Architecting on AWS Certification Quality Control & Inspection 2

Question 1

A security team wants to automatically assess EC2 instances for known software vulnerabilities and unintended network exposure. Which AWS service is purpose-built for this?

Accepted Answer

Amazon Inspector

Answer

Amazon Inspector automatically scans EC2 instances and container images for software vulnerabilities and unintended network exposure.

Question 2

Which AWS service aggregates security findings from multiple AWS security services and partner tools into a single dashboard?

Accepted Answer

AWS Security Hub

Answer

AWS Security Hub aggregates, organizes, and prioritizes security findings from services like GuardDuty, Inspector, and Macie.

Question 3

An architect must ensure S3 buckets never become publicly accessible across all accounts in an AWS Organization. Which control enforces this preventatively?

Accepted Answer

S3 Block Public Access at the organization level

Answer

Enabling S3 Block Public Access settings at the AWS Organizations level preventatively stops any account from making buckets public.

Question 4

AWS Audit Manager is BEST suited for which use case?

Accepted Answer

Continuously collecting evidence to simplify compliance audits

Answer

AWS Audit Manager continuously collects audit-ready evidence mapped to compliance frameworks like PCI DSS and HIPAA.

Question 5

A company needs to detect when an IAM policy is attached to a user directly (violating least-privilege policy). Which tool detects this configuration drift?

Accepted Answer

AWS Config with a managed rule

Answer

The AWS Config managed rule `iam-user-no-policies-check` flags any IAM user with policies attached directly rather than via groups.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Quality Control & Inspection 2