Security and Compliance practice questions

Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)

Why wrong: SSE-S3 is Amazon S3's native server-side encryption, but it relies on S3-managed keys that AWS creates, stores, and rotates on the customer's behalf. The data is encrypted with a unique object key, which is itself wrapped by a root key that AWS maintains in its infrastructure. Because the cloud provider holds and operates those keys, this does not satisfy the requirement that keys must never be stored by the cloud provider. Therefore, SSE-S3 is not compliant for this financial services policy.

Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS)

Why wrong: Incorrect. While SSE-KMS allows you to use a customer managed key, the key is still stored and managed by AWS KMS (a cloud service). The key material resides in AWS, which does not satisfy the requirement that keys must never be stored by the cloud provider.

Client-Side Encryption using an on-premises key management system

Why wrong: Incorrect. Client-side encryption encrypts data before it is sent to S3, which satisfies the key management requirement, but the question asks for an encryption option for Amazon S3. Client-side encryption is not an S3 server-side feature and would require additional application changes. Among the server-side options, only SSE-C ensures keys are not stored by AWS.

aws:RequestedRegion condition key

Why wrong: aws:RequestedRegion is an IAM condition key that matches the AWS region of the service endpoint being called (e.g., us-west-2). It is useful for limiting actions to specific regions in an account, but it is based on the destination region, not the requester's source IP. Therefore, it cannot enforce that SSH connections come from a specified IP range.

aws:PrincipalOrgID condition key

Why wrong: The aws:PrincipalOrgID condition key checks the ID of the AWS Organizations that the principal (the IAM user or role) belongs to, not the network origin of the request. Using it would only confirm that the request comes from an identity inside your organization, but it cannot evaluate the IP address of the SSH client. So it is not applicable to restricting source IPs.

aws:MultiFactorAuthPresent condition key

Why wrong: aws:MultiFactorAuthPresent is a boolean condition key that indicates whether the principal's credentials were authenticated with an MFA device. It is used to enforce extra login assurance, for example requiring MFA for IAM actions in the console or CLI. It says nothing about the IP address from which the request originates, making it irrelevant to an IP-based security policy for SSH.

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Why wrong: SSE-S3 encrypts your objects using 256-bit Advanced Encryption Standard (AES-256), but the encryption keys are generated, managed, and stored entirely within AWS. Under SSE-S3, AWS holds the plaintext master keys and automatically rotates them on your behalf, meaning AWS necessarily has access to the plaintext keying material. This directly violates the compliance requirement that the company generates and stores the keys and that AWS never has access to the plaintext key. Therefore, SSE-S3 cannot be used for these sensitive financial records.

Server-Side Encryption with AWS Key Management Service (SSE-KMS) using a customer managed key

Why wrong: Even with a customer managed key, the key is stored and managed within AWS KMS. The compliance policy states that AWS must never have access to the plaintext encryption key, which is not the case with KMS.

Server-Side Encryption with Customer-Provided Keys (SSE-C)

Why wrong: SSE-C allows you to provide your own encryption key with each request to S3. S3 uses the key to encrypt data but does not store the key. This meets the requirement that the company manages the key on-premises and AWS never has access to the plaintext key.

Create an AWS IAM policy with a Deny effect for ec2:RunInstances where the instance type starts with 'g' or 'p' and attach it to a specific IAM role in each account.

Why wrong: This approach is not centralized and requires manual IAM policy configuration in every account. It can also be bypassed if users assume roles that do not have the policy attached. SCPs provide a single, enforceable boundary across all accounts.

Use an AWS Config managed rule to detect GPU instance launches and trigger an auto-remediation action that terminates the instances.

Why wrong: AWS Config is a detective control and can only react after the instance is already launched. Auto-remediation can terminate it, but this may incur costs for the brief period the instance runs and wastes resources. The requirement is for a proactive, preventive policy.

Use AWS Trusted Advisor cost optimization checks to identify GPU instances and then manually disable them in each account.

Why wrong: AWS Trusted Advisor is a read-only advisory service that analyzes your AWS environment and offers best-practice recommendations, including cost optimization checks for unused or underutilized resources. However, it cannot enforce policies, block API calls, or prevent resource creation—it can only identify GPU instances after they already exist and suggest manual actions. In this scenario, relying on Trusted Advisor would leave you implementing a manual, account-by-account cleanup process, which fails to meet the requirement for a centralized, preventive guardrail.

Store the database password in AWS Systems Manager Parameter Store as a SecureString and retrieve it from within the Lambda function.

Why wrong: Parameter Store SecureString can store encrypted credentials, but Secrets Manager is the AWS best practice for database credential storage and rotation.

Configure the Lambda function to use an IAM role with permissions to connect to the RDS database using IAM database authentication.

Why wrong: IAM database authentication uses temporary tokens and is valid in some cases, but it is not the primary AWS best practice for managing database credentials for this scenario; it also requires RDS IAM authentication to be enabled and supported.

Encrypt the database password using AWS KMS and hardcode the encrypted password in the Lambda function code.

Why wrong: Incorrect: Encrypting and hardcoding the password still stores it in the function code, violating the requirement.

IAM permission boundaries

Why wrong: IAM permission boundaries set the maximum permissions for an IAM user or role within a single account. They do not provide central control across multiple accounts and do not block actions by default; they only limit the permissions that can be granted to a specific entity.

AWS Identity and Access Management (IAM) roles with a trust policy

Why wrong: IAM roles with trust policies allow cross-account access by granting permissions to users from other accounts. They do not restrict or deny actions across accounts, and they are not a preventive control for blocking API actions.

AWS Config conformance packs

Why wrong: AWS Config conformance packs are collections of AWS Config rules that evaluate whether your resources comply with specific policies. They are detective and can trigger auto-remediation, but they are not preventive controls that block actions before they occur.

S3 Block Public Access

Why wrong: S3 Block Public Access (BPA) offers four settings that prevent public exposure through ACLs or bucket policies, but it does not restrict requests by network origin. Even with BPA fully enabled, any IAM principal with valid credentials can access the bucket from outside the VPC if the policy grants permission. Since the threat is credential misuse from anywhere, BPA cannot stop exfiltration from a compromised user or role.

S3 CORS configuration

Why wrong: S3 CORS configuration consists of XML rules that define which cross-origin domains may make HTTP requests from a browser and what methods/headers they can use. It works by returning Access-Control-Allow-Origin headers in responses, but it is not a security boundary for direct API calls. An attacker with compromised AWS credentials can use the AWS CLI or SDK to access S3 from any IP address, completely bypassing CORS because CORS only applies to browser-enforced cross-origin scenarios. Therefore CORS cannot restrict traffic based on network origin or IP range.

Amazon Macie sensitive data classification

Why wrong: Amazon Macie uses pattern matching and machine learning to automatically discover, classify, and inventory sensitive data such as PII or credentials within S3 buckets. Its purpose is to provide visibility and alerts, and it can send findings or possibly trigger remediation workflows, but it does not perform access enforcement. Macie does not inspect the network source or origin of a request and will not deny access to an object based on where the request comes from. This makes it useful for detecting data leaks, not for preventing exfiltration via compromised credentials.

Amazon GuardDuty

Why wrong: Amazon GuardDuty is a continuous threat detection service that analyzes AWS CloudTrail event logs, VPC Flow Logs, and DNS logs to identify malicious activity or unauthorized behavior. It provides findings and alerts about active threats like crypto mining, aberrant API calls, or compromised instances, but it does not generate a security score or proactively review IAM password policies, access key rotation, or root MFA configuration. Because the requirement is about credential configuration review and security scoring, not threat detection, GuardDuty is wrong.

Amazon Inspector

Why wrong: Amazon Inspector is a vulnerability management service that scans EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and unintended network exposure. It produces a risk score for specific runtime findings, but it does not provide an account-level security score or review root MFA, IAM password policy, or access key rotation. Therefore, it does not fulfill the question's requirement, making it incorrect.

Amazon Macie

Why wrong: Amazon Macie is a data security service that uses machine learning and pattern matching to discover and protect sensitive data stored in Amazon S3. It alerts on things like PII, credentials, or financial data, but it does not perform account-level security posture assessments, root account MFA checks, IAM password policies, or access key rotation reviews. The question asks for a service that reviews IAM credential configuration and provides security scores, which is not Macie's function. Therefore, Macie is incorrect.

Granting least privilege permissions

Why wrong: Least privilege is an authorization control that restricts an IAM policy to only the permissions required for a task, so a compromised account can only damage or access a limited set of resources. It does not verify whether the person presenting the credentials is the legitimate owner, so stolen credentials will still pass authentication and be fully accepted; the policy only limits what those sessions can do afterward. Granting minimal permissions reduces blast radius, but MFA is the control that actually prevents the attacker from gaining an authenticated session in the first place.

Enabling Multi-Factor Authentication (MFA)

Why wrong: MFA is a direct authentication control that demands a second factor—such as a time-based one-time password, hardware token, or push notification—in addition to the user's long-term password or access key. Even if an attacker exfiltrates those credentials, every console sign-in or API request is blocked unless the attacker also possesses the MFA device, because the session is not established without a valid MFA factor. Enabling MFA therefore turns stolen credentials into useless data, which is exactly why it is the strongest immediate defense here.

Rotating access keys quarterly

Why wrong: Quarterly rotation of access keys is a credential hygiene practice that shortens the lifespan of any leaked key, but it does nothing to stop an attacker who is already using the current key. Before the next rotation date, the stolen secret remains fully valid and can be used to sign authenticated API calls, so the attack window is merely reduced, not eliminated. Rotating keys is useful for compliance and defense-in-depth, but it is not an authentication check like MFA and cannot actively deny access at the moment of compromise.

AWS Config

Why wrong: AWS Config is a service that evaluates your AWS resource configurations against desired policies. It does not provide access to AWS compliance reports; it helps you audit your own resource configurations.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor provides recommendations to help you follow AWS best practices in areas such as cost optimization, performance, security, and fault tolerance. It does not provide compliance reports.

AWS Security Hub

Why wrong: AWS Security Hub aggregates security findings from multiple AWS services and third-party tools, enabling you to automate security checks. It does not provide direct access to AWS compliance reports.

AWS CloudTrail

Why wrong: AWS CloudTrail is an auditing service that records API activity in an AWS account, such as AuthorizeSecurityGroupIngress or RevokeSecurityGroupIngress calls, along with the identity, time, and source IP of the requester. It can answer questions like 'who changed a security group' or 'when was it changed,' but it does not maintain or evaluate the current state of security group rules. To detect existing security groups with unrestricted SSH, you need a service that continuously captures configuration snapshots and assesses them against policies, which CloudTrail does not do. CloudTrail's value is forensic and operational auditing, not proactive configuration compliance.

Amazon GuardDuty

Why wrong: Amazon GuardDuty is purpose-built for intelligent threat detection, not configuration compliance. It analyzes telemetry such as VPC Flow Logs, DNS query logs, and CloudTrail management events using machine learning and threat intelligence to identify malicious activity like brute-force attempts, cryptocurrency mining, or compromised credentials. GuardDuty might detect an actual SSH brute force pattern in network traffic, but it will not examine the static definition of a security group rule to determine whether port 22 is open to 0.0.0.0/0. Because the requirement is to identify unrestricted SSH access in the security group configuration itself, GuardDuty is the wrong tool for this compliance-style assessment.

AWS Security Hub

Why wrong: AWS Security Hub provides a comprehensive view of security alerts and compliance status from multiple AWS services, but it does not directly perform configuration evaluations; it relies on services like AWS Config for that data.

Add a condition to the KMS key policy that uses the 'kms:RequestTag/ConditionKey' to require the tag on the caller.

Why wrong: Incorrect. KMS key policies use condition keys such as 'kms:EncryptionContext' or 'kms:ViaService', but not 'kms:RequestTag/ConditionKey' for principal tags. Principal tags are checked using 'aws:PrincipalTag' in the key policy, but this is not the most straightforward approach and the key policy alone cannot enforce this if the IAM policy also grants permission. Moreover, the option uses an incorrect condition key name.

Add a condition to the IAM role's trust policy that denies the 'kms:Decrypt' action unless the role has the tag.

Why wrong: Incorrect. A role's trust policy controls which principals can assume the role, not what actions the role can perform. The trust policy cannot directly limit the decryption permissions of the role. The permissions are governed by the IAM policy attached to the role.

Add a condition to the S3 bucket policy that denies all access unless the IAM role has the required tag.

Why wrong: Incorrect. An S3 bucket policy controls access to S3 actions (like s3:GetObject), but it does not control the KMS decrypt action. Even if the bucket policy allows access, the application still needs explicit permission to use the KMS key. Additionally, S3 bucket policies can use 'aws:PrincipalTag' conditions, but that would only affect S3 API calls, not the decryption operation.

AWS Config

Why wrong: AWS Config is a managed service that assesses, audits, and evaluates the configurations of your AWS resources against recorded desired policies over time. It records configuration changes and resource compliance states as configuration items, but it does not capture the API calls that caused those changes, nor does it provide caller identity, request parameters, or temporal sequencing of activity. For satisfying an audit trail requirement, AWS Config's configuration history and rules can help with configuration compliance, but they cannot substitute for a record of who performed what action via AWS APIs.

Amazon GuardDuty

Why wrong: Amazon GuardDuty is an intelligent threat detection service that continuously monitors for malicious or unauthorized behavior by analyzing data sources such as VPC Flow Logs, DNS logs, and AWS CloudTrail event logs. It uses machine learning and threat intelligence to identify anomalies and generate findings, but it is a consumer of audit logs, not a producer of a complete audit trail. GuardDuty does not record every API call or preserve historical caller information; its purpose is to alert on suspicious activity, not to provide a durable, verifiable account of all API operations.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor is an online tool that inspects your AWS environment and provides real-time recommendations to help you follow AWS Well-Architected best practices, covering areas like cost optimization, performance, security, fault tolerance, and service limits. It performs read-only checks and offers guidance based on resource configuration and usage metrics, but it does not capture or store API call logs, user identities, or request details. Therefore, Trusted Advisor can inform operational decision-making, but it cannot serve as an audit trail of API activity.

AWS Key Management Service (AWS KMS)

Why wrong: AWS Key Management Service (AWS KMS) is a managed service for creating and controlling customer master keys (CMKs) used for envelope encryption across AWS services and applications. While KMS can encrypt data, including secret values, it does not store the secret itself; it only provides cryptographic operations such as Encrypt, Decrypt, and GenerateDataKey. KMS lacks the built-in lifecycle management to automatically rotate RDS database credentials, which requires coordinated updates to both the database and the secret store—a capability unique to AWS Secrets Manager, which uses KMS only to encrypt the secret at rest.

AWS Systems Manager Parameter Store

Why wrong: While Parameter Store can store sensitive configuration data, it lacks the native integration required to perform automatic credential rotation for Amazon RDS. It is a tempting choice because it provides secure storage for application settings and secrets; however, it functions as a hierarchical key-value store rather than an orchestration service. You would select this when you need to manage non-rotating environment variables or configuration strings without requiring automated lifecycle management.

AWS Certificate Manager (ACM)

Why wrong: AWS Certificate Manager (ACM) provisions, manages, and deploys public and private SSL/TLS certificates for use with integrated AWS services such as Application Load Balancers, CloudFront, and API Gateway. It automatically renews certificates but has no mechanism for storing arbitrary secrets like database usernames or passwords, nor does it perform credential rotation against Amazon RDS. Therefore, an application connecting to a database cannot retrieve database credentials from ACM.

AWS Config

Why wrong: Incorrect. AWS Config evaluates your AWS resource configurations against desired rules and tracks configuration changes over time. While it can be used to detect non-compliant S3 bucket policies, it does not proactively analyze policies for unintended cross-account or public access in the same way as IAM Access Analyzer. Access Analyzer is more targeted for this specific requirement.

AWS Trusted Advisor

Why wrong: Incorrect. AWS Trusted Advisor provides a check for S3 buckets with open access permissions, but it is a point-in-time check that updates periodically, not a continuous, findings-based service. It also does not analyze access from specific external AWS accounts. IAM Access Analyzer offers more granular and continuous detection.

Amazon Macie

Why wrong: Incorrect. Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data within S3 buckets, such as personally identifiable information (PII). It does not analyze resource policies for unintended access permissions. The requirement is about policy analysis, not content inspection.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor is a best-practice recommendation engine that reports on cost optimization, performance, fault tolerance, security, and service limits, but it only runs AWS-provided checks and cannot be customized to evaluate resources against your own compliance policies. For example, you cannot create a Trusted Advisor check that requires specific tags or a particular security group association, so it cannot enforce a company-specific policy. It provides generic recommendations, not continuous compliance auditing or custom rule evaluation.

Amazon GuardDuty

Why wrong: Amazon GuardDuty is a threat detection service that uses machine learning to identify suspicious activity, such as unusual API calls or compromised credentials. It does not evaluate resource configurations for compliance with tagging or security group rules.

Amazon Inspector

Why wrong: Amazon Inspector is a vulnerability management service that performs network reachability and agent-based scans to identify software vulnerabilities (CVEs) and unintended network exposure on EC2 instances. It does not examine configuration metadata such as tags or the presence/association of security groups, and its checks are not designed to validate that resources meet your compliance requirements. Therefore, Inspector cannot detect whether an EC2 instance is missing a mandatory tag or is attached to an unapproved security group.

AWS Shield Standard

Why wrong: AWS Shield Standard provides always-on protection against common DDoS attacks at the network and transport layer, but it does not inspect application-layer content like SQL injection payloads. It cannot block or filter specific HTTP requests.

Network ACLs

Why wrong: Network ACLs are stateless, subnet-level filters that allow or deny traffic based solely on L3/L4 attributes such as source/destination IP, port, and protocol. They cannot inspect the payload of an HTTP request, so SQL injection strings embedded in a URI or body would pass through unnoticed. Additionally, because they are stateless, they require separate inbound and outbound rules and provide no session awareness, making them unsuitable for blocking application-layer attacks. To detect and block SQL injection or XSS, you need a web application firewall like AWS WAF that analyzes request content.

Amazon GuardDuty

Why wrong: Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning and threat intelligence. It can detect SQL injection attempts in logs, but it does not actively block the requests; it only generates alerts.

IAM policies

Why wrong: IAM policies define permissions for users and roles within a single account. However, an account administrator with full permissions can modify or bypass IAM policies. Since the requirement is for central enforcement across accounts regardless of individual permissions, IAM policies alone are insufficient.

AWS Config rules

Why wrong: AWS Config rules are detective controls that evaluate the recorded configuration of AWS resources against desired policies and can trigger remediation actions like SSM automation or Lambda functions. However, they operate asynchronously after a resource change or at a set frequency, so they cannot block the initial API call that disables CloudTrail. The rule can flag the non-compliant state and even attempt to re-enable the trail, but the disabling action itself has already occurred, making this an after-the-fact response rather than a preventive guardrail. In contrast, SCPs are evaluated before any action is allowed, providing a hard boundary that AWS Config rules inherently lack.

Amazon CloudWatch Events

Why wrong: Amazon CloudWatch Events (now part of Amazon EventBridge) can react to API calls (e.g., disabling CloudTrail) by invoking a Lambda function or sending a notification, but it does not prevent the action from happening. It is a reactive tool, not a preventive guardrail.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor includes a best practice check for IAM key rotation, but it is an advisory service that generates recommendations. It does not continuously enforce a specific rotation policy and does not automatically flag individual non-compliant keys for remediation or custom notifications in the same way AWS Config rules do.

Amazon Inspector

Why wrong: Amazon Inspector is a vulnerability management service that performs automated security assessments on compute workloads such as Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions. It detects software vulnerabilities (CVEs) and unintended network exposure by analyzing the operating system and application packages, but it does not evaluate the configuration of IAM identities. Therefore, Inspector has no mechanism to check the age or rotation status of IAM user access keys and cannot enforce a policy requiring key rotation.

AWS IAM Access Analyzer

Why wrong: AWS IAM Access Analyzer helps identify resources in your account that are shared with an external entity by analyzing resource-based policies (e.g., S3 bucket policies, IAM role trust policies). It does not evaluate the age or rotation status of IAM user access keys.

AWS Config

Why wrong: AWS Config records AWS resource configuration changes and evaluates them against your custom or AWS-managed rules, allowing you to assess whether your resources align with internal policies or regulatory requirements. It excels at providing an inventory of your resource state and configuration history, but it does not publish or distribute AWS's own compliance certifications. The official SOC 2 Type II report, for example, is a pre-compiled audited document that must be obtained from AWS Artifact, not derived from your Config evaluator checks.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor provides real-time recommendations across five categories: cost optimization, performance, security, fault tolerance, and service quotas, based on AWS Well-Architected best practices. It acts as a personalized cloud expert that inspects your environment, but it does not function as a compliance document portal. For annual audits, you need the actual signed compliance reports from AWS auditors, which Trusted Advisor cannot generate or download; those are available only from AWS Artifact.

Amazon Inspector

Why wrong: Amazon Inspector is a vulnerability management service that continuously scans EC2 instances, container images, and Lambda functions for software vulnerabilities, unintended network exposure, and deviations from security best practices. While it helps you identify and remediate security issues in your own workloads, it does not grant access to AWS's third-party audit reports, such as SOC 2 or ISO 27001. Those compliance documents are published separately and are retrieved through AWS Artifact, not through Inspector's scan results.