Security governance at scale (set 1)

Which AWS service or tool can track service costs and usage in AWS Service Catalog?

• AWS CloudTrail
• AWS Budgets
• AWS Cost and Usage Report
• AWS Cost Explorer

Which service helps you to assess, audit, and evaluate their AWS resource configurations?

• AWS Config
• AWS CloudFormation
• Amazon Machine Learning (Amazon ML)
• AWS Security Hub

AWS Service Catalog can be integrated with third-party IT service management tools. Which AWS connectors are available for third-party systems or tools?

• ServiceNow and Jira Software
• ServiceNow and Jira Core
• ServiceNext and Jira Service Desk
• ServiceNow and Jira Service Desk

Which aspects of governance at scale streamline account management across multiple Amazon Web Services (AWS) accounts?

• Policy automation, identity federation, and account automation
• Implement, provision, and operate account creation
• Account creation workflows, security automation, and budget enforcement
• Policy automation, identity syndication, and budget automation

Which AWS Control Tower component uses AWS Service Catalog for automated account provisioning?

• AWS Security Hub
• AWS CloudFormation
• AWS Control Tower dashboard
• Account Factory

With which service can you access and aggregate Domain Name System (DNS) logs?

• AWS CloudTrail
• Amazon GuardDuty
• AWS Security Hub
• Amazon CloudWatch

Which of the following statements are true from a multi-account design pattern perspective? (Select TWO.)

• Activating multi-factor authentication (MFA) for all accounts created with Account Factory is a best practice.
• The only required accounts are root, management, log archive, and audit accounts.
• A multi-account design can simplify permissions management, facilitate isolation, and separate billing.
• A multi-account design should only be considered by organizations with more than five teams or departments.
• To optimize cost, you should share accounts for development, testing, and production workloads.

What must you consider when working with guardrails? (Select TWO.)

• Mandatory and strongly recommended guardrails are enabled by default, but elective guardrails are not.
• Amazon Organizational Units (OUs) created through AWS Control Tower have mandatory guardrails applied to them automatically.
• Guardrail categories include default, mandatory, strongly recommended, and selective.
• Guardrails can be enabled at the individual account level.
• Accounts created through Account Factory inherit their parent Organizational Units (OUs) guardrails