Practice Test #2

Incorrect. CloudWatch Logs Insights is best for querying log content and patterns, but it scans log data and can add query cost/latency. Counting events per hour doesn’t identify ingestion bytes (large messages vs small messages) and “how many log groups received events” doesn’t rank the biggest ingest sources. It’s less efficient for rapid cost-driver attribution.

Incorrect. Cost Explorer can confirm CloudWatch Logs costs increased and can break down by usage type (e.g., ingestion, storage), but it typically cannot attribute ingestion to specific log groups or device types. It’s a billing/reporting tool, not an operational tool for pinpointing which of 90 log groups is responsible for the spike.

Incorrect. CloudTrail records API calls such as CreateLogStream and PutLogEvents, but it does not provide a reliable measure of bytes ingested per log group/device type. High API call volume doesn’t necessarily mean high ingestion bytes, and analyzing CloudTrail for this purpose is indirect and operationally heavy compared to using AWS/Logs IncomingBytes.

Incorrect. Attaching Elastic IPs implies the instances must have a route to an internet gateway to use those public IPs. The scenario explicitly states there is no IGW and internet egress is prohibited, so EIPs would not provide connectivity to S3. Even if it worked, it would violate the compliance requirement by enabling internet egress during bootstrap.

Incorrect. A NAT gateway requires a public subnet with a route to an internet gateway, and it enables outbound internet access from private subnets. The requirement explicitly prohibits all internet egress and states there is no IGW/NAT. Implementing NAT would directly violate the FedRAMP High control described in the prompt.

Incorrect. Security groups only control allowed traffic; they do not provide a network path. Without an IGW or NAT, the instances still cannot reach public IP ranges. Additionally, allowing egress to a public IP range is still internet egress and violates the requirement. S3 also does not have stable, customer-specific public IP ranges suitable for this approach.

Incorrect. AWS Config rules evaluate resources after they exist (detective control). Even with remediation via Systems Manager, noncompliant EBS volumes or SQS queues could be created during a CloudFormation operation and only corrected later. This violates the requirement to enforce the policy before any stack create/update runs. Config is excellent for continuous compliance reporting, not pre-provision blocking.

Incorrect for this question’s intent. SCPs can deny API actions and are preventive, but they are not evaluated “as a CloudFormation pre-check” and can be difficult to implement reliably for property-level requirements like enforcing a specific KMS key alias across multiple services. SCP conditions for KMS key alias usage are often nontrivial and can lead to false positives/negatives or operational breakage.

Incorrect. A Lambda-based scanner that assumes roles and inspects stacks is reactive and cannot reliably stop a CloudFormation create/update before resources are provisioned. It introduces timing/race conditions, additional operational complexity, and inconsistent enforcement across Regions/accounts. This approach is also less aligned with AWS best practices compared to native preventive controls like CloudFormation Hooks.

This option relies on storing logs in Amazon S3 and analyzing them with Athena and QuickSight, which creates significant operational overhead for schema management, query development, dashboard maintenance, and long-term log handling. Although it can provide reporting, it does not offer the same managed threat investigation experience as Amazon Detective. It also does not best meet the requirement for rapid investigation because analysts would need to manually correlate events across multiple datasets. For an exam question emphasizing low overhead and fast security analysis, this is not the strongest choice.

CloudWatch Container Insights is primarily an observability service for container and cluster performance metrics, not a managed threat detection or security investigation service. While CloudTrail logs in S3 can be queried with Athena and visualized in QuickSight, that again increases raw log management overhead and requires manual analysis. The option also lacks GuardDuty, which is the AWS managed service that detects suspicious activity from EKS audit logs, API calls, and network-related telemetry. Therefore, it does not adequately address the security detection and investigation requirements.

This option improves detection coverage by combining GuardDuty, CloudTrail, and VPC Flow Logs, but it still falls short of the requirement for a single summarized view across all AWS accounts and rapid investigation. GuardDuty generates findings, but Amazon Detective is the service that provides the investigation graph, entity relationships, and cross-account summarized analysis experience. Adding Container Insights does not solve the security investigation requirement because it is focused on operational telemetry rather than threat analysis. As a result, D is a strong partial solution for detection, but not the best complete solution for both detection and investigation.

Incorrect. AWS KMS does not have a native feature to publish SNS notifications based on key age or time since last rotation. KMS can emit API activity to CloudTrail, but it does not generate an event like “key older than 120 days” or “rotation overdue” that you can directly subscribe to. You must implement evaluation logic using services like AWS Config or scheduled Lambda checks.

Incorrect. Trusted Advisor is not the right control plane for verifying KMS key rotation recency for customer managed keys with manual rotation requirements. Trusted Advisor checks are limited and do not provide a customizable, per-key “last rotated within 120 days” evaluation for imported key material scenarios. Also, relying on a periodic EventBridge+Lambda call to Trusted Advisor is indirect and not a strong compliance pattern compared to AWS Config.

Incorrect. AWS Security Hub aggregates findings from integrated products and some AWS security checks, but it does not provide a built-in, configurable control to alert specifically when a customer managed KMS key has not been manually rotated within 120 days, especially for imported key material workflows. Security Hub is better for centralized posture management, not custom time-since-rotation compliance logic.