Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 171:

  A company stores infrastructure and application code in web-based, third-party, Git-compatible code repositories outside of AWS. The company wants to give the code repositories the ability to securely authenticate and assume an existing IAM role within the company ' s AWS account by using OpenID Connect (OIDC).

  Which solution will meet these requirements?

  A. Create an OIDC identity provider (IdP) by using AWS Identity and Access Management (IAM) federation. Modify the trust policy of the IAM role to allow the code repositories to assume the IAM role.
  B. Use AWS Identity and Access Management (IAM) Roles Anywhere to create a trust anchor that uses OIDC. Modify the trust policy of the IAM role to allow the code repositories to assume the IAM role.
  C. Set up an account instance of AWS IAM Identity Center. Configure access to the code repositories as a customer managed OIDC application. Grant the application access to the IAM role.
  D. Use AWS Resource Access Manager (AWS RAM) to create a new resource share that uses OIDC. Limit the resource share to the specified code repositories. Grant the IAM role access to the resource share.
  A. Create an OIDC identity provider (IdP) by using AWS Identity and Access Management (IAM) federation. Modify the trust policy of the IAM role to allow the code repositories to assume the IAM role.

  ---

  Explanation

  stores infrastructure application code web makes Create an OIDC identity provider (IdP) by using AWS Identity and Access Management (IAM) federation, Modify the trust policy of the IAM role to allow the the strongest match, because code web based third party asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. code web based third party depends on Create an OIDC identity provider (IdP) by using AWS Identity and Access Management (IAM) federation, Modify the trust policy of the IAM role to allow the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. third party Git compatible code is reinforced by A company stores infrastructure and application code in web-based, third-party, Git-compatible code repositories outside, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  compatible code repositories outside wants also supports Create an OIDC identity provider (IdP) by using AWS Identity and Access Management (IAM) federation, Modify the trust policy of the IAM role to allow the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. outside wants give code repositories would be weaker with Use AWS Identity and Access Management (IAM) Roles Anywhere to create a trust anchor that uses OIDC, Modify the trust policy of the IAM role to, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. code repositories ability securely authenticate separates Set up an account instance of AWS IAM Identity Center, Configure access to the code repositories as a customer managed OIDC application, Grant the application access and Use AWS Resource Access Manager (AWS RAM) to create a new resource share that uses OIDC, Limit the resource share to the specified code repositories, Grant from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. securely authenticate assume IAM role points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 172:

  A legacy web application is publicly reachable and cannot be patched before the next maintenance window.

  The security team has confirmed that current attack traffic matches common SQL injection patterns. The business requires the application to remain available while the short-term mitigation is deployed.

  A. Disable the database subnet route table so that the application cannot connect to the database.
  B. Place the application behind an Application Load Balancer, associate an AWS WAF web ACL that blocks SQL injection patterns, and restrict direct access to the instances.
  C. Replace all application instances with new instances that use the same vulnerable application image.
  D. Create an IAM policy that denies database queries containing SQL keywords.
  A. Disable the database subnet route table so that the application cannot connect to the database.

  ---

  Explanation

  legacy web application publicly reachable makes Place the application behind an Application Load Balancer, associate an AWS WAF web ACL that blocks SQL injection patterns, and restrict direct access to the instances, the strongest match, because publicly reachable cannot patched next asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. publicly reachable cannot patched next depends on Place the application behind an Application Load Balancer, associate an AWS WAF web ACL that blocks SQL injection patterns, and restrict direct access to the instances, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. patched next maintenance window team is reinforced by A legacy web application is publicly reachable and cannot be patched before the next, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  window team confirmed attack traffic also supports Place the application behind an Application Load Balancer, associate an AWS WAF web ACL that blocks SQL injection patterns, and restrict direct access to the instances,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. attack traffic matches common SQL would be weaker with Disable the database subnet route table so that the application cannot connect to the database,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. common SQL injection patterns business separates Replace all application instances with new instances that use the same vulnerable application image, and Create an IAM policy that denies database queries containing SQL keywords, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. patterns business requires application remain points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 173:

  A company wants to store all objects that contain sensitive data in an Amazon S3 bucket. The company will use server-side encryption to encrypt the S3 bucket. The company ' s operations team manages access to the company's S3 buckets. The company ' s security team manages access to encryption keys. The company wants to separate the duties of the two teams to ensure that configuration errors by only one of these teams will not compromise the data by granting unauthorized access to plaintext data.

  Which solution will meet this requirement?

  A. Ensure that the operations team configures default bucket encryption on the S3 bucket to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to use the encryption keys.
  B. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed. Ensure that the security team creates a key policy that controls access to the encryption keys.
  C. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with Amazon S3 managed keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to the encryption keys.
  D. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with customer-provided encryption keys (SSE-C). Ensure that the security team stores the customer-provided keys in AWS Key Management Service (AWS KMS). Ensure that the security team creates a key policy that controls access to the encryption keys.
  A. Ensure that the operations team configures default bucket encryption on the S3 bucket to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to use the encryption keys.

  ---

  Explanation

  wants store objects contain sensitive makes Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed, Ensure the strongest match, because contain sensitive data bucket server asks for a managed AWS capability while keeping the service responsibility clear for operations teams. contain sensitive data bucket server depends on Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed, Ensure to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. bucket server side encryption encrypt is reinforced by A company wants to store all objects that contain sensitive data in an Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  encryption encrypt bucket operations team also supports Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed, Ensure, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. operations team manages access buckets would be weaker with Ensure that the operations team configures default bucket encryption on the S3 bucket to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3), Ensure that, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. access buckets team manages encryption separates Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with Amazon S3 managed keys (SSE-S3), Ensure that the security and Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with customer-provided encryption keys (SSE-C), Ensure that the security team from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. manages access encryption keys wants points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 174:

  A security engineer discovers that a company ' s user passwords have no required minimum length. The company uses the following identity providers (IdPs):

  - AWS Identity and Access Management (IAM) federated with on-premises Active Directory

  - Amazon Cognito user pools that contain the user database for an AWS Cloud application

  Which combination of actions should the security engineer take to implement a required minimum password length? (Select TWO.)

  A. Update the password length policy in the IAM configuration.
  B. Update the password length policy in the Amazon Cognito configuration.
  C. Update the password length policy in the on-premises Active Directory configuration.
  D. Create an SCP in AWS Organizations to enforce minimum password length.
  E. Create an IAM policy with a minimum password length condition.
  A. Update the password length policy in the IAM configuration.
  B. Update the password length policy in the Amazon Cognito configuration.

  ---

  Explanation

  discovers user passwords required minimum makes Update the password length policy in the Amazon Cognito configuration, plus Update the password length policy in the on-premises Active Directory configuration, the strongest match, because required minimum length identity providers asks for a managed AWS capability and the design remains easier to govern across the environment. required minimum length identity providers depends on Update the password length policy in the Amazon Cognito configuration, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. identity providers IdPs Access Management is reinforced by A security engineer discovers that a company ' s user passwords have no required, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  Identity Access Management IAM federated also supports Update the password length policy in the on- premises Active Directory configuration,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. IAM federated premises Active Directory would be weaker with Update the password length policy in the IAM configuration,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. Active Directory Cognito user pools separates Create an SCP in AWS Organizations to enforce minimum password length, and Create an IAM policy with a minimum password length condition, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. user pools contain database Cloud points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 175:

  A company has an organization with all features enabled in AWS Organizations. In the management account, the company configures AWS IAM Identity Center for the organization in the eu-west-2 Region.

  The company configures IAM Identity Center with a SAML-based identity provider. The company needs to configure an AWS managed application that integrates with IAM Identity Center in a new AWS account in the us-east-1 Region. Most of the users that will authenticate to the AWS managed application are external third-party users who cannot be added to the company's identity provider.

  A security engineer needs to configure authentication for the third-party users. The solution must provide isolation from the company's identity provider.

  Which solution will meet these requirements?

  A. Create a SAML identity provider in IAM in the management account that connects to the third-party users' identity provider. Create IAM roles in the management account that allow access to the AWS managed application.
  B. Deploy Amazon Cognito into the new AWS account in us-east-1. Configure an identity pool for a SAML-based identity provider. Configure an IAM role that uses the sts:AssumeRole action to allow access to the AWS managed application from Amazon Cognito.
  C. Enable account instances in IAM Identity Center. Deploy an IAM Identity Center account instance in the new AWS account in us-east-1. Configure the AWS managed application to use the new instance. Configure users in the new account instance directory.
  D. Create a new identity provider for the third-party users. Configure a second identity source in IAM Identity Center in the organization's management account to use the new identity provider. Create a new permission set that gives access to the AWS managed application in the new account.
  A. Create a SAML identity provider in IAM in the management account that connects to the third-party users' identity provider. Create IAM roles in the management account that allow access to the AWS managed application.

  ---

  Explanation

  organization features enabled Organizations management makes Enable account instances in IAM Identity Center, Deploy an IAM Identity Center account instance in the new AWS account in us-east-1, Configure the AWS managed application the strongest match, because Organizations management configures IAM Identity asks for a managed AWS capability and that reduces the need for extra supervisory automation.

  Organizations management configures IAM Identity depends on Enable account instances in IAM Identity Center, Deploy an IAM Identity Center account instance in the new AWS account in us-east-1, Configure the AWS managed application to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. IAM Identity Center organization west is reinforced by A company has an organization with all features enabled in AWS Organizations, In the, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  organization west Region configures IAM also supports Enable account instances in IAM Identity Center, Deploy an IAM Identity Center account instance in the new AWS account in us-east-1, Configure the AWS managed application, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. configures IAM Identity Center SAML would be weaker with Create a SAML identity provider in IAM in the management account that connects to the third-party users' identity provider, Create IAM roles in the management account, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. Center SAML based identity provider separates Deploy Amazon Cognito into the new AWS account in us-east-1, Configure an identity pool for a SAML-based identity provider, Configure an IAM role that uses the and Create a new identity provider for the third-party users, Configure a second identity source in IAM Identity Center in the organization's management account to use the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. identity provider managed application integrates points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 176:

  A security engineer is asked to update an AWS CloudTrail log file prefix for an existing trail.

  When attempting to save the change in the CloudTrail console, the security engineer receives the following error message: "There is a problem with the bucket policy."

  What will enable the security engineer to save the change?

  A. Create a new trail with the updated log file prefix, and then delete the original trail.
  B. Update the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform PutBucketPolicy, and then update the log file prefix in the CloudTrail console.
  C. Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail console.
  D. Update the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform GetBucketPolicy, and then update the log file prefix in the CloudTrail console.
  A. Create a new trail with the updated log file prefix, and then delete the original trail.

  ---

  Explanation

  asked update CloudTrail log file makes Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail the strongest match, because log file prefix trail attempting asks for a managed AWS capability and the design remains easier to govern across the environment. log file prefix trail attempting depends on Update the existing bucket policy in the Amazon

  S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. trail attempting save change CloudTrail is reinforced by A security engineer is asked to update an AWS CloudTrail log file prefix for, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  change CloudTrail console receives error also supports Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. receives error message There problem would be weaker with Create a new trail with the updated log file prefix, and then delete the original trail,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. There problem bucket policy What separates Update the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform PutBucketPolicy, and then update the log file prefix and Update the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform GetBucketPolicy, and then update the log file prefix from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. policy.

  What enable save change points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 177:

  A company runs an online game on AWS. When players sign up for the game, their username and password credentials are stored in an Amazon Aurora database.

  The number of users has grown to hundreds of thousands of players. The number of requests for password resets and login assistance has become a burden for the company ' s customer service team.

  The company needs to implement a solution to give players another way to log in to the game. The solution must remove the burden of password resets and login assistance while securely protecting each player ' s credentials.

  Which solution will meet these requirements?

  A. When a new player signs up, use an AWS Lambda function to automatically create an IAM access key and a secret access key.
  B. Migrate the player credentials from the Aurora database to AWS Secrets Manager.
  C. Configure Amazon Cognito user pools to federate access to the game with third-party identity providers (IdPs), such as social IdPs. Migrate the game ' s authentication mechanism to Cognito.
  D. Issue API keys to new and existing players and use Amazon API Gateway for authentication.
  A. When a new player signs up, use an AWS Lambda function to automatically create an IAM access key and a secret access key.

  ---

  Explanation

  runs online game players sign makes Configure Amazon Cognito user pools to federate access to the game with third-party identity providers (IdPs), such as social IdPs, Migrate the game ' s authentication the strongest match, because players sign game their username asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. players sign game their username depends on Configure Amazon Cognito user pools to federate access to the game with third-party identity providers (IdPs), such as social IdPs, Migrate the game ' s authentication to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. their username password credentials stored is reinforced by A company runs an online game on AWS, When players sign up for the, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  credentials stored Aurora database number also supports Configure Amazon Cognito user pools to federate access to the game with third-party identity providers (IdPs), such as social IdPs, Migrate the game ' s authentication, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. database number users grown hundreds would be weaker with When a new player signs up, use an AWS Lambda function to automatically create an IAM access key and a secret access key,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. grown hundreds thousands players number separates Migrate the player credentials from the Aurora database to AWS Secrets Manager, and Issue API keys to new and existing players and use Amazon API Gateway for authentication, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. players number requests password resets points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 178:

  A compliance policy forbids inbound SSH and RDP ports on production instances. Administrators still need occasional command-line access, session logging, and IAM-based authorization.

  A. Use a bastion host with a shared SSH key and rotate the key monthly.
  B. Open SSH only from the corporate office CIDR block and disable session recording.
  C. Use AWS Systems Manager Session Manager with an instance profile and IAM permissions for approved administrators.
  D. Store administrator passwords in instance user data and require manual approval before login.
  A. Use a bastion host with a shared SSH key and rotate the key monthly.

  ---

  Explanation

  compliance policy forbids inbound SSH makes Use AWS Systems Manager Session Manager with an instance profile and IAM permissions for approved administrators, the strongest match, because inbound SSH RDP ports production asks for a managed AWS capability and the design remains easier to govern across the environment. inbound SSH RDP ports production depends on Use AWS Systems Manager Session Manager with an instance profile and IAM permissions for approved administrators, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. ports production instances Administrators still is reinforced by A compliance policy forbids inbound SSH and RDP ports on production instances, Administrators still, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  Administrators still need occasional command also supports Use AWS Systems Manager Session Manager with an instance profile and IAM permissions for approved administrators,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. occasional command line access session would be weaker with Use a bastion host with a shared SSH key and rotate the key monthly,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. access session logging IAM based separates Open SSH only from the corporate office CIDR block and disable session recording, and Store administrator passwords in instance user data and require manual approval

  before login, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. IAM based authorization Systems Manager points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 179:

  A company uses Amazon API Gateway to present REST APIs to users. An API developer wants to analyze API access patterns without the need to parse the log files.

  Which combination of steps will meet these requirements with the LEAST effort? (Select TWO.)

  A. Configure access logging for the required API stage.
  B. Configure an AWS CloudTrail trail destination for API Gateway events. Configure filters on the userIdentity, userAgent, and sourceIPAddress fields.
  C. Configure an Amazon S3 destination for API Gateway logs. Run Amazon Athena queries to analyze API access information.
  D. Use Amazon CloudWatch Logs Insights to analyze API access information.
  E. Select the Enable Detailed CloudWatch Metrics option on the required API stage.
  A. Configure access logging for the required API stage.
  B. Configure an AWS CloudTrail trail destination for API Gateway events. Configure filters on the userIdentity, userAgent, and sourceIPAddress fields.

  ---

  Explanation

  API Gateway present REST APIs makes Use Amazon CloudWatch Logs Insights to analyze API access information, plus Select the Enable Detailed CloudWatch Metrics option on the required API stage, the strongest match, because REST APIs users API developer asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. REST APIs users API developer depends on Use Amazon CloudWatch Logs Insights to analyze API access information, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. API developer wants analyze access is reinforced by A company uses Amazon API Gateway to present REST APIs to users, An API, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  analyze API access patterns without also supports Select the Enable Detailed CloudWatch Metrics option on the required API stage,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. patterns without need parse log would be weaker with Configure access logging for the required API stage,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. parse log files combination steps separates Configure an AWS CloudTrail trail destination for API Gateway events, Configure filters on the userIdentity, userAgent, and sourceIPAddress fields, and Configure an Amazon S3 destination for API Gateway logs, Run Amazon Athena queries to analyze API access information, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. combination steps requirements effort CloudWatch points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 180:

  A company runs ECS services behind an internet-facing ALB that is the origin for CloudFront. An AWS WAF web ACL is associated with CloudFront, but clients can bypass it by accessing the ALB directly.

  Which solution will prevent direct access to the ALB?

  A. Use AWS PrivateLink with the ALB.
  B. Replace the ALB with an internal ALB.
  C. Restrict ALB listener rules to CloudFront IP ranges.
  D. Require a custom header from CloudFront and validate it at the ALB.
  A. Use AWS PrivateLink with the ALB.

  ---

  Explanation

  runs ECS behind internet facing makes Require a custom header from CloudFront and validate it at the ALB, the strongest match, because internet facing ALB origin CloudFront asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. internet facing ALB origin CloudFront depends on Require a custom header from CloudFront and validate it at the ALB, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. origin CloudFront WAF web ACL is reinforced by A company runs ECS services behind an internet-facing ALB that is the origin for, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  web ACL associated CloudFront but also supports Require a custom header from CloudFront and validate it at the ALB,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. CloudFront but clients bypass accessing would be weaker with Use AWS PrivateLink with the ALB,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. bypass accessing ALB directly prevent separates Replace the ALB with an internal ALB, and Restrict ALB listener rules to CloudFront IP ranges, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. directly prevent direct access ALB points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.