Architecting on AWS Certification Quality Control & Inspection 2 — Questions and Answers
Question 1: A security team wants to automatically assess EC2 instances for known software vulnerabilities and unintended network exposure. Which AWS service is purpose-built for this?
- AWS Config
- Amazon Inspector (Correct answer)
- AWS Security Hub
- Amazon GuardDuty
Correct answer: Amazon Inspector
Amazon Inspector automatically scans EC2 instances and container images for software vulnerabilities and unintended network exposure.
Question 2: Which AWS service aggregates security findings from multiple AWS security services and partner tools into a single dashboard?
- Amazon Detective
- AWS Trusted Advisor
- AWS Security Hub (Correct answer)
- AWS Audit Manager
Correct answer: AWS Security Hub
AWS Security Hub aggregates, organizes, and prioritizes security findings from services like GuardDuty, Inspector, and Macie.
Question 3: An architect must ensure S3 buckets never become publicly accessible across all accounts in an AWS Organization. Which control enforces this preventatively?
- AWS Config rule with auto-remediation
- S3 Block Public Access at the organization level (Correct answer)
- AWS CloudTrail with SNS alerts
- Amazon Macie policy findings
Correct answer: S3 Block Public Access at the organization level
Enabling S3 Block Public Access settings at the AWS Organizations level preventatively stops any account from making buckets public.
Question 4: AWS Audit Manager is BEST suited for which use case?
- Detecting active threats in real time
- Continuously collecting evidence to simplify compliance audits (Correct answer)
- Patching EC2 instances based on compliance baselines
- Scanning container images for CVEs
Correct answer: Continuously collecting evidence to simplify compliance audits
AWS Audit Manager continuously collects audit-ready evidence mapped to compliance frameworks like PCI DSS and HIPAA.
Question 5: A company needs to detect when an IAM policy is attached to a user directly (violating least-privilege policy). Which tool detects this configuration drift?
- AWS Trusted Advisor
- Amazon GuardDuty
- AWS Config with a managed rule (Correct answer)
- AWS Systems Manager Compliance
Correct answer: AWS Config with a managed rule
The AWS Config managed rule `iam-user-no-policies-check` flags any IAM user with policies attached directly rather than via groups.
Question 6: Which AWS Well-Architected Tool feature allows teams to compare their workload against AWS best practices across five pillars?
- Trusted Advisor checks
- Well-Architected Review milestones (Correct answer)
- Security Hub standards
- Config conformance packs
Correct answer: Well-Architected Review milestones
The Well-Architected Tool guides teams through a questionnaire and records milestone snapshots showing improvement over time across all five pillars.
Question 7: Amazon Macie is PRIMARILY used to inspect which type of resource for sensitive data?
- EC2 instance memory
- Amazon S3 buckets (Correct answer)
- RDS database tables
- DynamoDB items
Correct answer: Amazon S3 buckets
Amazon Macie uses machine learning to automatically discover and classify sensitive data stored in Amazon S3.
Architecting on AWS Certification Quality Control & Inspection 2
A security team wants to automatically assess EC2 instances for known software vulnerabilities and unintended network exposure.
Which AWS service is purpose-built for this?