Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 101:

  A security engineer needs to prepare Amazon EC2 instances for quarantine during a security incident.

  AWS Systems Manager Agent (SSM Agent) is installed, and a script exists to install and update forensic tools.

  Which solution will quarantine EC2 instances during a security incident?

  A. Track SSM Agent versions with AWS Config.
  B. Configure Session Manager to deny external connections.
  C. Store the script in Amazon S3 and grant read access.
  D. Configure IAM permissions for the SSM Agent to run the script as a Systems Manager Run Command document.
  A. Track SSM Agent versions with AWS Config.

  ---

  Explanation

  prepare EC2 instances quarantine during makes Configure IAM permissions for the SSM Agent to run the script as a Systems Manager Run Command document, the strongest match, because quarantine during incident Systems Manager asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. quarantine during incident Systems Manager depends on Configure IAM permissions for the SSM Agent to run the script as a Systems Manager Run Command document, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. Systems Manager Agent SSM installed is reinforced by A security engineer needs to prepare Amazon EC2 instances for quarantine during a security, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  SSM Agent installed script exists also supports Configure IAM permissions for the SSM Agent to run the script as a Systems Manager Run Command document,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. script exists install update forensic would be weaker with Track SSM Agent versions with AWS Config,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. update forensic tools quarantine EC2 separates Configure Session Manager to deny external connections, and Store the script in Amazon S3 and grant read access, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. quarantine EC2 instances during incident points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 102:

  A company is using AWS WAF to protect a customized public API service that is based on Amazon EC2 instances. The API uses an Application Load Balancer. The AWS WAF web ACL is configured with an AWS Managed Rules rule group. After a software upgrade to the API and the client application, some types of requests are no longer working and are causing application stability issues. A security engineer discovers that AWS WAF logging is not turned on for the web ACL.

  The security engineer needs to immediately return the application to service, resolve the issue, and ensure that logging is not turned off in the future. The security engineer turns on logging for the web ACL and specifies Amazon CloudWatch Logs as the destination.

  Which additional set of steps should the security engineer take to meet the requirements?

  A. Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.
  B. Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs.
  C. Edit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs.
  D. Edit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.
  A. Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.

  ---

  Explanation

  WAF protect customized public API makes Edit the rules in the web ACL to include rules with Count actions, Review the logs to determine which rule is blocking the request, Modify the the strongest match, because public API based EC2 instances asks for a managed AWS capability and that reduces the need for extra supervisory automation. public API based EC2 instances depends on Edit the rules in the web ACL to include rules with Count actions, Review the logs to determine which rule is blocking the request, Modify the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. EC2 instances API Application Load is reinforced by A company is using AWS WAF to protect a customized public API service that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  Application Load Balancer WAF web also supports Edit the rules in the web ACL to include rules with Count actions, Review the logs to determine which rule is blocking the request, Modify the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. WAF web ACL configured Managed would be weaker with Edit the rules in the web ACL to include rules with Count actions, Review the logs to determine which rule is blocking the request, Modify the, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. configured Managed Rules rule group separates Edit the rules in the web ACL to include rules with Count and Challenge actions, Review the logs to determine which rule is blocking the request, and Edit the rules in the web ACL to include rules with Count and Challenge actions, Review the logs to determine which rule is blocking the request, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. rule group software upgrade API points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 103:

  A recent security audit identified that a company's application team injects database credentials into the environment variables of an AWS Fargate task. The company's security policy mandates that all sensitive data be encrypted at rest and in transit.

  Which combination of actions should the security team take to make the application compliant with the security policy? (Select THREE.)

  A. Store the credentials securely in a file in an Amazon S3 bucket with restricted access to the application team IAM role. Ask the application team to read the credentials from the S3 object instead.
  B. Create an AWS Secrets Manager secret and specify the key-value pairs to be stored in this secret.
  C. Modify the application to pull credentials from the AWS Secrets Manager secret instead of the environment variables.
  D. Add a policy statement to the container instance IAM role that allows ssm:GetParameters, secretsmanager:GetSecretValue, and kms:Decrypt for the required secret and KMS key.
  E. Add a policy statement to the task role or task execution role that allows ssm:GetParameters, secretsmanager:GetSecretValue, and kms:Decrypt for the required secret and KMS key.
  F. Log in to the AWS Fargate instance, create a script to read the secret value from AWS Secrets Manager, and inject the environment variables. Ask the application team to redeploy the application.
  A. Store the credentials securely in a file in an Amazon S3 bucket with restricted access to the application team IAM role. Ask the application team to read the credentials from the S3 object instead.
  B. Create an AWS Secrets Manager secret and specify the key-value pairs to be stored in this secret.

  ---

  Explanation

  recent audit identified application team makes Create an AWS Secrets Manager secret and specify the key-value pairs to be stored in this secret, plus Modify the application to pull credentials from the AWS Secrets Manager secret instead of the environment variables, plus Add a policy statement to the task role or task execution role that allows ssm, GetParameters, secretsmanager, GetSecretValue, and kms, Decrypt for the required secret and the strongest match, because application team injects database credentials asks for a managed AWS capability and the design remains easier to govern across the environment. application team injects database credentials depends on Create an AWS Secrets Manager secret and specify the key-value pairs to be stored in this secret, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. database credentials environment variables Fargate is reinforced by A recent security audit identified that a company's application team injects database credentials into, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  variables Fargate task policy mandates also supports Modify the application to pull credentials from the AWS Secrets Manager secret instead of the environment variables,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. policy mandates sensitive data encrypted would be weaker with Store the credentials securely in a file in an Amazon S3 bucket with restricted access to the application team IAM role, Ask the application team to, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. data encrypted rest transit combination separates Add a policy statement to the container instance IAM role that allows ssm, GetParameters, secretsmanager, GetSecretValue, and kms, Decrypt for the required secret and KMS key, and Log in to the AWS Fargate instance, create a script to read the secret value from AWS Secrets Manager, and inject the environment variables, Ask the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. transit combination actions should team points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 104:

  A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off.

  What is the MOST efficient way to implement this solution?

  A. Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.
  B. Create an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging API.
  C. Create an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLogging event name to invoke an AWS Lambda function to call the StartLogging API.
  D. Monitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.
  A. Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.

  ---

  Explanation

  build turn CloudTrail back multiple makes Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation, the strongest match, because back multiple Regions case ever asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. back multiple Regions case ever depends on Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. case ever turned off What is reinforced by A security engineer needs to build a solution to turn AWS CloudTrail back on, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  off What efficient way implement also supports Use AWS Config with a managed rule to initiate the AWS- EnableCloudTrail remediation,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. way implement Config managed rule would be weaker with Create an Amazon EventBridge event with a cloudtrail, amazonaws, com event source and a StartLogging event name to invoke an AWS Lambda function to call the, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. managed rule initiate EnableCloudTrail remediation separates Create an Amazon CloudWatch alarm with a cloudtrail, amazonaws, com event source and a StopLogging event name to invoke an AWS Lambda function to call the and Monitor AWS Trusted Advisor to ensure CloudTrail logging is

  enabled, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. EnableCloudTrail remediation EventBridge event cloudtrail points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 105:

  A company wants to deploy an application in a private VPC that will not be connected to the internet. The company's security team will not allow bastion hosts or methods using SSH to log in to Amazon EC2 instances. The application team plans to use AWS Systems Manager Session Manager to connect to and manage the EC2 instances.

  Which combination of steps should the security team take? (Select THREE.)

  A. Make sure the Systems Manager Agent is installed and running on all EC2 instances inside the VPC.
  B. Ensure the IAM role attached to the EC2 instances in the VPC allows access to Systems Manager.
  C. Create an SCP that prevents the creation of SSH key pairs.
  D. Launch a NAT gateway in the VPC. Update the routing policies to forward traffic to this NAT gateway.
  E. Ensure proper VPC endpoints are in place for Systems Manager and Amazon EC2.
  F. Ensure the VPC has a transit gateway attachment. Update the routing policies to forward traffic to this transit gateway.
  A. Make sure the Systems Manager Agent is installed and running on all EC2 instances inside the VPC.
  B. Ensure the IAM role attached to the EC2 instances in the VPC allows access to Systems Manager.

  ---

  Explanation

  wants deploy application private VPC makes Make sure the Systems Manager Agent is installed and running on all EC2 instances inside the VPC, plus Ensure the IAM role attached to the EC2 instances in the VPC allows access to Systems Manager, plus Ensure proper VPC endpoints are in place for Systems Manager and Amazon EC2, the strongest match, because private VPC connected internet team asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. private VPC connected internet team depends on Make sure the Systems Manager Agent is installed and running on all EC2 instances inside the VPC, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. internet team allow bastion hosts is reinforced by A company wants to deploy an application in a private VPC that will not, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  bastion hosts methods SSH log also supports Ensure the IAM role attached to the EC2 instances in the VPC allows access to Systems Manager,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. SSH log EC2 instances application would be weaker with Create an SCP that prevents the creation of SSH key pairs,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. instances application team plans Systems separates Launch a NAT gateway in the VPC, Update the routing policies to forward traffic to this NAT gateway, and Ensure the VPC has a transit gateway attachment, Update the routing policies to forward traffic to this transit gateway, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. plans Systems Manager Session connect points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 106:

  A company is running an application in the eu-west-1 Region. The application uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt sensitive data. The company plans to deploy the application in the eu-north-1 Region. A security engineer needs to implement a key management solution for the application deployment in the new Region. The security engineer must minimize changes to the application code.

  Which change should the security engineer make to the AWS KMS configuration to meet these requirements?

  A. Update the key policies in eu-west-1. Point the application in eu-north-1 to use the same customer managed key as the application in eu-west-1.
  B. Allocate a new customer managed key to eu-north-1 to be used by the application that is deployed in that Region.
  C. Allocate a new customer managed key to eu-north-1. Create the same alias name for both keys. Configure the application deployment to use the key alias.
  D. Allocate a new customer managed key to eu-north-1. Create an alias for eu--1. Change the application code to point to the alias for eu--1.
  A. Update the key policies in eu-west-1. Point the application in eu-north-1 to use the same customer managed key as the application in eu-west-1.

  ---

  Explanation

  running application west Region Key makes Allocate a new customer managed key to eu-north-1, Create the same alias name for both keys, Configure the application deployment to use the key alias, the strongest match, because Region application Key Management KMS asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. Region application Key Management KMS depends on Allocate a new customer managed key to eu-north-1, Create the same alias name for both keys, Configure the application deployment to use the key alias, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. Management KMS customer managed key is reinforced by A company is running an application in the eu-west-1 Region, The application uses an, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  managed key encrypt sensitive data also supports Allocate a new customer managed key to eu-north-1, Create the same alias name for both keys, Configure the application deployment to use the key alias,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. sensitive data plans deploy application would be weaker with Update the key policies in eu-west-1, Point the application in eu-north-1 to use the same customer managed key as the application in eu-west-1,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. deploy application north Region implement separates Allocate a new customer managed key to eu-north-1 to be used by the application that is deployed in that Region, and Allocate a new customer managed key to eu-north-1, Create an alias for eu--1, Change the application code to point to the alias for eu--1, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Region implement key management application points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 107:

  A company sends Apache logs from EC2 Auto Scaling instances to a CloudWatch Logs log group with 1- year retention. A suspicious IP address appears in logs. A security engineer needs to analyze the past week of logs to count requests from that IP and list requested URLs.

  What should the engineer do with the LEAST effort?

  A. Export to S3 and use Macie.
  B. Stream to OpenSearch and analyze.
  C. Use CloudWatch Logs Insights with queries.
  D. Export to S3 and use AWS Glue.
  A. Export to S3 and use Macie.

  ---

  Explanation

  sends Apache logs EC2 Auto makes Use CloudWatch Logs Insights with queries, the strongest match, because EC2 Auto Scaling instances CloudWatch asks for a managed AWS capability and that reduces the need for extra supervisory automation. EC2 Auto Scaling instances CloudWatch depends on Use CloudWatch Logs Insights with queries, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. instances CloudWatch Logs log group is reinforced by A company sends Apache logs from EC2 Auto Scaling instances to a CloudWatch Logs, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  log group year retention suspicious also supports Use CloudWatch Logs Insights with queries,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. retention suspicious address appears logs would be weaker with Export to S3 and use Macie,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. appears logs analyze past week separates Stream to OpenSearch and analyze, and Export to S3 and use AWS Glue, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. past week logs count requests points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 108:

  A company is running a dynamic website by using an Application Load Balancer (ALB). A security engineer notices that bots from different IP addresses are using brute-force attacks to invoke a service endpoint frequently.

  What is the FASTEST way to mitigate this problem?

  A. Create an AWS Lambda function to process ALB logs. Block the bots' IP addresses in the ALB's security group.
  B. Create an AWS WAF web ACL for the ALB. Add a rate-based rule to the web ACL to block the bots.
  C. Create an ALB listener rule. Combine source-ip and path-pattern as the conditions to match bots. Specify a fixed-response action to return an HTTP 403 status.
  D. Create an AWS WAF web ACL for the ALB. Add a rate-based rule to a rule group to block the bots. Attach the rule to the web ACL.
  A. Create an AWS Lambda function to process ALB logs. Block the bots' IP addresses in the ALB's security group.

  ---

  Explanation

  running dynamic website Application Load makes Create an AWS WAF web ACL for the ALB, Add a rate-based rule to the web ACL to block the bots, the strongest match, because Application Load Balancer ALB notices asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. Application Load Balancer ALB notices depends on Create an AWS WAF web ACL for the ALB, Add a rate-based rule to the web ACL to block the bots, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. ALB notices bots different addresses is reinforced by A company is running a dynamic website by using an Application Load Balancer (ALB),, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  different addresses brute force attacks also supports Create an AWS WAF web ACL for the ALB, Add a rate-based rule to the web ACL to block the bots,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. force attacks invoke endpoint frequently would be weaker with Create an AWS Lambda function to process ALB logs, Block the bots' IP addresses in the ALB's security group,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. endpoint frequently.

  What FASTEST way separates Create an ALB listener rule, Combine source-ip and path-pattern as the conditions to match bots, Specify a fixed-response action to return an HTTP 403 status, and Create an AWS WAF web ACL for the ALB, Add a rate-based rule to a rule group to block the bots, Attach the rule to the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. FASTEST way mitigate problem WAF points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 109:

  A company requires a specific software application to be installed on all new and existing Amazon EC2 instances across an AWS Organization. SSM Agent is installed and active.

  How can the company continuously monitor deployment status of the software application?

  A. Use AWS Config organization-wide with the ec2-managedinstance-applications-required managed rule and specify the application name.
  B. Use approved AMIs rule organization-wide.
  C. Use Distributor package and review output.
  D. Use Systems Manager Application Manager inventory filtering.
  A. Use AWS Config organization-wide with the ec2-managedinstance-applications-required managed rule and specify the application name.

  ---

  Explanation

  requires specific software application installed makes Use AWS Config organization-wide with the ec2- managedinstance-applications-required managed rule and specify the application name, the strongest match, because application installed new EC2 instances asks for a managed AWS capability while keeping the service responsibility clear for operations teams. application installed new EC2 instances depends on Use AWS Config organization-wide with the ec2-managedinstance-applications-required managed rule and specify the application name, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation.

  EC2 instances Organization SSM Agent is reinforced by A company requires a specific software application to be installed on all new and, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  SSM Agent installed active continuously also supports Use AWS Config organization-wide with the ec2- managedinstance-applications-required managed rule and specify the application name,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. active continuously monitor deployment status would be weaker with Use approved AMIs rule organization-wide,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. deployment status software application Config separates Use Distributor package and review output, and Use Systems Manager Application Manager inventory filtering, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. application Config organization wide ec2 points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 110:

  A company needs to scan all AWS Lambda functions for code vulnerabilities.

  A. Use Amazon Macie.
  B. Enable Amazon Inspector Lambda scanning.
  C. Use GuardDuty and Security Hub.
  D. Use GuardDuty Lambda Protection.
  A. Use Amazon Macie.

  ---

  Explanation

  scan Lambda functions code vulnerabilities makes Enable Amazon Inspector Lambda scanning, the strongest match, because code vulnerabilities Enable Inspector Lambda asks for a managed AWS capability which is important when security controls must be repeatable. code vulnerabilities Enable Inspector Lambda depends on Enable Amazon Inspector Lambda scanning, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. Inspector Lambda scanning Macie GuardDuty is reinforced by A company needs to scan all AWS Lambda functions for code vulnerabilities,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  Macie GuardDuty Hub Lambda Protection also supports Enable Amazon Inspector Lambda scanning,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. GuardDuty Lambda Protection scan functions would be weaker with Use Amazon Macie,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. scan Lambda functions code vulnerabilities separates Use GuardDuty and Security Hub, and Use GuardDuty Lambda Protection, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. scan Lambda functions code vulnerabilities points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.