Architecting on AWS Certification Quality Control & Inspection 3

Question 1

An organization wants to enforce that all new AWS resources are tagged with a 'CostCenter' tag before they can be created. Which mechanism achieves this preventatively?

Accepted Answer

Service Control Policy (SCP) with a tag condition

Answer

An SCP with an aws:RequestTag condition key denies resource creation if the required tag is absent, preventing non-compliant resources from ever existing.

Question 2

A developer accidentally deletes a CloudTrail trail. Which service can detect this and automatically recreate it?

Accepted Answer

AWS Config with auto-remediation using SSM Automation

Answer

An AWS Config rule can detect that a CloudTrail trail is missing and trigger an SSM Automation document to recreate it automatically.

Question 3

Which AWS CloudTrail feature ensures that log files have not been tampered with after delivery to S3?

Accepted Answer

Log file integrity validation

Answer

CloudTrail log file integrity validation creates a digitally signed digest file every hour so you can verify logs were not altered or deleted.

Question 4

AWS Trusted Advisor's 'Security' category flags which of the following issues? (Choose the BEST match)

Accepted Answer

S3 buckets with public read or write access enabled

Answer

Trusted Advisor's Security checks include identifying S3 buckets with public access, exposed access keys, and overly permissive security groups.

Question 5

A conformance pack in AWS Config is BEST described as:

Accepted Answer

A set of AWS Config rules bundled with remediation actions as a deployable template

Answer

A conformance pack is a YAML template that groups multiple Config rules and optional remediation actions for deployment across an organization.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Quality Control & Inspection 3