AWS Certified Security - Specialty practice questions.

A security engineer needs continuous threat detection across CloudTrail, VPC Flow Logs, DNS logs, and EKS audit logs in a multi-account AWS Organization, with findings centralized in a security account. Which combination is the canonical AWS-native fit?

A compliance auditor must verify that CloudTrail log files have not been tampered with. Which CloudTrail feature provides cryptographic verification?

A team has a private RDS database accessed only from one application subnet. The application must reach the RDS endpoint without traffic traversing the public internet. Which AWS feature best ensures this?

An IAM principal needs to assume a role in another AWS account. The cross-account role trust policy must allow only this specific principal and only when an external ID is supplied. Which IAM construct enforces both constraints?

A team encrypts S3 objects with SSE-KMS using a customer managed key. They need an automated way to detect any object stored without that specific KMS key (for example, an object accidentally written with SSE-S3 instead). Which AWS feature fits?

An organization wants to prevent any account in a specific Organizational Unit from creating internet-facing load balancers. Which AWS Organizations feature implements that constraint?