Architecting on AWS Certification Codes & Standards Compliance 4

Question 1

An architect needs to automate evidence collection for PCI DSS, HIPAA, and NIST 800-53 frameworks continuously. Which AWS service is purpose-built for this?

Accepted Answer

AWS Audit Manager

Answer

AWS Audit Manager continuously collects evidence from AWS services, maps it to compliance frameworks like PCI DSS and HIPAA, and generates audit-ready reports.

Question 2

A company uses AWS Organizations and wants to prevent any member account from disabling CloudTrail. Which is the most scalable enforcement mechanism?

Accepted Answer

An SCP denying cloudtrail:StopLogging and cloudtrail:DeleteTrail across the organization

Answer

An SCP applied at the organization root or OU level preventively blocks cloudtrail:StopLogging and cloudtrail:DeleteTrail for all member accounts, regardless of IAM policies.

Question 3

Which encryption standard must AWS KMS CMKs use to comply with FIPS 140-2 Level 2, as required by many US government frameworks?

Accepted Answer

AES-256 with validated HSMs

Answer

AWS KMS uses AES-256 on FIPS 140-2 Level 2 validated hardware security modules (HSMs), meeting federal cryptographic standards.

Question 4

A retail company processing credit cards must segment its CDE from other systems per PCI DSS Requirement 1. Which AWS networking approach provides the strongest isolation?

Accepted Answer

Placing CDE resources in a dedicated AWS account with its own VPC and no VPC peering to non-CDE

Answer

A dedicated AWS account with its own VPC provides account-level blast-radius containment and prevents any inadvertent network paths from non-CDE environments.

Question 5

GDPR Article 17 grants users the 'right to erasure.' Which S3 capability most directly supports complying with this requirement?

Accepted Answer

S3 batch operations to delete specific objects on demand

Answer

S3 Batch Operations can target and permanently delete specific objects (e.g., a user's data) across large buckets, enabling compliance with GDPR right-to-erasure requests.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Codes & Standards Compliance 4