Architecting on AWS Certification Safety Practices & PPE 3

Question 1

Which principle should guide IAM policy design to minimize the risk of accidental or malicious misuse of AWS resources?

Accepted Answer

Principle of least privilege

Answer

The principle of least privilege means granting only the permissions required to perform a task, reducing the attack surface.

Question 2

A workload processes highly sensitive PII data. The architect wants to ensure data in transit between services is always encrypted. Which approach satisfies this for an HTTPS API endpoint?

Accepted Answer

Deploy behind an Application Load Balancer with an SSL/TLS certificate

Answer

An ALB with an SSL/TLS certificate terminates HTTPS connections, ensuring all data in transit to the endpoint is encrypted.

Question 3

Which AWS service provides a centralized view of security alerts and compliance status across multiple AWS accounts and services?

Accepted Answer

AWS Security Hub

Answer

AWS Security Hub aggregates, organizes, and prioritizes security findings from multiple AWS services into a single dashboard.

Question 4

An organization wants to detect and classify sensitive data (such as PII or financial data) stored across thousands of S3 buckets. Which AWS service automates this?

Accepted Answer

Amazon Macie

Answer

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data stored in Amazon S3.

Question 5

A company must ensure that all API calls to AWS services are logged for compliance and forensic analysis. Which service provides this audit trail?

Accepted Answer

AWS CloudTrail

Answer

AWS CloudTrail records all API calls made in an AWS account, providing an audit trail of who did what and when.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Safety Practices & PPE 3