AIAI Agent Dev Labaiagentdev-lab.com
Sign in to save progressSign in
Menu

SAP-C03 · LESSON 2

Security, Compliance, and Governance25% · 5 topics

SCPs set permission ceilings rather than granting access. Combine roles, resource policies, encryption and audits for least privilege. Add tool authorization and approvals for consequential actions alongside content controls. Validate residency across inference, logs and replication.

2.1Combine organizational governance and responsible AI

Concept

SCPs set permission ceilings rather than granting access. Combine roles, resource policies, encryption and audits for least privilege. Add tool authorization and approvals for consequential actions alongside content controls. Validate residency across inference, logs and replication.

How it works / steps

  1. Write requirements and success criteria first.
  2. Use a test environment and retain success and failure evidence.
  3. Review the result, then check your decisions with domain practice below.

Workplace example

Verify denied Regions and tool operations, including their audit evidence.

Common confusions and exam tips

Mini quiz

Q1. You are reviewing the OU structure in AWS Organizations. Which approach best follows AWS recommendations?

  1. Group accounts with similar governance needs, such as security, infrastructure and workloads (prod/dev), into the same OU
  2. Mirror the company org chart in OUs and move OUs and accounts at every reorganization
  3. Put all accounts in one OU and attach SCPs to each account individually
  4. Put prod and dev workloads in one account and create no OUs to limit accounts
Show answer and explanation

Answer: A Group accounts with similar governance needs, such as security, infrastructure and workloads (prod/dev), into the same OU

OUs are the unit for applying policies, so separate them by governance requirements (production, development, security and so on) rather than the org chart. You then do not need to move OUs on every reorganization.

Q2. Which statement about service control policies (SCPs) is incorrect?

  1. Actions explicitly denied by an SCP cannot be performed even if allowed by IAM policies in the member account
  2. SCPs do not apply to users and roles in the management account
  3. Actions allowed by an SCP can be performed by account users even if no IAM policy allows them
  4. SCPs also apply to the root user of member accounts
Show answer and explanation

Answer: C Actions allowed by an SCP can be performed by account users even if no IAM policy allows them

SCPs only set the maximum permissions and do not grant permissions. To actually perform an action, it must also be allowed by an IAM policy or similar.

Reference links

2.2Prescribe security controls

Concept

Organizational security controls combine prevention (SCPs, RCPs, IAM, permissions boundaries), detection (GuardDuty, Security Hub, Config, an organization CloudTrail trail) and response (EventBridge and automatic remediation). SCPs set the maximum permissions for principals (IAM users and roles), and RCPs (resource control policies) set the maximum access to resources, organization-wide. Manage security services centrally from a delegated administrator account.

How it works / steps

  1. Set up dedicated security and log accounts
  2. Configure delegated administrators for GuardDuty, Security Hub and Config, and enable them automatically in all accounts
  3. Prohibit dangerous actions with SCPs and restrict access to resources from outside the organization with RCPs
  4. Cap the permissions of roles developers create with permissions boundaries
  5. Connect findings to automatic remediation with EventBridge

Workplace example

Set an RCP so principals outside the organization cannot access S3 buckets, and use an SCP to prohibit disabling GuardDuty in any account.

Common confusions and exam tips

Mini quiz

Q1. Which statement about AWS Control Tower is incorrect?

  1. Account Factory can create new accounts with predefined settings
  2. It can apply preventive controls such as SCPs and detective controls with Config rules
  3. Setting up the landing zone creates log archive and audit accounts
  4. When enabled, member accounts of an existing organization are automatically deleted and recreated
Show answer and explanation

Answer: D When enabled, member accounts of an existing organization are automatically deleted and recreated

Control Tower can also be deployed into an existing organization, and existing accounts can be enrolled into management. Accounts are never deleted.

Q2. You are designing organization-wide guardrails. You want to prevent anyone in member accounts, including users with administrator permissions, from stopping or deleting CloudTrail trails. Which mechanism is the most suitable?

  1. Resource control policy (RCP)
  2. Service control policy (SCP)
  3. Organizations tag policy
  4. IAM permissions boundary
Show answer and explanation

Answer: B Service control policy (SCP)

SCPs set the maximum actions that IAM users and roles (including the root user) in member accounts can perform. A deny takes precedence over IAM policy allows.

Reference links

2.3Design a multi-account AWS environment

Concept

For multi-account, classify accounts with AWS Organizations OUs (organizational units) — security, infrastructure, workloads, sandbox and so on — and automatically build a landing zone with AWS Control Tower (log archive and audit accounts, controls (guardrails), Account Factory). Provide human access with IAM Identity Center and share resources with RAM.

How it works / steps

  1. Design the OU structure by purpose and applicable policies
  2. Create a landing zone with Control Tower and separate log and audit accounts
  3. Enable preventive and detective controls per OU
  4. Vend new accounts with standard settings through Account Factory (or AFT)
  5. Manage per-account access with IAM Identity Center permission sets

Workplace example

When a new project account is vended through Account Factory, CloudTrail, Config and networking are configured automatically and the development OU's guardrails are applied.

Common confusions and exam tips

Mini quiz

Q1. You want to store API activity records for all accounts in the organization in one place for a long time, in tamper-proof form. Which configuration is most appropriate?

  1. Store them in an S3 bucket in the production account and let all employees read the logs through the bucket policy for transparency
  2. Have each account administrator download CloudTrail event history as CSV every month and put it in a head-office shared folder by date
  3. Create a separate CloudTrail trail in each account and store logs in each account's own S3 bucket
  4. Create an organization CloudTrail trail and store logs in an S3 bucket in a log archive account with Object Lock enabled
Show answer and explanation

Answer: D Create an organization CloudTrail trail and store logs in an S3 bucket in a log archive account with Object Lock enabled

An organization trail aggregates events from all accounts into one S3 bucket. Isolate it in a dedicated log account and prevent deletion or overwriting with Object Lock.

Q2. Employees authenticate with Microsoft Entra ID. You want to manage access to all accounts with employee identities and automate onboarding and offboarding. Which method is most appropriate?

  1. Ask employees at onboarding to set the same password on their IAM user as their Entra ID password
  2. Create one shared IAM user per department, share the password within the department and change it periodically
  3. Set Entra ID as the identity source for IAM Identity Center and automatically sync users and groups with SCIM
  4. Create an IAM user per employee in each account and delete them manually when HR reports a departure
Show answer and explanation

Answer: C Set Entra ID as the identity source for IAM Identity Center and automatically sync users and groups with SCIM

Using an external IdP as the identity source lets employees sign in with corporate identities, and SCIM automatic provisioning reflects joiners and leavers immediately.

Reference links

2.4Determine security controls based on requirements

Concept

For a new system's security, choose controls from requirements (regulation, data sensitivity, exposure). Defend the perimeter with WAF, Shield Advanced (DDoS response team and cost protection) and AWS Network Firewall (stateful inspection and domain filtering of VPC traffic); protect data with KMS or CloudHSM (when a dedicated HSM is required); patch with Systems Manager Patch Manager; and authenticate with Cognito (end users) or IAM Identity Center (employees).

How it works / steps

  1. Identify required controls from regulations and data classification
  2. Place WAF and Shield at the public perimeter and Network Firewall on VPC ingress/egress traffic
  3. Use CloudHSM if dedicated FIPS 140 Level 3 keys are required; otherwise KMS
  4. Define patch baselines and patching windows with Patch Manager
  5. Authenticate users with Cognito and require MFA

Workplace example

To allow outbound traffic from internal servers only to approved domains, restrict it with a Network Firewall domain list and deny everything else.

Common confusions and exam tips

Mini quiz

Q1. You are choosing how to manage encryption keys and certificates. You want to define in detail who can use a key with a key policy, set automatic rotation, and audit key use in CloudTrail. Which is the most suitable?

  1. AWS CloudHSM
  2. AWS Private CA
  3. KMS multi-Region key
  4. KMS customer managed key
Show answer and explanation

Answer: D KMS customer managed key

With customer managed keys, you manage key policies and rotation, and use is recorded in CloudTrail.

Q2. You are designing attack protection for a large website. Thousands of login attempts in 5 minutes are repeated from specific IP addresses. Which is the most suitable?

  1. AWS WAF managed rule groups
  2. AWS WAF rate-based rules
  3. AWS Shield Advanced
  4. CloudFront geographic restrictions
Show answer and explanation

Answer: B AWS WAF rate-based rules

Rate-based rules count requests per source IP or similar and block sources exceeding the threshold for a period.

Reference links

2.5Determine a strategy to improve security

Concept

Improve security of existing environments with Security Hub (standards checks and finding aggregation), IAM Access Analyzer (detecting external and unused access, generating policies), Config rules with automatic remediation, and Inspector vulnerability scanning. Rotating secrets and eliminating long-term access keys are also improvement targets.

How it works / steps

  1. Check scores against Security Hub standards (such as AWS Foundational Security Best Practices)
  2. Find externally exposed resources and unused permissions with Access Analyzer
  3. Automatically remediate resources that violate Config rules
  4. Replace long-term access keys with IAM roles or Identity Center
  5. Prioritize fixing critical vulnerabilities from Inspector findings

Workplace example

When Config detects “unencrypted EBS,” automatic remediation encrypts it via snapshots, and the Security Hub score is reviewed at a monthly meeting.

Common confusions and exam tips

Mini quiz

Q1. You want to centrally manage the security posture of the whole organization. You want to collect findings from GuardDuty, Inspector, Macie and others in one place and check compliance with security standards such as CIS across all accounts. Which service is the most suitable?

  1. IAM Access Analyzer
  2. AWS Config aggregator
  3. AWS Security Hub
  4. Amazon GuardDuty
Show answer and explanation

Answer: C AWS Security Hub

Security Hub aggregates findings from multiple services and lets the delegated administrator account review automated checks against security standards for the whole organization.

Q2. You are choosing how to manage credentials and configuration values. You want to rotate the RDS password automatically every 30 days, with the app always retrieving the latest value. Which is the most suitable?

  1. Systems Manager Parameter Store
  2. AWS Secrets Manager
  3. Amazon Cognito
  4. IAM role (instance profile)
Show answer and explanation

Answer: B AWS Secrets Manager

Secrets Manager provides automatic secret rotation integrated with RDS and others, and apps retrieve the latest value through the API.

Reference links

Lessons are written by this site based on public information and do not guarantee exam content. Product specifications change, so check the latest information at the reference links.

Notes (unofficial, original questions, no pass guarantee)