AWS Solutions Architect Security & Compliance 3

Question 1

A company needs to audit all API calls made to their AWS account over the past 90 days. Which service stores this data by default?

Accepted Answer

AWS CloudTrail

Answer

AWS CloudTrail records API activity and retains event history for 90 days by default in the console; longer retention requires an S3-backed trail.

Question 2

Which Amazon Macie capability helps protect sensitive data stored in Amazon S3?

Accepted Answer

Using ML to discover and classify sensitive data like PII in S3

Answer

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data such as PII stored in S3 buckets.

Question 3

A solutions architect must ensure cross-account access to an S3 bucket is limited to a specific external AWS account. Which approach is correct?

Accepted Answer

Add a bucket policy with the external account ARN as the Principal

Answer

A bucket policy with the external account's ARN in the Principal element is the recommended way to grant cross-account access to an S3 bucket.

Question 4

Which AWS service provides managed DDoS protection and is automatically included at no cost for all AWS customers?

Accepted Answer

AWS Shield Standard

Answer

AWS Shield Standard is automatically applied to all AWS customers at no extra cost and provides protection against common Layer 3 and Layer 4 DDoS attacks.

Question 5

A developer accidentally pushed AWS access keys to a public GitHub repository. What should a solutions architect do FIRST?

Accepted Answer

Immediately deactivate or delete the exposed access keys

Answer

Immediately deactivating or deleting the exposed access keys stops any potential misuse before attackers can use them.

AWS Practice Test

AWS Practice Test

AWS Solutions Architect Security & Compliance 3