Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 141:

  A company has a VPC that has no internet access and has the private DNS hostnames option enabled. An Amazon Aurora database is running inside the VPC. A security engineer wants to use AWS Secrets Manager to automatically rotate the credentials for the Aurora database. The security engineer configures the Secrets Manager default AWS Lambda rotation function to run inside the same VPC that the Aurora database uses.

  However, the security engineer determines that the password cannot be rotated properly because the Lambda function cannot communicate with the Secrets Manager endpoint.

  What is the MOST secure way that the security engineer can give the Lambda function the ability to communicate with the Secrets Manager endpoint?

  A. Add a NAT gateway to the VPC to allow access to the Secrets Manager endpoint.
  B. Add a gateway VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.
  C. Add an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.
  D. Add an internet gateway for the VPC to allow access to the Secrets Manager endpoint.
  A. Add a NAT gateway to the VPC to allow access to the Secrets Manager endpoint.

  ---

  Explanation

  VPC internet access private DNS makes Add an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint, the strongest match, because private DNS hostnames option enabled asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. private DNS hostnames option enabled depends on Add an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. option enabled Aurora database running is reinforced by A company has a VPC that has no internet access and has the private, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  database running inside VPC wants also supports Add an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. VPC wants Secrets Manager automatically would be weaker with Add a NAT gateway to the VPC to allow access to the Secrets Manager endpoint,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. Manager automatically rotate credentials Aurora separates Add a gateway VPC endpoint to the VPC to allow access to the Secrets Manager endpoint, and Add an internet gateway for the VPC to allow access to the Secrets Manager endpoint, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. credentials Aurora database configures Secrets points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 142:

  A company is operating an open-source software platform that is internet facing. The legacy software platform no longer receives security updates. The software platform operates using Amazon Route 53 weighted load balancing to send traffic to two Amazon EC2 instances that connect to an Amazon RDS cluster. A recent report suggests this software platform is vulnerable to SQL injection attacks, with samples of attacks provided. The company's security engineer must secure this system against SQL injection attacks within 24 hours. The security engineer's solution must involve the least amount of effort and maintain normal operations during implementation.

  What should the security engineer do to meet these requirements?

  A. Create an Application Load Balancer with the existing EC2 instances as a target group. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the ALB. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to the ALB. Update security groups on the EC2 instances to prevent direct access from the internet.
  B. Create an Amazon CloudFront distribution specifying one EC2 instance as an origin. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the distribution. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to CloudFront.
  C. Obtain the latest source code for the platform and make the necessary updates. Test the updated code to ensure that the vulnerability has been mitigated, then deploy the patched version of the platform to the EC2 instances.
  D. Update the security group that is attached to the EC2 instances, removing access from the internet to the TCP port used by the SQL database. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the EC2 instances. Test to ensure the vulnerability has been mitigated, then restore the security group to the original setting.
  A. Create an Application Load Balancer with the existing EC2 instances as a target group. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the ALB. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to the ALB. Update security groups on the EC2 instances to prevent direct access from the internet.

  ---

  Explanation

  operating open source software platform makes Create an Application Load Balancer with the existing EC2 instances as a target group, Create an AWS WAF web ACL containing rules that protect the application the strongest match, because software platform internet facing legacy asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. software platform internet facing legacy depends on Create an Application Load Balancer with the existing EC2 instances as a target group, Create an AWS WAF web ACL containing rules that protect the application to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. facing legacy software platform longer is reinforced by A company is operating an open-source software platform that is internet facing, The legacy, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  platform longer receives updates software also supports Create an Application Load Balancer with the existing EC2 instances as a target group, Create an AWS WAF web ACL containing rules that protect the application, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. updates software platform operates Route would be weaker with Create an Amazon CloudFront distribution specifying one EC2 instance as an origin, Create an AWS WAF web ACL containing rules that protect the application from this, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. operates Route weighted load balancing separates Obtain the latest source code for the platform and make the necessary updates, Test the updated code to ensure that the vulnerability has been mitigated, then and Update the security group that is attached to the EC2 instances, removing access from the internet to the TCP port used by the SQL database, Create from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. load balancing send traffic EC2 points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 143:

  A company operates an Amazon EC2 instance that is registered as a target of a Network Load Balancer (NLB). The NLB is associated with a security group. The security group allows inbound TCP traffic on port 22 from 10.0.0.0/23.

  The company maps the NLB to two subnets that share the same network ACL and route table. The route table has a route for 0.0.0.0/0 to an internet gateway. The network ACL has one inbound rule that has a priority of 20 and that allows TCP traffic on port 22 from 10.0.0.0/16.

  A security engineer receives an alert that there is an unauthorized SSH session on the EC2 instance. The

  unauthorized session originates from 10.0.1.5. The company ' s incident response procedure requires

  unauthorized SSH sessions to beimmediately interrupted. The instance must remain running, and its memory must remain intact.

  Which solution will meet these requirements?

  A. Restart the EC2 instance from either the AWS Management Console or the AWS CLI.
  B. Add a new inbound rule that has a priority of 10 to the network ACL to deny TCP traffic on port 22 from 10.0.1.5.
  C. Remove the security group rule that allows inbound TCP traffic on port 22 from 10.0.0.0/16.
  D. Update the route table to remove the route to the internet gateway.
  A. Restart the EC2 instance from either the AWS Management Console or the AWS CLI.

  ---

  Explanation

  operates EC2 instance registered target makes Add a new inbound rule that has a priority of 10 to the network ACL to deny TCP traffic on port 22 from 10, 0, 1, the strongest match, because registered target Network Load Balancer asks for a managed AWS capability which is important when security controls must be repeatable. registered target Network Load Balancer depends on Add a new inbound rule that has a priority of 10 to the network ACL to deny TCP traffic on port 22 from 10, 0, 1, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. Load Balancer NLB associated group is reinforced by A company operates an Amazon EC2 instance that is registered as a target of, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  NLB associated group allows inbound also supports Add a new inbound rule that has a priority of 10 to the network ACL to deny TCP traffic on port 22 from 10, 0, 1,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. group allows inbound TCP traffic would be weaker with Restart the EC2 instance from either the AWS Management Console or the AWS CLI,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. TCP traffic port maps NLB separates Remove the security group rule that allows inbound TCP traffic on port 22 from 10, 0, 0, 0/16, and Update the route table to remove the route to the internet gateway, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. maps NLB subnets share same points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 144:

  A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region. The DB cluster is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. To meet compliance requirements, the company needs to copy a DB snapshot to the us-west-1 Region. However, when the company tries to copy the snapshot to us-west-1, the company cannot access the key that was used to encrypt the original database.

  What should the company do to set up the snapshot in us-west-1 with proper encryption?

  A. Use AWS Secrets Manager to store the customer managed key in us-west-1 as a secret. Use this secret to encrypt the snapshot in us-west-1.
  B. Create a new customer managed key in us-west-1. Use this new key to encrypt the snapshot in us-west-1.
  C. Create an IAM policy that allows access to the customer managed key in us-east-1. Specify arn:aws: kms:us-west-1:* as the principal.
  D. Create an IAM policy that allows access to the customer managed key in us-east-1. Specify arn:aws:rds: us-west-1:* as the principal.
  A. Use AWS Secrets Manager to store the customer managed key in us-west-1 as a secret. Use this secret to encrypt the snapshot in us-west-1.

  ---

  Explanation

  encrypted Aurora cluster east Region makes Create a new customer managed key in us-west-1, Use this new key to encrypt the snapshot in us-west-1, the strongest match, because east Region cluster encrypted Key asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. east Region cluster encrypted Key depends on Create a new customer managed key in us-west-1, Use this new key to encrypt the snapshot in us-west-1, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. encrypted Key Management KMS customer is reinforced by A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  KMS customer managed key compliance also supports Create a new customer managed key in us-west-1, Use this new key to encrypt the snapshot in us-west-1,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. key compliance requirements copy snapshot would be weaker with Use AWS Secrets Manager to store the customer managed key in us-west-1 as a secret, Use this secret to encrypt the snapshot in us-west-1,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. copy snapshot west Region However separates Create an IAM policy that allows access to the customer managed key in us-east-1, Specify arn, aws, kms, us-west-1, * as the principal, and Create an IAM policy that allows access to the customer managed key in us-east-1, Specify arn, aws, rds, us-west-1, * as the principal, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Region.

  However tries copy snapshot points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 145:

  A company uses AWS IAM Identity Center to manage access to its AWS accounts. The accounts are in an organization in AWS Organizations. A security engineer needs to set up delegated administration of IAM Identity Center in the organization's management account.

  Which combination of steps should the security engineer perform in IAM Identity Center before configuring delegated administration? (Select THREE.)

  A. Grant least privilege access to the organization ' s management account.
  B. Create a new IAM Identity Center directory in the organization ' s management account.
  C. Set up a second AWS Region in the organization's management account.
  D. Create permission sets for use only in the organization ' s management account.
  E. Create IAM users for use only in the organization ' s management account.
  F. Create user assignments only in the organization ' s management account.
  A. Grant least privilege access to the organization ' s management account.
  B. Create a new IAM Identity Center directory in the organization ' s management account.

  ---

  Explanation

  IAM Identity Center manage access makes Create a new IAM Identity Center directory in the organization ' s management account, plus Create permission sets for use only in the organization ' s management account, plus Create user assignments only in the organization ' s management account, the strongest match, because manage access organization Organizations set asks for a managed AWS capability and the design remains easier to govern across the environment. manage access organization Organizations set depends on Create a new IAM Identity Center directory in the organization ' s management account, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. Organizations set delegated administration IAM is reinforced by A company uses AWS IAM Identity Center to manage access to its AWS accounts,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  administration IAM Identity Center organization also supports Create permission sets for use only in the organization ' s management account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. Center organization management combination steps would be weaker with Grant least privilege access to the organization ' s management account,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. combination steps should perform IAM separates Set up a second AWS Region in the organization's management account, and Create IAM users for use only in the organization ' s management account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. perform IAM Identity Center configuring points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 146:

  A company ' s security team wants to receive email notification from AWS about any abuse reports regarding

  DoS attacks. A security engineer needs to implement a solution that will provide a near-real-time alert for any abuse reports that AWS sends for the account. The security engineer already has created an Amazon Simple Notification Service (Amazon SNS) topic and has subscribed the security team ' s email address to the topic.

  What should the security engineer do next to meet these requirements?

  A. Use the AWS Trusted Advisor API and a scheduled Lambda function to detect AWS_ABUSE_DOS_REPORT notifications.
  B. Create an Amazon EventBridge rule that uses AWS Health and identifies a specific event forAWS_ABUSE_DOS_REPORT. Configure the rule action to publish a message to the SNS topic.
  C. Use the AWS Support API and a scheduled Lambda function to detect abuse report cases.
  D. Use AWS CloudTrail logs with metric filters to detect AWS_ABUSE_DOS_REPORT events.
  A. Use the AWS Trusted Advisor API and a scheduled Lambda function to detect AWS_ABUSE_DOS_REPORT notifications.

  ---

  Explanation

  team wants receive email notification makes Create an Amazon EventBridge rule that uses AWS Health and identifies a specific event for AWS_ABUSE_DOS_REPORT, Configure the rule action to publish a message to the the strongest match, because email notification about any abuse asks for a managed AWS capability and that reduces the need for extra supervisory automation. email notification about any abuse depends on Create an Amazon EventBridge rule that uses AWS Health and identifies a specific event for AWS_ABUSE_DOS_REPORT, Configure the rule action to publish a message to the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. any abuse reports regarding DoS is reinforced by A company ' s security team wants to receive email notification from AWS about, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  regarding DoS attacks implement provide also supports Create an Amazon EventBridge rule that uses AWS Health and identifies a specific event for AWS_ABUSE_DOS_REPORT, Configure the rule action to publish a message to the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. implement provide near real time would be weaker with Use the AWS Trusted Advisor API and a scheduled Lambda function to detect AWS_ABUSE_DOS_REPORT notifications,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. real time alert any abuse separates Use the AWS Support API and a scheduled Lambda function to detect abuse report cases, and Use AWS CloudTrail logs with metric filters to detect AWS_ABUSE_DOS_REPORT events, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. any abuse reports sends already points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 147:

  A company detects bot activity targeting Amazon Cognito user pool endpoints. The solution must block malicious requests while maintaining access for legitimate users.

  Which solution meets these requirements?

  A. Enable Amazon Cognito threat protection.
  B. Restrict access to authenticated users only.
  C. Associate AWS WAF with the Cognito user pool.
  D. Monitor requests with CloudWatch.
  A. Enable Amazon Cognito threat protection.

  ---

  Explanation

  detects bot activity targeting Cognito makes Enable Amazon Cognito threat protection, the strongest match, because targeting Cognito user pool endpoints asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. targeting Cognito user pool endpoints depends on Enable Amazon Cognito threat protection, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. pool endpoints block malicious requests is reinforced by A company detects bot activity targeting Amazon Cognito user pool endpoints, The solution must, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  malicious requests while maintaining access also supports Enable Amazon Cognito threat protection,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. maintaining access legitimate users requirements would be weaker with Restrict access to authenticated users only,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. users requirements Enable Cognito threat separates Associate AWS WAF with the Cognito user pool, and Monitor requests with CloudWatch, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. Cognito threat protection Restrict access points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 148:

  A company serves an application through Amazon CloudFront. The origin is an internet-facing Application Load Balancer with an AWS WAF web ACL associated with the CloudFront distribution. Users have discovered that they can bypass CloudFront and access the load balancer directly.

  A. Replace the load balancer with a NAT gateway and route CloudFront traffic through the NAT gateway.
  B. Disable TLS on the load balancer so that only CloudFront can negotiate HTTPS.
  C. Require CloudFront to add a shared secret header and configure the load balancer listener rules to allow only requests with that header.
  D. Add a security group rule that allows inbound traffic from all client IP addresses.
  A. Replace the load balancer with a NAT gateway and route CloudFront traffic through the NAT gateway.

  ---

  Explanation

  serves application through CloudFront origin makes Require CloudFront to add a shared secret header and configure the load balancer listener rules to allow only requests with that header, the strongest match, because CloudFront origin internet facing Application asks for a managed AWS capability and that reduces the need for extra supervisory automation. CloudFront origin internet facing Application depends on Require CloudFront to add a shared secret header and configure the load balancer listener rules to allow only requests with that header, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. facing Application Load Balancer WAF is reinforced by A company serves an application through Amazon CloudFront, The origin is an internet-facing Application, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  Balancer WAF web ACL associated also supports Require CloudFront to add a shared secret header and configure the load balancer listener rules to allow only requests with that header,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. ACL associated CloudFront distribution Users would be weaker with Replace the load balancer with a NAT gateway and route CloudFront traffic through the NAT gateway,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. distribution Users discovered they bypass separates Disable TLS on the load balancer so that only CloudFront can negotiate HTTPS, and Add a security group rule that allows inbound traffic from all client IP addresses, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. they bypass CloudFront access load points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 149:

  A company is running a containerized application on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The application runs as several ECS services.

  The ECS services are in individual target groups for an internet-facing Application Load Balancer (ALB).

  The ALB is the origin for an Amazon CloudFront distribution. An AWS WAF web ACL is associated with the CloudFront distribution.

  Web clients access the ECS services through the CloudFront distribution. The company learns that the web clients can bypass the web ACL and can access the ALB directly.

  Which solution will prevent the web clients from directly accessing the ALB?

  A. Create an AWS PrivateLink endpoint and set it as the CloudFront origin.
  B. Create a new internal ALB and delete the internet-facing ALB.
  C. Modify the ALB listener rules to allow only CloudFront IP ranges.
  D. Add a custom X-Shared-Secret header in CloudFront and configure the ALB listener rules to allow requests only when the header value matches.
  A. Create an AWS PrivateLink endpoint and set it as the CloudFront origin.

  ---

  Explanation

  running containerized application Elastic Container makes Add a custom X-Shared-Secret header in CloudFront and configure the ALB listener rules to allow requests only when the header value matches, the strongest match, because Elastic Container ECS cluster Fargate asks for a managed AWS capability which is important when security controls must be repeatable. Elastic Container ECS cluster Fargate depends on Add a custom X-Shared-Secret header in CloudFront and configure the ALB listener rules to allow requests only when the header value matches, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. cluster Fargate application runs several is reinforced by A company is running a containerized application on an Amazon Elastic Container Service (Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  runs several ECS individual target also supports Add a custom X-Shared-Secret header in CloudFront and configure the ALB listener rules to allow requests only when the header value matches,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. ECS individual target groups internet would be weaker with Create an AWS PrivateLink endpoint and set it as the CloudFront origin,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. groups internet facing Application Load separates Create a new internal ALB and delete the internet-facing ALB, and Modify the ALB listener rules to allow only CloudFront IP ranges, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. Application Load Balancer ALB origin points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 150:

  A company has the following security policy for its Amazon Aurora MySQL databases for a single AWS account:

  - Database storage must be encrypted at rest.

  - Deletion protection must be enabled.

  - Databases must not be publicly accessible.

  - Database audit logs must be published to Amazon CloudWatch Logs.

  A security engineer must implement a solution thatcontinuously monitorsall Aurora MySQL resources for compliance with this policy. The solution must be able todisplay a database ' s compliance state for each part of the policy at any time.

  Which solution will meet these requirements?

  A. Enable AWS Audit Manager. Configure Audit Manager to use a custom framework that matches the security requirements. Create an assessment report to view the compliance state.
  B. Enable AWS Config. Implement AWS Config managed rules that monitor all Aurora MySQL resources for the security requirements. View the compliance state in the AWS Config dashboard.
  C. Enable AWS Security Hub. Create a configuration policy that includes the security requirements. Apply the configuration policy to all Aurora MySQL resources. View the compliance state in Security Hub.
  D. Create an Amazon EventBridge rule that runs when an Aurora MySQL resource is created or modified. Create an AWS Lambda function to verify the security requirements and to send the compliance state to a CloudWatch custom metric.
  A. Enable AWS Audit Manager. Configure Audit Manager to use a custom framework that matches the security requirements. Create an assessment report to view the compliance state.

  ---

  Explanation

  policy Aurora MySQL databases single makes Enable AWS Config, Implement AWS Config managed rules that monitor all Aurora MySQL resources for the security requirements, View the compliance state in the AWS Config the strongest match, because databases single Database storage encrypted asks for a managed AWS capability which is important when security controls must be repeatable. databases single Database storage encrypted depends on Enable AWS Config, Implement AWS Config managed rules that monitor all Aurora MySQL resources for the security requirements, View the compliance state in the AWS

  Config to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. storage encrypted rest Deletion protection is reinforced by A company has the following security policy for its Amazon Aurora MySQL databases for, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  Deletion protection enabled Databases publicly also supports Enable AWS Config, Implement AWS Config managed rules that monitor all Aurora MySQL resources for the security requirements, View the compliance state in the AWS Config, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. Databases publicly accessible Database audit would be weaker with Enable AWS Audit Manager, Configure Audit Manager to use a custom framework that matches the security requirements, Create an assessment report to view the compliance state,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. Database audit logs published CloudWatch separates Enable AWS Security Hub, Create a configuration policy that includes the security requirements, Apply the configuration policy to all Aurora MySQL resources, View the compliance state and Create an Amazon EventBridge rule that runs when an Aurora MySQL resource is created or modified, Create an AWS Lambda function to verify the security requirements from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. published CloudWatch Logs implement thatcontinuously points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.