Task 4.1: Implement and manage security and compliance tools and policies.

• AIAM Access Analyzer external access findings for the account

  Incorrect

  External access analyzers identify resources that are shared with an external entity. They do not evaluate one user's request.

• BThe IAM policy simulator in the IAM console

  Correct

  The simulator evaluates a user's identity policies, permissions boundary and SCPs for an action without sending a real request, shows which policy produced the result, and can test new policies that are not attached.

• CAWS Trusted Advisor security checks

  Incorrect

  Trusted Advisor inspects the environment against best practices and makes recommendations. It does not explain a specific denied request.

• DThe IAM credential report for the account

  Incorrect

  The credential report lists users and the status of their passwords, access keys and MFA devices, not policy decisions.

"Why is this call denied, and would this policy fix it?" is the policy simulator's question; it tests without touching the account.

• AAttach a permissions boundary that allows only the two Regions to every IAM user and role

  Incorrect

  A boundary is set on one IAM user or role at a time and limits only that entity. Roles created later would each need it too.

• BDeploy an AWS Config rule that flags resources created in other Regions

  Incorrect

  Config rules evaluate resources against a desired configuration. They report a violation after the fact instead of preventing it.

• CAttach an SCP that denies other values of aws:RequestedRegion, exempting global services

  Correct

  SCPs set the maximum permissions for IAM users and roles in member accounts, and aws:RequestedRegion compares the Region called. Global services such as IAM need an exemption because their endpoint is in us-east-1.

• DCreate IAM Identity Center permission sets that allow only the two Regions

  Incorrect

  Permission sets define the access that Identity Center assigns to its users and groups. They do not limit IAM users and roles that exist in the member accounts.

A preventive guardrail for every principal in member accounts is an SCP. The Region condition must exempt global services, or calls to IAM would be denied too.

• ATurn on default encryption with AWS KMS keys for the bucket

  Incorrect

  Encryption protects stored objects, but anyone the policy allows can still read them. S3 already encrypts new uploads by default.

• BTurn on S3 Versioning for the bucket

  Incorrect

  Versioning keeps earlier versions of objects. It changes nothing about who can read them.

• CTurn on S3 server access logging for the bucket

  Incorrect

  Access logs record requests, including public ones. They do not block any request.

• DTurn on all four Block Public Access settings

  Correct

  Block Public Access overrides policies that grant public access, so the public can no longer read the reports. The check then shows yellow, not red, until the public statement is also removed from the bucket policy.

The check turns red when public access is allowed and Block Public Access is off. Full Block Public Access removes the public grant's effect while IAM access inside the account keeps working; deleting the public statement from the bucket policy is the clean-up that turns the check green.

• AAn organization conformance pack, deployed from the management account

  Correct

  Conformance packs bundle Config rules and remediation actions, and AWS Config can deploy, update and delete them centrally across the member accounts of an organization.

• BThe same Config rules created by hand in each account's console

  Incorrect

  Rules created account by account work, but nothing manages or updates them centrally, which is what the team asked for.

• CAn AWS CloudTrail organization trail that logs events from all accounts

  Incorrect

  An organization trail logs API events for every account. It does not evaluate resource configurations against rules.

• DAmazon Inspector turned on in all member accounts

  Incorrect

  Inspector scans workloads for software vulnerabilities and network exposure; it does not run Config rules.

A rule set with remediation, deployed as one unit across an organization, is an organization conformance pack.

• AAttach an SCP to the account that sets a 90-day password expiration

  Incorrect

  SCPs only set the maximum available permissions for users and roles. They never grant permissions and do not configure password rules.

• BCreate an IAM Access Analyzer unused access analyzer for the account

  Incorrect

  An unused access analyzer reports unused access. It enforces neither password changes nor MFA.

• CDownload the IAM credential report every 90 days and email it to the affected users

  Incorrect

  The credential report shows the status of passwords, access keys and MFA devices. It does not force anyone to act.

• DSet an account password policy with a password expiration period of 90 days

  Correct

  The account password policy sets mandatory rotation periods for IAM users' passwords, and an expiration period takes effect immediately.

• EAttach a policy that denies all but MFA self-service actions when aws:MultiFactorAuthPresent is false

  Correct

  AWS's example policy denies everything except managing one's own MFA device unless the request was authenticated with MFA.

Password rotation is an account password policy setting; "nothing without MFA" is a deny statement conditioned on aws:MultiFactorAuthPresent.