Exam Bundle

Transport-only TLS encrypts traffic in transit but does not by itself encrypt stored data. This does not address the need for A company wants stored database records encrypted when data resides on persistent storage. The appropriate Encryption at rest applies because Encryption at rest protects persisted data on storage media independently from transit security.

Open network ACL permits wider subnet traffic rather than implementing the requested least-privilege restriction. This does not address the need for A company wants stored database records encrypted when data resides on persistent storage. The appropriate Encryption at rest applies because Encryption at rest protects persisted data on storage media independently from transit security.

Public internet routing: Routes through internet paths rather than using the requested private connectivity. This does not address the need for A company wants stored database records encrypted when data resides on persistent storage. The appropriate Encryption at rest applies because Encryption at rest protects persisted data on storage media independently from transit security.

Transport-only TLS encrypts traffic in transit but does not by itself encrypt stored data. That does not meet the requirement: An archive owner needs ciphertext protection for objects saved to storage rather than only network links.

Public internet routing: Routes through internet paths rather than using the requested private connectivity. That does not meet the requirement: An archive owner needs ciphertext protection for objects saved to storage rather than only network links.

Open network ACL permits wider subnet traffic rather than implementing the requested least-privilege restriction. That does not meet the requirement: An archive owner needs ciphertext protection for objects saved to storage rather than only network links.

Transport-only TLS encrypts traffic in transit but does not by itself encrypt stored data. This does not address the need for An archive owner needs ciphertext protection for objects saved to storage rather than only network links. The appropriate Encryption at rest applies because Encryption at rest protects persisted data on storage media independently from transit security.

Open network ACL permits wider subnet traffic rather than implementing the requested least-privilege restriction. This does not address the need for An archive owner needs ciphertext protection for objects saved to storage rather than only network links. The appropriate Encryption at rest applies because Encryption at rest protects persisted data on storage media independently from transit security.

Public internet routing: Routes through internet paths rather than using the requested private connectivity. This does not address the need for An archive owner needs ciphertext protection for objects saved to storage rather than only network links. The appropriate Encryption at rest applies because Encryption at rest protects persisted data on storage media independently from transit security.

Amazon CloudWatch: CloudWatch collects operational metrics and logs and supports alarms and dashboards. That does not meet the requirement: Consider this AWS requirement: A company manages many AWS accounts and wants central policy boundaries and account organization.

AWS Artifact supplies compliance reports and agreements. That does not meet the requirement: Consider this AWS requirement: A company manages many AWS accounts and wants central policy boundaries and account organization.

AWS IAM users: Represent identities within an account, not multi-account governance structures. That does not meet the requirement: Consider this AWS requirement: A company manages many AWS accounts and wants central policy boundaries and account organization.

AWS IAM users: Represent identities within an account, not multi-account governance structures. This does not address the need for A company manages many AWS accounts and wants central policy boundaries and account organization. The appropriate AWS Organizations applies because AWS Organizations centralizes account governance and supports organization policies such as SCPs.

AWS Artifact supplies compliance reports and agreements. This does not address the need for A company manages many AWS accounts and wants central policy boundaries and account organization. The appropriate AWS Organizations applies because AWS Organizations centralizes account governance and supports organization policies such as SCPs.

Amazon CloudWatch: CloudWatch collects operational metrics and logs and supports alarms and dashboards. This does not address the need for A company manages many AWS accounts and wants central policy boundaries and account organization. The appropriate AWS Organizations applies because AWS Organizations centralizes account governance and supports organization policies such as SCPs.

AWS Artifact supplies compliance reports and agreements. That does not meet the requirement: A platform team must group AWS accounts into organizational units and apply central governance controls.

AWS IAM users: Represent identities within an account, not multi-account governance structures. That does not meet the requirement: A platform team must group AWS accounts into organizational units and apply central governance controls.

Amazon CloudWatch: CloudWatch collects operational metrics and logs and supports alarms and dashboards. That does not meet the requirement: A platform team must group AWS accounts into organizational units and apply central governance controls.

AWS IAM users: Represent identities within an account, not multi-account governance structures. This does not address the need for A platform team must group AWS accounts into organizational units and apply central governance controls. The appropriate AWS Organizations applies because AWS Organizations centralizes account governance and supports organization policies such as SCPs.

AWS Artifact supplies compliance reports and agreements. This does not address the need for A platform team must group AWS accounts into organizational units and apply central governance controls. The appropriate AWS Organizations applies because AWS Organizations centralizes account governance and supports organization policies such as SCPs.

Amazon CloudWatch: CloudWatch collects operational metrics and logs and supports alarms and dashboards. This does not address the need for A platform team must group AWS accounts into organizational units and apply central governance controls. The appropriate AWS Organizations applies because AWS Organizations centralizes account governance and supports organization policies such as SCPs.

AWS CloudTrail records API requests and account management events. That does not meet the requirement: A technical reviewer evaluates this need: A business wants guided, multi-account landing zone setup with preventive and detective controls.

AWS Config alone records configuration and rules but is not a complete multi-account landing-zone solution. That does not meet the requirement: A technical reviewer evaluates this need: A business wants guided, multi-account landing zone setup with preventive and detective controls.

AWS Budgets can track configured cost and usage thresholds and send alerts. That does not meet the requirement: A technical reviewer evaluates this need: A business wants guided, multi-account landing zone setup with preventive and detective controls.

AWS Budgets can track configured cost and usage thresholds and send alerts. This does not address the need for A business wants guided, multi-account landing zone setup with preventive and detective controls. The appropriate AWS Control Tower applies because Control Tower establishes and governs a multi-account AWS landing zone with defined guardrails.

AWS CloudTrail records API requests and account management events. This does not address the need for A business wants guided, multi-account landing zone setup with preventive and detective controls. The appropriate AWS Control Tower applies because Control Tower establishes and governs a multi-account AWS landing zone with defined guardrails.

AWS Config alone records configuration and rules but is not a complete multi-account landing-zone solution. This does not address the need for A business wants guided, multi-account landing zone setup with preventive and detective controls. The appropriate AWS Control Tower applies because Control Tower establishes and governs a multi-account AWS landing zone with defined guardrails.

AWS CloudTrail records API requests and account management events. That does not meet the requirement: A new cloud organization needs a standardized account foundation with governance guardrails.

AWS Budgets can track configured cost and usage thresholds and send alerts. That does not meet the requirement: A new cloud organization needs a standardized account foundation with governance guardrails.

AWS Config alone records configuration and rules but is not a complete multi-account landing-zone solution. That does not meet the requirement: A new cloud organization needs a standardized account foundation with governance guardrails.

AWS CloudTrail records API requests and account management events. This does not address the need for A new cloud organization needs a standardized account foundation with governance guardrails. The appropriate AWS Control Tower applies because Control Tower establishes and governs a multi-account AWS landing zone with defined guardrails.

AWS Budgets can track configured cost and usage thresholds and send alerts. This does not address the need for A new cloud organization needs a standardized account foundation with governance guardrails. The appropriate AWS Control Tower applies because Control Tower establishes and governs a multi-account AWS landing zone with defined guardrails.

AWS Config alone records configuration and rules but is not a complete multi-account landing-zone solution. This does not address the need for A new cloud organization needs a standardized account foundation with governance guardrails. The appropriate AWS Control Tower applies because Control Tower establishes and governs a multi-account AWS landing zone with defined guardrails.