Design secure architectures
Practise only this domain. 45 questions with explanations, 20 at a time.
Start design secure architecturesSample questions
- An identity-based policy attached to a user contains an explicit Deny statement for s3:DeleteObject on all resources. A different policy attached to the same user grants s3:DeleteObject. What happens when the user attempts to delete an S3 object?Medium
- A company stores sensitive customer data in Amazon S3. It requires encryption at rest with keys the company itself manages, plus a full audit trail of every key usage event. Which option meets these requirements?Medium
- An application uses Amazon RDS for MySQL. A compliance mandate requires the encryption key to live in hardware the company physically controls and that AWS personnel cannot access. Which solution satisfies this?Hard
- A security policy requires that every S3 upload is refused unless the request carries the required server-side encryption header. Uploads without an x-amz-server-side-encryption header must be automatically rejected. How should the bucket be configured?Medium
- An enterprise runs hundreds of AWS accounts under Organizations. The security team needs continuous, centralized evaluation of every account against PCI DSS requirements such as no public S3 buckets, encrypted EBS volumes, and enabled CloudTrail. Which service provides this consolidated compliance view?Medium