Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 111:

  A company uses an organization in AWS Organizations to manage multiple AWS accounts. A security engineer creates a WAF policy in AWS Firewall Manager in the us-east-1 Region. The security engineer sets the policy scope to apply to resources that are tagged withWAF-protected:truein one of the member

  accounts in the organization. The security engineer sets up a configuration to automatically remediate any noncompliant resources. In a member account, the security engineer attempts to protect an Amazon API Gateway REST API in the us-east-1 Region by using a web ACL. However, after several minutes, the REST API is still not associated with the web ACL.

  What is the likely cause of this issue?

  A. Web ACLs cannot be applied to REST APIs.
  B. The REST API is missing a tag that includes theWAF-protectedkey and a value oftrue.
  C. The web ACL is already associated with another REST API.
  D. The web ACL is already associated with an Amazon CloudFront distribution.
  A. Web ACLs cannot be applied to REST APIs.

  ---

  Explanation

  organization Organizations manage multiple creates makes.

  The REST API is missing a tag that includes theWAF-protectedkey and a value oftrue, the strongest match, because multiple creates WAF policy Firewall asks for a managed AWS capability and that reduces the need for extra supervisory automation. multiple creates WAF policy Firewall depends on The REST API is missing a tag that includes theWAF-protectedkey and a value oftrue, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. policy Firewall Manager east Region is reinforced by A company uses an organization in AWS Organizations to manage multiple AWS accounts, A, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  east Region sets policy scope also supports The REST API is missing a tag that includes theWAF- protectedkey and a value oftrue,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. policy scope apply resources tagged would be weaker with Web ACLs cannot be applied to REST APIs,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. resources tagged withWAF protected truein separates.

  The web ACL is already associated with another REST API, and The web ACL is already associated with an Amazon CloudFront distribution, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. protected truein member organization sets points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 112:

  A consulting firm needs temporary access to a company's production account to perform a security assessment. The firm has its own AWS account. The company requires MFA and does not allow long-term IAM users in the production account for consultants.

  A. Create an IAM user in the production account for each consultant and email the initial passwords.
  B. Create an IAM role in the production account that trusts the consulting firm's account and requires MFA in the trust policy.
  C. Create access keys for the production account root user and store them in a shared password vault.
  D. Add the consulting firm's account root user to every production account resource policy.
  A. Create an IAM user in the production account for each consultant and email the initial passwords.

  ---

  Explanation

  consulting firm temporary access production makes Create an IAM role in the production account that trusts the consulting firm's account and requires MFA in the trust policy, the strongest match, because access production perform assessment firm asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. access production perform assessment firm depends on Create an IAM role in the production account that trusts the consulting firm's account and requires MFA in the trust policy, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. assessment firm own requires MFA is reinforced by A consulting firm needs temporary access to a company's production account to perform a, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  requires MFA does allow long also supports Create an IAM role in the production account that trusts the consulting firm's account and requires MFA in the trust policy,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. allow long term IAM users would be weaker with Create an IAM user in the production account for each consultant and email the initial passwords,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. IAM users production consultants role separates Create access keys for the production account root user and store them in a shared password vault, and Add the consulting firm's account root user to every production account resource policy, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. consultants IAM role production trusts points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 113:

  A security engineer needs to configure DDoS protection for a Network Load Balancer (NLB) with an Elastic IP address. The security engineer wants to set up an AWS WAF web ACL with a rate-based rule statement to protect the NLB.

  The security engineer needs to determine a rate limit that will not block legitimate traffic. The security engineer has configured the rule statement to aggregate based on the source IP address.

  How should the security engineer configure the rule to protect the NLB?

  A. Configure the rule to use theCountaction.
  B. Configure the rule to use theBlockaction.
  C. Configure the rule to use theMonitoraction.
  D. Configure the rule to use theAllowaction.
  A. Configure the rule to use theCountaction.

  ---

  Explanation

  DDoS protection Network Load Balancer makes Configure the rule to use theCountaction, the strongest match, because Load Balancer NLB Elastic address asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. Load Balancer NLB Elastic address depends on Configure the rule to use theCountaction, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. Elastic address wants set WAF is reinforced by A security engineer needs to configure DDoS protection for a Network Load Balancer (NLB), because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  set WAF web ACL rate also supports Configure the rule to use theCountaction,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. ACL rate based rule statement would be weaker with Configure the rule to use theBlockaction,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. rule statement protect NLB determine separates Configure the rule to use theMonitoraction, and Configure the rule to use theAllowaction, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams.

  NLB determine rate limit block points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 114:

  A security team manages a company's AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security team can administer the KMS keys. The company ' s application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team ' s software process with access to the keys.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.
  B. Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals. Revert this change when the application team no longer needs access.
  C. Create a key grant to allow the application team to use the KMS keys. Revoke the grant when the application team no longer needs access.
  D. Create a new KMS key by generating key material on premises. Import the key material to AWS KMS whenever the application team needs access. Grant the application team permissions to use the key.
  A. Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.

  ---

  Explanation

  team manages Key Management KMS makes Create a key grant to allow the application team to use the KMS keys, Revoke the grant when the application team no longer needs access, the strongest match, because Management KMS customer managed keys asks for a managed AWS capability and the design remains easier to govern across the environment. Management KMS customer managed keys depends on Create a key grant to allow the application team to use the KMS keys, Revoke the grant when the application team no longer needs access, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. managed keys Only members team is reinforced by A security team manages a company's AWS Key Management Service (AWS KMS) customer managed, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  members team administer KMS keys also supports Create a key grant to allow the application team to use the KMS keys, Revoke the grant when the application team no longer needs access,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. KMS keys application team software would be weaker with Export the KMS key material to an on-premises hardware security module (HSM), Give the application team access to the key material,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. team software process temporary access separates Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals, Revert this change when the and Create a new KMS key by generating key material on premises, Import the key material to AWS KMS whenever the application team needs access, Grant the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. temporary access keys occasionally team points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 115:

  A CloudFormation template needs to configure an application with database credentials. The company already stores the credentials in AWS Secrets Manager and uses AWS KMS for encryption. The template must not contain plaintext credentials.

  A. Store the plaintext password in a template parameter and mark the parameter description as confidential.
  B. Use a dynamic reference in the CloudFormation template to retrieve the secret value at deployment time.
  C. Put the password in the template metadata section and restrict read access to the stack events.
  D. Encode the password with base64 in the template and decode it in user data.
  A. Store the plaintext password in a template parameter and mark the parameter description as confidential.

  ---

  Explanation

  CloudFormation template application database credentials makes Use a dynamic reference in the CloudFormation template to retrieve the secret value at deployment time, the strongest match, because database credentials already stores Secrets asks for a managed AWS capability which is important when security controls must be repeatable. database credentials already stores Secrets depends on Use a dynamic reference in the CloudFormation template to retrieve the secret value at deployment time, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. stores credentials Secrets Manager KMS is reinforced by A CloudFormation template needs to configure an application with database credentials, The company already, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  Manager KMS encryption template contain also supports Use a dynamic reference in the CloudFormation template to retrieve the secret value at deployment time,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. template contain plaintext credentials dynamic would be weaker with Store the plaintext password in a template parameter and mark the parameter description as confidential,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. credentials dynamic reference CloudFormation template separates Put the password in the template metadata section and restrict read access to the stack events, and Encode the password with base64 in the template and decode it in user data, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. CloudFormation template retrieve secret value points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 116:

  A company is using an organization with all features enabled in AWS Organizations. The organization contains OUs. The company has configured a delegated administrator account for AWS IAM Identity Center.

  In this delegated administrator account, the company has deployed an AWS CloudFormation stack that contains permission sets.

  A security engineer must implement a solution to prevent the deletion of the CloudFormation stack.

  Which solution will meet this requirement?

  A. Enable termination protection for the CloudFormation stack. Create an SCP that denies the cloudformation:UpdateTerminationProtection action for the stack's ARN. Apply the SCP to the root of the organization.
  B. Enable termination protection for the CloudFormation stack. Create an SCP that denies the cloudformation:DeleteStack action for the stack's ARN. Apply the SCP to all OUs except the OU that contains the delegated administrator account.
  C. Set the DeletionPolicy attribute to Retain for all resources in the CloudFormation stack. Create an IAM policy that denies the cloudformation:DeleteStack action for the stack's ARN. Attach the IAM policy to all IAM users and roles in the organization's management account.
  D. Assign a stack policy to deny updates to stack resources. Create an SCP that denies the cloudformation: UpdateStack action for the stack's ARN. Apply the SCP to all OUs and the organization's management account.
  A. Enable termination protection for the CloudFormation stack. Create an SCP that denies the cloudformation:UpdateTerminationProtection action for the stack's ARN. Apply the SCP to the root of the organization.

  ---

  Explanation

  organization features enabled Organizations contains makes Enable termination protection for the CloudFormation stack, Create an SCP that denies the cloudformation, UpdateTerminationProtection action for the stack's ARN, Apply the SCP to the root the strongest match, because Organizations organization contains OUs configured asks for a managed AWS capability and the design remains easier to govern across the environment. Organizations organization contains OUs configured depends on Enable termination protection for the CloudFormation stack, Create an SCP that denies the cloudformation, UpdateTerminationProtection action for the stack's ARN, Apply the SCP to the root to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. OUs configured delegated administrator IAM is reinforced by A company is using an organization with all features enabled in AWS Organizations, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  administrator IAM Identity Center delegated also supports Enable termination protection for the CloudFormation stack, Create an SCP that denies the cloudformation, UpdateTerminationProtection action for the stack's ARN, Apply the SCP to the root, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. Center delegated administrator deployed CloudFormation would be weaker with Enable termination protection for the CloudFormation stack, Create

  an SCP that denies the cloudformation, DeleteStack action for the stack's ARN, Apply the SCP to all OUs, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. deployed CloudFormation stack contains permission separates Set the DeletionPolicy attribute to Retain for all resources in the CloudFormation stack, Create an IAM policy that denies the cloudformation, DeleteStack action for the stack's and Assign a stack policy to deny updates to stack resources, Create an SCP that denies the

  cloudformation, UpdateStack action for the stack's ARN, Apply the SCP from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. contains permission sets implement prevent points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 117:

  A company ' s public website consists of an Application Load Balancer (ALB), a set of Amazon EC2 instances that run a stateless application behind the ALB, and an Amazon DynamoDB table from which the application reads data. The company is concerned about malicious scanning and DDoS attacks. The company wants to impose a restriction in which each client IP address can read the data only3 times in any 5-minute period.

  Which solution will meet this requirement with the LEAST effort?

  A. Set up AWS WAF in front of the ALB. Create a rule that blocks requests that exceed the limit of 3 requests in any 5-minute period for each IP address.
  B. Create an AWS Lambda function based on an Amazon CloudWatch request. Configure the Lambda function to count the requests for each IP address in rolling 5-minute intervals and to provide notification if the count exceeds 3.
  C. Modify the EC2 application to count the source IP address of requests and calculate a rolling 5-minute sum. Return an error message if the count sum is greater than 3.
  D. Add source IP address and request time to the DynamoDB table. Add a 5-minute TTL setting based on request time. Change the read capacity of the DynamoDB table throughput to 3.
  A. Set up AWS WAF in front of the ALB. Create a rule that blocks requests that exceed the limit of 3 requests in any 5-minute period for each IP address.

  ---

  Explanation

  public website consists Application Load makes Set up AWS WAF in front of the ALB, Create a rule that blocks requests that exceed the limit of 3 requests in any 5-minute period the strongest match, because Application Load Balancer ALB set asks for a managed AWS capability which is important when security controls must be repeatable. Application Load Balancer ALB set depends on Set up AWS WAF in front of the ALB, Create a rule that blocks requests that exceed the limit of 3 requests in any 5-minute period to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. ALB set EC2 instances run is reinforced by A company ' s public website consists of an Application Load Balancer (ALB), a, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  instances run stateless application behind also supports Set up AWS WAF in front of the ALB, Create a rule that blocks requests that exceed the limit of 3 requests in any 5-minute period, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. application behind ALB DynamoDB table would be weaker with Create an AWS Lambda function based on an Amazon CloudWatch request, Configure the Lambda function to count the requests for each IP address in rolling 5-minute, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. DynamoDB table application reads data separates Modify the EC2 application to count the source IP address of requests and calculate a rolling 5-minute sum, Return an error message if the count sum and Add source IP address and request time to the DynamoDB table, Add a 5-minute TTL setting based on request time, Change the read capacity of the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. reads data concerned about malicious points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 118:

  A platform team creates application roles for developers in multiple accounts. The security team wants developers to create and manage resources only within an approved permission envelope, even if a developer can attach policies to roles that the developer creates.

  A. Store all developer credentials in AWS Secrets Manager and rotate them daily.
  B. Use AWS Shield Advanced to block API calls that create privileged roles.
  C. Require a permissions boundary on developer-created roles and deny role creation when the boundary is missing.
  D. Enable S3 Block Public Access on every account.
  A. Store all developer credentials in AWS Secrets Manager and rotate them daily.

  ---

  Explanation

  platform team creates application roles makes Require a permissions boundary on developer-created roles and deny role creation when the boundary is missing, the strongest match, because application roles developers multiple team asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. application roles developers multiple team depends on Require a permissions boundary on developer-created roles and deny role creation when the boundary is missing, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. multiple team wants developers manage is reinforced by A platform team creates application roles for developers in multiple accounts, The security team, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  developers manage resources only approved also supports Require a permissions boundary on developer-created roles and deny role creation when the boundary is missing,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. only approved permission envelope even would be weaker with Store all developer credentials in AWS Secrets Manager and rotate them daily,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. envelope even developer attach policies separates Use AWS Shield Advanced to block API calls that create privileged roles, and Enable S3 Block Public Access on every account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. attach policies roles developer creates points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 119:

  A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are deployed in a private subnet that does not have internet access.

  The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy.

  Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required

  S3 buckets.

  The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3 bucket that isoutside the company's AWS Organization. The processing job must continue to function.

  Which solution will meet these requirements?

  A. Update the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and aws: PrincipalOrgId match the company's organization.
  B. Update the instance profile role policy to require aws:ResourceOrgId.
  C. Add a network ACL rule to block outbound traffic on port 443.
  D. Apply an SCP that restricts S3 actions using organization condition keys.
  A. Update the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and aws: PrincipalOrgId match the company's organization.

  ---

  Explanation

  run long running analysis process makes Update the policy on the S3 gateway endpoint to allow S3 actions only if aws, ResourceOrgId and aws, PrincipalOrgId match the company's organization, the strongest match, because analysis process data stored buckets asks for a managed AWS capability while keeping the service responsibility clear for operations teams. analysis process data stored buckets depends on Update the policy on the S3 gateway endpoint to allow S3 actions only if aws, ResourceOrgId and aws, PrincipalOrgId match the company's organization, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. stored buckets process runs fleet is reinforced by A company is using AWS to run a long-running analysis process on data that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated

  AWS boundary.

  runs fleet EC2 instances Auto also supports Update the policy on the S3 gateway endpoint to allow S3 actions only if aws, ResourceOrgId and aws, PrincipalOrgId match the company's organization,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. instances Auto Scaling group EC2 would be weaker with Update the instance profile role policy to require aws, ResourceOrgId,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. group EC2 instances deployed private separates Add a network ACL rule to block outbound traffic on port 443, and Apply an SCP that restricts S3 actions using organization condition keys, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. deployed private subnet does internet points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 120:

  A company ' s security engineer receives an alert that indicates that an unexpected principal is accessing a company-owned Amazon Simple Queue Service (Amazon SQS) queue. All the company ' s accounts are within an organization in AWS Organizations. The security engineer must implement a mitigation solution that minimizes compliance violations and investment in tools that are outside of AWS.

  What should the security engineer do to meet these requirements?

  A. Create security groups that only accept inbound traffic from the CIDR blocks of all the VPCs in the organization. Attach the security groups to all the SQS queues in all the VPCs in the organization.
  B. In all the VPCs in the organization, adjust the network ACLs to only accept inbound traffic from the CIDR blocks of all the VPCs in the organization. Attach the network ACLs to all the subnets in all the VPCs in the organization.
  C. Create interface VPC endpoints for Amazon SQS in all the VPCs in the organization. Set the aws: SourceVpce condition to the VPC endpoint identifier on the SQS policy. Add the aws:PrincipalOrgId condition to the VPC endpoint policy.
  D. Use a cloud access security broker (CASB) to maintain a list of managed resources. Configure the CASB to check the API and console access against that list on a web proxy.
  A. Create security groups that only accept inbound traffic from the CIDR blocks of all the VPCs in the organization. Attach the security groups to all the SQS queues in all the VPCs in the organization.

  ---

  Explanation

  receives alert indicates unexpected principal makes Create interface VPC endpoints for Amazon SQS in all the VPCs in the organization, Set the aws, SourceVpce condition to the VPC endpoint identifier on the the strongest match, because unexpected principal accessing owned Simple asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. unexpected principal accessing owned Simple depends on Create interface VPC endpoints for Amazon SQS in all the VPCs in the organization, Set the aws, SourceVpce condition to the VPC endpoint identifier on the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. owned Simple Queue SQS organization is reinforced by A company ' s security engineer receives an alert that indicates that an unexpected, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  SQS queue organization Organizations implement also supports Create interface VPC endpoints for Amazon SQS in all the VPCs in the organization, Set the aws, SourceVpce condition to the VPC endpoint identifier on the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. Organizations implement mitigation minimizes compliance would be weaker with Create security groups that only accept inbound traffic from the CIDR blocks of all the VPCs in the organization, Attach the security groups to all the, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. minimizes compliance violations investment tools separates In all the VPCs in the organization, adjust the network ACLs to only accept inbound traffic from the CIDR blocks of all the VPCs in the and Use a cloud access security broker (CASB) to maintain a list of managed resources, Configure the CASB to check the API and console access against that from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. investment tools outside.

  What should points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.