Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 151:

  A company ' s security engineer receives an abuse notification from AWS. The notification indicates that someone is hosting malware from the company ' s AWS account. After investigation, the security engineer finds a new Amazon S3 bucket that an IAM user created without authorization.

  Which combination of steps should the security engineer take toMINIMIZE the consequencesof this compromise? (Select THREE.)

  A. Encrypt all AWS CloudTrail logs.
  B. Turn on Amazon GuardDuty.
  C. Change the password for all IAM users.
  D. Rotate or delete all AWS access keys.
  E. Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
  F. Delete any resources that are unrecognized or unauthorized.
  A. Encrypt all AWS CloudTrail logs.
  B. Turn on Amazon GuardDuty.

  ---

  Explanation

  receives abuse notification indicates someone makes Turn on Amazon GuardDuty, plus Rotate or delete all AWS access keys, plus Delete any resources that are unrecognized or unauthorized, the strongest match, because notification indicates someone hosting malware asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. notification indicates someone hosting malware depends on Turn on Amazon GuardDuty, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. hosting malware investigation finds new is reinforced by A company ' s security engineer receives an abuse notification from AWS, The notification, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  finds new bucket IAM user also supports Rotate or delete all AWS access keys,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. IAM user created without authorization would be weaker with Encrypt all AWS CloudTrail logs,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. without authorization combination steps should separates Change the password for all IAM users, and Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. steps should take toMINIMIZE consequencesof points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 152:

  A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. Each Availability Zone contains one public subnet and one private subnet. Three route tables exist: one for the public subnets and one for each private subnet.

  The security engineer discovers that all four subnets are routing traffic through the internet gateway that is attached to the VPC.

  Which combination of steps should the security engineer take to remediate this scenario? (Select TWO.)

  A. Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.
  B. Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.
  C. Modify the route tables for the public subnets to add a local route to the VPC CIDR range.
  D. Modify the route tables for the private subnets to route 0.0.0.0/0 to the NAT gateway in the public subnet of the same Availability Zone.
  E. Modify the route tables for the private subnets to route 0.0.0.0/0 to the internet gateway.
  A. Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.
  B. Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.

  ---

  Explanation

  designed VPC segment private traffic makes Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone, plus Modify the route tables for the private subnets to route 0, 0, 0, 0/0 to the NAT gateway in the public subnet of the same Availability the strongest match, because private traffic public VPC includes asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. private traffic public VPC includes depends on Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. traffic VPC includes Availability Zones is reinforced by A security engineer has designed a VPC to segment private traffic from public traffic,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  Availability Zones Zone contains public also supports Modify the route tables for the private subnets to route 0, 0, 0, 0/0 to the NAT gateway in the public subnet of the same Availability, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. Zone contains public subnet private would be weaker with Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. subnet private route tables exist separates Modify the route tables for the public subnets to add a local route to the VPC CIDR range, and Modify the route tables for the private subnets to route 0, 0, 0, 0/0 to the internet gateway, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. route tables exist public subnets points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 153:

  A company is using AWS Organizations with the default SCP. The company needs to restrict AWS usage for all AWS accounts that are in a specific OU. Except for some desired global services, the AWS usage must occur only in theeu-west-1Region for all accounts in the OU. A security engineer must create an SCP that applies the restriction to existing accounts and any new accounts in the OU.

  Which SCP will meet these requirements?

  A. Deny with NotAction, but uses StringEquals for aws:RequestedRegion = eu-west-1
  B. Allow with Action, scoped to desired global services in eu-west-1
  C. Deny with NotAction for desired global services, and StringNotEquals aws:RequestedRegion = eu-west-1
  D. Allow with NotAction and StringNotEquals aws:RequestedRegion = eu-west-1
  A. Deny with NotAction, but uses StringEquals for aws:RequestedRegion = eu-west-1

  ---

  Explanation

  Organizations default SCP restrict usage makes Deny with NotAction for desired global services, and StringNotEquals aws, RequestedRegion = eu-west-1 the strongest match, because restrict usage specific Except some asks for a managed AWS capability and that reduces the need for extra supervisory automation. restrict usage specific Except some depends on Deny with NotAction for desired global services, and StringNotEquals aws, RequestedRegion = eu-west-1 to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. Except some desired global usage is reinforced by A company is using AWS Organizations with the default SCP, The company needs to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  global usage occur only theeu also supports Deny with NotAction for desired global services, and StringNotEquals aws, RequestedRegion = eu-west-1, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. only theeu west 1Region SCP would be weaker with Deny with NotAction, but uses StringEquals for aws, RequestedRegion = eu-west-1, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. 1Region SCP applies restriction any separates Allow

  with Action, scoped to desired global services in eu-west-1 and Allow with NotAction and StringNotEquals aws, RequestedRegion = eu-west-1 from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. restriction any new SCP requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 154:

  A company uses AWS Organizations to manage an organization that consists of three workload OUs: Production, Development, and Testing. The company uses AWS CloudFormation templates to define and deploy workload infrastructure in AWS accounts that are associated with the OUs. Different SCPs are attached to each workload OU.

  The company successfully deployed a CloudFormation stack update to workloads in the Development OU and the Testing OU.

  When the company uses the same CloudFormation template to deploy the stack update in an account in the Production OU, the update fails. The error message reports insufficient IAM permissions.

  What is the FIRST step that a security engineer should take to troubleshoot this issue?

  A. Review the AWS CloudTrail logs in the account in the Production OU. Search for any failed API calls from CloudFormation during the deployment attempt.
  B. Remove all the SCPs that are attached to the Production OU. Rerun the CloudFormation stack update to determine if the SCPs were preventing the CloudFormation API calls.
  C. Confirm that the role used by CloudFormation has sufficient permissions to create, update, and delete the resources that are referenced in the CloudFormation template.
  D. Make all the SCPs that are attached to the Production OU the same as the SCPs that are attached to the Testing OU.
  A. Review the AWS CloudTrail logs in the account in the Production OU. Search for any failed API calls from CloudFormation during the deployment attempt.

  ---

  Explanation

  Organizations manage organization consists workload makes Review the AWS CloudTrail logs in the account in the Production OU, Search for any failed API calls from CloudFormation during the deployment attempt, the strongest match, because consists workload OUs Production Development asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. consists workload OUs Production Development depends on Review the AWS CloudTrail logs in the account in the Production OU, Search for any failed API calls from CloudFormation during the deployment attempt, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. Production Development Testing CloudFormation templates is reinforced by A company uses AWS Organizations to manage an organization that consists of three workload, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  CloudFormation templates define deploy workload also supports Review the AWS CloudTrail logs in the account in the Production OU, Search for any failed API calls from CloudFormation during the deployment attempt,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. deploy workload infrastructure associated OUs would be weaker with Remove all the SCPs that are attached to the Production OU, Rerun the CloudFormation stack update to determine if the SCPs were preventing the CloudFormation API, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. associated OUs Different SCPs attached separates Confirm that the role used by CloudFormation has sufficient permissions to create, update, and delete the resources that are referenced in the CloudFormation template, and Make all the SCPs that are attached to the Production OU the same as the SCPs that are attached to the Testing OU, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. SCPs attached workload successfully deployed points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 155:

  A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards. However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes.

  Which solution will meet this requirement in the MOST operationally efficient way?

  A. Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
  B. Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.
  C. Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
  D. Use AWS Cloud Map to detect the configuration changes. Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.
  A. Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.

  ---

  Explanation

  wants evaluate configuration changes specific makes Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes, the strongest match, because changes specific resource ensure compliance asks for a managed AWS capability and that reduces the need for extra supervisory automation. changes specific resource ensure compliance depends on Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. ensure resource compliance standards.

  However is reinforced by A security engineer wants to evaluate configuration changes to a specific AWS resource to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  standards However concerned about situation also supports Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. about situation several configuration changes would be weaker with Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes, Use the most recent API call to indicate the cumulative, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. configuration changes made resource quick separates Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes, Use the most recent API call to indicate the cumulative and Use AWS Cloud Map to detect the configuration changes, Generate a report of configuration changes from AWS Cloud Map to track the latest state by using from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. resource quick succession wants record points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 156:

  A company uses infrastructure as code (IaC) to create AWS infrastructure. The company writes the code as AWS CloudFormation templates to deploy the infrastructure. The company has an existing CI/CD pipeline that the company can use to deploy these templates.

  After a recent security audit, the company decides to adopt a policy-as-code approach to improve the company's security posture on AWS. The company must prevent the deployment of any infrastructure that would violate a security policy, such as an unencrypted Amazon EBS volume.

  Which solution will meet these requirements?

  A. Turn on AWS Trusted Advisor. Configure security notifications as webhooks in the preferences section of the CI/CD pipeline.
  B. Turn on AWS Config. Use the prebuilt rules or customized rules. Subscribe the CI/CD pipeline to an Amazon SNS topic that receives notifications from AWS Config.
  C. Create rule sets in AWS CloudFormation Guard. Run validation checks for CloudFormation templates as a phase of the CI/CD process.
  D. Create rule sets as SCPs. Integrate the SCPs as a part of validation control in a phase of the CI/CD process.
  A. Turn on AWS Trusted Advisor. Configure security notifications as webhooks in the preferences section of the CI/CD pipeline.

  ---

  Explanation

  infrastructure code IaC writes CloudFormation makes Create rule sets in AWS CloudFormation Guard, Run validation checks for CloudFormation templates as a phase of the CI/CD process, the strongest match, because infrastructure writes code CloudFormation templates asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. infrastructure writes code CloudFormation templates depends on Create rule sets in AWS CloudFormation Guard, Run validation checks for CloudFormation templates as a phase of the CI/CD process, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. CloudFormation templates deploy infrastructure pipeline is reinforced by A company uses infrastructure as code (IaC) to create AWS infrastructure, The company writes, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  infrastructure pipeline deploy templates recent also supports Create rule sets in AWS CloudFormation Guard, Run validation checks for CloudFormation templates as a phase of the CI/CD process,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround.

  templates recent audit decides adopt would be weaker with Turn on AWS Trusted Advisor, Configure security notifications as webhooks in the preferences section of the CI/CD pipeline,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. decides adopt policy code approach separates Turn on AWS Config, Use the prebuilt rules or customized rules, Subscribe the CI/CD pipeline to an Amazon SNS topic that receives notifications from AWS Config, and Create rule sets as SCPs, Integrate the SCPs as a part of validation control in a phase of the CI/CD process, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. code approach improve posture prevent points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 157:

  A company has a web application that reads from and writes to an Amazon S3 bucket. The company needs to authenticate all S3 API calls with AWS credentials.

  Which solution will provide the application with AWS credentials?

  A. Use Amazon Cognito identity pools and the GetId API.
  B. Use Amazon Cognito identity pools and AssumeRoleWithWebIdentity.
  C. Use Amazon Cognito user pools with ID tokens.
  D. Use Amazon Cognito user pools with access tokens.
  A. Use Amazon Cognito identity pools and the GetId API.

  ---

  Explanation

  web application reads writes bucket makes Use Amazon Cognito identity pools and AssumeRoleWithWebIdentity, the strongest match, because writes bucket authenticate API calls asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. writes bucket authenticate API calls depends on Use Amazon Cognito identity pools and AssumeRoleWithWebIdentity, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. API calls credentials provide application is reinforced by A company has a web application that reads from and writes to an Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  provide application credentials Cognito identity also supports Use Amazon Cognito identity pools and AssumeRoleWithWebIdentity,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. Cognito identity pools AssumeRoleWithWebIdentity GetId would be weaker with Use Amazon Cognito identity pools and the GetId API,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. AssumeRoleWithWebIdentity Cognito identity pools GetId separates Use Amazon Cognito user pools with ID tokens, and Use Amazon Cognito user pools with access tokens, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. pools GetId API Cognito user points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 158:

  A company is running its application on AWS. The company has a multi-environment setup, and each environment is isolated in a separate AWS account. The company has an organization in AWS Organizations to manage the accounts. There is a single dedicated security account for the organization.

  The company must create an inventory of all sensitive data that is stored in Amazon S3 buckets across the organization ' s accounts. The findings must be visible from a single location.

  Which solution will meet these requirements?

  A. Set the security account as the delegated administrator for Amazon Macie and AWS Security Hub. Enable and configure Macie to publish sensitive data findings to Security Hub.
  B. Set the security account as the delegated administrator for AWS Security Hub. In each account, configure Amazon Inspector to scan the S3 buckets for sensitive data. Publish sensitive data findings to Security Hub.
  C. In each account, configure Amazon Inspector to scan the S3 buckets for sensitive data. Enable Amazon Inspector integration with AWS Trusted Advisor. Publish sensitive data findings to Trusted Advisor.
  D. In each account, enable and configure Amazon Macie to detect sensitive data. Enable Macie integration with AWS Trusted Advisor. Publish sensitive data findings to Trusted Advisor.
  A. Set the security account as the delegated administrator for Amazon Macie and AWS Security Hub. Enable and configure Macie to publish sensitive data findings to Security Hub.

  ---

  Explanation

  running application multi environment setup makes Set the security account as the delegated administrator for Amazon Macie and AWS Security Hub, Enable and configure Macie to publish sensitive data findings to Security the strongest match, because environment setup isolated separate organization asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. environment setup isolated separate organization depends on Set the security account as the delegated administrator for Amazon Macie and AWS Security Hub, Enable and configure Macie to publish sensitive data findings to Security to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. isolated separate organization Organizations manage is reinforced by A company is running its application on AWS, The company has a multi-environment setup,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  Organizations manage There single dedicated also supports Set the security account as the delegated administrator for Amazon Macie and AWS Security Hub, Enable and configure Macie to publish sensitive data findings to Security, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. single dedicated organization inventory sensitive would be weaker with Set the security account as the delegated administrator for AWS Security Hub, In each account, configure Amazon Inspector to scan the S3 buckets for sensitive data,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. inventory sensitive data stored buckets separates In each account, configure Amazon Inspector to scan the S3 buckets for sensitive data, Enable Amazon Inspector integration with AWS Trusted Advisor, Publish sensitive data findings and In each account, enable and configure Amazon Macie to detect sensitive data, Enable Macie integration with AWS Trusted Advisor, Publish sensitive data findings to Trusted Advisor, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. stored buckets organization findings visible points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 159:

  A company wants to remove all SSH keys permanently from a specific subset of its Amazon Linux 2 Amazon EC2 instances that are using the same IAM instance profile. However, three individuals who have IAM user accounts will need to access these instances by using an SSH session to perform critical duties.

  How can a security engineer provide the access to meet these requirements?

  A. Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager. Provide the IAM user accounts with permission to use Systems Manager. Remove the SSH keys from the EC2 instances. Use Systems Manager Inventory to select the EC2 instance and connect.
  B. Assign an IAM policy to the IAM user accounts to provide permission to use AWS Systems Manager Run Command. Remove the SSH keys from the EC2 instances. Use Run Command to open an SSH connection to the EC2 instance.
  C. Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager. Provide the IAM user accounts with permission to use Systems Manager. Remove the SSH keys from the EC2 instances. Use Systems Manager Session Manager to select the EC2 instance and connect.
  D. Assign an IAM policy to the IAM user accounts to provide permission to use the EC2 service in the AWS Management Console. Remove the SSH keys from the EC2 instances. Connect to the EC2 instance as the ec2-user through the AWS Management Console's EC2 SSH client method.
  A. Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager. Provide the IAM user accounts with permission to use Systems Manager. Remove the SSH keys from the EC2 instances. Use Systems Manager Inventory to select the EC2 instance and connect.

  ---

  Explanation

  wants remove SSH keys permanently makes Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager, Provide the IAM user accounts with the strongest match, because keys permanently specific subset Linux asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. keys permanently specific subset Linux depends on Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager, Provide the IAM user accounts with to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. subset Linux EC2 instances same is reinforced by A company wants to remove all SSH keys permanently from a specific subset of, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  instances same IAM instance profile also supports Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager, Provide the IAM user accounts with, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. instance profile However individuals IAM would be weaker with Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager, Provide the IAM user accounts with, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. individuals IAM user need access separates Assign an IAM policy to the IAM user accounts to provide permission to use AWS Systems Manager Run Command, Remove the SSH keys from the EC2 and Assign an IAM policy to the IAM user accounts to provide permission to use the EC2 service in the AWS Management Console, Remove the SSH keys from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. need access instances SSH session points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 160:

  A company has a web application that reads from and writes to an Amazon S3 bucket. The company needs to use AWS credentials to authenticate all S3 API calls to the S3 bucket.

  Which solution will provide the application with AWS credentials to make S3 API calls?

  A. Integrate with Cognito identity pools and use GetId to obtain AWS credentials.
  B. Integrate with Cognito identity pools and use AssumeRoleWithWebIdentity to obtain AWS credentials.
  C. Integrate with Cognito user pools and use the ID token to obtain AWS credentials.
  D. Integrate with Cognito user pools and use the access token to obtain AWS credentials.
  A. Integrate with Cognito identity pools and use GetId to obtain AWS credentials.

  ---

  Explanation

  web application reads writes bucket makes Integrate with Cognito identity pools and use AssumeRoleWithWebIdentity to obtain AWS credentials, the strongest match, because writes bucket credentials authenticate API asks for a managed AWS capability which is important when security controls must be repeatable. writes bucket credentials authenticate API depends on Integrate with Cognito identity pools and use AssumeRoleWithWebIdentity to obtain AWS credentials, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. authenticate API calls bucket provide is reinforced by A company has a web application that reads from and writes to an Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  bucket provide application credentials make also supports Integrate with Cognito identity pools and use AssumeRoleWithWebIdentity to obtain AWS credentials,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. credentials make API calls Integrate would be weaker with Integrate with Cognito identity pools and use GetId to obtain AWS credentials,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. calls Integrate Cognito identity pools separates Integrate with Cognito user pools and use the ID token to obtain AWS credentials, and Integrate with Cognito user pools and use the access token to obtain AWS credentials, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. identity pools AssumeRoleWithWebIdentity obtain credentials points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.