Security Foundations and Governance

A company wants to implement a governance strategy that prevents any member account in the organization from disabling CloudTrail or deleting the organization-level trail. What is the most effective way to implement this while allowing account administrators to manage their own local resources?

Which AWS IAM best practice ensures that users have only the permissions necessary to perform their specific business roles?

A company wants to implement a robust governance framework for their AWS accounts using AWS Control Tower. They need to ensure that specific security guardrails are applied to their 'Financial-Apps' Organizational Unit (OU). Which TWO types of guardrails can be applied within Control Tower?

Which AWS service is best suited for providing a comprehensive, searchable audit trail of every API call made in an AWS account?

According to the AWS Shared Responsibility Model, which of the following security tasks is the sole responsibility of the customer when using Amazon EC2 instances?

An organization wants to enforce encryption at rest for all S3 buckets using AWS Organizations. Which TWO actions should the security team perform to ensure consistent governance?

A company is preparing for an annual regulatory audit and needs to collect evidence of their compliance with the SOC 2 framework across multiple AWS accounts. Which TWO AWS services or features should the security team use to automate the collection of evidence and download official compliance reports?

A security engineer must ensure that no developer in a specific AWS Organizations member account can delete Amazon S3 buckets, even if they have AdministratorAccess. Which governance mechanism provides the most efficient and centralized way to enforce this restriction across the organizational unit?

A security auditor requires a centralized view of security findings across all AWS accounts in an organization. Which service should be enabled to aggregate and prioritize these findings?

A company requires that all cloud resources be tagged with a 'Department' code for cost allocation and security reporting. How should they enforce this?

An organization wants to centralize the management of Amazon GuardDuty across 50 AWS accounts. They want the security team to be able to view and manage findings for all accounts from a single dashboard. What is the recommended governance approach?

Refer to the exhibit. An administrator applied this policy to a bucket, but users are still able to upload unencrypted objects. Why is this occurring?

A security engineer needs to verify if all AWS accounts in the organization are compliant with the CIS AWS Foundations Benchmark. Which service provides a centralized compliance dashboard and the ability to run automated checks against this specific benchmark?

Refer to the exhibit. Why might a user in the 192.168.1.0/24 range still be denied access to the S3 bucket?

Which service should be used to securely store and automatically rotate database credentials?