Architecting on AWS Certification Quality Control & Inspection 4

Question 1

Which AWS Config aggregator feature allows a security team to view compliance data from all accounts in an AWS Organization from a single account?

Accepted Answer

Organization-level Config aggregator

Answer

An AWS Config aggregator collects configuration and compliance data from multiple accounts and regions into a single delegated administrator account.

Question 2

A company must prove to auditors that no IAM root account API calls occurred in the past 90 days. Which approach provides this evidence MOST efficiently?

Accepted Answer

Query CloudTrail Lake with SQL for root user events

Answer

CloudTrail Lake allows SQL-based queries over event history, making it straightforward to filter for `userIdentity.type = Root` within a date range.

Question 3

AWS Config's `restricted-ssh` managed rule evaluates which resource type?

Accepted Answer

EC2 security groups permitting unrestricted inbound SSH

Answer

The `restricted-ssh` rule flags EC2 security groups that allow inbound traffic from 0.0.0.0/0 or ::/0 on port 22.

Question 4

A company runs containers on Amazon ECS and needs vulnerability scanning for container images at the time of push. Which service integration provides this?

Accepted Answer

Amazon Inspector integrated with Amazon ECR

Answer

Amazon Inspector integrates with Amazon ECR to automatically scan container images for software vulnerabilities when they are pushed to a repository.

Question 5

Which metric does the AWS Well-Architected Tool produce after completing a workload review?

Accepted Answer

A count of high-risk issues (HRIs) per pillar

Answer

The Well-Architected Tool surfaces High Risk Issues (HRIs) and Medium Risk Issues (MRIs) per pillar, guiding remediation priority.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Quality Control & Inspection 4