Examkin

Tüm alıştırma soruları

27 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 21Soru →

A financial services company manages its multi-account environment using AWS Organizations. The security team mandates that all Amazon EBS volumes across all member accounts must be backed up daily, and the backups must be stored in a central vault. The company wants to delegate the administration of these backup policies to a dedicated backup-admin account, minimizing the use of the Organizations management account.

Arrange the correct sequence of steps to configure this centralized backup governance model across the organization.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order begins with enabling the Backup policy type in the management account, followed by registering the delegated administrator, creating the destination backup vault and access policy, creating the backup policy, and finally attaching the policy to the target OUs.
The correct sequence ensures that prerequisites are met at each stage: enabling the policy type, delegating administrative rights, establishing the target storage resource with access controls, defining the compliance policy, and finally applying it to the resource hierarchy.

Adım Adım Çözüm

1
Enable Backup policies in the Organizations management account.
The organization configuration is updated to support Backup policies.
Backup policies cannot be created or managed by any account until the policy type is enabled at the root organization level.
2
Register the backup-admin account as the delegated administrator for AWS Backup.
The backup-admin account receives administrative authority for Backup policies across the organization.
The management account must explicitly grant delegated permissions before the member account can perform administrative actions.
3
Create the centralized Backup vault and associate a cross-account vault access policy in the backup-admin account.
A vault is established that permits recovery points from other accounts in the organization.
Without a valid destination vault ARN and a policy granting cross-account write permissions, backups sent by member accounts will be rejected.
4
Create the Backup policy in the backup-admin account.
A JSON Backup policy is defined within the organization.
The policy must be created with correct plan details and destination vault configurations before it can be distributed.
5
Attach the Backup policy to the target OUs in the backup-admin account.
The backup schedule is applied to all accounts and EBS resources within the target OUs.
Attaching the policy initiates and enforces the backup schedule across the specified resources in the member accounts.

Anahtar Kavram

Delegated administration in AWS Organizations allows member accounts to manage specific service policies, reducing the operational burden on the management account.
Tahmini Süre:2m 0s
Soru 22Soru →

An enterprise is designing a secure multi-account governance strategy using AWS Organizations. The security team wants to establish a secure, managed landing zone with automated account provisioning, centralized logging, and strict service control policies (SCPs) to prevent member accounts from disabling security monitoring. Arrange the following steps in the correct sequence to configure and secure this multi-account environment, ensuring that guardrails are active before member accounts begin deploying workloads.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: Deploy AWS Control Tower in the management account, register the Audit account as the delegated administrator, enable security services from the Audit account, attach the protective SCP from the management account, and finally provision member accounts.
The correct sequence begins with deploying AWS Control Tower to establish the landing zone, which creates the foundational OUs and core accounts (including the Audit account). Once the Audit account exists, delegated administration is configured from the management account, allowing the Audit account to manage security services organization-wide. The Audit account then enables GuardDuty and Security Hub. Next, the management account applies SCPs to member OUs to prevent disabling these monitoring tools, establishing the necessary guardrails. Finally, workload accounts are provisioned via Account Factory, ensuring they are governed by the established security baselines and SCPs from the moment of creation.

Adım Adım Çözüm

1
Deploy AWS Control Tower in the management account.
Establishes the foundational landing zone, OUs, and core accounts (Log Archive and Audit).
Creates the target accounts and OUs needed for delegation and policy attachment.
2
Designate the Audit account as the delegated administrator for GuardDuty and Security Hub from the management account.
Grants the Audit account organization-wide management permissions for the security services.
The Audit account cannot enable or configure services across other accounts without this delegation.
3
Enable and configure GuardDuty and Security Hub for all accounts from the Audit account.
Security monitoring is active across the organization.
Ensures that all member accounts are baseline-monitored before restricting changes or adding workloads.
4
Attach a protective SCP to member OUs from the management account.
Member accounts are restricted from disabling or modifying GuardDuty and Security Hub.
Establishes policy-based guardrails to maintain security posture.
5
Provision member accounts using AWS Control Tower Account Factory.
New member accounts are created with full guardrails and monitoring enabled from day one.
Ensures no unmonitored window of time exists for new workloads.

Anahtar Kavram

Multi-Account Security Governance and Control Delegation
Soru 23Soru →

A financial services corporation is establishing a multi-account compliance auditing architecture using AWS Organizations. The solutions architect needs to configure AWS Config at the organization level to automatically record resource configurations and evaluate compliance using custom rules. The architect decides to delegate administrative capabilities to a dedicated Security tooling account instead of using the Organizations management account for daily compliance management. Arrange the following steps in the correct logical sequence to successfully configure this delegated compliance monitoring setup.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct logical sequence is to first enable trusted access for AWS Config in the Organizations management account, then register the Security tooling account as the delegated administrator, followed by creating the organization aggregator in the Security account, and finally deploying the organization conformance packs from the Security account.
To successfully establish delegated administration for compliance monitoring, trusted access for AWS Config must first be enabled in the Organizations management account. Next, the management account registers the Security tooling account as the delegated administrator. Finally, from this delegated admin account, the organization aggregator is created to gather configuration details, and the organization conformance packs are deployed to apply the compliance rules across the member accounts.

Adım Adım Çözüm

1
Enable trusted access for AWS Config (config.amazonaws.com) from the AWS Organizations management account.
AWS Config is granted permission to call AWS Organizations APIs to retrieve account list and structure details.
This is a prerequisite for registering a delegated administrator. Without trusted access, AWS Config cannot interact with the Organization's members.
2
Register the Security tooling account as the delegated administrator for AWS Config from the management account.
The Security tooling account receives permissions to manage AWS Config settings and deploy resources across the entire organization.
The delegated administrator registration authorizes the member account to perform administrative tasks on behalf of the organization.
3
Create an organization aggregator within the registered Security tooling account.
A centralized dashboard is created that aggregates configuration history and compliance status from all accounts and regions.
Establishing the aggregation framework first ensures that compliance data generated by rules is immediately collected and visible.
4
Deploy organization conformance packs from the Security tooling account.
Config rules and remediation actions are automatically deployed and run in all existing and future member accounts.
Conformance packs contain the actual compliance rules that evaluate the resources, completing the configuration setup.

Anahtar Kavram

Delegated Administration in AWS Organizations
Soru 24Soru →

An enterprise is establishing centralized security monitoring across its multi-account environment using AWS Organizations. A solutions architect needs to configure Amazon GuardDuty so that all security alerts are consolidated into a dedicated Security Tooling member account. The solution must ensure that member accounts cannot disable GuardDuty or modify its configurations, while allowing the Security Tooling account to manage the service.

Arrange the following steps in the correct chronological sequence to implement this governance and security architecture.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of steps is to first enable trusted access for Amazon GuardDuty from the AWS Organizations management account, then designate the Security Tooling account as the delegated administrator from the management account. After delegation, attach a Service Control Policy (SCP) to the member OUs restricting GuardDuty modifications while exempting the delegated administrator. Finally, sign in to the Security Tooling account to enable GuardDuty and configure it to automatically enable the service for all current and future member accounts.
The correct sequence begins with the AWS Organizations management account enabling trusted access for GuardDuty, which is a prerequisite for delegation. The management account then registers the dedicated Security Tooling account as the delegated administrator. Next, the solutions architect secures the deployment by attaching an SCP to the member OUs to prevent local modification of GuardDuty settings, ensuring the delegated administrator role is exempted from this restriction. Finally, the solutions architect signs in to the Security Tooling account to enable the service and configure automatic onboarding for all current and future member accounts.

Adım Adım Çözüm

1
Enable trusted access for Amazon GuardDuty from the AWS Organizations management account.
Enables integration between AWS Organizations and Amazon GuardDuty.
Before a member account can be registered as a delegated administrator, the service principal must be granted trusted access to the Organization's structure.
2
Register the Security Tooling account as the delegated administrator for GuardDuty from the management account.
Grants the Security Tooling account permission to manage GuardDuty for the organization.
Delegated administration shifts operational control of the security service from the management account to the designated security account, adhering to the principle of least privilege.
3
Apply a Service Control Policy (SCP) to member OUs to prevent disabling GuardDuty.
Restricts member accounts from tampering with GuardDuty detector status, while allowing the delegated administrator role to perform its tasks.
SCPs establish organization-wide guardrails. To prevent member accounts from deleting or disabling the security monitoring, the policy must deny these APIs, while using a condition to exempt the admin role/account.
4
Enable and configure GuardDuty in the Security Tooling account to auto-enable for all member accounts.
Activates monitoring across all current and future member accounts.
With administrative authority delegated and governance guardrails active, the security tooling account can enable the service centrally and ensure immediate coverage for any new accounts joined to the organization.

Anahtar Kavram

Delegated administration and centralized security governance in AWS Organizations allow operational tasks to be securely managed from a dedicated security account, enforced by organization-wide SCP guardrails.
Tahmini Süre:3m 0s
Soru 25Soru →

A solutions architect is establishing a governed multi-account environment for an enterprise using AWS Control Tower. The architect needs to initialize the landing zone, enforce corporate compliance guardrails, and onboard the first set of application team accounts. Arrange the steps to design and implement this multi-account governance structure in the correct chronological sequence.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence starts with configuring the AWS Organizations management account, followed by deploying the AWS Control Tower Landing Zone to establish the Security OU and core accounts. Next, preventative guardrails must be applied to the target OUs. Then, operational member accounts can be provisioned via Account Factory. Finally, the Customizations for AWS Control Tower pipeline is triggered to bootstrap resources inside the enrolled accounts.
Establishing a secure multi-account environment requires building from the foundational organization structure up to the account level. The correct path starts with designating the management account and setting up AWS Organizations. Next, the AWS Control Tower Landing Zone is deployed to establish core security OUs and shared accounts (Log Archive and Audit). Guardrails and SCPs are then applied to OUs to ensure governance boundaries are active. Only after the OUs are secured are operational member accounts provisioned using Account Factory, followed by CfCT pipelines to deploy application-specific resources and configurations within those accounts.

Adım Adım Çözüm

1
Set up the management account.
An AWS Organization is initialized with a designated management account.
AWS Control Tower orchestration requires a management account to launch the landing zone.
2
Deploy the Landing Zone.
Security OUs, Log Archive, and Audit accounts are provisioned and integrated.
This establishes the core administrative and security baseline of the landing zone.
3
Enable Service Control Policies (SCPs) on OUs.
The target OUs are configured with mandatory compliance restrictions.
Applying guardrails at the OU level first ensures that any account created under or moved to these OUs is instantly compliant.
4
Use AWS Control Tower Account Factory to provision member accounts.
New member accounts are created, registered with Control Tower, and placed under the governed OUs.
Member accounts should be created using the standardized Account Factory after the target OUs and guardrails are already defined.
5
Apply post-provisioning customizations via CfCT.
Resources such as IAM roles, KMS keys, and local VPC configurations are deployed to the new member accounts.
Customizations are applied to bootstrap accounts after they are successfully created and registered.

Anahtar Kavram

AWS Control Tower Landing Zone Setup and Account Lifecycle Management
Soru 26Soru →

A Solutions Architect needs to set up centralized security monitoring across all AWS accounts in an organization using AWS Organizations. The architect wants to delegate security administration to a dedicated Security Tooling account and implement standardized security controls across different Organizational Units (OUs) using AWS Security Hub.

Arrange the steps in the correct order to configure AWS Security Hub with delegated administration and centralized configuration management.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts by enabling trusted access for Security Hub in the organization management account, followed by designating the Security Tooling account as the delegated administrator. Next, Security Hub is enabled and member accounts are associated from the delegated administrator account, and finally, centralized configuration policies are applied to the targeted Organizational Units (OUs).
To successfully establish central security governance using AWS Security Hub, you must first enable trusted access from the Organizations management account. Once trusted access is enabled, you can designate a member account (the Security Tooling account) as the delegated administrator. Following delegation, all administrative tasks, including enabling member accounts and applying configuration policies to OUs, must be executed directly from the designated delegated administrator account, not the management account.

Adım Adım Çözüm

1
Enable trusted access in the management account.
Allows AWS Organizations to integrate and share organizational structure information with AWS Security Hub.
This is a prerequisite for registering a delegated administrator in AWS Organizations.
2
Designate the Security Tooling account as the delegated administrator.
Gives the Security Tooling account permissions to manage Security Hub settings and policies for the organization.
Delegation allows management of security services to be segregated from the Organizations management account, conforming to the principle of least privilege.
3
Enable Security Hub and associate member accounts from the Security Tooling account.
Registers all current member accounts under the centralized Security Hub administration scope.
The delegated administrator must bring the accounts under management before standard configurations can be pushed to them.
4
Create and apply Security Hub configuration policies.
Applies security standards and checks consistently across target OUs.
Centralized configuration management allows targeting specific OUs with customized or standard security requirements.

Anahtar Kavram

Delegated Administration in AWS Organizations
Soru 27Soru →

A solutions architect is implementing region-restriction Service Control Policies (SCPs) across an organization in AWS Organizations. The architect needs to ensure that the restrictions do not disrupt existing applications or logging workflows, and that they are applied safely.

Arrange the steps in the correct order to design, test, and safely deploy the SCPs.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with creating the SCP in the management account, followed by attaching it to a test OU. Next, validation testing is performed within the test OU, after which the policy is applied to the production OUs. Finally, centralized CloudTrail logs are monitored to verify enforcement and detect unexpected access denials.
The correct order ensures that policies are authored centrally, tested in an isolated non-production environment first, verified before being promoted to production accounts, and monitored via centralized logs to catch any unforeseen impacts.

Adım Adım Çözüm

1
Create the SCP in the AWS Organizations management account.
The SCP is stored in the management account and is ready to be attached.
SCPs must be authored centrally in the Organizations management account.
2
Attach the SCP to a testing OU.
The policy takes effect only on the accounts residing in the testing OU.
Applying guardrails to a test OU prevents accidental outages in production during the testing phase.
3
Perform validation testing.
Verify that resource creation succeeds in permitted regions and fails in restricted regions.
Active testing verifies that policy logic works as intended and does not block critical infrastructure operations.
4
Attach the SCP to the production OUs.
The policy is enforced across all production accounts under those OUs.
Once the SCP is proven safe, it is applied to the production environment to meet governance requirements.
5
Monitor centralized CloudTrail logs.
Analyze blocked API actions to detect misconfigured services or applications.
Continuous auditing helps identify production applications that may require modifications or exemptions.

Anahtar Kavram

Phased implementation and validation of Service Control Policies in a multi-account structure
ÖncekiSayfa 2 / 2
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin