S3 Lifecycle Policy practice questions

Convert the logs to Parquet format using AWS Glue and store them in the same bucket.

Why wrong: Parquet is good but partitioning is more impactful for recent data.

Use S3 lifecycle policies to transition logs to S3 Glacier after 7 days and query with Athena.

Why wrong: Glacier is not directly queryable by Athena.

Use Athena with federated query to scan logs directly from the application accounts.

Why wrong: Cross-account queries add complexity and latency.

The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.

Why wrong: SCPs are not required for StackSets; the necessary permissions are handled by IAM.

Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.

Why wrong: Self-managed roles are not required; StackSets can use service-managed permissions with automatic role creation.

Use Amazon GuardDuty to monitor S3 data access patterns.

Why wrong: GuardDuty is for threat detection, not encryption enforcement.

Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.

Why wrong: This does not enforce encryption; users can still choose not to use the role.

Enable AWS CloudTrail to log all S3 API calls.

Why wrong: Logging does not enforce encryption.

The S3 bucket has a lifecycle policy that deletes logs after a short period.

Why wrong: Lifecycle policies do not affect access permissions.

The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.

Why wrong: The analyst already has read-only access; assuming a role may not be necessary.

The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.

Why wrong: The question does not mention encryption; this is not the most likely cause.

Use an SCP to enforce a specific password policy and require MFA across all accounts.

Why wrong: SCPs cannot enforce a password policy or require MFA; they only deny or allow actions.

Use AWS Config rules to automatically set the password policy and enable MFA for all users.

Why wrong: AWS Config rules can detect but not remediate automatically unless combined with custom automation.

Use AWS CloudTrail to monitor password policy changes and MFA status, and trigger an automatic remediation.

Why wrong: CloudTrail logs but does not enforce or remediate.

Use an AWS Lambda function that runs periodically to enable CloudTrail in accounts where it is disabled.

Why wrong: Lambda is possible but not the best practice; Control Tower already provides this.

Create an AWS Config rule in each account to enable CloudTrail if it is disabled.

Why wrong: Config rules can detect but not automatically enable; custom remediation is needed.

Use an SCP to require CloudTrail to be enabled in each account.

Why wrong: SCPs can only deny or allow actions, not enable services.

The condition uses 'BoolIfExists' instead of 'Bool' which causes the policy to fail when the key is present.

Why wrong: BoolIfExists works correctly; it returns true if the key exists and is true.

The role requires MFA, but the user's MFA device is not configured correctly.

Why wrong: The question states MFA is enabled and token is passed.

The principal is set to the root account, which does not allow IAM users to assume the role.

Why wrong: The root account principal allows any IAM user from that account.

An SCP that allows only read-only billing actions.

Why wrong: SCPs cannot allow actions; they only deny or allow by default.

An SCP that denies all billing-related actions except read-only.

Why wrong: This would deny read access as well.

An IAM policy attached to the root OU that denies billing modifications.

Why wrong: IAM policies cannot be attached to OUs; they are attached to users/groups/roles.

Use AWS Service Catalog to publish a GuardDuty product and require account owners to launch it.

Why wrong: Requires manual action per account.

Use an SCP that denies guardduty:DeleteDetector and guardduty:UpdateDetector actions, then have each account administrator manually enable GuardDuty.

Why wrong: Manual step is not automated.

Use AWS Config rules to detect accounts without GuardDuty enabled and trigger a Lambda function to enable it.

Why wrong: Reactive, not proactive.

Manually create an S3 bucket in each account to store Config logs.

Why wrong: Centralized logging requires a single bucket; per-account buckets would defeat centralization.

Create an IAM role in each account to allow the management account to access Config logs.

Why wrong: The central bucket policy can grant access without per-account roles.

Deploy AD in two Regions and use a VPN connection between the VPCs to replicate data.

Why wrong: VPN traffic would bypass the inspection VPC unless specifically routed, but the requirement mandates transit gateway.

Deploy a single AD domain in one Region and use AD replication over a VPC peering connection to a second Region.

Why wrong: VPC peering does not support transitive routing through a third-party firewall in the transit gateway.

Deploy AD in two Regions, attach both VPCs to the transit gateway, and enable cross-Region transit gateway peering. Use route tables to direct AD traffic through the inspection VPC.

Why wrong: Transit gateway peering does not support transitive routing through a third-party appliance in a different Region; traffic would go directly.

Use AWS Service Catalog to provide a password policy product and require account owners to launch it.

Why wrong: Not automatic.

Use an SCP to deny the iam:CreateUser action unless the request includes a condition that the password policy meets the requirement.

Why wrong: SCPs cannot check password policy content.

Use AWS Config rules to detect accounts without the required password policy and auto-remediate with a Lambda function.

Why wrong: Reactive, not preventive.

Enable AWS CloudTrail and use Amazon Athena to query logs periodically and send a report.

Why wrong: This is not immediate.

Use AWS Config rules to detect root user activities and trigger an AWS Lambda function to send an email.

Why wrong: Config is not real-time and may have delays.

Use AWS Trusted Advisor to check for root user usage and generate a weekly report.

Why wrong: Weekly is not immediate.

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Why wrong: This only alerts, does not enforce.

Create an IAM policy that requires versioning and KMS encryption when creating buckets, and attach it to all users.

Why wrong: Does not cover roles or services; SCP is broader.

Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.

Why wrong: This is detective and reactive; the requirement is to enforce proactively.

Use S3 bucket policies with condition keys for tags

Why wrong: Bucket policies can check object tags but not enforce fine-grained access control per object.

Use S3 server-side encryption with customer-provided keys (SSE-C) and bucket policies

Why wrong: SSE-C does not provide tag-based access control.

Use AWS Lake Formation with column-level permissions

Why wrong: Lake Formation does not support tag-based access control natively.

Use On-Demand Instances only for the batch job to ensure availability.

Why wrong: On-Demand is costlier than Spot for this workload.

Purchase Reserved Instances for the batch job capacity.

Why wrong: Reserved Instances require a 1- or 3-year commitment, not suitable for short monthly jobs.

The Lambda function does not have permission to create log groups.

Why wrong: Log permissions are granted, and missing log permissions would cause a different error.

The Lambda function is not in the same VPC as DynamoDB.

Why wrong: DynamoDB is accessible over the internet; VPC is not required.

The DynamoDB table 'Orders' does not exist.

Why wrong: The error is AccessDenied, not ResourceNotFoundException.

Enable default encryption on each bucket using SSE-S3.

Why wrong: Default encryption only applies to objects uploaded without encryption headers; it can be overridden.

Require that all buckets use AWS KMS managed keys for encryption.

Why wrong: This does not enforce encryption at upload time.

Use a CloudFormation stack policy to prevent modification of bucket encryption settings.

Why wrong: Stack policies protect resources from updates, not from unencrypted uploads.

Attach an IAM role to the underlying EC2 instance.

Why wrong: Fargate does not use underlying EC2 instances.

Assign an IAM role to the ECS service using the ECS service-linked role.

Why wrong: The service-linked role is for ECS to manage resources, not for the application.

Store AWS credentials in the container environment variables.

Why wrong: Storing credentials in environment variables is insecure.