS networking approach provides the strongest isolation?
- Using separate security groups within the same VPC
- Placing CDE resources in a dedicated AWS account with its own VPC and no VPC peering to non-CDE (Correct answer)
- Enabling VPC Flow Logs on the CDE subnet
- Using Network ACLs with strict inbound rules
Correct answer: Placing CDE resources in a dedicated AWS account with its own VPC and no VPC peering to non-CDE
A dedicated AWS account with its own VPC provides account-level blast-radius containment and prevents any inadvertent network paths from non-CDE environments.
Question 5: GDPR Article 17 grants users the 'right to erasure.' Which S3 capability most directly supports complying with this requirement?
- S3 Lifecycle policies to transition objects to Glacier
- S3 Object Lock in Compliance mode
- S3 batch operations to delete specific objects on demand (Correct answer)
- S3 Intelligent-Tiering
Correct answer: S3 batch operations to delete specific objects on demand
S3 Batch Operations can target and permanently delete specific objects (e.g., a user's data) across large buckets, enabling compliance with GDPR right-to-erasure requests.
Question 6: An architect must ensure data in transit between on-premises systems and AWS meets NIST 800-52 TLS requirements. What is the recommended approach?
- Use HTTP with IP whitelisting
- Configure AWS services to use TLS 1.2 or higher and disable older protocol versions (Correct answer)
- Use AWS Direct Connect without encryption
- Enable VPC Flow Logs
Correct answer: Configure AWS services to use TLS 1.2 or higher and disable older protocol versions
NIST SP 800-52 mandates TLS 1.2 minimum; AWS services support enforcing minimum TLS versions via security policies on load balancers, API Gateway, and CloudFront.
Question 7: Which AWS feature enables an organization to define a minimum baseline of security controls that cannot be overridden by member accounts, supporting CIS Benchmark compliance?
- IAM Access Analyzer
- AWS Control Tower Guardrails (mandatory controls) (Correct answer)
- Amazon Macie
- AWS Shield Standard
Correct answer: AWS Control Tower Guardrails (mandatory controls)
AWS Control Tower mandatory guardrails enforce non-negotiable security baselines (e.g., CloudTrail enabled, S3 public access blocked) across all enrolled accounts, supporting CIS Benchmark requirements.
Architecting on AWS Certification Codes & Standards Compliance 4
An architect needs to automate evidence collection for PCI DSS, HIPAA, and NIST 800-53 frameworks continuously.
Which AWS service is purpose-built for this?