2.3 - AWS compliance and governance
AWS Certified Cloud Practitioner objective 2.3 covers compliance and governance in AWS. AWS Artifact provides on-demand access to AWS compliance reports such as SOC and ISO certifications, so auditors can download the evidence they need. To learn which security tasks are AWS's versus the customer's for a specific service, you consult the AWS Shared Responsibility Model documentation. For continuous threat detection, Amazon GuardDuty analyses CloudTrail management events, VPC Flow Logs and DNS logs to spot suspicious activity such as unusual API calls or communication with known-bad hosts. Governance also involves account structure, Organizations and logging. Expect scenario questions that describe downloading audit reports, clarifying responsibility for a service, or continuously detecting threats from logs, and ask which service or resource - AWS Artifact, the shared responsibility docs or GuardDuty - is the right answer.
Download SOC/ISO compliance reports = AWS Artifact. Who does what for a service = Shared Responsibility Model docs. Continuously detect threats from CloudTrail/VPC/DNS logs = Amazon GuardDuty.
Practice questions
1. Which AWS service provides on-demand access to AWS compliance reports such as SOC and PCI DSS?
- AWS Trusted Advisor
- AWS Artifact (correct answer)
- Amazon Inspector
- AWS Config
AWS Artifact is the self-service portal for AWS compliance documents (SOC, PCI DSS, ISO, etc.). Trusted Advisor gives best-practice checks; Inspector scans for vulnerabilities.
2. Where can you find which security tasks are AWS's vs the customer's for a specific service?
- Only by contacting sales
- In the AWS Shared Responsibility Model documentation (correct answer)
- In the EC2 instance metadata
- In the monthly invoice
The Shared Responsibility Model, documented by AWS, defines the split; it shifts depending on the service type (IaaS vs managed/PaaS vs SaaS).
3. Which AWS service provides on-demand access to security and compliance reports such as SOC and PCI DSS documents?
- AWS Trusted Advisor
- AWS Artifact (correct answer)
- Amazon Inspector
- AWS Config
AWS Artifact is the portal for downloading AWS compliance reports and agreements. Trusted Advisor checks best practices, Inspector scans workloads, and Config tracks configuration.
4. Which service continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to detect threats using machine learning?
- AWS WAF
- AWS Shield
- Amazon GuardDuty (correct answer)
- AWS KMS
Amazon GuardDuty is a managed threat-detection service that analyzes these log sources. WAF filters web traffic, Shield protects against DDoS, and KMS manages keys.
5. Which service helps you protect web applications from common exploits such as SQL injection and cross-site scripting by filtering HTTP/HTTPS requests?
- Amazon Macie
- Amazon Inspector
- AWS WAF (correct answer)
- AWS Secrets Manager
AWS WAF (Web Application Firewall) filters and blocks malicious web requests. Macie protects data privacy, Inspector scans for vulnerabilities, and Secrets Manager stores secrets.
6. Which principle means granting only the permissions required to perform a task and no more?
- Defense in depth
- Least privilege (correct answer)
- Shared responsibility
- High availability
Least privilege means giving each identity only the permissions it needs. Defense in depth is layering multiple security controls; both are good practice but the definition here is least privilege.