4 AWS Security Governance and Operations Online Quiz Questions

True or false: AWS compliance reports, by themselves, make a customer's workload compliant.

Which AWS service collects metrics and logs and can trigger alarms?

An organization applies an SCP to a member account. What does the SCP do?

True or false: AWS security governance is an ongoing operational practice, not a one-time configuration.

Which AWS service analyzes supported data sources for suspicious activity and generates findings?

An organization wants to use SCPs to limit activity across its accounts. Which statement about the management account is accurate?

A team is designing a multi-account environment to separate workloads and security operations. Which choices support that goal? Select all that apply.

A team is reviewing how it grants access to people and workloads. Which practices align with the recommended approach? Select all that apply.

An organization wants help establishing and governing a multi-account landing zone. Which AWS service is designed to help with that task?

During an investigation, a team needs evidence of who performed an API action and when. Which service is the best fit?

A security team discovers that its incident process uses only API activity logs, stores them with workload administrators, and has no clear owner for findings. Describe changes the team should make to its logging and response practices.

A company obtains AWS compliance reports and concludes that its own workload is automatically compliant. Is that conclusion correct?

A team deploys an application on an Amazon EC2 instance. Under the shared responsibility model, who manages the guest operating system and the application?

An administrator grants people and workloads only the access they need to perform their tasks. What access-control principle is being applied?

A team wants a control to check supported infrastructure-as-code deployments before any resources are provisioned. Which type of control fits this need?

Which AWS service records resource configurations and evaluates them against rules to help identify noncompliance?

An organization wants to group its production accounts separately from development accounts so it can apply consistent, stricter guardrails to production. Which AWS Organizations structure should it use?

A security team needs a service that analyzes supported data sources for suspicious activity and generates findings. Which service best fits this need?