Governance Risk Compliance And Security practice questions

CloudFormation StackSet

Why it fails: StackSets deploy resources; they do not enforce the restriction of region usage.

Resource Tagging

Why it fails: Tagging organizes resources but does not prevent their creation.

Security Groups

Why it fails: Security groups filter network traffic, not device health.

MFA (Multi-Factor Authentication)

Why it fails: MFA verifies the user, not the state of the device.

IAM Role Assumption

Why it fails: Roles manage permissions for entities, not device-level compliance checks.

Environment Variables

Why it fails: Environment variables are insecure as they can be exposed through system logs or process dumps.

Parameter Store

Why it fails: While it can store secrets, Secrets Manager is the primary tool for managing rotation and lifecycle of sensitive keys.

IAM Roles

Why it fails: Roles manage permissions for services, not for storing application secrets.

Provider has a data center power outage

Why it fails: This is the provider's responsibility.

Customer deploys code in a private VPC

Why it fails: This is a correct deployment, not a breach.

Provider fails to patch their physical hardware firmware

Why it fails: This is the provider's responsibility.

Configure a bucket policy that denies all public access and rely on the provider's default security posture.

Why it fails: Denying public access is a preventive control, but it does not detect or alert on changes to the bucket policy or ACL. An attacker or authorized user could still modify the policy, and the company would not know. This option addresses prevention, not detection and alerting. It fails the requirement for near real-time notification.

Enable versioning on the bucket and configure a lifecycle rule to retain all versions for 90 days.

Why it fails: Versioning protects object data by retaining prior versions, but it does not monitor or alert on changes to bucket ACLs or policies. It addresses data recovery, not access control change detection. Lifecycle rules manage object deletion, not security event notification. This does not meet the near real-time alerting requirement.

Use a third-party vulnerability scanner to periodically scan the bucket for misconfigurations.

Why it fails: Vulnerability scanners typically assess compute instances or network configurations, not bucket ACLs or policies. Periodic scanning is not near real-time and may miss rapid changes. It also does not provide automatic alerting on policy modifications. This approach is indirect and does not satisfy the real-time detection requirement.

Use a site-to-site VPN with AES-256 and store encryption keys in an on-premises hardware security module (HSM).

Why it fails: A site-to-site VPN with AES-256 encrypts data in transit, and an on-premises HSM gives the corporation control over keys. However, this does not integrate with cloud services for key management, making it difficult to use the keys for cloud-side encryption. The requirement is for data transferred between environments, and the keys must be usable for that encryption, which typically requires a KMS that can interface with both.

Use AWS Direct Connect with MACsec encryption and AWS-managed KMS keys.

Why it fails: AWS Direct Connect provides a dedicated network connection, and MACsec can encrypt at the link layer, but using AWS-managed KMS keys means the cloud provider controls the keys, not the corporation. This violates the requirement for customer-managed keys.

Use SSL/TLS for data transfer and store encryption keys in AWS Secrets Manager.

Why it fails: SSL/TLS encrypts data in transit, but AWS Secrets Manager is designed for storing secrets like database credentials, not for managing encryption keys for data at rest or in transit. It does not provide the key management capabilities of a KMS, and the keys would still be managed within AWS, not solely by the corporation.

Use a third-party auditor to certify the CRM application.

Why it fails: Certifying the CRM application does not ensure that the cloud provider's DPA includes the required clauses or that the provider is Privacy Shield certified. The legal requirement focuses on the provider's data processing terms and framework compliance, not the application itself.

Conduct a penetration test on the cloud provider's infrastructure.

Why it fails: Penetration testing assesses technical security but does not verify legal compliance with data protection clauses or Privacy Shield. Moreover, unauthorized testing is prohibited. This action does not fulfill the legal team's requirement for a compliant DPA and framework adherence.

Implement encryption for all data at rest and in transit.

Why it fails: Encryption is a technical safeguard that protects data, but it does not address the legal requirement for a DPA with specific clauses or Privacy Shield compliance. The legal team's requirement is about contractual and framework compliance, which must be verified separately from technical controls.

VPC Peering

Why it fails: VPC peering connects two VPCs within AWS, so it cannot link an on-premises data centre to a cloud provider, and it adds no encryption. It is tempting because peering privately routes traffic between networks, and would be correct if both endpoints were VPCs rather than on-premises and cloud.

IGW (Internet Gateway)

Why it fails: An internet gateway routes traffic between a VPC and the public internet; it provides no encryption or dedicated path to on-premises systems. It is tempting because IGWs are essential for public connectivity into a VPC, and would be correct if the requirement were outbound internet access rather than encrypted hybrid transport.

Direct Connect

Why it fails: Direct Connect is a dedicated private network link that does not encrypt traffic by itself; encryption requires a VPN or MACsec overlay. It is tempting because Direct Connect offers consistent bandwidth and bypasses the public internet, and would be correct if the requirement were private connectivity rather than encryption.

AWS IAM Access Analyzer

Why it fails: Access Analyzer evaluates resource policies to flag external or unintended access paths; it does not record API activity, so it cannot name the IAM principal behind a change. It is tempting because it is an IAM-named service, and it would be the right choice for identifying resources shared outside your account.

AWS CloudWatch

Why it fails: CloudWatch holds metrics, logs and alarms, not API audit records, so it cannot attribute an infrastructure change to a specific IAM principal. It is tempting because CloudWatch surfaces operational anomalies that reveal a change occurred. Identifying the calling IAM user requires AWS CloudTrail event history.

AWS Security Hub

Why it fails: Security Hub aggregates and scores findings from other services against standards; it holds no raw CloudTrail event history, so it cannot attribute a change to a specific IAM user. It is tempting as a central security dashboard, and would be correct for consolidated posture management and compliance scoring.

Azure Backup

Why it fails: Azure Backup provides data protection and restore points; it neither evaluates nor enforces configuration state. It tempts because both are governance-adjacent, and it is correct when the requirement is recovering VMs or files after failure. Policy enforcement for OS versions belongs to Azure Policy, which audits and remediates non-compliant resources.

Azure Resource Manager templates

Why it fails: ARM templates are declarative deployment artefacts; they define resources at provisioning time but do not continuously audit or remediate existing VMs. They tempt because they encode configuration as code, and they are correct for repeatable deployments. Ongoing enforcement of security standards requires Azure Policy with its audit and deny effects.

Azure Monitor

Why it fails: Azure Monitor collects metrics, logs and alerts; it observes compliance but cannot enforce or remediate configuration. It tempts because it surfaces drift, and it is correct for telemetry, dashboards and alerting. Enforcing OS version standards requires Azure Policy, which denies or remediates non-compliant virtual machines automatically.

AWS Trusted Advisor

Why it fails: Trusted Advisor inspects accounts against best-practise checks across cost optimisation, security, fault tolerance, and limits, offering recommendations rather than live spend tracking or budget alerts. It would be the right choice when seeking advisory guidance on idle resources or service quota risks.

AWS CloudTrail

Why it fails: CloudTrail logs API activity for auditing and security forensics, capturing who did what and when. It exposes no cost figures or budget thresholds. CloudTrail would be correct when investigating which principal made a specific API call or when tracing changes for incident response.

AWS Config

Why it fails: AWS Config records resource configuration state and changes for compliance auditing, not expenditure. It cannot display current spend or trigger budget alerts. Config would be the right choice when assessing whether resources match desired configuration rules, such as encrypted volumes or approved instance types.

AWS Secrets Manager

Why it fails: Secrets Manager stores and rotates credentials such as database passwords and API keys; it does not generate or manage the customer-managed encryption keys protecting data at rest, so it fails the scenario. It is tempting because it is a key-adjacent security service, and it would be correct for rotating application secrets.

AWS CloudHSM

Why it fails: CloudHSM provides dedicated single-tenant hardware security modules but no native key-audit logging integrated with CloudTrail, so it fails the compliance-logging requirement. It is tempting because CloudHSM does give customer-controlled keys, and it would be correct where FIPS 140-2 Level 3 dedicated hardware is mandated.

AWS Certificate Manager (ACM)

Why it fails: ACM issues and manages TLS certificates for transport encryption; it does not create or manage the customer-managed keys used for data-at-rest encryption, so it cannot satisfy the requirement. It is tempting because ACM is the default AWS certificate service, and it would be correct when securing HTTPS endpoints rather than storage keys.

Azure Information Protection

Why it fails: Azure Information Protection classifies and labels documents and emails, applying encryption as they travel; it does not inspect Azure SQL Database contents, so it cannot detect vulnerabilities or anomalous activity there. It is tempting because it does protect personal data against unauthorised access, and would be correct if the data lived in files or emails rather than a database.

Microsoft Entra Conditional Access

Why it fails: Conditional Access evaluates user sign-in signals to grant or block access to resources; it does not scan database contents, so it cannot surface SQL vulnerabilities or anomalous query behaviour. It is tempting because it genuinely restricts unauthorised access to Azure SQL Database, and would be correct if the requirement were controlling who may connect rather than detecting threats inside the data.

Azure Firewall

Why it fails: Azure Firewall filters network traffic at the perimeter using rules and threat intelligence; it inspects packets, not database queries, so it cannot identify vulnerabilities or anomalies within Azure SQL Database. It is tempting because it genuinely blocks unauthorised network access, and would be correct if the requirement were controlling inbound traffic to the database rather than monitoring activity inside it.

Allow TCP 80 from 0.0.0.0/0

Why it fails: Port 80 is for unencrypted HTTP, which is insecure.

Allow all TCP from 0.0.0.0/0

Why it fails: Allowing all traffic violates the principle of least privilege.

Allow UDP 443 from 0.0.0.0/0

Why it fails: HTTPS runs over TCP, not UDP.

Cloud Service Level Agreement (SLA)

Why it fails: An SLA defines availability and performance commitments from the provider, not the organisation's own risk mitigation strategies. It is tempting because it evidences provider-side guarantees, and would be correct when the auditor asks how service levels are contractually assured rather than how internal cloud risks are treated.

System Security Plan (SSP)

Why it fails: An SSP documents implemented controls for a system's authorisation boundary, not the organisation-wide risk mitigation strategy an auditor expects. It is tempting because it is control-focused evidence, and would be correct when the request concerns a single system's security posture rather than enterprise cloud risk management.

Network Topology Diagram

Why it fails: A network topology diagram shows connectivity and segmentation, not documented risk treatment decisions. It is tempting because it evidences technical controls that mitigate exposure, and would be correct when the auditor requests architecture evidence supporting a specific control, not the overarching risk management record.

S3 Intelligent Tiering

Why it fails: Intelligent Tiering automatically moves objects between access tiers to reduce cost; it sets no retention period and no write protection, so objects remain mutable and deletable. It is tempting because it optimises long-term storage economics, and it would suit log archives where access patterns vary and immutability is not mandated.

S3 Standard Storage Class

Why it fails: S3 Standard is a durability and availability class governing redundancy and retrieval latency, not retention; objects stay fully writable and deletable. It is tempting because it is the default class for frequently accessed data, and it would be correct for active logs needing low-latency access without compliance immutability.

S3 Cross-Region Replication

Why it fails: Cross-Region Replication copies objects to another region for resilience and latency; replicas inherit no retention lock, so data remains mutable in both locations. It is tempting because it addresses disaster recovery and geographic redundancy, and it would be correct where durability across regions matters but seven-year write-once retention is not required.

AWS CloudWatch

Why it fails: CloudWatch collects metrics, logs and alarms; it does not evaluate resource tags against a compliance rule, so it cannot detect or remediate untagged resources. It is tempting because it can trigger alarms, but it would be correct for monitoring performance thresholds and reacting to metric breaches.

AWS Trusted Advisor

Why it fails: Trusted Advisor checks cost, security, fault tolerance and service limits; it does not evaluate resource tags against an 'Owner'/'Environment' requirement, so it cannot detect or remediate untagged resources. It is tempting as a governance advisor, but it would be correct for surfacing idle instances or open security groups.

AWS Systems Manager

Why it fails: Systems Manager handles patching, run commands and inventory of instances; it does not evaluate resource tags against a compliance rule, so it cannot detect or remediate untagged resources. It is tempting as an automation tool, but it would be correct for running remediation commands on managed nodes.

Multi-tenancy

Why it fails: Multi-tenancy describes several customers sharing one instance of an application or infrastructure with logical isolation, which says nothing about matching capacity to traffic. It is tempting because cloud platforms are inherently multi-tenant, and it would be correct if the question asked how a provider serves many customers economically.

High Availability

Why it fails: High availability keeps workloads running through component failure by redundancy across zones, not by adding or removing capacity as traffic rises and falls. It is tempting because both concepts involve extra instances, and high availability would be correct if the requirement were uptime during an outage.

Scalability

Why it fails: Scalability covers growing capacity to meet demand, but the stem specifies both adding and removing resources as traffic changes, which is elasticity's automatic bidirectional adjustment. Scalability is tempting because it is the umbrella term, and it would be correct if the question asked only about handling increased load.

Access Control Lists (ACLs)

Why it fails: ACLs are legacy access mechanisms that cannot reliably prevent public exposure and are overridden by Block Public Access settings. They are tempting because ACLs historically controlled per-object and per-bucket permissions, and would be correct for granting individual AWS accounts granular read or write rights on specific objects.

IAM User Policies

Why it fails: IAM user policies attach to identities and govern what those principals may do; they cannot by themselves override a bucket's public access settings or block anonymous requests. They are tempting because identity-based policy is the normal way to grant S3 permissions, and would be correct for restricting which users can call S3 APIs.

Bucket Policy

Why it fails: A bucket policy alone can grant or deny access, but preventing public exposure reliably requires Block Public Access, which overrides bucket policies and ACLs. Bucket policies are tempting because they are the standard resource-based mechanism for controlling S3 access, and would be correct for granting cross-account or anonymous read access deliberately.

Content Delivery Network (CDN)

Why it fails: A CDN caches static content at edge locations worldwide, which spreads copies across many jurisdictions rather than confining the database to one country. It is tempting because CDNs reduce latency for global users, and would be the right choice when accelerating delivery of web assets, not for meeting data residency requirements.

Global Accelerator

Why it fails: Global Accelerator routes traffic over AWS's backbone to improve latency and availability; it directs packets to endpoints but does not control where the database itself is stored, so data can still reside outside the required country. It would be correct when optimising global application performance, not for enforcing data sovereignty.

VPC Peering

Why it fails: VPC peering connects two VPCs privately but does not constrain where data is stored; both VPCs can sit in different countries. It is tempting because it addresses network isolation between environments, yet sovereignty requires selecting a Region within the mandated country, not merely linking networks.