Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 121:

  A company's security team needs to receive a notification whenever an AWS access key has not been rotated in 90 or more days. A security engineer must develop a solution that provides these notifications automatically.

  Which solution will meet these requirements with the LEAST amount of effort?

  A. Deploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days. Create an Amazon EventBridge rule with an event pattern that matches the compliance type of NON_COMPLIANT from AWS Config for the managed rule. Configure EventBridge to send an Amazon SNS notification to the security team.
  B. Create a script to export a.csv file from the AWS Trusted Advisor check for IAM access key rotation. Load the script into an AWS Lambda function that will upload the.csv file to an Amazon S3 bucket. Create an Amazon Athena table query that runs when the.csv file is uploaded to the S3 bucket. Publish the results for any keys older than 90 days by using an invocation of an Amazon SNS notification to the security team.
  C. Create a script to download the IAM credentials report on a periodic basis. Load the script into an AWS Lambda function that will run on a schedule through Amazon EventBridge. Configure the Lambda script to load the report into memory and to filter the report for records in which the key was last rotated at least 90 days ago. If any records are detected, send an Amazon SNS notification to the security team.
  D. Create an AWS Lambda function that queries the IAM API to list all the users. Iterate through the users by using the ListAccessKeys operation. Verify that the value in the CreateDate field is not at least 90 days old. Send an SNS notification to the security team if the value is at least 90 days old. Create an EventBridge rule to schedule the Lambda function to run each day.
  A. Deploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days. Create an Amazon EventBridge rule with an event pattern that matches the compliance type of NON_COMPLIANT from AWS Config for the managed rule. Configure EventBridge to send an Amazon SNS notification to the security team.

  ---

  Explanation

  team receive notification whenever access makes Deploy an AWS Config managed rule to run on a periodic basis of 24 hours, Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to the strongest match, because whenever access key been rotated asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. whenever access key been rotated depends on Deploy an AWS Config managed rule to run on a periodic basis of 24 hours, Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. been rotated more days develop is reinforced by A company's security team needs to receive a notification whenever an AWS access key, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  days develop provides notifications automatically also supports Deploy an AWS Config managed rule to run on a periodic basis of 24 hours, Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. notifications automatically requirements amount effort would be weaker with Create a script to export a, csv file from the AWS Trusted Advisor check for IAM access key rotation, Load the script into an AWS Lambda, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. amount effort Deploy Config managed separates Create a script to download the IAM credentials report on a periodic basis, Load the script into an AWS Lambda function that will run on a and Create an AWS Lambda function that queries the IAM API to list all the users, Iterate through the users by using the ListAccessKeys operation, Verify that from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Config managed rule run periodic points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 122:

  A company has two AWS accounts: Account A and Account B. Each account has a VPC. An application that runs in the VPC in Account A needs to write to an Amazon S3 bucket in Account B. The application in Account A already has permission to write to the S3 bucket in Account B. The application and the S3 bucket are in the same AWS Region. The company cannot send network traffic over the public internet.

  Which solution will meet these requirements?

  A. Create a VPN connection between the software VPN appliance and a virtual private gateway in Account B.
  B. Update the VPC route tables, network ACLs, and security groups to allow network traffic between the peered IP ranges.
  C. Create a VPC peering connection between the VPC in Account A and the VPC in Account
  D. In Account A, create a gateway VPC endpoint for Amazon S3. Update the VPC route table in Account A.
  A. Create a VPN connection between the software VPN appliance and a virtual private gateway in Account B.

  ---

  Explanation

  VPC application runs write bucket makes In Account A, create a gateway VPC endpoint for Amazon S3, Update the VPC route table in Account A, the strongest match, because VPC write bucket application already asks for a managed AWS capability and that reduces the need for extra supervisory automation.

  VPC write bucket application already depends on In Account A, create a gateway VPC endpoint for Amazon

  S3, Update the VPC route table in Account A, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. application already permission write bucket is reinforced by A company has two AWS accounts, Account A and Account B, Each account has, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  write bucket application same Region also supports In Account A, create a gateway VPC endpoint for Amazon S3, Update the VPC route table in Account A,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. bucket same Region cannot send would be weaker with In both accounts, create a transit gateway and VPC attachments in a subnet in each Availability Zone, Update the VPC route tables,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. cannot send network traffic over separates Deploy a software VPN appliance in Account A, Create a VPN connection between the software VPN appliance and a virtual private gateway in Account B, and Create a VPC peering connection between the VPC in Account A and the VPC in Account B, Update the VPC route tables, network ACLs, and security from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. traffic over public internet requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 123:

  A company operates a web application that runs on Amazon EC2 instances. The application listens on port 80 and port 443. The company uses an Application Load Balancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the application instances only on port 80.

  The ALB is in public subnets that are associated with a network ACL named NACL1. The application instances are in dedicated private subnets that are associated with a network ACL named NACL2. An Amazon RDS for PostgreSQL DB instance that uses port 5432 is in a dedicated private subnet that is associated with a network ACL named NACL3. All the network ACLs currently allow all inbound and outbound traffic.

  Which set of network ACL changes will increase the security of the application while ensuring functionality?

  A. Make the following changes to NACL3:- Add a rule that allows inbound traffic on port 5432 from NACL2. - Add a rule that allows outbound traffic on ports 1024-65536 to NACL2. - Remove the default rules that allow all inbound and outbound traffic.
  B. Make the following changes to NACL3:- Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the application instance subnets. - Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets. - Remove the default rules that allow all inbound and outbound traffic.
  C. Make the following changes to NACL2:- Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDS subnets. - Remove the default rules that allow all inbound and outbound traffic.
  D. Make the following changes to NACL2:- Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDS subnets. - Add a rule that allows outbound traffic on port 5432 to the RDS subnets.
  A. Make the following changes to NACL3:- Add a rule that allows inbound traffic on port 5432 from NACL2. - Add a rule that allows outbound traffic on ports 1024-65536 to NACL2. - Remove the default rules that allow all inbound and outbound traffic.

  ---

  Explanation

  operates web application runs EC2 makes Make the following changes to NACL3, - Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the application instance subnets, the strongest match, because runs EC2 instances application listens asks for a managed AWS capability and that reduces the need for extra supervisory automation. runs EC2 instances application listens depends on Make the following changes to NACL3, - Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the application instance subnets, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. application listens port 443 Load is reinforced by A company operates a web application that runs on Amazon EC2 instances, The application, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain. port 443 Application Load Balancer also supports Make the following changes to NACL3, - Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the application instance subnets,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. Load Balancer ALB WAF terminate would be weaker with Make the following changes to NACL3, - Add a rule that allows inbound traffic on port 5432 from NACL2, - Add a rule that allows outbound, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. WAF terminate SSL forward traffic separates Make the following changes to NACL2, - Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDS subnets, - and Make the following changes to NACL2, - Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDS subnets, - from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. forward traffic application instances only points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 124:

  A company ' s data scientists want to create artificial intelligence and machine learning (AI/ML) training models by using Amazon SageMaker. The training models will use large datasets in an Amazon S3 bucket.

  The datasets contain sensitive information.

  On average, the data scientists need 30 days to train models. The S3 bucket has been secured appropriately. The company ' s data retention policy states that all data that is older than 45 days must be removed from the S3 bucket.

  Which action should a security engineer take to enforce this data retention policy?

  A. Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days.
  B. Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an S3 event notification to invoke the Lambda function for each PutObject operation.
  C. Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an Amazon EventBridge rule to invoke the Lambda function each month.
  D. Configure S3 Intelligent-Tiering on the S3 bucket to automatically transition objects to another storage class.
  A. Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days.

  ---

  Explanation

  data scientists want artificial intelligence makes Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days, the strongest match, because artificial intelligence machine learning training asks for a managed AWS capability while keeping the service responsibility clear for operations teams. artificial intelligence machine learning training depends on Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. learning training models SageMaker large is reinforced by A company ' s data scientists want to create artificial intelligence and machine learning, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  SageMaker training models large datasets also supports Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. large datasets bucket contain sensitive would be weaker with Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days, Create an S3, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. datasets contain sensitive information average separates Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days, Create an Amazon and Configure S3 Intelligent-Tiering on the S3 bucket to automatically transition objects to another storage class, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. information average data scientists need points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 125:

  A company runs an application on a fleet of Amazon EC2 instances. The application is accessible to users around the world. The company associates an AWS WAF web ACL with an Application Load Balancer (ALB) that routes traffic to the EC2 instances. A security engineer is investigating a sudden increase in traffic to the application. The security engineer discovers a significant amount of potentially malicious requests coming from hundreds of IP addresses in two countries. The security engineer wants to quickly limit the potentially malicious requests but does not want to prevent legitimate users from accessing the application.

  Which solution will meet these requirements?

  A. Use AWS WAF to implement a rate-based rule for all incoming requests.
  B. Use AWS WAF to implement a geographical match rule to block all incoming traffic from the two countries.
  C. Edit the ALB security group to include a geographical match rule to block all incoming traffic from the two countries.
  D. Add deny rules to the ALB security group that prohibit incoming requests from the IP addresses.
  A. Use AWS WAF to implement a rate-based rule for all incoming requests.

  ---

  Explanation

  runs application fleet EC2 instances makes Use AWS WAF to implement a rate-based rule for all incoming requests, the strongest match, because EC2 instances application accessible users asks for a managed AWS capability which is important when security controls must be repeatable. EC2 instances application accessible users depends on Use AWS WAF to implement a rate-based rule for all incoming requests, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. accessible users around world associates is reinforced by A company runs an application on a fleet of Amazon EC2 instances, The application, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  world associates WAF web ACL also supports Use AWS WAF to implement a rate-based rule for all incoming requests,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. web ACL Application Load Balancer would be weaker with Use AWS WAF to implement a geographical match rule to block all incoming traffic from the two countries,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. Load Balancer ALB routes traffic separates Edit the ALB security group to include a geographical match rule to block all incoming traffic from the two countries, and Add deny rules to the ALB security group that prohibit incoming requests from the IP addresses, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. routes traffic EC2 instances investigating points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 126:

  A startup company is using a single AWS account that has resources in a single AWS Region. A security engineer configures an AWS CloudTrail trail in the same Region to deliver log files to an Amazon S3 bucket by using the AWS CLI. Because of expansion, the company adds resources in multiple Regions.

  The security engineer notices that the logs from the new Regions are not reaching the S3 bucket.

  What should the security engineer do to fix this issue with the LEAST amount of operational overhead?

  A. Create a new CloudTrail trail. Select the new Regions where the company added resources.
  B. Change the S3 bucket to receive notifications to track all actions from all Regions.
  C. Create a new CloudTrail trail that applies to all Regions.
  D. Change the existing CloudTrail trail so that it applies to all Regions.
  A. Create a new CloudTrail trail. Select the new Regions where the company added resources.

  ---

  Explanation

  startup single resources Region configures makes Change the existing CloudTrail trail so that it applies to all Regions, the strongest match, because single Region configures CloudTrail trail asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. single Region configures CloudTrail trail depends on Change the existing CloudTrail trail so that it applies to all Regions, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. CloudTrail trail same Region deliver is reinforced by A startup company is using a single AWS account that has resources in a, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  Region deliver log files bucket also supports Change the existing CloudTrail trail so that it applies to all Regions,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. files bucket CLI Because expansion would be weaker with Create a new CloudTrail trail, Select the new Regions where the company added resources,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. Because expansion adds resources multiple separates Change the S3 bucket to receive notifications to track all actions from all Regions, and Create a new CloudTrail trail that applies to all Regions, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. resources multiple Regions notices logs points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 127:

  A company has enabled AWS Config for its organization in AWS Organizations. The company has deployed hundreds of Amazon S3 buckets across the organization. A security engineer needs to identify any S3 buckets that are not encrypted with AWS Key Management Service (AWS KMS). The security engineer also must prevent objects that are not encrypted with AWS KMS from being uploaded to the S3 buckets.

  Which solution will meet these requirements?

  A. Use thes3-default-encryption-kmsAWS Config managed rule to identify unencrypted S3 buckets. Create an SCP to allow thes3:PutObjectaction only when the object is encrypted with AWS KMS.
  B. Use thes3-default-encryption-kmsAWS Config managed rule to identify unencrypted S3 buckets. Create bucket policies for each S3 bucket to deny thes3:PutObjectaction only when the object has server-side encryption with S3 managed keys (SSE-S3).
  C. Use thes3-bucket-ssl-requests-onlyAWS Config managed rule to identify unencrypted S3 buckets. Create an SCP to allow thes3:PutObjectaction only when the object is encrypted with AWS KMS.
  D. Use thes3-bucket-ssl-requests-onlyAWS Config managed rule to identify unencrypted S3 buckets. Create bucket policies for each S3 bucket to allow thes3:PutObjectaction only when the object is encrypted with AWS KMS.
  A. Use thes3-default-encryption-kmsAWS Config managed rule to identify unencrypted S3 buckets. Create an SCP to allow thes3:PutObjectaction only when the object is encrypted with AWS KMS.

  ---

  Explanation

  enabled Config organization Organizations deployed makes Use thes3-default-encryption-kmsAWS Config managed rule to identify unencrypted S3 buckets, Create an SCP to allow thes3, PutObjectaction only when the object is encrypted with AWS KMS, the strongest match, because Organizations deployed hundreds buckets organization asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. Organizations deployed hundreds buckets organization depends on Use thes3-default-encryption-kmsAWS Config managed rule to identify unencrypted S3 buckets, Create an SCP to allow thes3, PutObjectaction only when the object is encrypted with AWS KMS, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. buckets organization identify any encrypted is reinforced by A company has enabled AWS Config for its organization in AWS Organizations, The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  any buckets encrypted Key Management also supports Use thes3-default-encryption-kmsAWS Config managed rule to identify unencrypted S3 buckets, Create an SCP to allow thes3, PutObjectaction only when the object is encrypted with AWS KMS,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. Key Management KMS also prevent would be weaker with Use thes3-default-encryption-kmsAWS Config managed rule to identify unencrypted S3 buckets, Create bucket policies for each S3 bucket to deny thes3, PutObjectaction only when the object has, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. also prevent objects encrypted KMS separates Use thes3-bucket-ssl-requests-onlyAWS Config managed rule to identify unencrypted S3 buckets, Create an SCP to allow thes3, PutObjectaction only when the object is encrypted with AWS KMS, and Use thes3-bucket-ssl-requests-onlyAWS Config managed rule to identify unencrypted S3 buckets, Create bucket policies for each S3 bucket to allow thes3, PutObjectaction only when the object is from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. encrypted KMS being uploaded buckets points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 128:

  A company is implementing new compliance requirements to meet customer needs. According to the new requirements, the company must not use any Amazon RDS DB instances or DB clusters that lack encryption of the underlying storage. The company needs a solution that will generate an email alert when an unencrypted DB instance or DB cluster is created. The solution also must terminate the unencrypted DB instance or DB cluster.

  Which solution will meet these requirements in the MOST operationally efficient manner?

  A. Create an AWS Config managed rule to detect unencrypted RDS storage. Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.
  B. Create an AWS Config managed rule to detect unencrypted RDS storage. Configure a manual remediation action to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.
  C. Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.
  D. Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.
  A. Create an AWS Config managed rule to detect unencrypted RDS storage. Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.

  ---

  Explanation

  implementing new compliance requirements customer makes Create an AWS Config managed rule to detect unencrypted RDS storage, Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon the strongest match, because requirements customer According new any asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. requirements customer According new any depends on Create an AWS Config managed rule to detect unencrypted RDS storage, Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. new requirements any RDS instances is reinforced by A company is implementing new compliance requirements to meet customer needs, According to the, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  RDS instances clusters lack encryption also supports Create an AWS Config managed rule to detect unencrypted RDS storage, Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. lack encryption underlying storage generate would be weaker with Create an AWS Config managed rule to detect unencrypted RDS storage, Configure a manual remediation action to invoke an AWS Lambda function, Configure the Lambda function, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. storage generate email alert unencrypted separates Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters, Configure the rule to and Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters, Configure the rule to from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. alert unencrypted instance cluster created points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 129:

  A security engineer needs to prepare for a security audit of an AWS account.

  Select the correct AWS resource from the following list to meet each requirement. Select each resource one time or not at all. (Select THREE.)

  - AWS Artifact reports

  - AWS Audit Manager controls

  - AWS Config conformance packs

  - AWS Config rules

  - Amazon Detective investigations

  - AWS Identity and Access Management Access Analyzer internal access analyzers

  

  

  ---

  Proposed correct regions:

  - Automatically collect assessment material for a report -> AWS Audit Manager controls

  - Determine IAM principals in the account with access to a specified resource -> AWS Identity and Access Management Access Analyzer internal access analyzers

  - Download security and compliance documents on demand -> AWS Artifact reports

  AWS Audit Manager is designed for assessment workflows and can collect supporting records from AWS services such as CloudTrail, AWS Config, and Security Hub. Controls in Audit Manager map technical service activity to an assessment report, which matches the requirement to gather assessment material automatically rather than merely define configuration rules or investigate activity after an event.

  IAM Access Analyzer evaluates resource policies and access paths. An internal access analyzer helps identify principals within the account or organization that can access a resource, so it matches the requirement to determine which IAM principals have access. AWS Artifact is the service for retrieving AWS security and compliance reports and agreements on demand. Config rules and conformance packs evaluate resource configuration compliance, while Detective is used for security investigations. Those services can support a review program, but the three selected resources map directly to assessment collection, principal access analysis, and downloadable compliance documentation.

• Question 130:

  A company has several Amazon S3 buckets that do not enforce encryption in transit. A security engineer must implement a solution that enforces encryption in transit for all the company ' s existing and future S3 buckets.

  Which solution will meet these requirements?

  A. Enable AWS Config. Create a proactive AWS Config Custom Policy rule. Create a Guard clause to evaluate the S3 bucket policies to check for a value of True for the aws:SecureTransport condition key. If the AWS Config rule evaluates to NON_COMPLIANT, block resource creation.
  B. Enable AWS Config. Configure the s3-bucket-ssl-requests-only AWS Config managed rule and set the rule trigger type to Hybrid. Create an AWS Systems Manager Automation runbook that applies a bucket policy to deny requests when the value of the aws:SecureTransport condition key is False. Configure automatic remediation. Set the runbook as the target of the rule.
  C. Enable Amazon Inspector. Create a custom AWS Lambda rule. Create a Lambda function that applies a bucket policy to deny requests when the value of the aws:SecureTransport condition key is False. Set the Lambda function as the target of the rule.
  D. Create an AWS CloudTrail trail. Enable S3 data events on the trail. Create an AWS Lambda function that applies a bucket policy to deny requests when the value of the aws:SecureTransport condition key is False. Configure the CloudTrail trail to invoke the Lambda function.
  A. Enable AWS Config. Create a proactive AWS Config Custom Policy rule. Create a Guard clause to evaluate the S3 bucket policies to check for a value of True for the aws:SecureTransport condition key. If the AWS Config rule evaluates to NON_COMPLIANT, block resource creation.

  ---

  Explanation

  several buckets enforce encryption transit makes Enable AWS Config, Configure the s3-bucket-ssl-requests- only AWS Config managed rule and set the rule trigger type to Hybrid, Create an AWS Systems Manager Automation runbook that the strongest match, because encryption transit implement enforces buckets asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. encryption transit implement enforces buckets depends on Enable AWS Config, Configure the s3-bucket-ssl-requests-only AWS Config managed rule and set the rule trigger type to Hybrid, Create an AWS Systems Manager Automation runbook that to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. enforces encryption transit buckets requirements is reinforced by A company has several Amazon S3 buckets that do not enforce encryption in transit,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  buckets requirements Enable Config bucket also supports Enable AWS Config, Configure the s3-bucket-ssl- requests-only AWS Config managed rule and set the rule trigger type to Hybrid, Create an AWS Systems

  Manager Automation runbook that, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. Config bucket ssl requests only would be weaker with Enable AWS Config, Create a proactive AWS Config Custom Policy rule, Create a Guard clause to evaluate the S3 bucket policies to check for a value, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. requests only Config managed rule separates Enable Amazon Inspector, Create a custom AWS Lambda rule, Create a Lambda function that applies a bucket policy to deny requests when the value of the and Create an AWS CloudTrail trail, Enable S3 data events on the trail, Create an AWS Lambda function that applies a bucket policy to deny requests when from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. managed rule set trigger type points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.