Security Foundations and Governance

A security auditor requires a centralized view of security findings across all AWS accounts in an organization. Which service should be enabled to aggregate and prioritize these findings?

An organization wants to enforce encryption at rest for all S3 buckets using AWS Organizations. Which TWO actions should the security team perform to ensure consistent governance?

Refer to the exhibit. An administrator applied this policy to a bucket, but users are still able to upload unencrypted objects. Why is this occurring?

Which AWS service is best suited for providing a comprehensive, searchable audit trail of every API call made in an AWS account?

A company requires that all cloud resources be tagged with a 'Department' code for cost allocation and security reporting. How should they enforce this?

Which AWS IAM best practice ensures that users have only the permissions necessary to perform their specific business roles?

Refer to the exhibit. Why might a user in the 192.168.1.0/24 range still be denied access to the S3 bucket?

Which service should be used to securely store and automatically rotate database credentials?

A security engineer must ensure that no developer in a specific AWS Organizations member account can delete Amazon S3 buckets, even if they have AdministratorAccess. Which governance mechanism provides the most efficient and centralized way to enforce this restriction across the organizational unit?

A company is preparing for an annual regulatory audit and needs to collect evidence of their compliance with the SOC 2 framework across multiple AWS accounts. Which TWO AWS services or features should the security team use to automate the collection of evidence and download official compliance reports?

A company wants to implement a governance strategy that prevents any member account in the organization from disabling CloudTrail or deleting the organization-level trail. What is the most effective way to implement this while allowing account administrators to manage their own local resources?

According to the AWS Shared Responsibility Model, which of the following security tasks is the sole responsibility of the customer when using Amazon EC2 instances?

An organization wants to centralize the management of Amazon GuardDuty across 50 AWS accounts. They want the security team to be able to view and manage findings for all accounts from a single dashboard. What is the recommended governance approach?

A company wants to implement a robust governance framework for their AWS accounts using AWS Control Tower. They need to ensure that specific security guardrails are applied to their 'Financial-Apps' Organizational Unit (OU). Which TWO types of guardrails can be applied within Control Tower?

A security engineer needs to verify if all AWS accounts in the organization are compliant with the CIS AWS Foundations Benchmark. Which service provides a centralized compliance dashboard and the ability to run automated checks against this specific benchmark?