Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 91:

  A security engineer configured VPC Flow Logs to publish to Amazon CloudWatch Logs. After 10 minutes, no logs appear. The issue is isolated to the IAM role associated with VPC Flow Logs.

  What could be the reason?

  A. logs:GetLogEvents is missing.
  B. The engineer cannot assume the role.
  C. The vpc-flow-logs.amazonaws.com principal cannot assume the role.
  D. The role cannot tag the log stream.
  A. logs:GetLogEvents is missing.

  ---

  Explanation

  configured VPC Flow Logs publish makes.

  The vpc-flow-logs, amazonaws, com principal cannot assume the role, the strongest match, because Logs publish CloudWatch minutes appear asks for a managed AWS capability which is important when security controls must be repeatable. Logs publish CloudWatch minutes appear depends on The vpc-flow-logs, amazonaws, com principal cannot assume the role, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. Logs minutes appear issue isolated is reinforced by A security engineer configured VPC Flow Logs to publish to Amazon CloudWatch Logs, After, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  appear issue isolated IAM role also supports.

  The vpc-flow-logs, amazonaws, com principal cannot assume the role,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. IAM role associated VPC Flow would be weaker with logs, GetLogEvents is missing,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. VPC Flow Logs What could separates.

  The engineer cannot assume the role, and The role cannot tag the log stream, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. What could reason vpc flow points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 92:

  A security engineer wants to forward custom application-security logs from an Amazon EC2 instance to Amazon CloudWatch. The security engineer installs the CloudWatch agent on the EC2 instance and adds the path of the logs to the CloudWatch configuration file.

  However, CloudWatch does not receive the logs. The security engineer verifies that the awslogs service is running on the EC2 instance.

  What should the security engineer do next to resolve the issue?

  A. Add AWS CloudTrail to the trust policy of the EC2 instance. Send the custom logs to CloudTrail instead of CloudWatch.
  B. Add Amazon S3 to the trust policy of the EC2 instance. Configure the application to write the custom logs to an S3 bucket that CloudWatch can use to ingest the logs.
  C. Add Amazon Inspector to the trust policy of the EC2 instance. Use Amazon Inspector instead of the CloudWatch agent to collect the custom logs.
  D. Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role.
  A. Add AWS CloudTrail to the trust policy of the EC2 instance. Send the custom logs to CloudTrail instead of CloudWatch.

  ---

  Explanation

  wants forward application logs EC2 makes Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role, the strongest match, because logs EC2 instance CloudWatch installs asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. logs EC2 instance CloudWatch installs depends on Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. CloudWatch installs agent EC2 instance is reinforced by A security engineer wants to forward custom application-security logs from an Amazon EC2 instance, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  agent EC2 instance adds path also supports Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. adds path logs CloudWatch configuration would be weaker with Add AWS CloudTrail to the trust policy of the EC2 instance, Send the custom logs to CloudTrail instead of CloudWatch,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. CloudWatch configuration file.

  However does separates Add Amazon S3 to the trust policy of the EC2 instance, Configure the application to write the custom logs to an S3 bucket that CloudWatch can and Add Amazon Inspector to the trust policy of the EC2 instance, Use Amazon Inspector instead of the CloudWatch agent to collect the custom logs, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. However CloudWatch does receive logs points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 93:

  A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs a solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating system, networking, and file events. The solution must send email alerts for any identified risks to a mailing list that is associated with a security team.

  Which solution will meet these requirements?

  A. Deploy AWS Security Hub and enable security standards that contain EKS controls. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant Security Hub events to the SNS topic.
  B. Enable Amazon Inspector container image scanning. Configure Amazon Detective to analyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Use an AWS Lambda function to process the logs and to send email alerts to the security team.
  C. Enable Amazon GuardDuty. Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team ' s mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
  D. Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. Configure Amazon CloudWatch Logs to collect EKS audit logs. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team ' s mailing list as a subscriber. Configure a CloudWatch alarm to publish a message to the SNS topic when new audit logs are generated.
  A. Deploy AWS Security Hub and enable security standards that contain EKS controls. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant Security Hub events to the SNS topic.

  ---

  Explanation

  runs several applications Elastic Kubernetes makes Enable Amazon GuardDuty, Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty, Create an Amazon Simple Notification Service (Amazon SNS) topic and set the the strongest match, because Elastic Kubernetes EKS detect any asks for a managed AWS capability and the design remains easier to govern across the environment. Elastic Kubernetes EKS detect any depends on Enable Amazon GuardDuty, Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty, Create an Amazon Simple Notification Service (Amazon SNS) topic and set the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. detect any Kubernetes risks monitoring is reinforced by A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS), The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  risks monitoring EKS audit logs also supports Enable Amazon GuardDuty, Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty, Create an Amazon Simple Notification Service (Amazon SNS) topic and set the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. audit logs addition operating system would be weaker with Deploy AWS Security Hub and enable security standards that contain EKS controls, Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. operating system networking file events separates Enable Amazon Inspector container image scanning, Configure Amazon Detective to analyze EKS security logs, Create Amazon CloudWatch log groups for EKS audit logs, Use an AWS and Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes, Configure Amazon CloudWatch Logs to collect EKS audit logs, Create an Amazon Simple Notification from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. file events send email alerts points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 94:

  A company needs to migrate several applications to AWS. This will require storing more than 5,000 credentials. To meet compliance requirements, the company will use its existing password management system for key rotation, auditing, and integration with third-party secrets containers. The company has a limited budget and is seeking the most cost-effective solution that is still secure.

  How should the company accomplish this at the LOWEST cost?

  A. Configure the company's key management solution to integrate with AWS Systems Manager Parameter Store.
  B. Configure the company's key management solution to integrate with AWS Secrets Manager.
  C. Use an Amazon S3 encrypted bucket to store the secrets and configure the applications with the appropriate roles to access the secrets.
  D. Configure the company's key management solution to integrate with AWS CloudHSM.
  A. Configure the company's key management solution to integrate with AWS Systems Manager Parameter Store.

  ---

  Explanation

  migrate several applications require storing makes Configure the company's key management solution to integrate with AWS Systems Manager Parameter Store, the strongest match, because require storing more than 000 asks for a managed AWS capability which is important when security controls must be repeatable. require storing more than 000 depends on Configure the company's key management solution to integrate with AWS Systems Manager Parameter Store, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. than 000 credentials compliance requirements is reinforced by A company needs to migrate several applications to AWS, This will require storing more, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  compliance requirements password management system also supports Configure the company's key management solution to integrate with AWS Systems Manager Parameter Store,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. management system key rotation auditing would be weaker with Configure the company's key management solution to integrate with AWS Secrets Manager,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. rotation auditing integration third party separates Use an Amazon S3 encrypted bucket to store the secrets and configure the applications with the appropriate roles to access the secrets, and Configure the company's key management solution to integrate with AWS CloudHSM, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. third party secrets containers limited points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 95:

  A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator. A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application.

  Which solution will meet these requirements?

  A. Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string. Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.
  B. Modify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack.
  C. Create an AWS WAF web ACL for the ALB. Create a custom rule that blocks requests that contain the user agent string of the device emulator.
  D. Create an AWS WAF web ACL for the ALB. Create a custom rule that allows requests from legitimate user agent strings.
  A. Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string. Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.

  ---

  Explanation

  web based application runs behind makes Create an AWS WAF web ACL for the ALB, Create a custom rule that blocks requests that contain the user agent string of the device emulator, the strongest match, because runs behind Application Load Balancer asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. runs behind Application Load Balancer depends on Create an AWS WAF web ACL for the ALB, Create a custom rule that blocks requests that contain the user agent string of the device emulator, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. Load Balancer ALB application experiencing is reinforced by A company has a web-based application that runs behind an Application Load Balancer (ALB),, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  application experiencing credential stuffing attack also supports Create an AWS WAF web ACL for the ALB, Create a custom rule that blocks requests that contain the user agent string of the device emulator,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. stuffing attack producing many failed would be weaker with Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string, Add an Amazon Simple Notification Service (Amazon SNS) topic, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. many failed login attempts attack separates Modify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack, and Create an AWS WAF web ACL for the ALB, Create a custom rule that allows requests from legitimate user agent strings, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. attempts attack coming many addresses points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 96:

  A company runs a global ecommerce website using Amazon CloudFront. The company must block traffic from specific countries to comply with data regulations.

  Which solution will meet these requirements MOST cost-effectively?

  A. Use AWS WAF IP match rules.
  B. Use AWS WAF geo match rules.
  C. Use CloudFront geo restriction to deny the countries.
  D. Use geolocation headers in CloudFront.
  A. Use AWS WAF IP match rules.

  ---

  Explanation

  runs global ecommerce website CloudFront makes Use CloudFront geo restriction to deny the countries, the strongest match, because website CloudFront block traffic specific asks for a managed AWS capability which is important when security controls must be repeatable. website CloudFront block traffic specific depends on Use CloudFront geo restriction to deny the countries, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. traffic specific countries comply data is reinforced by A company runs a global ecommerce website using Amazon CloudFront, The company must block, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  comply data regulations requirements cost also supports Use CloudFront geo restriction to deny the countries,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. requirements cost effectively CloudFront geo would be weaker with Use AWS WAF IP match rules,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. CloudFront geo restriction deny countries separates Use AWS WAF geo match rules, and Use geolocation headers in CloudFront, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. deny countries WAF match rules points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 97:

  A company has a platform that is divided into 12 AWS accounts under the same organization in AWS Organizations. Many of these accounts use Amazon API Gateway to expose APIs to the company ' s frontend applications. The company needs to protect the existing APIs and any resources that will be deployed in the future against common SQL injection and bot attacks.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Create an AWS WAF web ACL for each API. Include managed rules to block SQL injection and bot attacks. Use AWS Config to detect new resources that do not have a web ACL. Configure a remediation action to provision a web ACL for these resources.
  B. Use AWS Firewall Manager to create an AWS WAF policy. Configure the policy to include the AWS Bot Control and SQL database managed rule groups. Set the policy scope to include the API Gateway stage as the resource type.
  C. Create an AWS Service Catalog product for an AWS WAF web ACL that includes rules to block SQL injection and bot attacks. Use AWS Config to detect new resources that do not have this product applied. Configure a remediation action to provision a web ACL for these resources.
  D. Use AWS Security Hub to detect unprotected resources and to send the findings as custom action events to Amazon EventBridge. Create an AWS Lambda function for these events to provision an AWS WAF web ACL for the unprotected resources. Include managed rules to block SQL injection and bot attacks.
  A. Create an AWS WAF web ACL for each API. Include managed rules to block SQL injection and bot attacks. Use AWS Config to detect new resources that do not have a web ACL. Configure a remediation action to provision a web ACL for these resources.

  ---

  Explanation

  platform divided under same organization makes Use AWS Firewall Manager to create an AWS WAF policy, Configure the policy to include the AWS Bot Control and SQL database managed rule groups, Set the strongest match, because same organization Organizations Many API asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. same organization Organizations Many API depends on Use AWS Firewall Manager to create an AWS WAF policy, Configure the policy to include the AWS Bot Control and SQL database managed rule groups, Set to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. Many API Gateway expose APIs is reinforced by A company has a platform that is divided into 12 AWS accounts under the, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  expose APIs frontend applications protect also supports Use AWS Firewall Manager to create an AWS WAF policy, Configure the policy to include the AWS Bot Control and SQL database managed rule groups, Set, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. applications protect APIs any resources would be weaker with Create an AWS WAF web ACL for each API, Include managed rules to block SQL injection and bot attacks, Use AWS Config to detect new resources, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. any resources deployed against common separates Create an AWS Service Catalog product for an AWS WAF web ACL that includes rules to block SQL injection and bot attacks, Use AWS Config to and Use AWS Security Hub to detect unprotected resources and to send the findings as custom action events to Amazon EventBridge, Create an AWS Lambda function for from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. against common SQL injection bot points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 98:

  A company has AWS accounts in an organization in AWS Organizations. The organization includes a dedicated security account.

  All AWS account activity across all member accounts must be logged and reported to the dedicated security account. The company must retain all the activity logs in a secure storage location within the dedicated security account for2 years.No changes or deletions of the logs are allowed.

  Which combination of steps will meet these requirements with theLEAST operational overhead? (Select TWO.)

  A. In the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock incompliance modewith a retention period of 2 years. Set the bucket policy to allow the organization' smanagement accountto write to the S3 bucket.
  B. In the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock incompliance modewith a retention period of 2 years. Set the bucket policy to allow the organization' smember accountsto write to the S3 bucket.
  C. In the dedicated security account, create an Amazon S3 bucket with an S3 Lifecycle configuration that expires objects after 2 years. Allow member accounts to write to the bucket.
  D. Create anAWS CloudTrail organization trail. Configure logs to be delivered to the Amazon S3 bucket in the dedicated security account.
  E. Turn on AWS CloudTrail in each account and forward logs to the dedicated security account by using AWS Lambda and Amazon Data Firehose.
  A. In the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock incompliance modewith a retention period of 2 years. Set the bucket policy to allow the organization' smanagement accountto write to the S3 bucket.
  B. In the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock incompliance modewith a retention period of 2 years. Set the bucket policy to allow the organization' smember accountsto write to the S3 bucket.

  ---

  Explanation

  organization Organizations includes dedicated activity makes In the dedicated security account, create an Amazon S3 bucket, Configure S3 Object Lock incompliance modewith a retention period of 2 years, Set the bucket policy plus Create anAWS CloudTrail organization trail, Configure logs to be delivered to the Amazon

  S3 bucket in the dedicated security account, the strongest match, because includes dedicated activity member logged asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. includes dedicated activity member logged depends on In the dedicated security account, create an Amazon S3 bucket, Configure S3 Object Lock incompliance modewith a retention period of 2 years, Set the bucket policy to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. member logged reported dedicated retain is reinforced by A company has AWS accounts in an organization in AWS Organizations, The organization includes, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  dedicated retain activity logs secure also supports Create anAWS CloudTrail organization trail, Configure logs to be delivered to the Amazon S3 bucket in the dedicated security account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. logs secure storage location dedicated would be weaker with In the dedicated security account, create an Amazon S3 bucket, Configure S3 Object Lock incompliance modewith a retention period of 2 years, Set the bucket policy, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. location dedicated for2 years changes separates In the dedicated security account, create an Amazon S3 bucket with an S3 Lifecycle configuration that expires objects after 2 years, Allow member accounts to write and Turn on AWS CloudTrail in each account and forward logs to the dedicated security account by using AWS Lambda and Amazon Data Firehose, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. years changes deletions logs allowed points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 99:

  A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). A security engineer must prevent any modifications to the data in the S3 bucket.

  Which solution will meet this requirement?

  A. Configure S3 bucket policies to deny DELETE and PUT object permissions.
  B. Configure S3 Object Lock in compliance mode with S3 bucket versioning enabled.
  C. Change the encryption on the S3 bucket to use AWS Key Management Service (AWS KMS) customer managed keys.
  D. Configure the S3 bucket with multi-factor authentication (MFA) delete protection.
  A. Configure S3 bucket policies to deny DELETE and PUT object permissions.

  ---

  Explanation

  stores sensitive data bucket encrypts makes Configure S3 Object Lock in compliance mode with S3 bucket versioning enabled, the strongest match, because bucket encrypts data rest server asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. bucket encrypts data rest server depends on Configure S3 Object Lock in compliance mode with S3 bucket versioning enabled, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. rest server side encryption managed is reinforced by A company stores sensitive data in an Amazon S3 bucket, The company encrypts the, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  encryption managed keys SSE prevent also supports Configure S3 Object Lock in compliance mode with S3 bucket versioning enabled,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. SSE prevent any modifications data would be weaker with Configure S3 bucket policies to deny DELETE and PUT object permissions,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. modifications data bucket requirement Object separates Change the encryption on the S3 bucket to use AWS Key Management Service (AWS KMS) customer managed keys, and Configure the S3 bucket with multi-factor authentication (MFA) delete protection, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. requirement Object Lock compliance mode points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 100:

  A company recently set up Amazon GuardDuty and is receiving a high number of findings from IP addresses within the company. A security engineer has verified that these IP addresses are trusted and allowed.

  Which combination of steps should the security engineer take to configure GuardDuty so that it does not produce findings for these IP addresses? (Select TWO.)

  A. Create a plaintext configuration file that contains the trusted IP addresses.
  B. Create a JSON configuration file that contains the trusted IP addresses.
  C. Upload the configuration file directly to GuardDuty.
  D. Upload the configuration file to Amazon S3. Add a new trusted IP list to GuardDuty that points to the file.
  E. Manually copy and paste the configuration file data into the trusted IP list in GuardDuty.
  A. Create a plaintext configuration file that contains the trusted IP addresses.
  B. Create a JSON configuration file that contains the trusted IP addresses.

  ---

  Explanation

  recently set GuardDuty receiving high makes Create a plaintext configuration file that contains the trusted IP addresses, plus Upload the configuration file to Amazon S3, Add a new trusted IP list to GuardDuty that points to the file, the strongest match, because receiving high number findings addresses asks for a managed AWS capability and that reduces the need for extra supervisory automation. receiving high number findings addresses depends on Create a plaintext configuration file that contains the trusted IP addresses, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. findings addresses verified trusted allowed is reinforced by A company recently set up Amazon GuardDuty and is receiving a high number of, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  addresses trusted allowed combination steps also supports Upload the configuration file to Amazon S3, Add a new trusted IP list to GuardDuty that points to the file,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. combination steps should take GuardDuty would be weaker with Create a JSON configuration file that contains the trusted IP addresses,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. take GuardDuty does produce findings separates Upload the configuration file directly to GuardDuty, and Manually copy and paste the configuration file data into the trusted IP list in GuardDuty, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. produce findings addresses plaintext configuration points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.