AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 526–600

The policy includes an explicit Allow statement for s3:ListBucket on the bucket resource, so this action is permitted. IAM defaults to deny only for actions not covered by any applicable Allow, and because no explicit or resource-based Deny applies to this principal for that bucket, the ListBucket call is authorized. The permission is scoped to the bucket ARN, not individual objects, which matches the resource type required by the ListBucket API.

Lambda function execution output is written to CloudWatch Logs, so a metric filter can parse log events for patterns such as 'ERROR' or 'AccessDenied' and drive a CloudWatch alarm. The alarm then publishes to an SNS topic, delivering real-time notifications to operators. This is the native, low-latency monitoring path for Lambda function behavior and is ideal for sensitive-data processing failures.

Enabling EBS encryption by default causes all newly created EBS volumes and snapshots to be encrypted automatically. When no custom key is specified, AWS uses the AWS managed key with alias 'aws/ebs' to perform encryption, which is transparent and requires no additional configuration. This satisfies encryption-at-rest requirements with minimal operational overhead and is the simplest valid option.

This approach aligns with AWS best practices by placing logs in a dedicated security account that is isolated from production workloads and the management account. The bucket policy grants write access only to the logging services of all accounts, using service principals like logging.s3.amazonaws.com, while condition keys such as aws:SecureTransport force TLS and a deny statement without s3:x-amz-server-side-encryption ensures all objects are encrypted at rest. This centralizes auditability, enforces least privilege, and provides a single source of truth for compliance and incident investigation.

Security groups act as a stateful virtual firewall, evaluating inbound traffic and allowing only the rules you explicitly define. By restricting inbound traffic to only necessary ports and source IP ranges, you minimize the attack surface and block unused services from being probed. This least-privilege approach is a fundamental security control that should be applied in addition to network segmentation, not as a substitute for it.

AWS CloudTrail records management events (and optionally data events) for every API call made in an AWS account, capturing the identity, source IP, time, request parameters, and response elements. When enabled for an AWS Organization, you can create an organization trail that logs events for all accounts and delivers them to a single Amazon S3 bucket, enabling centralized auditing. This makes CloudTrail the definitive source of API activity for security monitoring, compliance, and forensic investigation.

AWS CloudTrail records management events in your account, including the PutBucketPolicy API call that modifies an S3 bucket policy. This gives you a complete, auditable history of who made the change, from which IP address, and when, making it a primary service for detecting and investigating policy changes.

The unified CloudWatch agent (amazon-cloudwatch-agent) is the recommended method for collecting both custom metrics and log files from EC2 instances. It tails configured log files and forwards each line to a CloudWatch Logs group and stream using the PutLogEvents API, with options for multi-line logs, timestamp formats, and rotation. This directly and reliably satisfies the requirement to send application logs to CloudWatch Logs, making it a correct answer.

The EC2 instance's security group explicitly permits inbound SSH on port 22 from 0.0.0.0/0. This means the instance is reachable directly from the internet on its own public or elastic IP, completely bypassing the ALB. GuardDuty detects the resulting SSH brute-force attempts from external sources, so this is the root cause despite the ALB fronting web traffic.

Configure an S3 Lifecycle policy with a transition rule that moves CloudTrail logs from S3 Standard to S3 Glacier after a defined number of days, such as 30 or 90. This automated, deterministic approach aligns perfectly with typical log access patterns—logs are actively analyzed immediately after delivery, then only rarely needed for compliance or audit investigations. Glacier provides extremely low-cost, durable archival storage, which is cost-optimal for a 7-year retention requirement, and the lifecycle rule requires no ongoing operational effort once set.

AWS STS is the service that issues temporary, limited-privilege credentials through APIs like GetSessionToken, AssumeRole, and GetFederationToken. These credentials consist of an access key ID, a secret access key, and a session token, and they automatically expire after a configurable duration, ranging from 15 minutes to 36 hours depending on the API used. This reduces the risk of long-term credential exposure and is the correct IAM feature that directly grants temporary credentials.

Private subnets with a NAT Gateway in a public subnet provide a controlled outbound-only internet path. The private subnets' route table sends 0.0.0.0/0 to the NAT Gateway, which holds an Elastic IP and translates traffic, while inbound connections from the internet are still impossible. This allows instances to fetch updates and call external services without being directly exposed, making it the recommended multi-tier architecture pattern.

AWS Organizations gives you a central management structure for all your AWS accounts, and service control policies (SCPs) let you apply permission guardrails at the root, organizational unit (OU), or account level. SCPs restrict the maximum allowed actions for IAM principals in member accounts, but they do not grant permissions—they work alongside IAM policies to enforce central restrictions across the entire organization. This is the correct service because it provides centralized, cross-account permission governance that IAM alone cannot achieve.

A customer managed CMK is the correct choice because the customer controls the key, including its rotation schedule, access policies, and auditability, which meets financial services compliance demands. When you create a DynamoDB table with a customer managed CMK and enable automatic key rotation, DynamoDB uses that key to encrypt the base table and all GSIs automatically, as GSIs inherit the table's encryption settings. This provides unified, customer-controlled encryption with rotation, fully satisfying the requirement.

AWS Site-to-Site VPN creates encrypted IPsec tunnels between an on-premises customer gateway device and an AWS virtual private gateway or transit gateway attachment. It automatically provisions two tunnels for high availability, encrypts traffic as it traverses the public internet, and supports dynamic BGP or static routing. This directly satisfies the requirement to protect data in transit between the on-premises network and the VPC.

Cross-account access is an AND operation: the bucket policy in Account A must explicitly allow the principal (the root user or a specific IAM principal in Account B) to call s3:GetObject, and the IAM identity in Account B must have an attached identity-based policy that also permits s3:GetObject. If either policy denies or lacks the permission, the request fails, because both the resource-based policy (in the owning account) and the identity-based policy (in the accessing account) must grant the action. This pattern is the standard way to grant direct cross-account access to an S3 object while keeping the resource owner in control.

AWS CloudTrail is the purpose-built service that records API activity across your AWS account, capturing management events for the control plane and optionally data events for services like S3. Each event includes the identity of the caller, source IP address, request parameters, response elements, and a timestamp, whether the call came from the console, SDK, or CLI. CloudTrail's event history provides 90 days of visibility by default, and you can create trails to deliver logs to S3 or CloudWatch Logs for long-term auditing and compliance.

Amazon GuardDuty is a managed threat detection service that continuously analyzes AWS account activity, including CloudTrail management and S3 data events, VPC Flow Logs, and DNS query logs, using integrated threat intelligence and anomaly-detection machine learning. It can generate findings such as an S3 bucket compromised finding or unusual data-access patterns that strongly indicate data exfiltration, and it alerts security engineers without requiring manually defined thresholds. This makes it the most direct, purpose-built service for spotting suspicious S3 activity in near real time.

This is the correct outcome because AWS IAM uses an explicit deny override model: if any applicable policy contains a Deny statement that matches the request, access is denied even if an Allow statement also matches. Here, the request is sent over HTTP, so the Deny condition on aws:SecureTransport (e.g., "aws:SecureTransport": "false") is triggered, blocking the request. The user's IP being within the allowed range is irrelevant because the Deny statement takes unconditional precedence.

When the destination S3 bucket is encrypted with SSE-KMS, CloudTrail must be explicitly allowed to use that customer-managed KMS key before it can write delivery files. The key policy must grant the CloudTrail service principal (or the trail's assumed role) kms:GenerateDataKey and kms:Decrypt actions; without these, CloudTrail will fail at the encryption step even though the trail is otherwise correctly configured. This is the most likely cause because the error is specific to SSE-KMS buckets — CloudTrail cannot silently assume IAM permissions across services for KMS operations and requires explicit key policy authorization. Therefore, a KMS key policy lacking CloudTrail permissions is exactly the kind of misconfiguration that would block log delivery.

This is the correct approach because an IAM role attached to an EC2 instance profile securely provides the instance with temporary credentials through the instance metadata service. The role enforces least-privilege permissions for S3, automatically rotates credentials, and eliminates the need to embed long-term keys, aligning with AWS security best practices and following the principle of granting only the required access.

The aws:SourceVpce condition key can be used to restrict access to requests that come through a specific VPC endpoint. Adding this condition ensures that the user can only access objects when the request originates from that endpoint, meeting the requirement to limit access to a specific VPC endpoint.

After designating a GuardDuty administrator (master) account, the administrator must send an invitation to each member account it wants to onboard. This invitation is the formal step that creates the GuardDuty account relationship, allowing the master account to access member findings, manage GuardDuty configurations, and generate usage reports. In an AWS Organizations environment, this step can be automated through delegated administration, but the manual invitation process is the correct and required approach when not using Organizations.

AWS Config records configuration changes for supported resources and continuously evaluates those configurations against managed or custom rules. For S3 bucket policies, rules such as s3-bucket-policy-grant-check can detect unauthorized or noncompliant policy changes, flag the resource as noncompliant, and trigger remediation. It maintains a configuration history and timeline, making it the appropriate service for monitoring unauthorized changes to resource configuration.

Enabling encryption by default for new EBS volumes is a foundational data-at-rest protection control because it automatically encrypts the underlying volume and its snapshots with an AWS KMS key, without requiring per-volume configuration. This prevents raw storage from being accessed if an unauthorized party gains access to the physical media, and it also ensures that any future snapshots derived from these volumes inherit the same encryption, which is mandatory for many compliance frameworks.

VPC Flow Logs capture IP traffic metadata—source and destination addresses, ports, protocol, packet and byte counts, and allow/deny actions—for traffic reaching network interfaces in your VPC. When published to Amazon S3, these logs become a durable, queryable history that can be analyzed with Athena using standard SQL to reconstruct past network behavior, such as whether an instance communicated with a suspicious host. This makes VPC Flow Logs the correct and most direct source for retrospective network traffic analysis.

MACsec operates at layer 2, providing hop-by-hop encryption on the dedicated Direct Connect link between the customer router and the AWS device. It encrypts traffic traversing the connection itself, satisfying the requirement without overlaying an IPsec tunnel.

GuardDuty emits findings to CloudWatch Events as structured events, and the rule's pattern must exactly match their JSON schema. Specifically, the pattern must use "source": ["aws.guardduty"] and "detail-type": ["GuardDuty Finding"]; otherwise the rule is never triggered. If the pattern mismatches, the Lambda function will not be invoked, even though the finding is visible in the GuardDuty console. This is the most common cause of a silent rule failure.

CloudTrail requires explicit kms:GenerateDataKey and kms:Decrypt permissions on the customer managed KMS key used for SSE-KMS encryption of the S3 bucket. If the key policy grants these actions only to the bucket owner or other principals, CloudTrail's delivery role is denied and PutObject calls fail with an access denied error. This is a common cause of CloudTrail logs not appearing while the trail itself remains active.

S3 event notifications are delivered in near-real-time directly from the bucket for object-level actions. By subscribing to s3:ObjectRemoved:* events, the Lambda function is invoked immediately upon a delete or delete-marker creation, then publishes to SNS for alerting. This bypasses the multi-minute delivery latency of CloudTrail logs and does not require any additional monitoring infrastructure.

The bucket policy includes an explicit deny statement that blocks any request where the transport protocol is HTTP, typically via a condition such as `aws:SecureTransport: false`. Since the request in question uses HTTP, that deny condition is met, and an explicit deny always overrides any allow statement in the policy. As a result, even a request from an otherwise permitted IP address is denied because of the insecure protocol.

Creating an EBS snapshot of the root volume captures the disk state at a single point in time, including compromised binaries, log files, user artifacts, and any persistence mechanisms the attacker installed. Unlike live acquisition, a snapshot allows offline analysis on a separate instance without altering the original evidence. It also provides a recoverable copy in case the instance is later terminated for containment.

This is the complete cross-account access solution: the role's trust policy allows the user's account to assume the role, and the bucket policy grants the role's ARN explicit permission to perform S3 actions. The user calls sts:AssumeRole and receives temporary credentials scoped to the role, then uses those credentials to access the bucket; the bucket policy recognizes the assumed-role principal. Both policies are necessary because the trust policy does not confer resource permissions, and the bucket policy does not grant the ability to assume the role.

An AWS Organizations trail is the native solution: CloudTrail is enabled in the management account and automatically applies to every member account, including accounts added later. The management account creates a service-linked role that allows CloudTrail to deliver log files from all member accounts to a designated S3 bucket in the management account. This centralizes all API activity across the organization into a single auditable store without per-account manual setup.

Updating the existing trail to log data events for IAM captures the exact API calls needed for the investigation, including GetUser, ListAccessKeys, GetLoginProfile, and other IAM data-plane operations. By default, a trail only records management events, so these data events are absent unless you explicitly add an event selector for the IAM resource type. Doing this on the existing trail preserves the current delivery configuration and eliminates the need for a separate, redundant trail, giving investigators a direct, complete audit of the user's activity.

Amazon CloudWatch Logs is the correct choice because the CloudWatch agent (or the legacy Logs agent) can be installed on an EC2 instance to tail local system logs, including /var/log/auth.log on Amazon Linux or /var/log/secure on RHEL/CentOS. Once collected, you can define a metric filter to match patterns such as 'Failed password' or 'Connection refused' that sshd emits on failed attempts, and then trigger alarms based on those metrics. This directly captures the OS-level authentication events needed to monitor failed SSH logins.

AWS CloudTrail records S3 data events such as GetObject and PutObject, capturing the identity, source IP, timestamp and request details for each object-level API call. This satisfies the requirement to audit who accessed which objects, provided data events are explicitly enabled on the trail.

Enabling CloudTrail in all regions ensures a complete, auditable record of all AWS API activity, including management events, across every region, which is essential for reconstructing the timeline of an incident, identifying compromised credentials or unusual actions, and meeting forensic and compliance requirements. Without multi-region trails, actions in unmonitored regions can go undetected, leaving gaps in the investigation. CloudTrail is a foundational security service that should be enabled by default as part of incident response preparation.

CloudTrail records API activity across the account, capturing who called which AWS API, from where, and when. Its event history and trail delivery to CloudWatch Logs or EventBridge enable near-real-time detection and automated response to suspicious calls.

AWS CloudTrail records API activity across the account, capturing every IAM action as a management event with caller identity, timestamp and source IP. This satisfies the requirement to audit all IAM actions, since CloudTrail logs control-plane operations by default. CloudWatch, Config and Trusted Advisor do not provide this comprehensive API audit trail.

The CloudWatch Logs agent installed on the EC2 instance can tail OS-level log files such as /var/log/secure or /var/log/auth.log and continuously stream those events to CloudWatch Logs. A CloudWatch Logs metric filter can then be configured with a pattern like 'Failed password for' or 'authentication failure' to count each failed SSH login attempt into a custom metric. A CloudWatch Alarm associated with that metric can trigger when the count breaches a threshold—for instance, 5 failures in 5 minutes—and then invoke an SNS topic or other action. This captures exactly the OS-level authentication signal needed to detect brute-force or failed SSH login events.

Amazon GuardDuty is the correct choice because it automatically monitors CloudTrail events, VPC Flow Logs, and DNS logs using threat intelligence and machine learning to detect anomalies. The specific finding type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' is designed to identify when EC2 instance role credentials are being used from an external source or in an unusual pattern, indicating exfiltration. This automated detection provides real-time alerts, which is far more effective than manual analysis for this type of security incident.

Effective permissions for any principal are always the intersection of all applicable policies: the permissions boundary acts as a ceiling, and the identity-based policy (e.g., attached to the role) acts as the grant. The IAM engine evaluates both, and an action is permitted only if it is allowed by the identity-based policy, not denied by the boundary, and not denied by any other policy (like a service control policy or resource policy). This intersection model is the fundamental logic of IAM permissions boundaries: the boundary limits the maximum permissions, but the identity policy must still explicitly grant the action within that limit.

A VPC endpoint for Amazon S3 (a gateway endpoint) allows resources in private subnets to access S3 using private IP addresses with traffic staying entirely within the AWS network, without any internet gateway, NAT device, or VPN connection. Since patches are stored in S3 buckets, the application can retrieve patch files directly over the endpoint, and an endpoint for DynamoDB can handle patch metadata or state tables. This satisfies the no-internet-route requirement while enabling secure patch downloads.

Amazon Detective relies on VPC Flow Logs to populate the network activity details on a finding, such as source/destination IPs, ports, and protocol. For those flow logs to be ingested, they must be enabled for the relevant VPC and published to Amazon CloudWatch Logs in the same AWS account and Region as the Detective graph. Without this configuration, Detective can still show the GuardDuty finding and some API activity, but the network path section will be empty—so enabling VPC Flow Logs is the correct fix.

AWS WAF is a web application firewall that can detect and respond to application-layer DDoS attacks by creating rate-based rules that automatically block or rate-limit requests from a single IP address once a configured threshold is exceeded. It also supports custom rules for HTTP inspection, making it a direct, policy-driven tool for DDoS mitigation. WAF integrates with CloudFront, Application Load Balancer, and API Gateway to enforce these rules in real time at the edge or ingestion point.

An SCP applied at the organization root in AWS Organizations is an identity-policy boundary that affects every principal, including the root user, in every member account. By explicitly denying the s3:PutBucketPublicAccessBlock action, users cannot create, change, or delete S3 Block Public Access settings, effectively preventing all accounts from removing public-access protections. This is the only option that gives a centrally manageable, organization-wide preventive control.

Amazon Athena is an interactive serverless query service that runs standard SQL directly against data stored in Amazon S3. After logs from multiple accounts are centrally delivered to an S3 bucket, Athena can query those logs (e.g., CloudTrail, VPC Flow Logs, ALB logs) without loading them into a database or managing infrastructure. It complements S3 as the storage layer by providing the analysis capability needed to search and correlate log data, making it a correct answer for centrally collecting and analyzing logs.

SSE-S3 uses a multi-layer envelope encryption scheme in which Amazon S3 creates a unique data key for each object and encrypts that data key with a S3-owned master key that AWS automatically rotates. The customer needs no key material, no KMS configuration, and no key lifecycle management, making this the straightforward option for delegating key management entirely to AWS. It is the only option listed that relies purely on AWS-managed keys with no customer-controlled key configuration.

CloudTrail continuously streams API activity from the account, and a CloudWatch Events rule can match specific IAM actions (e.g., PutUserPolicy, AttachUserPolicy) in real time. The rule triggers a Lambda function, which can immediately respond by removing the policy, restoring a backup, or alerting security personnel. This is a native, serverless, event-driven architecture that satisfies both detection and automated remediation.

Amazon EventBridge is the correct answer because Security Hub natively publishes all findings and finding updates to the default event bus as events such as 'Security Hub Findings - Imported'. A rule can use an event pattern to filter on compliance status, severity, or finding type and target a Lambda function, which EventBridge then invokes asynchronously. This is the standard event-driven integration designed for automating responses to Security Hub findings.

A NAT gateway in a public subnet is correct because it enables instances in private subnets to initiate outbound IPv4 traffic to the internet, such as software updates or API calls, while preventing unsolicited inbound connections from reaching them. The NAT gateway resides in a public subnet with an Elastic IP and uses the internet gateway to reach external networks, while private subnet route tables direct 0.0.0.0/0 traffic to the NAT gateway. It is fully managed, scales automatically, and does not require patch management—unlike a NAT instance.

AWS Lambda is the correct answer because it is a serverless compute service that can be triggered by security events via Amazon EventBridge (e.g., a GuardDuty finding) and execute automated response actions. A Lambda function can revoke IAM credentials, modify security groups, terminate instances, or quarantine an RDS instance, turning detection signals into immediate remediation without manual intervention.

Launching an EC2 instance is an ec2:RunInstances API call, and IAM requires a separate, explicit authorization for that action. A policy that grants iam:PassRole only authorizes the developer to attach a pre-existing role to a resource; it does not authorize creating or starting the instance itself. Without ec2:RunInstances permission, AWS denies the request even though the PassRole policy is valid, so this is the correct reason for the failure.

Changing the target group protocol to HTTPS instructs the ALB to establish TLS connections to the EC2 instances. To complete a TLS handshake, each instance must present a valid certificate (for the domain or IP) trusted by the client, so you must install and configure a certificate on the instances. This ensures that traffic between the ALB and instances is encrypted, closing the gap where plaintext HTTP might otherwise travel inside the VPC.

The database security group should have an inbound rule that references the web server security group as its source rather than a CIDR block. This allows the web tier to reach the database service on the required port, such as 3306 or 5432, while keeping the database isolated from all other sources. Because security group references are stateful and evaluated dynamically, this rule continues to work as web instances scale or are replaced, and it does not require the database to have a public IP or an internet gateway route.

Change the Principal element in the role's trust policy from arn:aws:iam::123456789012:root to arn:aws:iam::123456789012:user/specific-user. The root ARN represents every principal in the external account, whereas the user ARN scopes the sts:AssumeRole permission to exactly one IAM user, eliminating the ability of roles or other users in that account to assume the production role.

CloudWatch Logs requires exactly these three log actions for a Lambda function to create its log group, stream and write events. Omitting any action causes logging to fail, so this is the minimum viable set.

This SCP is correct because it applies at the organization level to all member accounts and uses the global IAM condition key iam:InstanceProfile to require a specific instance profile ARN. The deny rule blocks any ec2:RunInstances call from any principal—user, role, or service—that does not include the required profile in its parameters. The condition key is evaluated exactly and provides a preventive guardrail that cannot be bypassed by user-specific policy exceptions.

AWS CloudTrail records API activity across the account, including every IAM create, update, and delete operation, with the identity, timestamp, and source IP. This provides the complete audit trail the security team needs to track all IAM resource changes.

CloudTrail log file integrity validation uses a SHA-256 hash chain, where each delivered log file references the hash of the previous file. This cryptographic digest is computed on the log file and stored in a separate digest file (optionally encrypted with the customer's KMS key), allowing you to detect any tampering or modification of log files after delivery. It confirms authenticity and integrity, not prevention of actions.

AWS Transit Gateway acts as a hub to connect multiple VPCs and on-premises networks, enabling you to implement a hub-and-spoke routing architecture without VPC peering complexities. By attaching a dedicated inspection VPC to the Transit Gateway and configuring route tables so that all inter-VPC traffic is sent to that inspection VPC as a next hop, security appliances (e.g., Palo Alto, Fortinet) can inspect and filter all traffic. This provides centralized visibility and control over east-west traffic while avoiding the scaling limits and meshed connections of VPC peering.

AWS Key Management Service (KMS) is the managed service purpose-built for creating and managing encryption keys, called customer master keys (CMKs), and data keys. It supports key policies, IAM-based access control, automatic annual rotation, key disabling and deletion, and direct cryptographic operations like encrypt, decrypt, and re-encrypt. KMS also integrates with dozens of AWS services for envelope encryption and records every key usage event in CloudTrail, making it the correct answer.

GuardDuty continuously monitors CloudTrail management events and uses machine learning and threat intelligence to detect anomalous IAM behavior, such as unusual user creation or policy attachment. It generates findings in near real-time with minimal setup, requiring only that GuardDuty be enabled. This directly addresses the analyst's need for quick anomaly detection and alerts.

Requesting a public certificate from AWS Certificate Manager is the correct, fully managed way to implement HTTPS on an Application Load Balancer. ACM's public certificates are issued by trusted CAs (such as Amazon Trust Services), are free of charge, and are automatically renewed as long as you maintain the required DNS validation or email validation records. After ACM validates your domain, you simply attach the certificate to the ALB's HTTPS listener, and the ALB handles TLS termination. This avoids any self-managed CA infrastructure and is aligned with AWS best practices for securing a web application.

A service control policy attached to the root organizational unit acts as a maximum permission boundary for every account under it, cascading through all child OUs and accounts. Because SCPs affect the effective permissions of all principals, including the account root users, an explicit deny statement overrides any allow from IAM-based or resource-based policies. This makes it the only option here that centrally prevents an action across the entire organization before the request can be executed.

Correct. Security Hub is the central hub for compliance status, aggregating findings from AWS Config and GuardDuty, and providing reports on CIS benchmark compliance.

AWS CloudTrail records all KMS API requests as audit events, including both management-plane actions (such as CreateKey, EnableKeyRotation, and DescribeCustomKeyStores) and data-plane operations like Encrypt, Decrypt, and GenerateDataKey. Each CloudTrail event captures the caller's IAM identity, source IP address, key ID, request parameters, and timestamp, and can be delivered to Amazon S3 or CloudWatch Logs for long-term retention and analysis. CloudTrail is therefore the authoritative service for auditing all access to a KMS custom key store or the keys associated with it.

Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in S3. It identifies data types such as personally identifiable information (PII), financial data, and credentials, then surfaces findings in dashboards and EventBridge events. For this use case, Macie is correct because it continuously scans and reports on sensitive data without requiring custom tooling or manual inspection.

Creating a cross-Region read replica with encryption enabled gives you a continuously updated, readable copy of the primary database in another AWS Region. RDS automatically replicates changes from the primary using its asynchronous replication engine, and in a disaster you simply promote the replica to a standalone master with a few clicks, minimizing RTO. For encryption, the primary must be encrypted and you specify an AWS KMS key in the destination Region when creating the replica, so the DR copy is encrypted in transit and at rest.

Amazon Detective is purpose-built for security investigation: it ingests VPC Flow Logs, AWS CloudTrail, and EKS audit logs and automatically builds an interactive graph of network traffic, resource interactions, and IAM identities. You can expand a suspected instance to view all of its inbound/outbound connections, the aggregate bytes transferred per peer, and the API actions performed around each flow, which directly answers whether and how data exfiltration occurred. This interactive, multi-source correlation is exactly what the other options lack.

Setting require_secure_transport to 1 in the custom DB parameter group instructs the MySQL server to reject any connection that does not use a secure transport protocol such as TLS/SSL. This enforces encryption in transit at the server level, meaning clients that request plaintext are refused immediately. It directly addresses the requirement to prevent all unencrypted traffic, regardless of client-side settings.

CloudTrail delivers log files by writing objects into the bucket, so the bucket policy must grant the CloudTrail service principal s3:PutObject on the target prefix. Without that write action, delivery fails regardless of ACLs or ownership controls, which only govern access to objects already written.

The correct behavior is that the request fails with AccessDenied. S3 MFA Delete requires an MFA-authenticated request to permanently delete an object version. Since the request does not include the x-amz-mfa header with a valid MFA code, S3 denies the DeleteObject call. This prevents any deletion, including creation of delete markers.

SCPs apply to all principals in the account.