Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 131:

  A company uploads data files as objects into an Amazon S3 bucket. A vendor downloads the objects to perform data processing.

  A security engineer must implement a solution that prevents objects from residing in the S3 bucket for longer than 72 hours.

  A. Configure S3 Versioning to expire object versions that have been in the bucket for 72 hours.
  B. Configure an S3 Lifecycle configuration rule on the bucket to expire objects after 72 hours.
  C. Use the S3 Intelligent-Tiering storage class and configure expiration after 72 hours.
  D. Generate presigned URLs that expire after 72 hours.
  A. Configure S3 Versioning to expire object versions that have been in the bucket for 72 hours.

  ---

  Explanation

  uploads data files objects bucket makes Configure an S3 Lifecycle configuration rule on the bucket to expire objects after 72 hours, the strongest match, because objects bucket vendor downloads perform asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. objects bucket vendor downloads perform depends on Configure an S3 Lifecycle configuration rule on the bucket to expire objects after 72 hours, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. downloads objects perform data processing is reinforced by A company uploads data files as objects into an Amazon S3 bucket, A vendor, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  data processing implement prevents objects also supports Configure an S3 Lifecycle configuration rule on the bucket to expire objects after 72 hours,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. prevents objects residing bucket longer would be weaker with Configure S3 Versioning to expire object versions that have been in the bucket for 72 hours,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. bucket longer than hours Lifecycle separates Use the S3 Intelligent-Tiering storage class and configure expiration after 72 hours, and Generate presigned URLs that expire after 72 hours, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. hours Lifecycle configuration rule bucket points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 132:

  A security engineer for a company is investigating suspicious traffic on a web application in the AWS Cloud.

  The web application is protected by an Application Load Balancer (ALB) behind an Amazon CloudFront distribution. There is an AWS WAF web ACL associated with the ALB. The company stores AWS WAF logs in an Amazon S3 bucket.

  The engineer notices that all incoming requests in the AWS WAF logs originate from a small number of IP addresses that correspond to CloudFront edge locations. The security engineer must identify the source IP addresses of the clients that are initiating the suspicious requests.

  Which solution will meet this requirement?

  A. Enable VPC Flow Logs in the VPC where the ALB is deployed. Examine the source field to capture the client IP addresses.
  B. Inspect the X-Forwarded-For header in the AWS WAF logs to determine the original client IP addresses.
  C. Modify the CloudFront distribution to disable ALB connection reuse. Examine the clientIp field in the AWS WAF logs to identify the original client IP addresses.
  D. Configure CloudFront to add a custom header named Client-IP to origin requests that are sent to the ALB.
  A. Enable VPC Flow Logs in the VPC where the ALB is deployed. Examine the source field to capture the client IP addresses.

  ---

  Explanation

  investigating suspicious traffic web application makes Inspect the X-Forwarded-For header in the AWS WAF logs to determine the original client IP addresses, the strongest match, because web application Cloud protected Load asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. web application Cloud protected Load depends on Inspect the X-Forwarded-For header in the AWS WAF logs to determine the original client IP addresses, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. web application protected Load Balancer is reinforced by A security engineer for a company is investigating suspicious traffic on a web application, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  Application Load Balancer ALB behind also supports Inspect the X-Forwarded-For header in the AWS WAF logs to determine the original client IP addresses,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. ALB behind CloudFront distribution There would be weaker with Enable VPC Flow Logs in the VPC where the ALB is deployed, Examine the source field to capture the client IP addresses,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. distribution There WAF web ACL separates Modify the CloudFront distribution to disable ALB connection reuse, Examine the clientIp field in the AWS WAF logs to identify the original client IP addresses, and Configure CloudFront to add a custom header named Client-IP to origin requests that are sent to the ALB, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. web ACL associated ALB stores points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 133:

  A company needs centralized log monitoring with automatic detection across hundreds of AWS accounts.

  Which solution meets these requirements with the LEAST operational effort?

  A. Designate a GuardDuty administrator account and enable protections.
  B. Centralize CloudWatch logs and use Inspector.
  C. Centralize CloudTrail logs and query with Athena.
  D. Stream logs to Kinesis and process with Lambda.
  A. Designate a GuardDuty administrator account and enable protections.

  ---

  Explanation

  centralized log monitoring automatic detection makes Designate a GuardDuty administrator account and enable protections, the strongest match, because automatic detection hundreds requirements operational asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. automatic detection hundreds requirements operational depends on Designate a GuardDuty administrator account and enable protections, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. requirements operational effort Designate GuardDuty is reinforced by A company needs centralized log monitoring with automatic detection across hundreds of AWS accounts,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  Designate GuardDuty administrator enable protections also supports Designate a GuardDuty administrator account and enable protections,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. enable protections Centralize CloudWatch logs would be weaker with Centralize CloudWatch logs and use Inspector,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. CloudWatch logs Inspector Centralize CloudTrail separates Centralize CloudTrail logs and query with Athena, and Stream logs to Kinesis and process with Lambda, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. Centralize CloudTrail logs query Athena points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 134:

  A company wants to use a suite of AWS Lambda functions to automatically remediate noncompliant resources. The company packages the suite of Lambda functions into an AWS CloudFormation template.

  The company wants to deploy the suite of Lambda functions to all AWS Organizations accounts. However, the company cannot use the Organizations management account for deployment.

  Which solution provides centralized deployment of the Lambda function suite to all accounts in the organization?

  A. Register a delegated administrator for CloudFormation. Deploy the template to every account in the organization by using StackSets.
  B. Create a cross-account IAM role with a unique external ID in each AWS account. Assume the cross-account role to deploy the template.
  C. Package the template as an AWS Service Catalog product. Log in to each account and provision the product to each account.
  D. Set up AWS CodePipeline in each account. Configure a pipeline to pull the template from an Amazon S3 bucket in the Organizations management account.
  A. Register a delegated administrator for CloudFormation. Deploy the template to every account in the organization by using StackSets.

  ---

  Explanation

  wants suite Lambda functions automatically makes Register a delegated administrator for CloudFormation, Deploy the template to every account in the organization by using StackSets, the strongest match, because functions automatically remediate noncompliant resources asks for a managed AWS capability which is important when security controls must be repeatable. functions automatically remediate noncompliant resources depends on Register a delegated administrator for CloudFormation, Deploy the template to every account in the organization by using StackSets, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. noncompliant resources packages suite Lambda is reinforced by A company wants to use a suite of AWS Lambda functions to automatically remediate, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  suite Lambda functions CloudFormation template also supports Register a delegated administrator for CloudFormation, Deploy the template to every account in the organization by using StackSets,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. CloudFormation template wants deploy suite would be weaker with Create a cross-account IAM role with a unique external ID in each AWS account, Assume the cross-account role to deploy the template,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. deploy suite Lambda functions Organizations separates Package the template as an AWS Service Catalog product, Log in to each account and provision the product to each account, and Set up AWS CodePipeline in each account, Configure a pipeline to pull the template from an Amazon S3 bucket in the Organizations management account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. functions Organizations However cannot management points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 135:

  A company is building a secure solution that relies on an AWS Key Management Service (AWS KMS) customer managed key. The company wants to allow AWS Lambda to use the KMS key. However, the company wants to prevent Amazon EC2 from using the key.

  Which solution will meet these requirements?

  A. Use IAM explicit deny for EC2 instance profiles and allow for Lambda roles.
  B. Use a KMS key policy with kms:ViaService conditions to allow Lambda usage and deny EC2 usage.
  C. Use aws:SourceIp and aws:AuthorizedService condition keys in the KMS key policy.
  D. Use an SCP to deny EC2 and allow Lambda.
  A. Use IAM explicit deny for EC2 instance profiles and allow for Lambda roles.

  ---

  Explanation

  building secure relies Key Management makes Use a KMS key policy with kms, ViaService conditions to allow Lambda usage and deny EC2 usage, the strongest match, because Key Management KMS customer managed asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. Key Management KMS customer managed depends on Use a KMS key policy with kms, ViaService conditions to allow Lambda usage and deny EC2 usage, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. customer managed key wants allow is reinforced by A company is building a secure solution that relies on an AWS Key Management, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  wants allow Lambda KMS key also supports Use a KMS key policy with kms, ViaService conditions to allow Lambda usage and deny EC2 usage,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. KMS key However wants prevent would be weaker with Use IAM explicit deny for EC2 instance profiles and allow for Lambda roles,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. wants prevent EC2 key requirements separates Use aws, SourceIp and aws, AuthorizedService condition keys in the KMS key policy, and Use an SCP to deny EC2 and allow Lambda, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. key requirements KMS policy ViaService points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 136:

  A company uses AWS Organizations to manage the company's AWS accounts. The company's security team needs to implement preventive controls to deny the use of account-level root credentials. The solution must minimize the risk that an AWS account root user could be compromised. The solution must also minimize the effort needed to manage root access.

  Which solution will meet these requirements?

  A. Create an AWS Lambda function to disable the root user in every member account. Enable the root account only if the company needs it to modify settings related to centralized billing or the recovery of AWS KMS keys.
  B. Enable centralized root access management in IAM. Remove long-term root credentials in the member accounts. Create a company policy that requires employees to use Organizations to create new accounts.
  C. Enable centralized root access management through AWS Security Hub CSPM. Remove long-term root credentials in the member accounts. Configure new accounts to be created without root credentials in Security Hub CSPM.
  D. Configure an SCP to explicitly deny all actions when the principal is the root user of an account for all member accounts. Require that member account root users have MFA enabled. Require that root credentials are rotated on a regular schedule.
  A. Create an AWS Lambda function to disable the root user in every member account. Enable the root account only if the company needs it to modify settings related to centralized billing or the recovery of AWS KMS keys.

  ---

  Explanation

  Organizations manage team implement preventive makes Enable centralized root access management in IAM, Remove long-term root credentials in the member accounts, Create a company policy that requires employees to use Organizations to the strongest match, because implement preventive controls deny level asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. implement preventive controls deny level depends on Enable centralized root access management in IAM, Remove long-term root credentials in the member accounts, Create a company policy

  that requires employees to use Organizations to to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. deny level root credentials minimize is reinforced by A company uses AWS Organizations to manage the company's AWS accounts, The company's security, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  credentials minimize risk root user also supports Enable centralized root access management in IAM, Remove long-term root credentials in the member accounts, Create a company policy that requires employees to use Organizations to, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. root user could compromised also would be weaker with Create an AWS Lambda function to disable the root user in every member account, Enable the root account only if the company needs it to modify, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. compromised also minimize effort needed separates Enable centralized root access management through AWS Security Hub CSPM, Remove long-term root credentials in the member accounts, Configure new accounts to be created without root and Configure an SCP to explicitly deny all actions when the principal is the root user of an account for all member accounts, Require that member account from the

  requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. effort needed manage root access points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 137:

  A company's application team needs a new AWS Key Management Service (AWS KMS) customer managed key to use with Amazon S3. The company's security policy requires separate keys for different AWS services to limit security exposure.

  How can a security engineer limit the KMS customer managed key to work with only Amazon S3?

  A. Configure the key policy to allow only Amazon S3 to perform the kms:Encrypt action.
  B. Configure the key policy to allow KMS actions only when the value for the kms:ViaService condition key matches the Amazon S3 service name.
  C. Configure the application's IAM role policy to allow Amazon S3 to perform the iam:PassRole action.
  D. Configure the application's IAM role policy to allow only S3 operations when the operations arecombined with the KMS customer managed key.
  A. Configure the key policy to allow only Amazon S3 to perform the kms:Encrypt action.

  ---

  Explanation

  application team new Key Management makes Configure the key policy to allow KMS actions only when the value for the kms, ViaService condition key matches the Amazon S3 service name, the strongest match, because Key Management KMS customer managed asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. Key Management KMS customer managed depends on Configure the key policy to allow KMS actions only when the value for the kms, ViaService condition key matches the Amazon S3 service name, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. customer managed key policy requires is reinforced by A company's application team needs a new AWS Key Management Service (AWS KMS) customer, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  policy requires separate keys different also supports Configure the key policy to allow KMS actions only when the value for the kms, ViaService condition key matches the Amazon S3 service name,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. keys different limit exposure KMS would be weaker with Configure the key policy to allow only Amazon S3 to perform the kms, Encrypt action,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. exposure limit KMS customer managed separates Configure the application's IAM role policy to allow Amazon S3 to perform the iam, PassRole action, and Configure the application's IAM role policy to

  allow only S3 operations when the operations are combined with the KMS customer managed key, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. customer managed key work only points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 138:

  A company has a PHP-based web application that uses Amazon S3 as an object store for user files. The S3 bucket is configured for server-side encryption with Amazon S3 managed keys (SSE-S3). New requirements mandate full control of encryption keys.

  Which combination of steps must a security engineer take to meet these requirements? (Select THREE.)

  A. Create a new customer managed key in AWS Key Management Service (AWS KMS).
  B. Change the SSE-S3 configuration on the S3 bucket to server-side encryption with customer-provided keys (SSE-C).
  C. Configure the PHP SDK to use the SSE-S3 key before upload.
  D. Create an AWS managed key for Amazon S3 in AWS KMS.
  E. Change the SSE-S3 configuration on the S3 bucket to server-side encryption with AWS KMS managedkeys (SSE-KMS).
  F. Change all the S3 objects in the bucket to use the new encryption key.
  A. Create a new customer managed key in AWS Key Management Service (AWS KMS).
  B. Change the SSE-S3 configuration on the S3 bucket to server-side encryption with customer-provided keys (SSE-C).

  ---

  Explanation

  PHP based web application object makes Create a new customer managed key in AWS Key Management Service (AWS KMS), plus Change the SSE-S3 configuration on the S3 bucket to server-side encryption with AWS KMS managed keys (SSE-KMS), plus Change all the S3 objects in the bucket to use the new encryption key, the strongest match, because application object store user files asks for a managed AWS capability which is important when security controls must be repeatable. application object store user files depends on Create a new customer managed key in AWS Key Management Service (AWS KMS), to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. user files bucket configured server is reinforced by A company has a PHP-based web application that uses Amazon

  S3 as an object, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  configured server side encryption managed also supports Change the SSE-S3 configuration on the S3 bucket to server-side encryption with AWS KMS managed keys (SSE-KMS),, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. encryption managed keys SSE New would be weaker with Change the SSE-S3 configuration on the S3 bucket to server-side encryption with customer-provided keys (SSE-C),, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. SSE New requirements mandate full separates Configure the PHP SDK to use the SSE-S3 key before upload, and Create an AWS managed key for Amazon S3 in AWS KMS, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. mandate full control encryption keys points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 139:

  A company uses an external identity provider with IAM Identity Center. The security team needs emergency access if the identity provider is unavailable. Emergency activity must be attributable to individual administrators and must allow cross-account recovery actions.

  A. Share a single root user password among the incident response team and rotate it after each incident.
  B. Create individual break-glass IAM users with MFA and tightly scoped ability to assume emergency roles in member accounts.
  C. Create one generic IAM user named emergency-admin and allow every responder to use it.
  D. Store access keys for every production role in a shared encrypted file.
  A. Share a single root user password among the incident response team and rotate it after each incident.

  ---

  Explanation

  external identity provider IAM Center makes Create individual break-glass IAM users with MFA and tightly scoped ability to assume emergency roles in member accounts, the strongest match, because IAM Identity Center team emergency asks for a managed AWS capability while keeping the service responsibility clear for operations teams. IAM Identity Center team emergency depends on Create individual break-glass IAM users with MFA and tightly scoped ability to assume emergency roles in member accounts, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. team emergency access identity provider is reinforced by A company uses an external identity provider with IAM Identity Center, The security team, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  identity provider unavailable Emergency activity also supports Create individual break-glass IAM users with MFA and tightly scoped ability to assume emergency roles in member accounts,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. Emergency activity attributable individual administrators would be weaker with Share a single root user password among the incident response team and rotate it after each incident,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. individual administrators allow cross recovery separates Create one generic IAM user named emergency-admin and allow every responder to use it, and Store access keys for every production role in a shared encrypted file, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. cross recovery actions individual break points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 140:

  A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB).

  The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent.

  A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The security engineer must implement a rule statement as part of the web ACL to block the requests. The rule statement must mitigate the current attack and future attacks from these IoT devices without blocking requests from customers.

  Which rule statement will meet these requirements?

  A. Use an IP set match rule statement that includes the IP address for IoT devices from the user agent.
  B. Use a geographic match rule statement. Configure the statement to block countries that the IoT devices are located in.
  C. Use a rate-based rule statement. Set a rate limit that is equal to the number of requests that are coming from the IoT devices.
  D. Use a string match rule statement that includes details of the IoT device brand from the user agent.
  A. Use an IP set match rule statement that includes the IP address for IoT devices from the user agent.

  ---

  Explanation

  hosts public website EC2 instances makes Use a string match rule statement that includes details of the IoT device brand from the user agent, the strongest match, because EC2 instances behind Application Load asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. EC2 instances behind Application Load depends on Use a string match rule statement that includes details of the IoT device brand from the user agent, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. Application Load Balancer ALB website is reinforced by A company hosts its public website on Amazon EC2 instances behind an Application Load, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  ALB website experiencing global DDoS also supports Use a string match rule statement that includes details of the IoT device brand from the user agent,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. global DDoS attack specific IoT would be weaker with Use an IP set match rule statement that includes the IP address for IoT devices from the user agent,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. specific IoT device brand unique separates Use a geographic match rule statement, Configure the statement to block countries that the IoT devices are located in, and Use a rate-based rule statement, Set a rate limit that is equal to the number of requests that are coming from the IoT devices, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. brand unique user agent creating points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.