6.4 - Identifying gaps through architecture review and cost analysis (Well-Architected, Trusted Advisor)
AWS Certified Security Specialty objective 6.4 covers finding the gaps a dashboard does not show and reading the bill as a security signal. The AWS Well-Architected Tool runs a structured review against the security pillar and returns a prioritized improvement plan, milestones freeze the state before a remediation programme so progress is measurable, a custom lens carries internal requirements the standard questions ignore, and the review is repeated because the workload and the threat landscape both move. Trusted Advisor is the opposite shape: a fixed set of best practice checks such as exposed access keys and public snapshots, with the full catalogue unlocked only on the higher support plans, and an exposed key is deactivated before anything else. Cost tells its own story: a sudden nine thousand dollars of EC2 in an unused Region reads as compromise, AWS Cost Anomaly Detection spots that variation with machine learning where a Budget only fires at a fixed threshold, cost allocation tags must be activated before Cost Explorer breaks spend down per business unit, and a GuardDuty or CloudTrail bill that tripled points at data event volume that advanced event selectors can narrow. S3 Bucket Keys cut a KMS bill, Config exclusions cut noisy resource types, and an unused key or idle NAT gateway gets investigated then removed. Expect prioritization scenarios.
Structured security review with a prioritized improvement plan = Well-Architected Tool, not Trusted Advisor. Unusual spend spike detected by machine learning = Cost Anomaly Detection, a Budget only fires at a fixed threshold. Freeze the state before a remediation programme = a Well-Architected milestone.
Practice questions
1. A team wants a structured review of a workload against the security pillar, producing a prioritized list of improvement items. Which tool is designed for that?
- Amazon Inspector
- The AWS Well-Architected Tool (correct answer)
- AWS Config, whose rules are grouped by pillar and produce the same improvement plan once every resource of the workload has been evaluated at least once
- AWS Artifact
The Well-Architected Tool guides a questionnaire based review of a defined workload and returns risks ranked as high or medium with a matching improvement plan. Inspector scans for vulnerabilities in code and images, Config evaluates individual resources and has no notion of an architectural workload review, and Artifact only distributes AWS compliance reports.
2. Which service checks an account against a set of best practice checks including exposed access keys and public snapshots, with the full check list available on Business support and above?
- AWS Trusted Advisor (correct answer)
- AWS Audit Manager
- Amazon GuardDuty, whose detectors continuously analyze the account telemetry and raise a finding for each best practice deviation they observe in the environment
- AWS Artifact
Trusted Advisor runs predefined checks across cost, performance, security, fault tolerance and limits, and its exposed access key check is one of the fastest ways to spot a leaked credential. Audit Manager gathers evidence for frameworks, GuardDuty detects threats from behaviour rather than checking best practices, and Artifact distributes compliance documents.
3. An account that normally spends about 400 dollars a month suddenly shows 9000 dollars of EC2 charges in three days, in a region the company never uses. What should the security team conclude first?
- That a pricing change has been applied by AWS to the instance families used by the workload
- That the finance team must simply raise the budget threshold and continue monitoring the trend over the coming billing cycles
- That credentials were probably compromised and are being used for unauthorized compute (correct answer)
- That reserved instance coverage expired on the running fleet
A sudden spend spike in an unused region is a classic signature of stolen credentials used for cryptomining: cost is a security signal, not only a finance one. A price change or an expiring reservation would affect existing regions gradually, and raising the budget threshold hides the very indicator that revealed the compromise.
4. Which service detects an unusual variation in spending using machine learning and alerts on it, rather than only comparing against a fixed threshold?
- AWS Budgets
- Amazon CloudWatch, whose billing metrics are analyzed by the anomaly detection band configured on the estimated charges alarm for each linked account
- AWS Trusted Advisor
- AWS Cost Anomaly Detection (correct answer)
Cost Anomaly Detection learns the usual spending pattern of a monitor and reports deviations with a root cause breakdown. Budgets fires when a threshold you chose is crossed, which misses an unusual pattern that stays under budget, CloudWatch billing alarms are threshold based too, and Trusted Advisor looks at optimization opportunities rather than anomalies.
5. How do Trusted Advisor and the Well-Architected Tool differ in the way they surface security gaps?
- Trusted Advisor covers only cost, the Well-Architected Tool covers only security
- Trusted Advisor inspects live resources automatically, the Well-Architected Tool guides a human review of a workload (correct answer)
- Trusted Advisor is available only to the management account of an organization while the Well-Architected Tool can be used from any member account of that same organization
- Both perform the same automated checks under two different consoles
Trusted Advisor is automated and resource centric; the Well-Architected Tool is a design review answered by humans about a workload, which surfaces gaps no scanner can see, such as a missing incident response process. Trusted Advisor covers five categories including security, both are available in any account, and their checks are not the same.
6. A monthly cost review reveals a steady charge for NAT gateway data processing in an account whose workload was decommissioned six months ago. What is the best security reading of this?
- Something is still sending traffic outbound from a supposedly empty account, and it must be investigated (correct answer)
- It is a normal residual charge, since a NAT gateway keeps billing data processing on the health checks that AWS performs against it even when no instance remains behind it in the subnet
- It only proves that the decommissioning script forgot to delete the gateway, which is a pure cost cleanup item
- NAT gateway charges are always fixed and unrelated to traffic
Data processing charges are proportional to bytes, so a persistent charge means real outbound traffic from an account that should be idle, a plausible sign of a forgotten or hostile workload. An orphaned gateway alone would generate the hourly charge but almost no processing charge, no health check billing exists, and the hourly and processing components are distinct.