Free Security Foundations and Governance Practice Questions — AWS Certified Security

Question 1 of 6 · Domain 6: Security Foundations and Governance

A financial services company must comply with PCI DSS requirements and needs to demonstrate continuous compliance of their AWS environment. They have 50+ AWS accounts under AWS Organizations. The security team needs to automatically detect when S3 buckets storing cardholder data have public access enabled, when EC2 instances processing payments are missing required security patches, and when IAM policies violate least privilege principles. The solution must provide automated remediation and generate compliance reports for auditors. Which combination of services BEST meets these requirements?

AWS Audit Manager is specifically designed for continuous compliance auditing and maps directly to compliance frameworks like PCI DSS. Config conformance packs provide pre-built collections of Config rules that can be deployed organization-wide for consistent compliance checking. Systems Manager State Manager ensures continuous patch compliance (not just detection). Config remediation actions with SSM Automation documents provide native, scalable automated remediation without custom Lambda code. This combination provides framework-based compliance assessment, continuous monitoring, and automated remediation.

Question 2 of 6 · Domain 6: Security Foundations and Governance

A healthcare organization processes PHI across multiple AWS accounts and must enforce that all data at rest is encrypted using FIPS 140-3 validated cryptographic modules. They need to prevent any team from launching resources that don't meet this requirement, even if they have AdministratorAccess permissions. The solution must apply to EBS volumes, S3 buckets, RDS databases, and DynamoDB tables. Which approach provides the STRONGEST enforcement?

SCPs provide the strongest preventive control because they apply at the account level and override all permissions, including AdministratorAccess. Denying the specific API calls without encryption parameters prevents resources from being created unencrypted in the first place. This is preventive (not detective), applies even to root users, and cannot be bypassed by any IAM permission. The deny conditions on specific API parameters (like encrypted=false) provide precise enforcement of the encryption requirement.

Question 3 of 6 · Domain 6: Security Foundations and Governance

A security team manages 200 AWS accounts and needs to implement a solution where security-critical IAM roles (incident-response-role, security-audit-role, break-glass-admin-role) are identical across all accounts and cannot be modified by account administrators. The roles must automatically update when the central security team modifies the master template. If an account administrator attempts to modify or delete these roles, the change must be automatically reverted within 5 minutes. Which solution accomplishes this with the LEAST operational overhead?

CloudFormation StackSets with SERVICE_MANAGED permissions (Organizations integration) automatically deploys to all accounts in specified OUs and can auto-deploy to new accounts. The key is that StackSets continuously monitors for drift and with automatic deployment enabled, will detect changes to stack resources and redeploy the template to revert changes. OVERRIDE mode ensures that local changes are overwritten. This provides automatic drift correction without custom Lambda code, with typical remediation within the next deployment cycle (configurable, can be minutes).

Question 4 of 6 · Domain 6: Security Foundations and Governance

A company's security governance requires that all AWS API calls be logged and retained immutably for 7 years for forensic analysis. The logs must be protected from deletion or modification by any user, including the root account. The solution must support querying logs for security investigations and meet SEC 17a-4(f) compliance requirements for immutability. Log volume is approximately 2TB per month. Which solution BEST meets these requirements in the most cost-effective manner?

S3 Object Lock in Compliance mode provides true immutability - objects cannot be deleted or modified by any user including root account until retention period expires, meeting SEC 17a-4(f) requirements. Organization trail ensures all accounts are covered. Glacier Flexible Retrieval (formerly Glacier) after 90 days significantly reduces storage costs while maintaining queryability through Athena (Athena can query Glacier). MFA Delete adds additional protection. This is the only option that provides true immutability meeting regulatory requirements while optimizing costs.

Question 5 of 6 · Domain 6: Security Foundations and Governance

A security architect needs to design a cross-account access strategy for a multi-account AWS environment where developers in the Development account (111111111111) need read-only access to production CloudWatch metrics and logs in the Production account (222222222222), but should NOT be able to access any production resources, modify any settings, or assume any production IAM roles. The solution must support automatic access for new developers added to the Development account's "Developers" IAM group and must enforce that all access is logged with the developer's identity (not a shared role identity). Which solution BEST meets these requirements?

IAM Identity Center provides user-level access (not role assumption) that preserves individual developer identity in CloudTrail logs. Permission sets define what users can do in the Production account, and can be scoped to only CloudWatch read permissions. When developers access Production through Identity Center, CloudTrail logs show their actual user identity, not a shared role. Automatic access for new developers is achieved by adding them to the Developers group - no manual permission grants needed per user. This is the only solution that maintains individual identity attribution while providing automatic group-based access.

Question 6 of 6 · Domain 6: Security Foundations and Governance

A regulated company must ensure that any AWS service supporting their production workloads complies with their corporate security standards before the service can be used. They need to prevent developers from launching new AWS services not yet approved by the security team, while allowing use of approved services. The approval process includes security review, compliance validation, and cost analysis, taking 2-4 weeks per service. Currently approved services: EC2, S3, RDS (PostgreSQL only), Lambda, CloudWatch, VPC. The solution must work across 75 AWS accounts. Which approach provides the MOST restrictive and maintainable enforcement?

SCPs with NotAction create a deny-list approach that blocks all services except those explicitly listed. This is MOST restrictive because any new AWS service is automatically blocked until explicitly added to the NotAction list. The rds:DatabaseEngine condition (with values like "postgres") restricts RDS to only PostgreSQL engines. Since SCPs are applied at OU level, they cannot be bypassed by any permission in member accounts. The NotAction approach is more maintainable than trying to list all AWS services to deny - you only list what's allowed. This is preventive control at the strongest enforcement level.