CCNA Security Governance Questions

IAM decisions are made by evaluating all statements: if any applicable Deny statement matches the request, the result is Deny regardless of any matching Allow. Here, the Deny statement's condition is satisfied by the request, and because explicit Deny statements cannot be overridden by Allows, the effective decision is denied. This is not due to a default deny or missing allow, but an active, matching Deny.

AWS Organizations is the correct service for centrally managing multiple accounts and applying service control policies (SCPs) that place guardrails on the maximum permissions available to IAM principals within member accounts. SCPs act as a policy filter, allowing you to forbid or allow specific AWS services and actions at the organizational, organizational unit, or account level without modifying the IAM policies themselves. This makes Organizations a central control plane for permission boundaries across an entire AWS environment.

AWS Config conformance packs aggregate a pack of rules plus associated remediation actions, deployable across an entire AWS Organization from a single managed template. For a public S3 bucket, the included rule (e.g., s3-bucket-public-read-prohibited) detects noncompliance and automatically invokes an SSM Automation document, such as AWS-DisablePublicReadAccessForS3Bucket, to remove public access. This provides centralized, scalable, and fully automated governance rather than per-account, manual, or report-only controls.

AWS Config's managed rule s3-bucket-server-side-encryption-enabled continuously evaluates each bucket and flags any bucket whose default encryption setting is disabled. When non-compliance is detected, the rule can trigger an SSM Automation remediation—typically the AWS-EnableS3BucketEncryption document—which automatically applies the appropriate SSE-S3 or SSE-KMS default encryption to the bucket. This pairing of continuous detection and automated remediation provides an enforceable, organization-wide corrective control that directly satisfies the encryption requirement.

AWS CloudTrail is an audit service that continuously records all API activity in an AWS account, capturing the calling identity, source IP address, timestamp, request parameters, and response elements. CloudTrail itself is not a threat-detection engine—it simply produces the raw audit logs—but it is a required and correct component because it provides the management-event data that GuardDuty consumes to detect suspicious API calls. Enabling CloudTrail is the necessary first step, and when paired with GuardDuty's analysis engine, it becomes part of a complete detection solution.

AWS Config rules continuously evaluate bucket public access settings and flag noncompliant resources, triggering remediation. Lambda or SSM Automation then applies the block public access configuration automatically, satisfying both continuous monitoring and automatic remediation requirements.

IAM policies define which actions an identity may perform on which resources; listing only the required actions means any unlisted API call is implicitly denied. This directly enforces least privilege at the identity-policy layer, satisfying the stem's requirement to grant no more than the task needs.

AWS IAM Identity Center (successor to AWS SSO) is designed precisely for centralized management of workforce user access to multiple AWS accounts. It connects to external identity providers like Okta, Azure AD, or its own built-in identity store, and assigns users and groups to accounts using permission sets that define granular IAM permissions. With IAM Identity Center, an organization can manage one user directory and control sign-in across all accounts, complete with MFA and auditing, eliminating the need to create IAM users in each account.

AWS Config conformance packs bundle multiple managed or custom Config rules and remediation actions into a single CloudFormation template, and when deployed from the management account using CloudFormation StackSets, they are automatically applied to every target member account and Region. This leverages native AWS Organizations integration, so rules are provisioned consistently without manual per-account steps, and any updates to the conformance pack template can be rolled out centrally. With organization conformance packs, AWS Config manages the deployment across all accounts, making this a fully managed, scalable solution for enforcing security group compliance.

An instance profile is a container for an IAM role that you attach to an EC2 instance, and its trust policy allows the EC2 service to assume the role on behalf of the instance. When the instance calls the instance metadata service (IMDS) at 169.254.169.254, it receives temporary security credentials with the role's permissions, and these credentials are automatically rotated before they expire. This eliminates the need to store any long-term access key on the instance, keeps permissions centrally managed, and is the secure AWS-recommended approach for granting instance-level access to resources like S3.

Enabling multi-factor authentication (MFA) on the management account's root user is a mandatory security best practice because the root user holds unrestricted permissions across the entire organization, including billing and the ability to close accounts. Without MFA, a compromised password or access key for the root user grants an attacker complete control of the organization's structure and member accounts. MFA forces a second authentication factor, mitigating password theft or phishing attacks on that critical identity.

The AWS IAM Credentials Report is a built-in console or API-generated CSV that inventories every IAM user and the root user, listing each access key's ID, status, creation date, and the exact date and time it was last used. This report is the authoritative source for producing a usage report because it directly provides last-used timestamps without requiring log mining. Generating it is a single action, and it can be refreshed on demand to reflect the most recent activity.

AWS CloudTrail is the native service that records management events in the AWS control plane, including every IAM policy change such as PutRolePolicy, AttachUserPolicy, and DeletePolicy. Each event includes the requesting principal, source IP, timestamp, and request/response details, giving you a complete audit trail. You can configure a trail to deliver these logs to S3 or CloudWatch Logs for long-term storage, analysis, and alerting on unauthorized IAM modifications.

AWS CloudTrail is the correct choice because it is the native AWS service for recording management events such as the CreateRole API call, capturing the requesting IAM principal, source IP, request parameters, and timestamp. By default, CloudTrail logs management events for all IAM actions, and you can deliver these logs to an S3 bucket or CloudWatch Logs for long-term retention and analysis. This makes CloudTrail the authoritative audit trail for answering 'who created this IAM role and when'.

An explicit deny statement using the condition 'aws:MultiFactorAuthPresent' equals 'false' will reject any IAM user request that did not authenticate with MFA. Because AWS IAM evaluation logic gives explicit deny precedence over every allow, this pattern universally blocks non-MFA access while still permitting MFA-authenticated requests. Correctly scoped, this is the standard and reliable way to enforce MFA across all users, including those with other grants.

When you create a CloudTrail trail in the management account with the 'Apply trail to my organization' option enabled, CloudTrail automatically creates and configures trails in every member account, delivering all management events to a single S3 bucket. The trail is managed centrally by the organization management account, and any new accounts that join the organization are automatically included without additional manual setup. This provides the lowest operational overhead and ensures comprehensive, centralized logging of API activity across the entire AWS organization, which is exactly what the requirement demands.

Amazon Inspector is a vulnerability management service that automatically scans Amazon EC2 instances, container images in Amazon ECR, and Lambda functions for software vulnerabilities and unintentional network exposure. It assesses the OS and application packages against known CVE databases and CIS benchmarks, producing a risk score. This is precisely the security assessment tool suited for checking compute workloads for weaknesses.

CloudTrail records all API activity in your account—who made the call, from which IP, when, and with what outcome—enabling you to audit for suspicious behavior like new keys or unusual regions. But simply enabling CloudTrail is not enough; you must actively monitor the logs via CloudWatch Logs, Athena, or a SIEM. This is a detective control, not a preventive one, so it requires continual human or automated review to catch anomalies.