Controls (guardrails) quiz · Level 0

Question 1Todo.io's auditors require that nobody in the Prod account can ever stop CloudTrail logging. Which control meets the requirement?

An SCP on the Prod OU that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.Correct. "Can ever" asks for a preventive control. An SCP Deny blocks the API call for everyone in the account, administrators and root included.An AWS Config rule that checks CloudTrail is turned on.Not this one. Config is detective: it tells you after logging was stopped. The requirement says it must never happen.A CloudWatch alarm that emails the security team when logging stops.Not this one. An alarm also fires after the fact. Being told isn't the same as preventing it.Remove cloudtrail:StopLogging from every IAM policy in the account.Not this one. Anyone who can edit IAM policies could add it back. An SCP sits outside the account, where they can't change it.

Learn it: SCP (service control policy) · Controls (guardrails) · Set up AWS: Day 0 with Control Tower

Question 2Todo.io may only run in us-east-1 and eu-west-1, in every account, now and in future accounts. What enforces that?

An SCP attached to the organization's root, at the top of the tree, that denies requests outside those two Regions.Correct. A preventive guardrail at the top of the tree covers every member account, including ones created later. (As always, SCPs skip the management account.) Global services such as IAM are left out of a Region rule.An IAM policy on every user and role that only allows those Regions.Not this one. Anyone who can edit IAM policies can remove it, and every new user or role needs it added.An AWS Config rule that flags resources in other Regions.Not this one. Config reports after the fact. The requirement says it may only run there.Deleting the default VPC in every other Region.Not this one. Many services don't need a VPC at all, and anyone can create a new VPC.

Learn it: SCP (service control policy) · Controls (guardrails) · Region

Question 3Todo.io wants to be told whenever an S3 bucket in any account becomes public. Teams must still be able to make the change. Which kind of Control Tower control fits?

A detective control.Correct. Detective controls are AWS Config rules. They spot something after it happens and report it, without blocking it. "Be told" is the clue.A preventive control.Not this one. Preventive controls are SCPs. They would block the change, which the requirement doesn't want.A proactive control.Not this one. Proactive controls check CloudFormation templates before resources are created. Buckets changed in the console would be missed.A mandatory control.Not this one. "Mandatory" says a control is always on, not what kind it is.

Learn it: Controls (guardrails)

Question 4Todo.io deploys everything with CloudFormation. It wants each resource checked against its rules before CloudFormation creates it. Which kind of Control Tower control fits?

A proactive control.Correct. Proactive controls are CloudFormation hooks: they check a resource before it is created.A detective control.Not this one. Detective controls check after the resource exists.A preventive control.Not this one. Preventive controls are SCPs that block API calls. They don't look at what a template is about to create.An elective control.Not this one. "Elective" means optional. It doesn't say when the check happens.

Learn it: Controls (guardrails)

Question 5Which statement about Control Tower's controls is true?

Some are mandatory and always on. Others are strongly recommended or elective, and you choose where to turn them on.Correct. Mandatory controls protect the landing zone itself, such as its logging. The rest you enable per OU.Every control is a preventive SCP.Not this one. Controls are preventive (SCPs), detective (Config rules) or proactive (CloudFormation hooks).Every control is optional.Not this one. Mandatory controls can't be turned off.Controls only apply to the management account.Not this one. Controls are applied to OUs, so they reach the accounts in them.

Learn it: Controls (guardrails)

Question 6A Config rule checks that no S3 bucket is public. A teammate makes a bucket public. Does the rule stop it?

No. Config reports the bucket as noncompliant after the change; it doesn't block it.Correct. Config is detective. You can attach a remediation that fixes it afterwards, but blocking needs a preventive control such as an SCP.Yes. Config rules block changes that break them.Not this one. Config evaluates after the fact.Yes, by deleting the bucket.Not this one. Config never deletes resources on its own.Only if CloudTrail is turned off.Not this one. CloudTrail has nothing to do with it.

Learn it: AWS Config · Control Tower controls

Question 7What are Control Tower's detective controls built from?

AWS Config rules.Correct. They spot problems after they happen and report them.Service control policies.Not this one. SCPs are the preventive controls.CloudFormation hooks.Not this one. Hooks are the proactive controls.IAM policies in each account.Not this one. Controls are applied across OUs, not written into each account's IAM.

Learn it: AWS Config · Controls (guardrails)

Question 8Which requirement points to AWS Config rather than an SCP?

"Report on any resource that isn't tagged with its owner."Correct. "Report on", "find out when" and "show evidence" are detective words: Config."It must never be possible to disable CloudTrail."Not this one. "Must never" asks for a preventive control: an SCP."Block any request outside approved Regions."Not this one. Blocking is preventive."Prevent anyone from leaving the organization."Not this one. Preventing is preventive.

Learn it: Controls (guardrails)

Question 9What does "Controls (guardrails)" mean?

Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.Correct. Think of it as: Locked doors, CCTV, and a plan check before building work starts.Control Tower's way to create new AWS accounts from a standard template.Not this one. That describes Account Factory.A ready-made, well-run multi-account AWS environment that your apps can "land" in.Not this one. That describes Landing zone.Sets up and governs a multi-account AWS environment (a landing zone) for you.Not this one. That describes AWS Control Tower.

Learn it: Controls (guardrails)

Question 10Which term is this? "Control Tower's rules for every account in an OU. Some block, some report, some check before deploying."

Controls (guardrails)Correct. Yes. Think of it as: Locked doors, CCTV, and a plan check before building work starts.Account FactoryNot this one. Account Factory is: Control Tower's way to create new AWS accounts from a standard template.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you.

Learn it: Controls (guardrails)

Question 11Which AWS term is described by this analogy? "Locked doors, CCTV, and a plan check before building work starts."

Controls (guardrails)Correct. Yes: Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.Account FactoryNot this one. Account Factory is: Control Tower's way to create new AWS accounts from a standard template. Its analogy: A vending machine for pre-furnished flats.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in. Its analogy: A finished business park, with roads, security gates, CCTV and empty units ready to rent.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you. Its analogy: A developer who builds the whole apartment complex to code, then inspects it regularly.

Learn it: Controls (guardrails)

Controls (guardrails)

Worth another look

Your weak spots

Services

Concepts