Practice Test #6

Amazon Inspector does not inspect S3 object contents for PHI; it assesses vulnerabilities for supported compute and container resources. Trap: The word security scanning is tempting, but this is data classification, not vulnerability management.

Macie is the right discovery service, but SQS does not directly alert a human compliance team and requires a consumer to poll and notify. Trap: It uses the right detector, but the queue adds an unnecessary step for immediate alerting.

Inspector is the wrong service for PHI in S3, and SQS is also not the best direct notification mechanism for people. Trap: It combines two familiar security/event services, but neither satisfies the core requirement cleanly.

Glacier Vault Lock is not the right fit for records that the question says must be stored in Amazon S3 with object-level controlled release. Trap: Vault Lock is WORM-related, but the S3-native answer is Object Lock.

A 75-year governance retention period is fixed, not indefinite until explicit approval, and it does not express the legal-hold workflow. Trap: A long retention period feels compliant, but it does not match indefinite retention with controlled release.

CloudTrail monitoring and restoration is detective and corrective; it does not prevent tampering or deletion from occurring. Trap: Auditing is important for compliance, but it is not WORM immutability.

An Application Load Balancer is not a private proxy for S3 bucket access and would introduce an unnecessary public-facing component. Trap: Load balancers are common for applications, but S3 access is solved with endpoints.

Direct Connect connects on-premises networks to AWS, but this application is already inside a VPC and needs private S3 service access. Trap: Direct Connect sounds private, but it is not the right mechanism for EC2-to-S3 routing inside the VPC.

A NAT instance sends traffic from private subnets toward public endpoints, which violates the requirement to avoid public internet traversal. Trap: NAT is often used by private subnets, but not for this compliance constraint.

Global Accelerator improves network routing to application endpoints, but it is not the most cost-effective CDN for static S3 objects. Trap: It sounds global, but the workload is cacheable content delivery, not TCP/UDP acceleration to servers.

Redis is an in-memory data store for application caching and session-like data; it does not distribute large S3 objects to global students. Trap: Caching is the right idea, but this is the wrong cache layer for static media delivery.

Memcached has the same issue as Redis here: it is not a global CDN and would add app-tier management without reducing S3 bandwidth like CloudFront. Trap: The word cache is tempting, but ElastiCache does not sit in front of S3 for worldwide content delivery.

Route tables do not selectively block public subnet CIDRs inside the same VPC because the local VPC route enables subnet-to-subnet reachability. Trap: It sounds like network isolation, but route tables are not the right authorization control here.

Security groups do not support explicit deny rules, so you cannot deny the ALB security group this way. Trap: The wording matches the public-tier concern, but SGs work by allowing only trusted sources.

VPC peering connects separate VPCs, not subnets in the same VPC, and it does not provide tier-level database authorization. Trap: Peering sounds like segmentation, but these tiers are already in one VPC.

Data Pipeline plus EMR is more batch-oriented and does not provide the managed real-time ingestion and reliable transmission layer the scenario requires. Trap: S3 and EMR can process big data, but the missing piece is streaming ingestion.

An EC2 fleet would require custom ingestion, backpressure, retries, and scaling logic for 25 TB per day. Trap: Auto Scaling sounds scalable, but it creates undifferentiated work compared with Kinesis.

CloudFront is for content delivery caching, and S3 event-triggered Lambda is not a robust real-time ingestion pipeline for this data volume. Trap: It mentions S3 and Lambda, but those do not replace a streaming buffer and delivery service.

Attaching the SCP to the root OU would make the prod account inherit the large-instance deny. Trap: Root attachment is broad and simple, but it violates the nonprod-only scope.

Attaching an SCP to the management account does not enforce the restriction on the three nonprod member accounts. Trap: The management account is not a shortcut for all member accounts.

Attaching the SCP to a prod OU targets the wrong environment and would restrict production rather than nonprod. Trap: Creating an OU is useful only when the right accounts are placed under it.

An inbound endpoint is for on-premises clients querying DNS names in AWS, which is the opposite direction of this requirement. Trap: Inbound and outbound sound similar, but the arrow in the prompt determines the endpoint type.

A private hosted zone would require hosting or duplicating the records in Route 53 instead of securely forwarding to the authoritative on-prem DNS server. Trap: Private hosted zones are private, but they do not query the existing on-prem DNS authority.

A public hosted zone for corp.local would expose an internal namespace path to public DNS and does not use the VPN-connected on-prem resolver. Trap: Public DNS is easy to create, but it violates the private and most-secure requirement.

Network Load Balancers operate at Layer 4 and do not perform HTTP header-based routing or custom header decisions. They also do not provide global CDN caching. Trap: Load balancers distribute traffic, but NLBs cannot inspect User-Agent or cache media variants.

Global Accelerator improves routing to regional endpoints but does not cache video, inspect HTTP headers, or select device-specific formats. Trap: It is a global performance service, but not a media CDN or content negotiation layer.

Weighted routing in Global Accelerator cannot distribute traffic by device type and does not solve multi-variant content caching. Trap: Weights help with traffic shifting, not per-request device capability decisions.