Practice Test #2

Incorrect. Inviting accounts into an organization is right, but the SCP statement is wrong: SCPs cannot grant permissions to the management account (or anyone). SCPs only define the maximum permissions that accounts can use; they do not create IAM roles or allow cross-account access by themselves. Break-glass access requires an assumable IAM role (or equivalent) in each member account.

Incorrect. AWS Firewall Manager centralizes the administration of firewall-related policies (AWS WAF, Shield Advanced, security groups, Network Firewall, DNS Firewall) across an organization. It is not intended to be the central aggregation and grouping service for security findings across the entire environment. Security Hub is the correct service for findings aggregation.

Incorrect. Amazon Inspector provides vulnerability management findings (e.g., EC2, ECR, Lambda) and can operate across multiple accounts with delegated administration, but it does not serve as the central, cross-service findings aggregation and grouping layer for the whole environment. The requirement is broader and maps to Security Hub’s organization-wide findings aggregation.

Increasing retry attempts does not reduce the number of error-free records retried; it typically increases it. With Kinesis batch retries, the whole batch is retried when any record causes a failure, so more retries means more duplicate sends to the ERP endpoint and a higher chance that good records eventually land in the DLQ after repeated failures. This can also increase downstream load and complicate idempotency.

Increasing parallelization factor increases the number of concurrent batches processed per shard, improving throughput and reducing lag. However, it does not change the fundamental behavior that a single failing record causes the entire batch to be retried. Therefore, it will not reduce the number of good records retried or sent to the DLQ; it may even increase duplicate deliveries to the ERP endpoint under failure conditions.

Decreasing maximum record age causes Lambda to stop retrying older records sooner and send them to the on-failure destination earlier. This does not isolate the failing record within a batch; instead, it can increase the number of records (including valid ones) that are discarded to the DLQ because the batch keeps failing and ages out. It reduces recovery time at the cost of higher data loss/noise.

Incorrect. AmazonRDSFullAccess is an IAM policy. IAM permissions cannot override an explicit Deny from an SCP. The error explicitly states the action was blocked by an Organizations SCP, so adding more IAM permissions (even admin) will not help until the SCP no longer denies rds:CreateDBInstance.

Incorrect. Attaching a new SCP that allows RDS to the ext-ml account does not override the analytics OU SCP’s explicit Deny. SCPs combine as guardrails, and explicit Deny in any applicable SCP still blocks the action. You would need to remove/modify the deny condition in the OU SCP (or move the account).

Incorrect. A root OU SCP that allows all actions does not cancel a child OU SCP’s explicit Deny. SCP evaluation requires the action to be permitted by all applicable SCP constraints; any explicit Deny still wins. Therefore, adding an allow-RDS SCP at the root will not enable RDS in an OU that explicitly denies it.

Incorrect. The DR account does not need to read from the source account’s backup vault for cross-account copy. The copy is initiated by AWS Backup based on the backup plan and writes into the destination vault. The key authorization point for the vault is on the destination vault policy (allowing write), not on the source vault policy granting read.

Incorrect. Backup vault policies do not grant access to KMS keys in another account. KMS authorization is controlled by the KMS key policy (and possibly grants), not by the backup vault access policy. You must update the destination CMK policy in the DR account to allow AWS Backup (and the source account context) to use it.

Incorrect. Sharing the source account CMK (alias/ops-backup) with the DR account is not the primary requirement for cross-account copy into a DR vault encrypted with a DR-owned CMK. AWS Backup copies and re-encrypts the recovery point using the destination vault’s encryption key. The missing permission is typically on the destination vault policy and destination CMK policy.

Incorrect. CloudWatch Logs Insights is best for querying log content and patterns, but it scans log data and can add query cost/latency. Counting events per hour doesn’t identify ingestion bytes (large messages vs small messages) and “how many log groups received events” doesn’t rank the biggest ingest sources. It’s less efficient for rapid cost-driver attribution.

Incorrect. Cost Explorer can confirm CloudWatch Logs costs increased and can break down by usage type (e.g., ingestion, storage), but it typically cannot attribute ingestion to specific log groups or device types. It’s a billing/reporting tool, not an operational tool for pinpointing which of 90 log groups is responsible for the spike.

Incorrect. CloudTrail records API calls such as CreateLogStream and PutLogEvents, but it does not provide a reliable measure of bytes ingested per log group/device type. High API call volume doesn’t necessarily mean high ingestion bytes, and analyzing CloudTrail for this purpose is indirect and operationally heavy compared to using AWS/Logs IncomingBytes.

Incorrect. Attaching Elastic IPs implies the instances must have a route to an internet gateway to use those public IPs. The scenario explicitly states there is no IGW and internet egress is prohibited, so EIPs would not provide connectivity to S3. Even if it worked, it would violate the compliance requirement by enabling internet egress during bootstrap.

Incorrect. A NAT gateway requires a public subnet with a route to an internet gateway, and it enables outbound internet access from private subnets. The requirement explicitly prohibits all internet egress and states there is no IGW/NAT. Implementing NAT would directly violate the FedRAMP High control described in the prompt.

Incorrect. Security groups only control allowed traffic; they do not provide a network path. Without an IGW or NAT, the instances still cannot reach public IP ranges. Additionally, allowing egress to a public IP range is still internet egress and violates the requirement. S3 also does not have stable, customer-specific public IP ranges suitable for this approach.

Incorrect. AWS Config rules evaluate resources after they exist (detective control). Even with remediation via Systems Manager, noncompliant EBS volumes or SQS queues could be created during a CloudFormation operation and only corrected later. This violates the requirement to enforce the policy before any stack create/update runs. Config is excellent for continuous compliance reporting, not pre-provision blocking.

Incorrect for this question’s intent. SCPs can deny API actions and are preventive, but they are not evaluated “as a CloudFormation pre-check” and can be difficult to implement reliably for property-level requirements like enforcing a specific KMS key alias across multiple services. SCP conditions for KMS key alias usage are often nontrivial and can lead to false positives/negatives or operational breakage.

Incorrect. A Lambda-based scanner that assumes roles and inspects stacks is reactive and cannot reliably stop a CloudFormation create/update before resources are provisioned. It introduces timing/race conditions, additional operational complexity, and inconsistent enforcement across Regions/accounts. This approach is also less aligned with AWS best practices compared to native preventive controls like CloudFormation Hooks.

This option relies on storing logs in Amazon S3 and analyzing them with Athena and QuickSight, which creates significant operational overhead for schema management, query development, dashboard maintenance, and long-term log handling. Although it can provide reporting, it does not offer the same managed threat investigation experience as Amazon Detective. It also does not best meet the requirement for rapid investigation because analysts would need to manually correlate events across multiple datasets. For an exam question emphasizing low overhead and fast security analysis, this is not the strongest choice.

CloudWatch Container Insights is primarily an observability service for container and cluster performance metrics, not a managed threat detection or security investigation service. While CloudTrail logs in S3 can be queried with Athena and visualized in QuickSight, that again increases raw log management overhead and requires manual analysis. The option also lacks GuardDuty, which is the AWS managed service that detects suspicious activity from EKS audit logs, API calls, and network-related telemetry. Therefore, it does not adequately address the security detection and investigation requirements.

This option improves detection coverage by combining GuardDuty, CloudTrail, and VPC Flow Logs, but it still falls short of the requirement for a single summarized view across all AWS accounts and rapid investigation. GuardDuty generates findings, but Amazon Detective is the service that provides the investigation graph, entity relationships, and cross-account summarized analysis experience. Adding Container Insights does not solve the security investigation requirement because it is focused on operational telemetry rather than threat analysis. As a result, D is a strong partial solution for detection, but not the best complete solution for both detection and investigation.

Incorrect. AWS KMS does not have a native feature to publish SNS notifications based on key age or time since last rotation. KMS can emit API activity to CloudTrail, but it does not generate an event like “key older than 120 days” or “rotation overdue” that you can directly subscribe to. You must implement evaluation logic using services like AWS Config or scheduled Lambda checks.

Incorrect. Trusted Advisor is not the right control plane for verifying KMS key rotation recency for customer managed keys with manual rotation requirements. Trusted Advisor checks are limited and do not provide a customizable, per-key “last rotated within 120 days” evaluation for imported key material scenarios. Also, relying on a periodic EventBridge+Lambda call to Trusted Advisor is indirect and not a strong compliance pattern compared to AWS Config.

Incorrect. AWS Security Hub aggregates findings from integrated products and some AWS security checks, but it does not provide a built-in, configurable control to alert specifically when a customer managed KMS key has not been manually rotated within 120 days, especially for imported key material workflows. Security Hub is better for centralized posture management, not custom time-since-rotation compliance logic.