Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 1:

  A security engineer needs to implement AWS IAM Identity Center with an external identity provider (IdP).

  Select and order the correct steps from the following list to meet this requirement. Select each step one time or not at all. (Select and order THREE.)

  . Configure the external IdP as the identity source in IAM Identity Center.

  . Create an IAM role that has a trust policy that specifies the IdP ' s API endpoint.

  . Enable automatic provisioning in IAM Identity Center settings.

  . Enable automatic provisioning in the external IdP.

  . Obtain the SAML metadata from IAM Identity Center.

  . Obtain the SAML metadata from the external IdP.

  

  

  ---

  Proposed correct regions:

  - Obtain the SAML metadata from the external IdP

  - Configure the external IdP as the identity source in IAM Identity Center

  - Enable automatic provisioning in IAM Identity Center settings

  IAM Identity Center must trust the external identity provider before users can authenticate through that provider. The metadata supplied by the provider contains the federation details that IAM Identity Center needs for the SAML trust relationship. After that metadata is available, IAM Identity Center can be configured to use the external provider as its identity source. That step establishes where user authentication will occur and prevents local Identity Center users from being treated as the authoritative directory for this deployment.

  Automatic provisioning is then enabled in IAM Identity Center so users and groups can be synchronized through the supported provisioning flow. Creating an IAM role that trusts an API endpoint is not part of Identity Center federation setup, and enabling provisioning only on the provider side is incomplete unless the IAM Identity Center side is also ready to accept the provisioning connection. The ordered set therefore begins with provider metadata, continues with the Identity Center identity source change, and finishes by preparing Identity Center for automated user and group provisioning.

• Question 2:

  A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager.

  Which solution will meet the requirements?

  A. Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.
  B. Use a parameter in the CloudFormation template to reference the database credentials. Encrypt the CloudFormation template by using AWS KMS.
  C. Use a SecureString parameter in the CloudFormation template to reference the database credentials in Secrets Manager.
  D. Use a SecureString parameter in the CloudFormation template to reference an encrypted value in AWS KMS.
  A. Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.

  ---

  Explanation

  follow best practices deploy resources makes Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager, the strongest match, because deploy resources CloudFormation template able asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. deploy resources CloudFormation template able depends on Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. template CloudFormation able sensitive database is reinforced by A company needs to follow security best practices to deploy resources from an AWS, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams. able sensitive database credentials already also supports Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. credentials already Key Management KMS would be weaker with Use a parameter in the CloudFormation template to reference the database credentials, Encrypt the CloudFormation template by using AWS KMS,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. Management KMS Secrets Manager requirements separates Use a SecureString parameter in the CloudFormation template to reference the database credentials in Secrets Manager, and Use a SecureString parameter in the CloudFormation template to reference an encrypted value in AWS KMS, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Manager requirements dynamic reference CloudFormation points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 3:

  A GuardDuty finding indicates that temporary credentials from an EC2 instance profile are being used from an unexpected network location. The instance must continue serving traffic for a short period while the application team prepares a fix. The security engineer needs to stop the unauthorized API use immediately.

  A. Revoke the active sessions for the instance profile role and add a temporary deny condition if needed.
  B. Change the instance type to force the attacker to request new credentials.
  C. Remove inbound internet access to the instance security group only.
  D. Enable default encryption on all S3 buckets in the account.
  A. Revoke the active sessions for the instance profile role and add a temporary deny condition if needed.

  ---

  Explanation

  GuardDuty finding indicates temporary credentials makes Revoke the active sessions for the instance profile role and add a temporary deny condition if needed, the strongest match, because temporary credentials EC2 instance profile asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. temporary credentials EC2 instance profile depends on Revoke the active sessions for the instance profile role and add a temporary deny condition if needed, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. instance profile being used unexpected is reinforced by A GuardDuty finding indicates that temporary credentials from an EC2 instance profile are being, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  used unexpected network location instance also supports Revoke the active sessions for the instance profile role and add a temporary deny condition if needed,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. location instance continue serving traffic would be weaker with Change the instance type to force the attacker to request new credentials,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. serving traffic short period while separates Remove inbound internet access to the instance security group only, and Enable default encryption on all S3 buckets in the account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. period while application team prepares points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 4:

  A security engineer is preparing an incident response runbook for compromised Amazon EC2 instances. The runbook must preserve evidence, keep a record of the incident identifier, prevent lateral movement, and capture volatile data without requiring inbound management ports.

  Which combination of steps should the runbook include? Choose three.

  A. Tag the instance with the incident identifier and create snapshots of attached Amazon EBS volumes.
  B. Use AWS Systems Manager Run Command or Session Manager logging to collect volatile evidence.
  C. Replace the instance security group with a restrictive isolation security group.
  D. Terminate the instance immediately so that malicious processes cannot continue running.
  E. Open SSH from the investigation workstation to install forensic tools interactively.
  F. Disable all CloudTrail trails until the investigation is complete.
  A. Tag the instance with the incident identifier and create snapshots of attached Amazon EBS volumes.
  B. Use AWS Systems Manager Run Command or Session Manager logging to collect volatile evidence.

  ---

  Explanation

  preparing incident response runbook compromised makes Tag the instance with the incident identifier and create snapshots of attached Amazon EBS volumes, plus Use AWS Systems Manager Run Command or Session Manager logging to collect volatile evidence, plus Replace the instance security group with a restrictive isolation security group, the strongest match, because runbook compromised EC2 instances preserve asks for a managed AWS capability and the design remains easier to govern across the environment. runbook compromised EC2 instances preserve depends on Tag the instance with the incident identifier and create snapshots of attached Amazon EBS volumes, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. instances runbook preserve evidence keep is reinforced by A security engineer is preparing an incident response runbook for compromised Amazon EC2 instances,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  evidence keep record incident identifier also supports Use AWS Systems Manager Run Command or Session Manager logging to collect volatile evidence,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. incident identifier prevent lateral movement would be weaker with Terminate the instance immediately so that malicious processes cannot continue running,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. lateral movement capture volatile data separates Open SSH from the investigation workstation to install forensic tools interactively, and Disable all CloudTrail trails until the investigation is complete, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. volatile data without requiring inbound points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 5:

  A security team manages a company ' s AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security team can administer the KMS keys. The company ' s application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team's software process with access to the keys.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.
  B. Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals. Revert this change when the application team no longer needs access.
  C. Create a key grant to allow the application team to use the KMS keys. Revoke the grant when the application team no longer needs access.
  D. Create a new KMS key by generating key material on premises. Import the key material to AWS KMS whenever the application team needs access. Grant the application team permissions to use the key.
  A. Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.

  ---

  Explanation

  team manages Key Management KMS makes Create a key grant to allow the application team to use the KMS keys, Revoke the grant when the application team no longer needs access, the strongest match, because Management KMS customer managed keys asks for a managed AWS capability which is important when security controls must be repeatable. Management KMS customer managed keys depends on Create a key grant to allow the application team to use the KMS keys, Revoke the grant when the application team no longer needs access, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. managed keys Only members team is reinforced by A security team manages a company ' s AWS Key Management Service (AWS KMS), because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  members team administer KMS keys also supports Create a key grant to allow the application team to use the KMS keys, Revoke the grant when the application team no longer needs access,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. KMS keys application team software would be weaker with Export the KMS key material to an on-premises hardware security module (HSM), Give the application team access to the key material,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. team software process temporary access separates Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals, Revert this change when the and Create a new KMS key by generating key material on premises, Import the key material to AWS KMS whenever the application team needs access, Grant the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. temporary access keys occasionally team points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 6:

  A development organization deploys AWS CloudFormation templates through a CI/CD pipeline. The security team wants to stop templates that would create noncompliant infrastructure before the templates are deployed.

  A. Wait for AWS Config to evaluate the deployed resources and manually delete noncompliant stacks later.
  B. Review CloudTrail logs weekly to identify templates that created noncompliant resources.
  C. Enable GuardDuty and treat every template deployment as a threat finding.
  D. Add AWS CloudFormation Guard checks to the pipeline and fail the deployment when a template violates policy rules.
  A. Wait for AWS Config to evaluate the deployed resources and manually delete noncompliant stacks later.

  ---

  Explanation

  development organization deploys CloudFormation templates makes Add AWS CloudFormation Guard checks to the pipeline and fail the deployment when a template violates policy rules, the strongest match, because CloudFormation templates through pipeline team asks for a managed AWS capability while keeping the service responsibility clear for operations teams. CloudFormation templates through pipeline team depends on Add AWS CloudFormation Guard checks to the pipeline and fail the deployment when a template violates policy rules, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. pipeline team wants stop templates is reinforced by A development organization deploys AWS CloudFormation templates through a CI/CD pipeline, The security team, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  stop templates would noncompliant infrastructure also supports Add AWS CloudFormation Guard checks to the pipeline and fail the deployment when a template violates policy rules,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. noncompliant infrastructure templates deployed Add would be weaker with Wait for AWS Config to evaluate the deployed resources and manually delete noncompliant stacks later,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. deployed Add CloudFormation Guard checks separates Review CloudTrail logs weekly to identify templates that created noncompliant resources, and Enable GuardDuty and treat every template deployment as a threat finding, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. Guard checks pipeline fail deployment points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 7:

  A company uses AWS Organizations to manage its AWS accounts in a single organization. The company applies the FullAWSAccess SCP to every OU. However, now the company must explicitly deny specific services. The company needs a solution that restricts any users in the organization from using the explicitly denied services.

  Additionally, the solution must enforce all Amazon S3 buckets across the organization to have a minimum TLS version of 1.2. The company requires a central solution that applies to all existing accounts and any new accounts that the company creates in the future.

  Which solution will meet these requirements?

  A. Create an SCP that denies a list of services that are restricted in the organization. Create an RCP to deny s3:* where the TLS version is less than 1.2. Attach both policies to the root of the organization.
  B. Create an SCP that denies a list of services that are restricted in the organization. Create an RCP to deny s3:* where the TLS version is less than 1.2. Attach the SCP to the root OU. Attach the RCP to each account within the organization.
  C. Create an SCP deny statement to disallow s3:* where the TLS version is less than 1.2. Create an RCP that denies a list of services that are restricted in the organization. Attach both policies to the root OU.
  D. Create an SCP that denies a list of services that are restricted in the organization. Create a declarative policy to deny s3:* where the TLS version is less than 1.2. Attach both policies to the root of the organization.
  A. Create an SCP that denies a list of services that are restricted in the organization. Create an RCP to deny s3:* where the TLS version is less than 1.2. Attach both policies to the root of the organization.

  ---

  Explanation

  Organizations manage single organization applies makes Create an SCP that denies a list of services that are restricted in the organization, Create an RCP to deny s3, * where the TLS version the strongest match, because organization applies FullAWSAccess SCP every asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. organization applies FullAWSAccess SCP every depends on Create an SCP that denies a list of services that are restricted in the organization, Create an RCP to deny s3, * where the TLS version to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. SCP every.

  However now explicitly is reinforced by A company uses AWS Organizations to manage its AWS accounts in a single organization,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  now explicitly deny specific restricts also supports Create an SCP that denies a list of services that are restricted in the organization, Create an RCP to deny s3, * where the TLS version, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. specific restricts any users organization would be weaker with Create an SCP that denies a list of services that are restricted in the organization, Create an RCP to deny s3, * where the TLS version, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. users organization explicitly denied Additionally separates Create an SCP deny statement to disallow s3, * where the TLS version is less than 1, 2, Create an RCP that denies a list of and Create an SCP that denies a list of services that are restricted in the organization, Create a declarative policy to deny s3, * where the TLS from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. denied Additionally enforce buckets organization points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 8:

  A security engineer is troubleshooting an AWS Lambda function that is namedMyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is namedDOC-EXAMPLE-BUCKET. The S3 bucket has the following bucket policy:

  {

  " Effect " : " Allow " ,

  " Principal " : { " Service " : " lambda.amazonaws.com " },

  " Action " : " s3:GetObject " ,

  " Resource " : " arn:aws:s3:::DOC-EXAMPLE-BUCKET " ,

  " Condition " : {

  " ArnLike " : {

  " aws:SourceArn " : " arn:aws:lambda:::function:MyLambdaFunction "

  }

  }

  }

  Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?

  A. Remove the Condition element. Change the Principal element to the following:{ " AWS " : " arn:aws: lambda:::function:MyLambdaFunction " }
  B. Change the Action element to the following:[ " s3:GetObject* " , " s3:GetBucket* " ]
  C. Change the Resource element to " arn:aws:s3:::DOC-EXAMPLE-BUCKET/* " .
  D. Change the Resource element to " arn:aws:lambda:::function:MyLambdaFunction " . Change the Principal element to the following:{ " Service " : " s3.amazonaws.com " }
  A. Remove the Condition element. Change the Principal element to the following:{ " AWS " : " arn:aws: lambda:::function:MyLambdaFunction " }

  ---

  Explanation

  troubleshooting Lambda function namedMyLambdaFunction encountering makes Change the Resource element to " arn, aws, s3, DOC-EXAMPLE-BUCKET/* ", the strongest match, because namedMyLambdaFunction function encountering error attempts asks for a managed AWS capability and the design remains easier to govern across the environment. namedMyLambdaFunction function encountering error attempts depends on Change the Resource element to " arn, aws, s3, DOC-EXAMPLE-BUCKET/* ", to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. error function attempts read objects is reinforced by A security engineer is troubleshooting an AWS Lambda function that is namedMyLambdaFunction, The function, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  read objects bucket namedDOC EXAMPLE also supports Change the Resource element to " arn, aws, s3, DOC-EXAMPLE-BUCKET/* ",, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. namedDOC EXAMPLE BUCKET policy Effect would be weaker with Remove the Condition element, Change the Principal element to the following, { " AWS ", " arn, aws, lambda, function, MyLambdaFunction " }, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. bucket policy Effect Allow Principal separates Change the Action element to the following,

  [ " s3, GetObject* ", " s3, GetBucket* " ] and Change the Resource element to " arn, aws, lambda, function, MyLambdaFunction ", Change the Principal element to the following, { " Service ", " s3, amazonaws, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. Effect Allow Principal lambda amazonaws points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 9:

  A company uses AWS to run a web application that manages ticket sales in several countries. The company recently migrated the application to an architecture that includes Amazon API Gateway, AWS Lambda, and Amazon Aurora Serverless. The company needs the application to comply with Payment Card Industry Data Security Standard (PCI DSS) v4.0. A security engineer must generate a report that shows the effectiveness of the PCI DSS v4.0 controls that apply to the application. The company ' s compliance team must be able to add manual evidence to the report.

  Which solution will meet these requirements?

  A. Enable AWS Trusted Advisor. Configure all the Trusted Advisor checks. Manually map the checks against the PCI DSS v4.0 standard to generate the report.
  B. Enable and configure AWS Config. Deploy the Operational Best Practices for PCI DSS conformance pack in AWS Config. Use AWS Config to generate the report.
  C. Enable AWS Security Hub. Enable the Security Hub PCI DSS security standard. Use the AWS Management Console to download the report from the security standard.
  D. Create an AWS Audit Manager assessment that uses the AWS managed PCI DSS v4.0 standard framework. Add all evidence to the assessment. Generate the report in Audit Manager for download.
  A. Enable AWS Trusted Advisor. Configure all the Trusted Advisor checks. Manually map the checks against the PCI DSS v4.0 standard to generate the report.

  ---

  Explanation

  run web application manages ticket makes Create an AWS Audit Manager assessment that uses the AWS managed PCI DSS v4, 0 standard framework, Add all evidence to the assessment, Generate the report the strongest match, because manages ticket sales several countries asks for a managed AWS capability and that reduces the need for extra supervisory automation. manages ticket sales several countries depends on Create an AWS Audit Manager assessment that uses the AWS managed PCI DSS v4, 0 standard framework, Add all evidence to the assessment, Generate the report to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. several countries recently migrated application is reinforced by A company uses AWS to run a web application that manages ticket sales in, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  migrated application architecture includes API also supports Create an AWS Audit Manager assessment that uses the AWS managed PCI DSS v4, 0 standard framework, Add all evidence to the assessment, Generate the report, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. includes API Gateway Lambda Aurora would be weaker with Enable AWS Trusted Advisor, Configure all the Trusted Advisor checks, Manually map the checks against the PCI DSS v4, 0 standard to generate the report,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. Lambda Aurora Serverless application comply separates Enable and configure AWS Config, Deploy the Operational Best Practices for PCI DSS conformance pack in AWS Config, Use AWS Config to generate the report, and Enable AWS Security Hub, Enable the Security Hub PCI DSS security standard, Use the AWS Management Console to download the report from the security standard, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. application comply Payment Card Industry points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 10:

  A company is operating an open-source software platform that is internet facing. The legacy software platform no longer receives security updates. The software platform operates using Amazon Route 53 weighted load balancing to send traffic to two Amazon EC2 instances that connect to an Amazon RDS cluster. A recent report suggests this software platform is vulnerable to SQL injection attacks, with samples of attacks provided. The company ' s security engineer must secure this system against SQL injection attacks within 24 hours. The solution must involve the least amount of effort and maintain normal operations during implementation.

  What should the security engineer do to meet these requirements?

  A. Create an Application Load Balancer with the existing EC2 instances as a target group. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the ALB. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to the ALB. Update security groups on the EC2 instances to prevent direct access from the internet.
  B. Create an Amazon CloudFront distribution specifying one EC2 instance as an origin. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the distribution. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to CloudFront.
  C. Obtain the latest source code for the platform and make the necessary updates. Test the updated code to ensure that the vulnerability has been mitigated, then deploy the patched version of the platform to the EC2 instances.
  D. Update the security group that is attached to the EC2 instances, removing access from the internet to the TCP port used by the SQL database. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the EC2 instances.
  A. Create an Application Load Balancer with the existing EC2 instances as a target group. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the ALB. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to the ALB. Update security groups on the EC2 instances to prevent direct access from the internet.

  ---

  Explanation

  operating open source software platform makes Create an Application Load Balancer with the existing EC2 instances as a target group, Create an AWS WAF web ACL containing rules that protect the application the strongest match, because software platform internet facing legacy asks for a managed AWS capability while keeping the service responsibility clear for operations teams. software platform internet facing legacy depends on Create an Application Load Balancer with the existing EC2 instances as a target group, Create an AWS WAF web ACL containing rules that protect the application to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. facing legacy software platform longer is reinforced by A company is operating an open-source software platform that is internet facing, The legacy, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  platform longer receives updates software also supports Create an Application Load Balancer with the existing EC2 instances as a target group, Create an AWS WAF web ACL containing rules that protect the application, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. updates software platform operates Route would be weaker with Create an Amazon CloudFront distribution specifying one EC2 instance as an origin, Create an AWS WAF web ACL containing rules that protect the application from this, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. operates Route weighted load balancing separates Obtain the latest source code for the platform and make the necessary updates, Test the updated code to ensure that the vulnerability has been mitigated, then and Update the security group that is attached to the EC2 instances, removing access from the internet to the TCP port used by the SQL database, Create from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. load balancing send traffic EC2 points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.