Architecting on AWS Certification Safety Practices & PPE 2

Question 1

Which AWS service provides automated security assessments to identify vulnerabilities and deviations from best practices in EC2 instances and applications?

Accepted Answer

Amazon Inspector

Answer

Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices.

Question 2

A company wants to ensure that no S3 bucket is ever made publicly accessible. Which AWS mechanism enforces this across an entire AWS account?

Accepted Answer

S3 Block Public Access account-level settings

Answer

S3 Block Public Access at the account level overrides any bucket-level or object-level ACL settings that would otherwise allow public access.

Question 3

Which AWS feature allows you to define guardrails that prevent member accounts in an AWS Organization from performing unsafe or non-compliant actions?

Accepted Answer

AWS Service Control Policies (SCPs)

Answer

Service Control Policies (SCPs) act as guardrails that restrict what actions can be performed in member accounts, regardless of their IAM policies.

Question 4

An architect needs to protect sensitive data in an RDS database so that even if the storage media is stolen, the data remains unreadable. Which approach should be used?

Accepted Answer

Enable RDS encryption at rest using AWS KMS

Answer

RDS encryption at rest using AWS KMS encrypts the underlying storage so data is unreadable without the decryption key.

Question 5

Which AWS Well-Architected Framework pillar specifically addresses the ability to protect information, systems, and assets while delivering business value?

Accepted Answer

Security

Answer

The Security pillar of the AWS Well-Architected Framework covers protecting information, systems, and assets through risk assessments and mitigation strategies.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Safety Practices & PPE 2