Architecting on AWS Certification Quality Control & Inspection 5

Question 1

A company wants to enforce a maximum 90-day rotation policy for all IAM access keys organization-wide. Which combination BEST achieves continuous enforcement?

Accepted Answer

AWS Config rule `access-keys-rotated` triggering an SNS alert to the security team

Answer

The `access-keys-rotated` Config managed rule checks key age and can trigger SNS notifications to alert the security team when keys exceed 90 days.

Question 2

Which AWS service can automatically remediate a non-compliant resource by invoking an AWS Systems Manager Automation document?

Accepted Answer

AWS Config automatic remediation

Answer

AWS Config supports automatic remediation by associating a Config rule violation with an SSM Automation document that corrects the resource.

Question 3

A team uses AWS CodePipeline and wants to block deployments if the container image has critical CVEs. Which integration achieves this quality gate?

Accepted Answer

Amazon Inspector scan results gating CodePipeline via Lambda

Answer

A Lambda function can query Amazon Inspector findings for the image and return a failure status to CodePipeline if critical CVEs are present, acting as a deployment gate.

Question 4

Which AWS service uses machine learning to establish a baseline of normal API call behavior and alerts on anomalous patterns like unusual data access volume?

Accepted Answer

Amazon GuardDuty

Answer

Amazon GuardDuty uses ML on CloudTrail, VPC Flow Logs, and DNS logs to detect anomalous behavior such as unusual API calls or data exfiltration patterns.

Question 5

A customer needs to demonstrate SOC 2 compliance to an auditor. Which AWS service maps AWS controls to SOC 2 requirements and continuously collects evidence?

Accepted Answer

AWS Audit Manager with the SOC 2 framework

Answer

AWS Audit Manager provides a prebuilt SOC 2 framework that maps AWS controls to SOC 2 criteria and automatically collects evidence for auditors.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Quality Control & Inspection 5