AWS Solutions Architect Security & Compliance 2

Question 1

A company needs to enforce that all S3 objects are encrypted at rest using customer-managed keys. Which S3 bucket policy condition key enforces SSE-KMS encryption on uploads?

Accepted Answer

s3:x-amz-server-side-encryption

Answer

The condition key `s3:x-amz-server-side-encryption` with value `aws:kms` enforces that objects must be uploaded using SSE-KMS encryption.

Question 2

Which AWS service provides a managed, hardware-based key storage that meets FIPS 140-2 Level 3 compliance requirements?

Accepted Answer

AWS CloudHSM

Answer

AWS CloudHSM provides dedicated hardware security modules that meet FIPS 140-2 Level 3 compliance, unlike KMS which is Level 2.

Question 3

A solutions architect needs to ensure EC2 instances in a private subnet can retrieve secrets without traversing the internet. What is the most secure approach?

Accepted Answer

Create a VPC endpoint for Secrets Manager

Answer

A VPC interface endpoint for Secrets Manager allows private subnet instances to access secrets without internet exposure via NAT.

Question 4

Which IAM policy element explicitly overrides all Allow statements and denies access regardless of other policies?

Accepted Answer

Explicit Deny

Answer

An explicit Deny in any policy always overrides any Allow, following the IAM evaluation logic of default deny → explicit allow → explicit deny.

Question 5

An organization wants to detect when AWS root account credentials are used. Which combination of services provides near-real-time alerting?

Accepted Answer

CloudTrail + CloudWatch Alarms + SNS

Answer

CloudTrail logs root account usage, CloudWatch Alarms filter for root login events, and SNS delivers the alert in near-real time.

AWS Practice Test

AWS Practice Test

AWS Solutions Architect Security & Compliance 2