AWS Solutions Architect Security & Compliance 2 — Questions and Answers
Question 1: A company needs to enforce that all S3 objects are encrypted at rest using customer-managed keys. Which S3 bucket policy condition key enforces SSE-KMS encryption on uploads?
- s3:x-amz-server-side-encryption-aws-kms-key-id
- s3:x-amz-server-side-encryption (Correct answer)
- s3:x-amz-acl
- s3:x-amz-storage-class
Correct answer: s3:x-amz-server-side-encryption
The condition key `s3:x-amz-server-side-encryption` with value `aws:kms` enforces that objects must be uploaded using SSE-KMS encryption.
Question 2: Which AWS service provides a managed, hardware-based key storage that meets FIPS 140-2 Level 3 compliance requirements?
- AWS KMS
- AWS CloudHSM (Correct answer)
- AWS Secrets Manager
- AWS Certificate Manager
Correct answer: AWS CloudHSM
AWS CloudHSM provides dedicated hardware security modules that meet FIPS 140-2 Level 3 compliance, unlike KMS which is Level 2.
Question 3: A solutions architect needs to ensure EC2 instances in a private subnet can retrieve secrets without traversing the internet. What is the most secure approach?
- Store secrets in environment variables
- Use a NAT Gateway to access Secrets Manager
- Create a VPC endpoint for Secrets Manager (Correct answer)
- Embed credentials in the AMI
Correct answer: Create a VPC endpoint for Secrets Manager
A VPC interface endpoint for Secrets Manager allows private subnet instances to access secrets without internet exposure via NAT.
Question 4: Which IAM policy element explicitly overrides all Allow statements and denies access regardless of other policies?
- NotAction
- Condition
- Explicit Deny (Correct answer)
- Principal
Correct answer: Explicit Deny
An explicit Deny in any policy always overrides any Allow, following the IAM evaluation logic of default deny → explicit allow → explicit deny.
Question 5: An organization wants to detect when AWS root account credentials are used. Which combination of services provides near-real-time alerting?
- AWS Config + SNS
- CloudTrail + CloudWatch Alarms + SNS (Correct answer)
- AWS Trusted Advisor + SES
- AWS Shield + GuardDuty
Correct answer: CloudTrail + CloudWatch Alarms + SNS
CloudTrail logs root account usage, CloudWatch Alarms filter for root login events, and SNS delivers the alert in near-real time.
Question 6: What is the purpose of an AWS Organizations Service Control Policy (SCP)?
- Grant permissions to IAM users in member accounts
- Define maximum available permissions for accounts in an OU (Correct answer)
- Enforce MFA on root accounts across all member accounts
- Automatically rotate IAM access keys
Correct answer: Define maximum available permissions for accounts in an OU
SCPs set guardrails by defining the maximum permissions that accounts in an OU or organization can have, without granting permissions themselves.
Question 7: A web application on EC2 must restrict traffic to only HTTPS. Which resource controls inbound traffic at the instance level and supports stateful filtering?
- Network ACL
- Security Group (Correct answer)
- AWS WAF
- Route 53 Resolver DNS Firewall
Correct answer: Security Group
Security groups are stateful firewalls attached at the instance level and can restrict inbound traffic to port 443 (HTTPS) only.
AWS Solutions Architect Security & Compliance 2
A company needs to enforce that all S3 objects are encrypted at rest using customer-managed keys.
Which S3 bucket policy condition key enforces SSE-KMS encryption on uploads?