Architecting on AWS Certification Codes & Standards Compliance 5

Question 1

A company must detect and classify sensitive data (PII, PHI) stored in S3 to meet GDPR data inventory requirements. Which AWS service automates this classification?

Accepted Answer

Amazon Macie

Answer

Amazon Macie uses machine learning to automatically discover and classify sensitive data such as PII and PHI in S3, supporting GDPR data inventory and mapping obligations.

Question 2

Which AWS Organizations feature can enforce that all new accounts in the organization automatically have AWS Config enabled, supporting ongoing compliance posture?

Accepted Answer

CloudFormation StackSets deployed via AWS Organizations

Answer

CloudFormation StackSets with AWS Organizations integration can automatically deploy baseline stacks (enabling Config, CloudTrail, etc.) to new accounts as they join the organization.

Question 3

An architect is designing a solution where database encryption keys must be stored in hardware that the customer exclusively controls, not AWS, to meet strict regulatory requirements. Which service satisfies this?

Accepted Answer

AWS CloudHSM with customer-managed HSM partitions

Answer

AWS CloudHSM provides dedicated, single-tenant HSM hardware where the customer holds exclusive control of the key material, meeting regulations that prohibit multi-tenant key storage.

Question 4

Which ISO standard specifically covers cloud-specific information security controls that complement ISO 27001, and for which AWS holds certification?

Accepted Answer

ISO 27017

Answer

ISO 27017 provides cloud-specific guidance extending ISO 27001 controls for cloud service providers and customers, and AWS maintains certification for this standard.

Question 5

A company must demonstrate that its AWS environment meets the CIS AWS Foundations Benchmark. Which AWS service provides a scored compliance check against this benchmark out of the box?

Accepted Answer

AWS Security Hub with CIS AWS Foundations Benchmark standard enabled

Answer

AWS Security Hub includes the CIS AWS Foundations Benchmark as a built-in security standard, automatically running checks and producing a compliance score.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Codes & Standards Compliance 5