Security Foundations and Governance

177. A new AWS Organizations member account must be brought under central security governance. (Place the steps in the correct order.)

1. A Review the account's findings in AWS Security Hub to confirm the baseline is reporting.
2. B Confirm that the service control policies attached to that organizational unit apply to the account.
3. C Verify that the delegated administrator has enabled the security services in the account.
4. D Move the account into the organizational unit that carries the required policies.

178. An organization using AWS Control Tower must block a non-compliant resource configuration before it is created rather than detecting it afterwards. Which control type should be applied?

1. A Apply a detective control with an automatic remediation action attached.
2. B Apply a detective control, which evaluates resources after they are provisioned.
3. C Apply a proactive control, which evaluates resources against policy before they are provisioned.
4. D Apply a preventive control expressed as a service control policy denying the resource type entirely.

179. An organization must enforce a service configuration, such as blocking public access, across all accounts in a way that cannot be altered locally and applies to accounts created later. Which solution meets these requirements?

1. A Create an AWS Config conformance pack reporting accounts where the setting is absent.
2. B Apply a declarative policy from AWS Organizations so the configuration is enforced centrally and persists for new accounts.
3. C Apply the setting manually in each account and record it in a runbook.
4. D Deploy the setting with CloudFormation StackSets targeting the organizational unit.

180. A service control policy restricting aws:RequestedRegion has been applied, and IAM and AWS Organizations calls in member accounts have begun failing. Which correction should be made?

1. A Move the service control policy from the organizational unit to each individual member account.
2. B Attach the policy to the management account as well so the restriction is applied uniformly.
3. C Add a NotAction exception for global services, because their API calls are made against a single Region endpoint that the condition rejects.
4. D Change the condition key from aws:RequestedRegion to aws:SourceIp so the restriction is applied by network origin.

181. A security tooling account must be able to administer Amazon GuardDuty, AWS Security Hub, and IAM Access Analyzer for the whole organization without using the management account. Which solution meets these requirements?

1. A Create a separate organization containing only the security tooling account.
2. B Grant the security team cross-account roles into every member account.
3. C Register the security tooling account as the delegated administrator for each of those services.
4. D Share the management account credentials with the security team.

182. An organization must prevent member accounts from disabling AWS CloudTrail or deleting its trails. Which solution meets these requirements?

1. A Enable CloudTrail log file validation on the organization trail.
2. B Attach an IAM policy denying those actions to every administrator role in each member account.
3. C Attach a service control policy to the organizational unit denying cloudtrail:StopLogging and cloudtrail:DeleteTrail.
4. D Create an AWS Config rule that re-enables a trail when it is stopped.

183. An infrastructure pipeline must prevent a template that would create a publicly readable Amazon S3 bucket from ever being deployed. Which solution meets these requirements?

1. A Add a manual approval action so a reviewer can inspect the template before deployment.
2. B Add a policy-as-code scanning stage that evaluates the templates and fails the build on a violation.
3. C Enable S3 Block Public Access on the buckets after each deployment completes.
4. D Create an AWS Config rule that reports public buckets after the stack is deployed.

184. AWS WAF rules and security group baselines must be deployed and continuously enforced across every account from a single place. Which solution meets these requirements?

1. A Create an AWS Config conformance pack that reports accounts missing the rules.
2. B Attach a service control policy requiring the rules to be present in each account.
3. C Configure AWS Firewall Manager policies from the delegated administrator account so the rules are applied and drift is remediated.
4. D Deploy the rules with CloudFormation StackSets to every account in the organization.

185. A deployment role used by a pipeline must be prevented from granting itself broader permissions. Which solution meets these requirements?

1. A Apply a service control policy denying all IAM actions in the deployment account.
2. B Require multi-factor authentication for the pipeline's deployment role.
3. C Attach a permissions boundary to the deployment role and require that boundary on any role it creates.
4. D Reduce the deployment role's maximum session duration.

186. An organization must allow developers to provision only approved infrastructure patterns without granting them broad creation permissions. Which solution meets these requirements?

1. A Grant developers a managed policy allowing the underlying service actions and publish a written standard.
2. B Publish the approved patterns as AWS Service Catalog products with launch constraints and grant access to the portfolio.
3. C Create AWS Config rules that report resources not matching the approved patterns.
4. D Place approved CloudFormation templates in a shared repository for developers to deploy.

187. An organization must continuously evaluate every account against a published control framework and collect the evidence an auditor will request. Which solution meets these requirements?

1. A Enable AWS Config with an organization conformance pack and export the compliance results.
2. B Enable AWS Audit Manager with a framework assessment so evidence is collected automatically against each control.
3. C Enable AWS Security Hub standards and export the findings each quarter.
4. D Enable AWS Trusted Advisor and review its checks each quarter.

188. An organization conformance pack deployed from the delegated administrator account is reported as non-compliant in several member accounts, although the rules themselves evaluate correctly elsewhere. Which cause should the team investigate first?

1. A Check whether the member accounts have opted out of the Regions in which the pack was deployed.
2. B Check whether the conformance pack template exceeds the maximum number of rules permitted.
3. C Check whether AWS Config recording is enabled in those accounts and Regions, because a conformance pack cannot evaluate resources that are not being recorded.
4. D Check whether the delegated administrator account has AWS Security Hub enabled.

189. An auditor requires the AWS SOC 2 report and the signed Business Associate Addendum on demand. Which solution meets these requirements?

1. A Request the report from AWS Support through a service quota increase case.
2. B Retrieve the report and the agreement from AWS Artifact.
3. C Retrieve the report from AWS Audit Manager assessment reports.
4. D Retrieve the report from the AWS Security Hub compliance standards page.

190. A service control policy must permit a specific action while denying everything else in a member account. Which policy structure is required?

1. A An allow statement with a wildcard and a deny for the excluded actions.
2. B A deny statement listing every action to be blocked.
3. C An allow statement listing the permitted actions, since service control policies do not grant permissions and a member account also needs identity policies.
4. D A permissions boundary attached to the organizational unit.

191. A declarative policy and a service control policy both apply to the same account. Which statement describes their relationship?

1. A Only the policy attached closest to the account takes effect.
2. B The declarative policy overrides the service control policy.
3. C The service control policy overrides the declarative policy.
4. D They act on different things, with the declarative policy enforcing a service configuration and the service control policy restricting permitted actions.

192. A delegated administrator for a security service must be changed to a different member account. Which consideration applies?

1. A The new account can be designated while the existing delegation remains in place.
2. B Delegation can only be changed by recreating the organization.
3. C The delegation transfers automatically when the new account is registered.
4. D The existing delegation must be removed before a new account is designated, and historical data may not transfer.

193. A CloudFormation template must be prevented from deploying a resource configuration that violates policy, and the check must run before any resource is created. Which approach is appropriate?

1. A Evaluate the template with policy-as-code in the pipeline and fail the build on a violation.
2. B Add a stack policy preventing updates to the affected resources.
3. C Deploy the stack and remediate violations detected by AWS Config.
4. D Review the template in a pull request before merge.

194. A Service Catalog product must let users provision a resource without holding permission to create it directly. Which configuration is required?

1. A An IAM policy granting users the underlying creation permissions.
2. B A launch constraint specifying a role Service Catalog assumes to provision the resource.
3. C A tag option applied to the product.
4. D A template constraint restricting the parameter values users may choose.

195. An organization must ensure that only container images signed by its build system are deployed. Which approach is appropriate?

1. A Verify the image signature at an admission control step and reject unsigned or unrecognised images.
2. B Scan the images for vulnerabilities before deployment.
3. C Restrict push permissions on the registry to the build system.
4. D Record the image digest in the deployment manifest.

196. An AWS Config rule must evaluate resources continuously rather than only when they change. Which configuration is required?

1. A Set a periodic trigger with an evaluation frequency in addition to or instead of the configuration change trigger.
2. B Attach an automatic remediation action to the rule.
3. C Enable the rule in every Region of the account.
4. D Increase the configuration recorder's delivery frequency.

197. An Audit Manager assessment reports evidence gaps for a control although the underlying data sources are configured. Which cause should be investigated first?

1. A Check whether the assessment report has been generated recently.
2. B Check whether the delegated administrator has changed.
3. C Check whether the assessment's scope includes the accounts and Regions holding those resources.
4. D Check whether the framework has been updated to its latest version.

198. A compliance requirement states that an AWS SOC report must be provided to an auditor under a non-disclosure agreement. Which approach is appropriate?

1. A Request the report from AWS Support through a technical case.
2. B Extract the relevant sections from the AWS compliance web pages.
3. C Download the report from AWS Artifact, where accepting the associated terms is part of the retrieval.
4. D Generate the report from AWS Audit Manager.

199. An organization must apply a control to all accounts except one that requires an exception. Which approach is appropriate?

1. A Omit the control entirely until the exception is resolved.
2. B Place the exception account in its own organizational unit and attach the control to the units that require it.
3. C Apply the control manually to each account except the exception.
4. D Attach the control to the root and add a conditional exception for that account.

200. An organization must ensure a newly created account is enrolled in centralized security services automatically. Which approach is appropriate?

1. A Enrol each account manually during onboarding.
2. B Rely on the account request process including enrolment.
3. C Enable automatic enrolment for the security services from the delegated administrator so new accounts are covered on creation.
4. D Run a weekly job that finds unenrolled accounts.

201. An organization must confirm which accounts are not covered by a required control. Which approach is appropriate?

1. A Review the organization's account list.
2. B Check each account's configuration in turn.
3. C Ask each account owner to confirm.
4. D Use an organization conformance pack or aggregated Config compliance data to report coverage across accounts.

202. A management account must be protected because service control policies do not apply to it. Which approach is appropriate?

1. A Keep workloads out of the management account and restrict its use to organization administration with tightly controlled access.
2. B Attach a service control policy to the management account.
3. C Grant the security team administrator access to the management account.
4. D Enable GuardDuty in the management account only.

203. An organization must be able to revoke a member account's access to a shared resource immediately. Which approach is appropriate?

1. A Remove the account from the organization.
2. B Change the resource's tags.
3. C Delete the shared resource.
4. D Remove the account from the resource share in AWS Resource Access Manager.

204. An organization must prevent member accounts from creating IAM users while permitting role creation. Which approach is appropriate?

1. A Attach a service control policy denying CreateUser while leaving CreateRole permitted.
2. B Attach a policy denying all IAM actions.
3. C Require multi-factor authentication for user creation.
4. D Delete IAM users as they are created.

205. An organization must prevent a CloudFormation stack from creating a resource type that policy forbids. Which approach is appropriate?

1. A Attach a service control policy denying the create action for that resource type, so the stack fails regardless of the template.
2. B Add a Config rule reporting the resource type after creation.
3. C Remove the resource type from the template library.
4. D Review templates manually before deployment.

206. A pipeline's deployment role must be prevented from modifying security controls. Which approach is appropriate?

1. A Require approval before each deployment.
2. B Grant the role administrator access and monitor its activity.
3. C Reduce the role's maximum session duration.
4. D Scope the deployment role's policy to exclude the security control resources and actions, and deny them explicitly.

207. An organization must ensure infrastructure templates are scanned for policy violations before merge. Which approach is appropriate?

1. A Publish the policy in the team wiki.
2. B Review templates at the weekly architecture meeting.
3. C Scan templates after deployment.
4. D Run policy-as-code evaluation as a required check on the pull request so a violating template cannot merge.

208. An organization must apply consistent security group baselines across accounts and remediate drift. Which approach is appropriate?

1. A Create a Config rule reporting non-conforming security groups.
2. B Audit security groups quarterly.
3. C Deploy the security groups with StackSets.
4. D Configure AWS Firewall Manager security group policies from the delegated administrator so baselines are applied and drift is corrected.

209. An organization must ensure that only approved AMIs can be used to launch instances. Which approach is appropriate?

1. A Attach a policy condition on RunInstances restricting the permitted image identifiers or requiring an approved image tag.
2. B Create a Config rule reporting instances using unapproved images.
3. C Publish the approved AMI list in documentation.
4. D Delete unapproved AMIs from the account.

210. An organization must produce evidence that a control operated across every account for an audit period. Which approach is appropriate?

1. A Export each account's Config compliance status at audit time.
2. B Use AWS Audit Manager with an organization-scoped assessment so evidence is collected from all in-scope accounts continuously.
3. C Collect screenshots from each account.
4. D Ask each account owner to attest to the control.

211. A conformance pack must be applied across an organization with account-specific parameter values. Which approach is appropriate?

1. A Deploy the pack manually where the parameters differ.
2. B Deploy a separate conformance pack in each account.
3. C Use a single parameter value for every account.
4. D Deploy the organization conformance pack with parameters, adjusting them per organizational unit where the requirement differs.

212. An organization must detect when an account drifts from its Control Tower baseline. Which approach is appropriate?

1. A Review Control Tower's drift detection and re-enroll or remediate the affected account.
2. B Review each account's configuration manually.
3. C Redeploy the landing zone entirely.
4. D Remove the account from Control Tower.