AWS Solutions Architect Security & Compliance 3 — Questions and Answers
Question 1: A company needs to audit all API calls made to their AWS account over the past 90 days. Which service stores this data by default?
- AWS Config
- Amazon CloudWatch Logs
- AWS CloudTrail (Correct answer)
- AWS X-Ray
Correct answer: AWS CloudTrail
AWS CloudTrail records API activity and retains event history for 90 days by default in the console; longer retention requires an S3-backed trail.
Question 2: Which Amazon Macie capability helps protect sensitive data stored in Amazon S3?
- Detecting misconfigured S3 bucket policies
- Automatically encrypting S3 objects with KMS
- Using ML to discover and classify sensitive data like PII in S3 (Correct answer)
- Blocking public S3 bucket access at the account level
Correct answer: Using ML to discover and classify sensitive data like PII in S3
Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data such as PII stored in S3 buckets.
Question 3: A solutions architect must ensure cross-account access to an S3 bucket is limited to a specific external AWS account. Which approach is correct?
- Attach an IAM role to the S3 bucket
- Use S3 Access Control Lists to specify the external account ID
- Add a bucket policy with the external account ARN as the Principal (Correct answer)
- Enable S3 Block Public Access and add the account to the allowlist
Correct answer: Add a bucket policy with the external account ARN as the Principal
A bucket policy with the external account's ARN in the Principal element is the recommended way to grant cross-account access to an S3 bucket.
Question 4: Which AWS service provides managed DDoS protection and is automatically included at no cost for all AWS customers?
- AWS WAF
- AWS Shield Standard (Correct answer)
- AWS Shield Advanced
- Amazon GuardDuty
Correct answer: AWS Shield Standard
AWS Shield Standard is automatically applied to all AWS customers at no extra cost and provides protection against common Layer 3 and Layer 4 DDoS attacks.
Question 5: A developer accidentally pushed AWS access keys to a public GitHub repository. What should a solutions architect do FIRST?
- Rotate the keys using IAM
- Delete the IAM user
- Immediately deactivate or delete the exposed access keys (Correct answer)
- Enable MFA on the root account
Correct answer: Immediately deactivate or delete the exposed access keys
Immediately deactivating or deleting the exposed access keys stops any potential misuse before attackers can use them.
Question 6: Which AWS feature allows you to evaluate whether your AWS resource configurations comply with organizational policies on an ongoing basis?
- AWS Trusted Advisor
- AWS Config Rules (Correct answer)
- AWS Security Hub
- AWS Inspector
Correct answer: AWS Config Rules
AWS Config Rules continuously evaluate resource configurations against desired settings and flag non-compliant resources automatically.
Question 7: An application uses an IAM role attached to an EC2 instance to access DynamoDB. What is retrieved from the instance metadata to authenticate API calls?
- A long-term IAM access key and secret
- Temporary security credentials issued by AWS STS (Correct answer)
- An OAuth2 token from Cognito
- An API Gateway API key
Correct answer: Temporary security credentials issued by AWS STS
EC2 instance roles use AWS STS to issue temporary credentials (access key, secret key, session token) available via the instance metadata service.
AWS Solutions Architect Security & Compliance 3
A company needs to audit all API calls made to their AWS account over the past 90 days.
Which service stores this data by default?