Exam Bundle

AWS CloudTrail records API requests and account management events. This does not address the need for A new cloud organization needs a standardized account foundation with governance guardrails. The appropriate AWS Control Tower applies because Control Tower establishes and governs a multi-account AWS landing zone with defined guardrails.

AWS Budgets can track configured cost and usage thresholds and send alerts. This does not address the need for A new cloud organization needs a standardized account foundation with governance guardrails. The appropriate AWS Control Tower applies because Control Tower establishes and governs a multi-account AWS landing zone with defined guardrails.

AWS Config alone records configuration and rules but is not a complete multi-account landing-zone solution. This does not address the need for A new cloud organization needs a standardized account foundation with governance guardrails. The appropriate AWS Control Tower applies because Control Tower establishes and governs a multi-account AWS landing zone with defined guardrails.

Any edge cache location is for distribution rather than authoritative regulated data placement. That does not meet the requirement: A regulated company must keep primary application data within an approved geographical jurisdiction.

Random global routing: Does not provide a planned regional routing and failover policy. That does not meet the requirement: A regulated company must keep primary application data within an approved geographical jurisdiction.

Single IAM group: Groups IAM users but does not automatically span AWS accounts or supply governance. That does not meet the requirement: A regulated company must keep primary application data within an approved geographical jurisdiction.

Single IAM group: Groups IAM users but does not automatically span AWS accounts or supply governance. This does not address the need for A regulated company must keep primary application data within an approved geographical jurisdiction. The appropriate Region selection and residency controls applies because Choosing appropriate Regions and data placement helps meet data residency constraints, subject to service-specific data flows.

Random global routing: Does not provide a planned regional routing and failover policy. This does not address the need for A regulated company must keep primary application data within an approved geographical jurisdiction. The appropriate Region selection and residency controls applies because Choosing appropriate Regions and data placement helps meet data residency constraints, subject to service-specific data flows.

Any edge cache location is for distribution rather than authoritative regulated data placement. This does not address the need for A regulated company must keep primary application data within an approved geographical jurisdiction. The appropriate Region selection and residency controls applies because Choosing appropriate Regions and data placement helps meet data residency constraints, subject to service-specific data flows.

AdministratorAccess for everyone grants broad administrator privileges rather than narrowly scoped access. That does not meet the requirement: Consider this AWS requirement: A new reporting user should only read one approved resource and nothing more.

Unrestricted wildcard permissions: Permit excessive actions or resources contrary to least privilege. That does not meet the requirement: Consider this AWS requirement: A new reporting user should only read one approved resource and nothing more.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. That does not meet the requirement: Consider this AWS requirement: A new reporting user should only read one approved resource and nothing more.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. This does not address the need for A new reporting user should only read one approved resource and nothing more. The appropriate Least-privilege IAM policy applies because Least privilege grants only actions and resources required for a role's tasks.

AdministratorAccess for everyone grants broad administrator privileges rather than narrowly scoped access. This does not address the need for A new reporting user should only read one approved resource and nothing more. The appropriate Least-privilege IAM policy applies because Least privilege grants only actions and resources required for a role's tasks.

Unrestricted wildcard permissions: Permit excessive actions or resources contrary to least privilege. This does not address the need for A new reporting user should only read one approved resource and nothing more. The appropriate Least-privilege IAM policy applies because Least privilege grants only actions and resources required for a role's tasks.

Unrestricted wildcard permissions: Permit excessive actions or resources contrary to least privilege. That does not meet the requirement: A contractor requires narrowly scoped API permissions limited to assigned work.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. That does not meet the requirement: A contractor requires narrowly scoped API permissions limited to assigned work.

AdministratorAccess for everyone grants broad administrator privileges rather than narrowly scoped access. That does not meet the requirement: A contractor requires narrowly scoped API permissions limited to assigned work.

AdministratorAccess for everyone grants broad administrator privileges rather than narrowly scoped access. This does not address the need for A contractor requires narrowly scoped API permissions limited to assigned work. The appropriate Least-privilege IAM policy applies because Least privilege grants only actions and resources required for a role's tasks.

Unrestricted wildcard permissions: Permit excessive actions or resources contrary to least privilege. This does not address the need for A contractor requires narrowly scoped API permissions limited to assigned work. The appropriate Least-privilege IAM policy applies because Least privilege grants only actions and resources required for a role's tasks.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. This does not address the need for A contractor requires narrowly scoped API permissions limited to assigned work. The appropriate Least-privilege IAM policy applies because Least privilege grants only actions and resources required for a role's tasks.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. That does not meet the requirement: A technical reviewer evaluates this need: An EC2 application needs access to S3 without putting long-term access keys into its code.

Hard-coded access keys: Embed long-lived credentials in code, increasing exposure and rotation difficulty. That does not meet the requirement: A technical reviewer evaluates this need: An EC2 application needs access to S3 without putting long-term access keys into its code.

IAM user password in code: Exposes credentials in source files instead of using temporary workload credentials. That does not meet the requirement: A technical reviewer evaluates this need: An EC2 application needs access to S3 without putting long-term access keys into its code.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. This does not address the need for An EC2 application needs access to S3 without putting long-term access keys into its code. The appropriate IAM role applies because IAM roles provide assumed temporary credentials to workloads rather than distributing embedded long-lived secrets.

Hard-coded access keys: Embed long-lived credentials in code, increasing exposure and rotation difficulty. This does not address the need for An EC2 application needs access to S3 without putting long-term access keys into its code. The appropriate IAM role applies because IAM roles provide assumed temporary credentials to workloads rather than distributing embedded long-lived secrets.

IAM user password in code: Exposes credentials in source files instead of using temporary workload credentials. This does not address the need for An EC2 application needs access to S3 without putting long-term access keys into its code. The appropriate IAM role applies because IAM roles provide assumed temporary credentials to workloads rather than distributing embedded long-lived secrets.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. That does not meet the requirement: A Lambda function must access DynamoDB using role-based temporary credentials.

Hard-coded access keys: Embed long-lived credentials in code, increasing exposure and rotation difficulty. That does not meet the requirement: A Lambda function must access DynamoDB using role-based temporary credentials.

IAM user password in code: Exposes credentials in source files instead of using temporary workload credentials. That does not meet the requirement: A Lambda function must access DynamoDB using role-based temporary credentials.

Hard-coded access keys: Embed long-lived credentials in code, increasing exposure and rotation difficulty. This does not address the need for A Lambda function must access DynamoDB using role-based temporary credentials. The appropriate IAM role applies because IAM roles provide assumed temporary credentials to workloads rather than distributing embedded long-lived secrets.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. This does not address the need for A Lambda function must access DynamoDB using role-based temporary credentials. The appropriate IAM role applies because IAM roles provide assumed temporary credentials to workloads rather than distributing embedded long-lived secrets.

IAM user password in code: Exposes credentials in source files instead of using temporary workload credentials. This does not address the need for A Lambda function must access DynamoDB using role-based temporary credentials. The appropriate IAM role applies because IAM roles provide assumed temporary credentials to workloads rather than distributing embedded long-lived secrets.