DevOps Engineering on AWS Certification Security Automation and Compliance on AWS 2

Question 1

Which AWS Config resource type is used to create custom compliance rules using Lambda functions?

Accepted Answer

AWS::Config::ConfigRule with type CUSTOM_LAMBDA

Answer

Custom Lambda config rules (type CUSTOM_LAMBDA) invoke a Lambda function to evaluate resource configurations against custom compliance logic.

Question 2

Which AWS KMS key type allows key material to be imported by the customer?

Accepted Answer

Customer managed key with imported key material

Answer

Customer managed keys with imported key material allow you to supply your own key material to AWS KMS, giving you full control over the cryptographic material.

Question 3

What AWS service discovers, classifies, and protects sensitive data such as PII stored in Amazon S3?

Accepted Answer

Amazon Macie

Answer

Amazon Macie uses machine learning to automatically discover and classify sensitive data like PII in S3 and alerts on data security risks.

Question 4

Which AWS service provides automated remediation of non-compliant AWS Config rules?

Accepted Answer

Both AWS Config Remediation Actions using SSM Automation

Answer

AWS Config supports automatic remediation by triggering SSM Automation documents to fix non-compliant resources without manual intervention.

Question 5

What is the purpose of a VPC endpoint policy?

Accepted Answer

To restrict which AWS service APIs can be accessed through the VPC endpoint

Answer

A VPC endpoint policy controls which AWS principals can access which AWS service resources through the VPC endpoint.

DevOps Engineering on AWS Certification Practice Test

DevOps Engineering on AWS Certification Practice Test

DevOps Engineering on AWS Certification Security Automation and Compliance on AWS 2