4 of the 16 questions we have for this objective, shown with the answer and the reasoning.
Determine appropriate data security controls
Ambergate Insurance runs workloads in 12 AWS accounts that use Amazon EBS volumes, Amazon RDS databases, Amazon DynamoDB tables, and Amazon EFS file systems. A regulator requires daily backups retained for 35 days, with a copy of every backup stored in a second Region and in a separate, locked-down account so that a compromise of a workload account cannot destroy its backups. Each service currently has its own ad hoc snapshot script.
Which solution meets these requirements with the LEAST operational overhead?
- AStandardize the existing per-service scripts, schedule them with Amazon EventBridge in each account, and add a copy step to the second Region.Maintaining separate scripts for four services across 12 accounts remains a large custom codebase and still lacks a managed way to copy into an isolated account.
- BUse AWS Backup with Organizations integration: create a backup policy that applies a daily plan with 35-day retention to all accounts, and configure cross-Region and cross-account copies into a backup vault in a dedicated backup account.AWS Backup supports EBS, RDS, DynamoDB, EFS, and other services under one policy, can be managed centrally through Organizations, and copies recovery points to another Region and to a vault in a separate account with its own access policy.
- CEnable Amazon Data Lifecycle Manager policies in every account for the EBS volumes and rely on each database service's built-in automated backups.Data Lifecycle Manager covers only EBS and EBS-backed AMIs, and the built-in backups for RDS and DynamoDB do not copy automatically to another account.
- DReplicate every data store to the second Region continuously using cross-Region read replicas, global tables, and EFS replication.Replication provides availability, not point-in-time backups; a deletion or corruption would be replicated immediately, and nothing is isolated in a separate account.
Why: AWS Backup is the centralized backup service that applies one policy across many services and, through AWS Organizations, across many accounts. Its copy actions move recovery points to another Region and to a vault in a different account, which is the standard pattern for isolating backups from the workload account that could be compromised. Replication is often confused with backup on the exam; replication protects against infrastructure loss, while backup protects against data loss and ransomware.
Determine appropriate data security controls
Fairholme Securities must keep trade confirmation records in an S3 bucket named fairholme-confirms for seven years under a financial regulation that requires the records to be immutable for the full retention period, such that no user, including the account's administrators and the root user, can delete or overwrite them. The records are accessed frequently for the first 90 days and rarely afterward, and the company wants to minimize storage cost without affecting the retention guarantee.
Which two actions should a solutions architect take? Each correct answer presents part of the solution.
- AEnable S3 Object Lock in governance mode with a seven-year default retention period on the bucket.Governance mode retention can be bypassed by any principal that has the s3:BypassGovernanceRetention permission, so administrators could still delete the records.
- BEnable S3 Object Lock in compliance mode with a seven-year default retention period on the bucket.In compliance mode, no principal, including the root user, can delete or overwrite a protected object version or shorten its retention period until the period expires.
- CEnable MFA Delete on the bucket so that deletions require the root user's MFA device.MFA Delete only adds a factor for the root user; it does not stop the root user from deleting, so it fails the immutability requirement.
- DAdd an S3 Lifecycle rule that transitions the objects to S3 Glacier Deep Archive after 90 days.Lifecycle transitions change the storage class without altering the object or its retention settings, so Object Lock remains in force while the rarely accessed records move to the lowest-cost class.
- EAdd an S3 Lifecycle rule that expires the objects after 90 days and relies on a copy in another bucket.Expiring the records after 90 days directly contradicts the seven-year retention requirement, and Object Lock would block the expiration anyway.
Why: S3 Object Lock provides write-once-read-many protection, and the mode decides who can override it: governance mode can be bypassed by authorized users, while compliance mode cannot be overridden by anyone for the life of the retention period, which is what regulators usually require. Storage cost is addressed independently with a lifecycle transition, because moving an object to a colder class does not modify the object or its lock. The traps are governance mode, which looks like a lock but is bypassable, and MFA Delete, which only adds friction for root.
Determine appropriate data security controls
Caldera Biotech has an internal standard that every Amazon EBS volume in the us-west-2 Region of its research account must be encrypted. Engineers launch instances through the console, the CLI, and several CloudFormation templates, and a recent review found 14 unencrypted volumes that were created by templates that omitted the encryption flag.
What is the SIMPLEST way to ensure that all new volumes in the Region are encrypted?
- AEnable EBS encryption by default for the account in us-west-2.Encryption by default is a per-Region account setting that encrypts every new EBS volume and snapshot copy with the default KMS key, regardless of whether the launch request specifies encryption.
- BAdd an AWS Config rule that flags unencrypted volumes and have an operator delete them when they appear.This is a detective control that acts after the fact and requires manual intervention; it does not prevent the unencrypted volumes from being created.
- CEdit every CloudFormation template and CLI script to set Encrypted to true on each volume definition.Fixing every template still leaves console launches and future templates able to create unencrypted volumes.
- DCreate an IAM policy that denies ec2:RunInstances unless the request includes an encrypted root volume.A condition-based deny can enforce encryption on launches but is more complex to write correctly and does not cover ec2:CreateVolume; the account-level default handles all paths with one setting.
Why: EBS encryption by default is the account- and Region-level switch that makes encryption automatic for all new volumes and snapshots created through any path, which is why it is the simplest answer. It does not retroactively encrypt existing volumes, which must be re-created from encrypted snapshots. Detective controls such as Config and per-template fixes are useful supplements but do not satisfy a requirement to guarantee encryption at creation time.
Determine appropriate data security controls
Stirling Payments encrypts card tokens in an S3 bucket named stirling-tokens with a customer managed KMS key named tokens-key. An application role named TokenService must be able to read and write those objects. Security requires that TokenService be unable to call kms:Decrypt directly through the KMS API or from any other service, so that the key can be used only when S3 performs encryption and decryption on the application's behalf, and that key administrators be unable to use the key for cryptographic operations.
How should the key policy for tokens-key be written?
- AGrant TokenService kms:* and grant the administrators only kms:DescribeKey, relying on S3 permissions to limit how TokenService uses the key.kms:* lets TokenService call Decrypt directly through the KMS API and use the key with any service, and it also lets it change the key policy.
- BGrant TokenService kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey with no conditions, and grant the administrators kms:* so they can manage the key.Without a condition TokenService can decrypt directly through the API, and kms:* for administrators includes the cryptographic operations the requirement forbids.
- CGrant the administrators only key management actions, and grant TokenService kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey with a condition that kms:CallerAccount equals the Stirling Payments account ID.kms:CallerAccount only restricts use to principals from the named account, which TokenService already is; it does nothing to stop TokenService from calling Decrypt directly through the KMS API or using the key from a service other than S3.
- DGrant the administrators only key management actions such as kms:Describe*, kms:Put*, kms:Enable*, and kms:Disable*, and grant TokenService kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey with a condition that kms:ViaService equals s3.<region>.amazonaws.com.Separating administrative actions from cryptographic actions enforces separation of duties, and the kms:ViaService condition restricts TokenService so the key can be used only when the request comes from S3 on its behalf, not from direct KMS API calls or other services.
Why: A least-privilege KMS key policy separates key administrators, who manage the key's lifecycle, from key users, who perform cryptographic operations, and never gives one role both. To bind a key user to a single integrated service, the kms:ViaService condition key limits cryptographic operations to requests that a named service makes on the principal's behalf. The trap options grant kms:* somewhere, which collapses the separation, or omit the service condition so the role can decrypt directly.