Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 181:

  A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB).

  The website is experiencing a global DDoS attack from a specific IoT device brand that uses a unique user agent. A security engineer is creating an AWS WAF web ACL and will associate it with the ALB.

  Which rule statement will mitigate the current attack and future attacks from these IoT devices without blocking legitimate customers?

  A. Use an IP set match rule statement.
  B. Use a geographic match rule statement.
  C. Use a rate-based rule statement.
  D. Use a string match rule statement on the user agent.
  A. Use an IP set match rule statement.

  ---

  Explanation

  hosts public website EC2 instances makes Use a string match rule statement on the user agent, the strongest match, because EC2 instances behind Application Load asks for a managed AWS capability and that reduces the need for extra supervisory automation. EC2 instances behind Application Load depends on Use a string match rule statement on the user agent, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. Application Load Balancer ALB website is reinforced by A company hosts its public website on Amazon EC2 instances behind an Application Load, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  ALB website experiencing global DDoS also supports Use a string match rule statement on the user agent,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. global DDoS attack specific IoT would be weaker with Use an IP set match rule statement,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. specific IoT device brand unique separates Use a geographic match rule statement, and Use a rate-based rule statement, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. brand unique user agent creating points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 182:

  A company's platform has grown rapidly over the past 6 months. The company's platform architecture evolved quickly to accommodate the growth. The company's development team has been deploying features quickly by using different AWS services. The development team has not performed formal architecture reviews.

  The company needs to evaluate its security posture against AWS security best practices.

  Which solution will meet these requirements?

  A. Create a new workload in the AWS Well-Architected Tool. Work with the development team to answer security questions based on the team's current state. Use the save milestone feature to track improvements against identified high-risk items.
  B. Use the cost recommendations in AWS Cost Explorer. Analyze the cost implications of security misconfigurations. Prioritize architectural changes based on potential cost savings as a result of implementing AWS security best practices.
  C. Enable AWS Security Hub CSPM. Create a Security Hub CSPM automation rule to map existing services to approved architecture patterns. Use the data to identify non-compliance against AWS bestpractices and generate a compliance report.
  D. Enable Amazon Detective. Create a Detective investigation for AWS security best practices. Use a behavior graph to visualize the data. Analyze the entities to identify architectural components that do not follow AWS security best practices.
  A. Create a new workload in the AWS Well-Architected Tool. Work with the development team to answer security questions based on the team's current state. Use the save milestone feature to track improvements against identified high-risk items.

  ---

  Explanation

  platform grown rapidly over past makes Create a new workload in the AWS Well-Architected Tool, Work with the development team to answer security questions based on the team's current state, Use the the strongest match, because over past months platform architecture asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. over past months platform architecture depends on Create a new workload in the AWS Well-Architected Tool, Work with the development team to answer security questions based on the team's current state, Use the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. platform architecture evolved quickly accommodate is reinforced by A company's platform has grown rapidly over the past 6 months, The company's platform, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  quickly accommodate growth development team also supports Create a new workload in the AWS Well-Architected Tool, Work with the development team to answer security questions based on the team's current state, Use the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. development team been deploying features would be weaker with Use the cost recommendations in AWS Cost Explorer, Analyze the cost implications of security misconfigurations, Prioritize architectural changes based on potential cost savings as a result, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. deploying features quickly different development separates Enable AWS Security Hub CSPM, Create a Security Hub CSPM automation rule to map existing services to approved architecture patterns, Use the data to identify non-compliance and Enable Amazon Detective, Create a Detective investigation for AWS security best practices, Use a behavior graph to visualize the data, Analyze the entities to identify architectural from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. different development team performed formal points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 183:

  A company has configured an organization in AWS Organizations for its AWS accounts. AWS CloudTrail is enabled in all AWS Regions.

  A security engineer must implement a solution toprevent CloudTrail from being disabled.

  Which solution will meet this requirement?

  A. Enable CloudTrail log file integrity validation from the organization ' s management account.
  B. Enable server-side encryption with AWS KMS keys (SSE-KMS) for CloudTrail logs. Create a KMS key. Attach a policy to the key to prevent decryption of the logs.
  C. Create a service control policy (SCP) that includes an explicitDenyrule for the cloudtrail:StopLogging action and the cloudtrail:DeleteTrail action. Attach the SCP to the root OU.
  D. Create IAM policies for all the company ' s users to prevent the users from performing the DescribeTrails action and the GetTrailStatus action.
  A. Enable CloudTrail log file integrity validation from the organization ' s management account.

  ---

  Explanation

  configured organization Organizations CloudTrail enabled makes Create a service control policy (SCP) that includes an explicitDenyrule for the cloudtrail, StopLogging action and the cloudtrail, DeleteTrail action, Attach the SCP to the root the strongest match, because CloudTrail enabled Regions implement toprevent asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. CloudTrail enabled Regions implement toprevent depends on Create a service control policy (SCP) that includes an explicitDenyrule for the cloudtrail, StopLogging action and the cloudtrail, DeleteTrail

  action, Attach the SCP to the root to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. implement toprevent CloudTrail being disabled is reinforced by A company has configured an organization in AWS Organizations for its AWS accounts, AWS, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  being disabled requirement control policy also supports Create a service control policy (SCP) that includes an explicitDenyrule for the cloudtrail, StopLogging action and the cloudtrail, DeleteTrail action, Attach the SCP to the root, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated

  AWS boundary. control policy SCP includes explicitDenyrule would be weaker with Enable CloudTrail log file integrity validation from the organization ' s management account,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. includes explicitDenyrule cloudtrail StopLogging action separates Enable server-side encryption with AWS KMS keys (SSE-KMS) for CloudTrail logs, Create a KMS key, Attach a policy to the key to prevent decryption of the and Create IAM policies for all the company ' s users to prevent the users from performing the DescribeTrails action and the GetTrailStatus action, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. StopLogging action cloudtrail DeleteTrail Attach points to a design with clearer responsibility, cleaner operations, and

  better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 184:

  A company has a compliance requirement to encrypt all data in transit. The company recently discovered an Amazon Aurora cluster that does not meet this requirement.

  How can the company enforce encryption for all connections to the Aurora cluster?

  A. In the Aurora cluster configuration, set therequire_secure_transportDB cluster parameter toON.
  B. Use AWS Directory Service for Microsoft Active Directory to create a user directory and to enforce Kerberos authentication with Aurora.
  C. Configure the Aurora cluster to use AWS Certificate Manager (ACM) to provide encryption certificates.
  D. Create an Amazon RDS proxy. Connect the proxy to the Aurora cluster to enable encryption.
  A. In the Aurora cluster configuration, set therequire_secure_transportDB cluster parameter toON.

  ---

  Explanation

  compliance requirement encrypt data transit makes In the Aurora cluster configuration, set therequire_secure_transportDB cluster parameter toON, the strongest match, because data transit recently discovered Aurora asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. data transit recently discovered Aurora depends on In the Aurora cluster configuration, set therequire_secure_transportDB cluster parameter toON, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. discovered Aurora cluster does requirement is reinforced by A company has a compliance requirement to encrypt all data in transit, The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  does requirement enforce encryption connections also supports In the Aurora cluster configuration, set therequire_secure_transportDB cluster parameter toON,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. encryption connections Aurora cluster configuration would be weaker with Use AWS Directory Service for Microsoft Active Directory to create a user directory and to enforce Kerberos authentication with Aurora,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. cluster Aurora configuration set therequire separates

  Configure the Aurora cluster to use AWS Certificate Manager (ACM) to provide encryption certificates, and Create an Amazon RDS proxy, Connect the proxy to the Aurora cluster to enable encryption, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. configuration set therequire secure transportDB points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 185:

  An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connect to the website during the attack period. The ecommerce company ' s security team is worried about future potential attacks and wants to prepare for such events. The company needs to minimize downtime in its response to similar attacks in the future.

  Which steps would help achieve this? (Select TWO.)

  A. Enable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
  B. Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack.
  C. Use VPC Flow Logs to monitor network traffic and an AWS Lambda function to automatically block an attacker's IP using security groups.
  D. Set up an Amazon EventBridge rule to monitor the AWS CloudTrail events in real time, use AWS Config rules to audit the configuration, and use AWS Systems Manager for remediation.
  E. Use AWS WAF to create rules to respond to such attacks.
  A. Enable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
  B. Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack.

  ---

  Explanation

  ecommerce website was down hour makes Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack, plus Use AWS WAF to create rules to respond to such attacks, the strongest match, because down hour DDoS attack Users asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. down hour DDoS attack Users depends on Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. attack Users were unable connect is reinforced by An ecommerce website was down for 1 hour following a DDoS attack, Users were, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  unable connect website during attack also supports Use AWS WAF to create rules to respond to such attacks,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. during attack period ecommerce team would be weaker with Enable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. ecommerce team worried about potential separates Use VPC Flow Logs to monitor network traffic and an AWS Lambda function to automatically block an attacker's IP using security groups, and Set up an Amazon EventBridge rule to monitor the AWS CloudTrail events in real time, use AWS Config rules to audit the configuration, and use AWS from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. about potential attacks wants prepare points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 186:

  A company runs a web application on a fleet of Amazon EC2 instances that are in an Auto Scaling group.

  The EC2 instances are in the same VPC subnet as other workloads.

  A security engineer deploys Amazon GuardDuty and integrates it with AWS Security Hub. The security engineer needs to implement anautomated solutionto detect and respond to anomalous traffic patterns.

  The solution must follow AWS best practices forinitial incident responseand mustminimize disruptionto the web application.

  Which solution will meet these requirements?

  A. Disable the instance profile access keys by using AWS Lambda.
  B. Remove the affected instance from the Auto Scaling group and isolate it with a restricted security group by using AWS Lambda.
  C. Update the network ACL to block the detected traffic source.
  D. Send GuardDuty findings to Amazon SNS for email notification.
  A. Disable the instance profile access keys by using AWS Lambda.

  ---

  Explanation

  runs web application fleet EC2 makes Remove the affected instance from the Auto Scaling group and isolate it with a restricted security group by using AWS Lambda, the strongest match, because fleet EC2 instances Auto Scaling asks for a managed AWS capability while keeping the service responsibility clear for operations teams. fleet EC2 instances Auto Scaling depends on Remove the affected instance from the Auto Scaling group and isolate it with a restricted security group by using AWS Lambda, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. Auto Scaling group EC2 instances is reinforced by A company runs a web application on a fleet of Amazon EC2 instances that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  EC2 instances same VPC subnet also supports Remove the affected instance from the Auto Scaling group and isolate it with a restricted security group by using AWS Lambda,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. VPC subnet other workloads deploys would be weaker with Disable the instance profile access keys by using AWS Lambda,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. workloads deploys GuardDuty integrates Hub separates Update the network ACL to block the detected traffic source, and Send GuardDuty findings to Amazon SNS for email notification, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. integrates Hub implement anautomated solutionto points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 187:

  A company is developing an application that runs across a combination of Amazon EC2 On-Demand Instances and Spot Instances. A security engineer needs to provide a logging solution that makes logs for all instances available from a single location. The solution must allow only a specific set of users to analyze the logs for event patterns. The users must be able to use SQL queries on the logs to perform root cause analysis.

  Which solution will meet these requirements?

  A. Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group. Allow only specific users to access the log group. Use CloudWatch Logs Insights to query the log group.
  B. Configure the EC2 instances to send application logs to a single Amazon S3 bucket. Allow only specific users to access the S3 bucket. Use Amazon CloudWatch Logs Insights to query the log files in the S3 bucket.
  C. Configure each EC2 instance to send its application logs to its own specific Amazon CloudWatch Logs log group. Allow only specific users to access the log groups. Use Amazon Athena to query all the log groups.
  D. Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group. Grant Amazon Detective access to the log group. Allow only specific users to use Detective to analyze the logs.
  A. Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group. Allow only specific users to access the log group. Use CloudWatch Logs Insights to query the log group.

  ---

  Explanation

  developing application runs combination EC2 makes Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group, Allow only specific users to access the log group, Use the strongest match, because combination EC2 Demand Instances Spot asks for a managed AWS capability which is important when security controls must be repeatable. combination EC2 Demand Instances Spot depends on Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group, Allow only specific users to access the log group, Use to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. Instances Spot provide logging makes is reinforced by A company is developing an application that runs across a combination of Amazon EC2, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  provide logging makes logs instances also supports Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group, Allow only specific users to access the log group, Use, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. logs instances available single location would be weaker with Configure the EC2 instances to send application logs to a single Amazon S3 bucket, Allow only specific users to access the S3 bucket, Use Amazon CloudWatch, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. single location allow only specific separates Configure each EC2 instance to send its application logs to its own specific Amazon CloudWatch Logs log group, Allow only specific users to access the log and Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group, Grant Amazon Detective access to the log group, Allow only from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. only specific set users analyze points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 188:

  A workload runs in private subnets with no route to the internet. The application must read objects from Amazon S3 and call AWS KMS without using public internet paths. The design must preserve private connectivity for both services.

  Which combination of changes should the security engineer make? Choose two.

  A. Create a gateway VPC endpoint for Amazon S3 and associate it with the private subnet route tables.
  B. Create an interface VPC endpoint for AWS KMS and enable private DNS.
  C. Add an internet gateway to the VPC and keep the instances in the private subnets.
  D. Route all service traffic through a NAT gateway in a public subnet.
  E. Add inbound rules from the AWS public IP ranges to the instance security group.
  A. Create a gateway VPC endpoint for Amazon S3 and associate it with the private subnet route tables.
  B. Create an interface VPC endpoint for AWS KMS and enable private DNS.

  ---

  Explanation

  workload runs private subnets route makes Create a gateway VPC endpoint for Amazon S3 and associate it with the private subnet route tables, plus Create an interface VPC endpoint for AWS KMS and enable private DNS, the strongest match, because subnets route internet application read asks for a managed AWS capability while keeping the service responsibility clear for operations teams. subnets route internet application read depends on Create a gateway VPC endpoint for Amazon S3 and associate it with the private subnet route tables, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. application read objects call KMS is reinforced by A workload runs in private subnets with no route to the internet, The application, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  call KMS without public internet also supports Create an interface VPC endpoint for AWS KMS and enable private DNS,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. public internet paths design preserve would be weaker with Add an internet gateway to the VPC and keep the instances in the private subnets,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. design preserve private connectivity both separates Route all service traffic through a NAT gateway in a public subnet, and Add inbound rules from the AWS public IP ranges to the instance security group, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. connectivity both combination changes should points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 189:

  A company recently experienced a malicious attack on its cloud-based environment. The company successfully contained and eradicated the attack. A security engineer is performing incident response work.

  The security engineer needs to recover an Amazon RDS database cluster to the last known good version.

  The database cluster is configured to generate automated backups with a retention period of 14 days. The initial attack occurred 5 days ago at exactly 3:15 PM.

  Which solution will meet this requirement?

  A. Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the restore to point in time feature. Set a target time 5 days ago at 3:14 PM.
  B. Identify the Regional cluster ARN for the database. List snapshots that have been taken of the cluster. Restore the database by using the snapshot that has a creation time that is closest to 5 days ago at 3:14 PM.
  C. List all snapshots that have been taken of all the company ' s RDS databases. Identify the snapshot that was taken closest to 5 days ago at 3:14 PM and restore it.
  D. Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the restore to point in time feature. Set a target time 14 days ago.
  A. Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the restore to point in time feature. Set a target time 5 days ago at 3:14 PM.

  ---

  Explanation

  recently experienced malicious attack cloud makes Identify the Regional cluster ARN for the database, Use the ARN to restore the Regional cluster by using the restore to point in time feature, Set the strongest match, because attack cloud based environment successfully asks for a managed AWS capability while keeping the service responsibility clear for operations teams. attack cloud based environment successfully depends on Identify the Regional cluster ARN for the database, Use the ARN to restore the Regional cluster by using the restore to point in time feature, Set to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. environment successfully contained eradicated attack is reinforced by A company recently experienced a malicious attack on its cloud-based environment, The company successfully, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  eradicated attack performing incident response also supports Identify the Regional cluster ARN for the database, Use the ARN to restore the Regional cluster by using the restore to point in time feature, Set, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. incident response work recover RDS would be weaker with Identify the Regional cluster ARN for the database, List snapshots that have been taken of the cluster, Restore the database by using the snapshot that has, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. recover RDS database cluster last separates List all snapshots that have been taken of all the company ' s RDS databases, Identify the snapshot that was taken closest to 5 days ago and Identify the Regional cluster ARN for the database, Use the ARN to restore the Regional cluster by using the restore to point in time feature, Set from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. cluster last known good version points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 190:

  A security engineer uses Amazon Macie to scan a company ' s Amazon S3 buckets for sensitive data. The company has many S3 buckets and many objects stored in the S3 buckets. The security engineer must identify S3 buckets that contain sensitive data and must perform additional scanning on those S3 buckets.

  Which solution will meet these requirements with the LEAST administrative overhead?

  A. Configure S3 Cross-Region Replication (CRR) on the S3 buckets to replicate the objects to a second AWS Region. Configure Macie in the second Region to scan the replicated objects daily.
  B. Create an AWS Lambda function as an S3 event destination for the S3 buckets. Configure the Lambda function to start a Macie scan of an object when the object is uploaded to an S3 bucket.
  C. Configure Macie automated discovery to continuously sample data from the S3 buckets. Perform full scans of the S3 buckets where Macie discovers sensitive data.
  D. Configure Macie scans to run on the S3 buckets. Aggregate the results of the scans in an Amazon DynamoDB table. Use the DynamoDB table for queries.
  A. Configure S3 Cross-Region Replication (CRR) on the S3 buckets to replicate the objects to a second AWS Region. Configure Macie in the second Region to scan the replicated objects daily.

  ---

  Explanation

  Macie scan buckets sensitive data makes Configure Macie automated discovery to continuously sample data from the S3 buckets, Perform full scans of the S3 buckets where Macie discovers sensitive data, the strongest match, because sensitive data many buckets objects asks for a managed AWS capability which is important when security controls must be repeatable. sensitive data many buckets objects depends on Configure Macie automated discovery to continuously sample data from the S3 buckets, Perform full scans of the S3 buckets where Macie discovers sensitive data, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. buckets many objects stored identify is reinforced by A security engineer uses Amazon Macie to scan a company ' s Amazon S3, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  stored buckets identify contain sensitive also supports Configure Macie automated discovery to continuously sample data from the S3 buckets, Perform full scans of the S3 buckets where Macie discovers sensitive data,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. buckets contain sensitive data perform would be weaker with Configure S3 Cross-Region Replication (CRR) on the S3 buckets to replicate the objects to a second AWS Region, Configure Macie in the second Region to scan, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. data perform additional scanning those separates Create an AWS Lambda function as an S3 event destination for the S3 buckets, Configure the Lambda function to start a Macie scan of an object and Configure Macie scans to run on the S3 buckets, Aggregate the results of the scans in an Amazon DynamoDB table, Use the DynamoDB table for queries, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. scanning those buckets requirements administrative points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.