模擬試験 1

AWS Config conformance packs can report bucket encryption configuration and notify SNS, but they do not block an S3 PutObject call in real time. Trap: It sounds organization-ready because Config is already monitoring S3, but it is detective rather than preventive.

Denying s3:CreateBucket does not enforce encryption on object uploads and does not evaluate each PutObject request. Trap: It uses the right guardrail type but applies it to the wrong S3 API action.

CloudTrail data events plus EventBridge and SNS can alert after an unencrypted PutObject, but the upload has already succeeded. Trap: It is useful for audit evidence, not for blocking noncompliant attempts.

AWS Health is the right event source, but invoking AWS-RestartEC2Instance directly from EventBridge restarts instances as soon as the event arrives. Trap: It uses the right notification source and runbook, but it skips the maintenance-window control.

A Systems Manager maintenance window event does not identify scheduled EC2 retirement or host maintenance notifications or the affected instances. Trap: The window is important, but it is not the event source for AWS infrastructure maintenance.

EC2 state-change notifications are not the proactive source for scheduled instance retirement or host maintenance, so the automation may run too late or miss the required signal. Trap: Lambda plus a maintenance-window task is plausible, but the trigger is the wrong control-plane event.

AWS Config evaluates compliance and Resource Data Sync aggregates inventory/compliance data; neither service lays down a TOML file on EC2 instances when stack metadata changes. Trap: It sounds like a governance loop, but the requirement is configuration distribution and in-place reapplication.

cfn-init and cfn-hup are the right helper scripts, but embedding the file in launch template data does not give cfn-hup CloudFormation metadata to monitor for running instances. Trap: The helper script names are tempting, but the file must live in CloudFormation init metadata.

Launch template content affects future launches, and SSM Resource Data Sync does not poll and apply configuration updates to instances. Trap: It combines IaC with an SSM feature, but that SSM feature is for reporting data outward, not pushing files inward.

It checks only whether aws:VpcSourceIp is inside a CIDR and then compares a private IPv4 address to a VPC ID, which cannot bind credentials to the exact instance. Trap: The shared VPC CIDR sounds relevant, but CIDR membership would still allow replay from another host in that range.

Static allow lists of VPC IDs and private IPs do not prove that the credentials are being used by the instance that received them, and per-account application misses the OU-level requirement. Trap: Allow lists can restrict broad network locations, but they do not create dynamic credential-to-instance binding.

It reverses the comparisons by matching a VPC ID to an IP address and an IP address to a VPC ID, and it applies the policy per account instead of at the OU. Trap: It mentions the right condition keys, but the key pairings and governance scope are wrong.

S3 can store copied repository objects or archives, but it is not a normal Git remote that developers can push to and pull from. Trap: It sounds like backup, but the requirement is engineering continuity with a usable Git endpoint.

CodeArtifact distributes packages, not Git repositories with branches, refs, tags, and push/pull workflows. Trap: Packaging source helps consumers, but it does not preserve a repository mirror for developers.

Cloud9 is a development environment and does not automatically maintain a secondary CodeCommit mirror for all developers. Trap: It offers a place to work during an outage, but changes the workflow and leaves replication unsolved.

Assigning IPv6 addresses to every private instance is unnecessary when the ALB is the public IPv6 endpoint, and it does not define the required dualstack ALB front end. Trap: End-to-end IPv6 sounds thorough, but the scenario only requires IPv6 client ingress to the service.

IPv6 Elastic IPs are not the EC2 exposure mechanism here, and assigning public addresses to instances violates the private-instance requirement. Trap: It includes an ALB listener, but it exposes the wrong layer.

Replacing the ALB with an NLB is unnecessary, and the option relies on an IPv6 Elastic IP concept that is not the standard solution. Trap: NLBs can be dualstack, but the existing ALB already supports the required HTTPS ingress pattern.

GuardDuty is useful, but building S3, Athena, and QuickSight investigation dashboards creates the raw log management overhead the stem wants to avoid. Trap: It contains the right detection service, but the analytics layer is custom and slower to operate.

Container Insights monitors resource and performance telemetry; it does not provide managed threat detection or malicious-activity investigation. Trap: It is relevant to EKS observability, but the requirement is security investigation.

GuardDuty, Container Insights, VPC Flow Logs, and CloudTrail collect useful signals, but this option lacks Detective or another summarized investigation layer. Trap: It lists many data sources, yet the key requirement is a single managed view with minimal log management overhead.

IAM Identity Center is for workforce access and SSO permission assignments, not a workload exchanging an OIDC ID token for DynamoDB credentials. Trap: It mentions an external IdP, but it does not solve pod-to-AWS API federation for this portal.

For OIDC provider claims in an IAM role trust policy, the audience condition key is provider-specific, not sts:aud. Trap: It scopes the role permissions correctly, but the trust-policy condition key is wrong.

GetFederationToken is not the web identity federation API for accepting an external OIDC token from the portal. Trap: It returns temporary credentials, but it is the wrong STS operation for OIDC token exchange.

There are no Organization group policies that enforce service and Region restrictions, and StackSets alone would not provide the preventive guardrails. Trap: It includes StackSets for roles, but uses the wrong governance control.

Permissions boundaries limit IAM principals or roles but do not centrally restrict all accounts to specific AWS Regions and services. Trap: Boundaries are useful for delegation ceilings, not Organization-wide service allowlists.

SCPs are correct for the guardrails, but AWS RAM cannot share IAM roles for workforce assumption into member accounts as described. Trap: IAM Identity Center and RAM sound centralized, but the stem requires identical account-local job roles.