Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 11:

  A company needs to develop a code-signing application that will use a certificate authority (CA) to sign a code-signing certificate. The solution must use an AWS KMS asymmetric key. The solution needs to collect and store immutable evidence about the creation, origin, and use of the KMS key for compliance purposes.

  This information must be made available to internal auditors.

  Which solution meets these requirements?

  A. Create an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrail trail with an event selector and log file validation enabled for all kms.amazonaws.com CreateKey events. Configure the event selector to send the CreateKey events to the S3 bucket. Create the KMS key. Update the event selector to filter for API calls that reference the KMS key ARN. Provide the auditors with access to the S3 bucket.
  B. Implement logging for application operations that reference the KMS key. Ensure that the logs contain allassociated metadata. Store the logs in an Amazon CloudWatch Logs log group. Configure an automated export of the log group. Send the export to the auditors.
  C. Create an Amazon DynamoDB table that the auditors can access. Create an AWS Lambda function that an Amazon EventBridge rule invokes. Configure the EventBridge rule to monitor KMS API calls. Configure the EventBridge rule to filter for all API calls that reference the KMS key ARN. Configure the Lambda function to store the contents of the API calls in the DynamoDB table.
  D. Set up Amazon CloudWatch Logs Insights with a custom metric to track KMS key usage. Visualize the metrics by using a CloudWatch dashboard with real-time monitoring. Configure CloudWatch alarms. Use a subscription filter to replicate the data to a separate account for the auditors to review.
  A. Create an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrail trail with an event selector and log file validation enabled for all kms.amazonaws.com CreateKey events. Configure the event selector to send the CreateKey events to the S3 bucket. Create the KMS key. Update the event selector to filter for API calls that reference the KMS key ARN. Provide the auditors with access to the S3 bucket.

  ---

  Explanation

  develop code signing application certificate makes Create an Amazon S3 bucket with S3 Object Lock enabled, Create an AWS CloudTrail trail with an event selector and log file validation enabled for all the strongest match, because application certificate authority sign code asks for a managed AWS capability and that reduces the need for extra supervisory automation. application certificate authority sign code depends on Create an Amazon S3 bucket with S3 Object Lock enabled, Create an AWS CloudTrail trail with an event selector and log file validation enabled for all to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. sign code signing certificate KMS is reinforced by A company needs to develop a code-signing application that will use a certificate authority, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  certificate KMS asymmetric key collect also supports Create an Amazon S3 bucket with S3 Object Lock enabled, Create an AWS CloudTrail trail with an event selector and log file validation enabled for all, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. key collect store immutable evidence would be weaker with Implement logging for application operations that reference the KMS key, Ensure that the logs contain all associated metadata, Store the logs in an Amazon CloudWatch Logs, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. immutable evidence about creation origin separates Create an Amazon DynamoDB table that the auditors can access, Create an AWS Lambda function that an Amazon EventBridge rule invokes, Configure the EventBridge rule to and Set up

  Amazon CloudWatch Logs Insights with a custom metric to track KMS key usage, Visualize the metrics by using a CloudWatch dashboard with real-time monitoring, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. creation origin KMS key compliance points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 12:

  A company needs to deploy AWS CloudFormation templates that configure sensitive database credentials.

  The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager.

  Which solution will meet the requirements?

  A. Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.
  B. Use encrypted parameters in the CloudFormation template.
  C. Use SecureString parameters to reference Secrets Manager.
  D. Use SecureString parameters encrypted by AWS KMS.
  A. Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.

  ---

  Explanation

  deploy CloudFormation templates sensitive database makes Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager, the strongest match, because sensitive database credentials already Key asks for a managed AWS capability and the design remains easier to govern across the environment. sensitive database credentials already Key depends on Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. already Key Management KMS Secrets is reinforced by A company needs to deploy AWS CloudFormation templates that configure sensitive database credentials, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  KMS Secrets Manager requirements dynamic also supports Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. requirements dynamic reference CloudFormation template would be weaker with Use encrypted parameters in the CloudFormation template,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams.

  CloudFormation template reference database credentials separates Use SecureString parameters to reference Secrets Manager, and Use SecureString parameters encrypted by AWS KMS, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. database credentials Secrets Manager encrypted points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 13:

  A security engineer needs to implement a solution to identify any sensitive data that is stored in an Amazon

  S3 bucket. The solution must report on sensitive data in the S3 bucket by using an existing Amazon Simple Notification Service (Amazon SNS) topic.

  Which solution will meet these requirements with the LEAST implementation effort?

  A. Enable AWS Config. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.
  B. Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern. Program the Lambda function to send notifications to the SNS topic.
  C. Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data. Create an Amazon EventBridge rule to send notifications to the SNS topic.
  D. Enable Amazon GuardDuty. Configure AWS CloudTrail S3 data events. Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic.
  A. Enable AWS Config. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.

  ---

  Explanation

  implement identify any sensitive data makes Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data, Create an Amazon EventBridge rule to send notifications to the SNS topic, the strongest match, because sensitive data stored bucket report asks for a managed AWS capability which is important when security controls must be repeatable. sensitive data stored bucket report depends on Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data, Create an Amazon EventBridge rule to send notifications to the SNS topic, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. bucket report sensitive data Simple is reinforced by A security engineer needs to implement a solution to identify any sensitive data that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  data bucket Simple Notification SNS also supports Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data, Create an Amazon EventBridge rule to send notifications to the SNS topic,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. Notification SNS topic requirements implementation would be weaker with Enable AWS Config, Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS

  topic,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. requirements implementation effort Macie managed separates Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern, Program the Lambda function to send notifications to the and Enable Amazon GuardDuty, Configure AWS CloudTrail S3 data events, Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. Macie managed data identifiers identify points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 14:

  A company needs to identify the root cause of security findings and investigate IAM roles involved in those findings. The company has enabled VPC Flow Logs, Amazon GuardDuty, and AWS CloudTrail.

  Which solution will meet these requirements?

  A. Use Amazon Detective to investigate IAM roles and visualize findings.
  B. Use Amazon Inspector and CloudWatch dashboards.
  C. Export GuardDuty findings to S3 and analyze with Athena.
  D. Use Security Hub custom actions to investigate IAM roles.
  A. Use Amazon Detective to investigate IAM roles and visualize findings.

  ---

  Explanation

  identify root cause findings investigate makes Use Amazon Detective to investigate IAM roles and visualize findings, the strongest match, because findings investigate IAM roles involved asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. findings investigate IAM roles involved depends on Use Amazon Detective to investigate IAM roles and visualize findings, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. roles involved those findings enabled is reinforced by A company needs to identify the root cause of security findings and investigate IAM, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  findings enabled VPC Flow Logs also supports Use Amazon Detective to investigate IAM roles and visualize findings,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation.

  Flow Logs GuardDuty CloudTrail requirements would be weaker with Use Amazon Inspector and CloudWatch dashboards,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary.

  CloudTrail requirements Detective investigate IAM separates Export GuardDuty findings to S3 and analyze with Athena, and Use Security Hub custom actions to investigate IAM roles, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. investigate IAM roles visualize findings points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 15:

  A company is using Amazon Elastic Container Service (Amazon ECS) to deploy an application that deals with sensitive data. During a recent security audit, the company identified a security issue in which Amazon RDS credentials were stored with the application code in the company ' s source code repository. A security engineer needs to develop a solution to ensure that database credentials are stored securely and rotated periodically. The credentials should be accessible to the application only. The engineer also needs to prevent database administrators from sharing database credentials as plaintext with other teammates.

  The solution must also minimize administrative overhead.

  Which solution meets these requirements?

  A. Use the AWS Systems Manager Parameter Store to generate database credentials. Use an IAM profile for ECS tasks to restrict access to database credentials to specific containers only.
  B. Use AWS Secrets Manager to store database credentials. Use an IAM inline policy for ECS tasks to restrict access to database credentials to specific containers only.
  C. Use the AWS Systems Manager Parameter Store to store database credentials. Use IAM roles for ECS tasks to restrict access to database credentials to specific containers only.
  D. Use AWS Secrets Manager to store database credentials. Use IAM roles for ECS tasks to restrict access to database credentials to specific containers only.
  A. Use the AWS Systems Manager Parameter Store to generate database credentials. Use an IAM profile for ECS tasks to restrict access to database credentials to specific containers only.

  ---

  Explanation

  Elastic Container ECS deploy application makes Use AWS Secrets Manager to store database credentials, Use IAM roles for ECS tasks to restrict access to database credentials to specific containers only, the strongest match, because deploy application deals sensitive data asks for a managed AWS capability and that reduces the need for extra supervisory automation. deploy application deals sensitive data depends on Use AWS Secrets Manager to store database credentials, Use IAM roles for ECS tasks to restrict access to database credentials to specific containers only, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. sensitive data During recent audit is reinforced by A company is using Amazon Elastic Container Service (Amazon ECS) to deploy an application, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  recent audit identified issue RDS also supports Use AWS Secrets Manager to store database credentials, Use IAM roles for ECS tasks to restrict access to database credentials to specific containers only,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. issue RDS credentials were stored would be weaker with Use the AWS Systems Manager Parameter Store to generate database credentials, Use an IAM profile for ECS tasks to restrict access to database credentials to specific, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. were stored application code source separates Use AWS Secrets Manager to store database credentials, Use an IAM inline policy for ECS tasks to restrict access to database credentials to specific containers only, and Use the AWS Systems Manager Parameter Store to store database credentials, Use IAM roles for ECS tasks to restrict access to database credentials to specific containers from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. code source repository develop ensure points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 16:

  A company runs an application outside of AWS. The external application authenticates to AWS as an IAM user. A security engineer needs to migrate the external application to use an IAM role. The company's human users already use IAM roles with AWS IAM Identity Center.

  Which solution will give the external application the ability to use an IAM role?

  A. Set up the external application as a managed application in IAM Identity Center. Create a new account assignment to generate an IAM role for the external application to use.
  B. Create an AWS Verified Access instance. Set up a trust provider for the external application. Create a Verified Access policy to allow the external application to assume an IAM role.
  C. Use IAM Roles Anywhere. Create a trust anchor and profile on AWS. Set up the credential helper tool in the external application. Configure an IAM role to trust IAM Roles Anywhere.
  D. Enable federation with IAM. Configure SAML 2.0 federation by adding a relying party trust between the external application and AWS. Set up an IAM role for the external application to assume.
  A. Set up the external application as a managed application in IAM Identity Center. Create a new account assignment to generate an IAM role for the external application to use.

  ---

  Explanation

  runs application outside external authenticates makes Use IAM Roles Anywhere, Create a trust anchor and profile on AWS, Set up the credential helper tool in the external application, Configure an IAM role the strongest match, because external application authenticates IAM user asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. external application authenticates IAM user depends on Use IAM Roles Anywhere, Create a trust anchor and profile on AWS, Set up the credential helper tool in the external application, Configure an IAM role to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. IAM user migrate external application is reinforced by A company runs an application outside of AWS, The external application authenticates to AWS, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  external application IAM role human also supports Use IAM Roles Anywhere, Create a trust anchor and profile on AWS, Set up the credential helper tool in the external application, Configure an IAM role, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. role human users already IAM would be weaker with Set up the external application as a managed application in IAM Identity Center, Create a new account assignment to generate an IAM role for the external, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. already IAM roles Identity Center separates Create an AWS Verified Access instance, Set up a trust provider for the external application, Create a Verified Access policy to allow the external application to and Enable federation with IAM, Configure SAML 2, 0 federation by adding a relying party trust between the external application and AWS, Set up an IAM role from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment.

  IAM Identity Center give external points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 17:

  AWS Config cannot deliver configuration snapshots to Amazon S3.

  Which TWO actions will remediate this issue?

  A. Verify the S3 bucket policy allows config.amazonaws.com.
  B. Verify the IAM role has s3:GetBucketAcl and s3:PutObject permissions.
  C. Verify the S3 bucket can assume the IAM role.
  D. Verify IAM policy allows AWS Config to write logs.
  E. Modify AWS Config API permissions.
  A. Verify the S3 bucket policy allows config.amazonaws.com.
  B. Verify the IAM role has s3:GetBucketAcl and s3:PutObject permissions.

  ---

  Explanation

  Config cannot deliver configuration snapshots makes Verify the S3 bucket policy allows config, amazonaws, com, plus Verify the IAM role has s3, GetBucketAcl and s3, PutObject permissions, the strongest match, because configuration snapshots actions remediate issue asks for a managed AWS capability while keeping the service responsibility clear for operations teams. configuration snapshots actions remediate issue depends on Verify the S3 bucket policy allows config, amazonaws, com, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. remediate issue Verify bucket policy is reinforced by AWS Config cannot deliver configuration snapshots to Amazon S3, Which TWO actions will remediate, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  bucket policy allows config amazonaws also supports Verify the IAM role has s3, GetBucketAcl and s3, PutObject permissions,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. config amazonaws com Verify IAM would be weaker with Verify the S3 bucket can assume the IAM role,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. Verify IAM role GetBucketAcl PutObject separates Verify IAM policy allows AWS Config to write logs, and Modify AWS Config API permissions, from the requested outcome, since those choices can help a

  wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. GetBucketAcl PutObject permissions Verify bucket points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 18:

  A company has an organization in AWS Organizations. The company's security team is developing automation to capture Amazon EC2 forensic evidence within any AWS account in the organization. The company has encrypted the Amazon EBS volumes of all the EC2 instances in the organization by default by using the AWS managed key. The automation consists of AWS Lambda functions and AWS Step Functions state machines.

  The automation assumes an IAM role in the target AWS account. The automation takes snapshots of suspicious EC2 instances and assigns permissions to allow the security team's account to copy the snapshots. The security team has an AWS KMS key to encrypt the snapshots. During testing, the automation fails to copy the snapshots into the security team's AWS account.

  Which combination of steps should the security team take so that the automation can capture EC2 forensic evidence in all AWS accounts in the organization? (Select THREE.)

  A. In the target AWS account, update the KMS key policy on the AWS managed key to explicitly allow the kms:Decrypt and kms:CreateGrant actions to the automation's IAM role.
  B. In the target AWS account, create a customer managed KMS key. Update the automation's IAM role to allow the kms:Encrypt, kms:Decrypt, kms:GenerateDataKey*, and kms:CreateGrant actions.
  C. In the security team's AWS account, update the automation's IAM role to allow the kms:Encrypt, kms: Decrypt, and kms:CreateGrant actions for the AWS managed key.
  D. In the security team's AWS account, update the automation's IAM role to allow the kms:Encrypt, kms: Decrypt, kms:GenerateDataKey*, and kms:CreateGrant actions for the customer managed KMS key.
  E. In the security team's AWS account, update the automation code to take EBS snapshots and to use the AWS managed key.
  F. In the security team's AWS account, update the automation code to take EBS snapshots and to use the customer managed KMS key.
  A. In the target AWS account, update the KMS key policy on the AWS managed key to explicitly allow the kms:Decrypt and kms:CreateGrant actions to the automation's IAM role.
  B. In the target AWS account, create a customer managed KMS key. Update the automation's IAM role to allow the kms:Encrypt, kms:Decrypt, kms:GenerateDataKey*, and kms:CreateGrant actions.

  ---

  Explanation

  organization Organizations team developing automation makes In the target AWS account, create a customer managed KMS key, Update the automation's IAM role to allow the kms, Encrypt, kms, Decrypt, kms, GenerateDataKey*, and plus In the security team's AWS account, update the automation's IAM role to allow the kms, Encrypt, kms, Decrypt, kms, GenerateDataKey*, and kms, CreateGrant actions for the plus In the security team's AWS account, update the automation code to take EBS snapshots and to use the customer managed KMS key, the strongest match, because developing automation capture EC2 forensic asks for a managed AWS capability which is important when security controls must be repeatable. developing automation capture EC2 forensic depends on In the target AWS account, create a customer managed KMS key, Update the automation's IAM role to allow the kms, Encrypt, kms, Decrypt, kms, GenerateDataKey*, and to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. EC2 forensic evidence any organization is reinforced by A company has an organization in AWS Organizations, The company's security team is developing, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  any organization encrypted EBS volumes also supports In the security team's AWS account, update the automation's IAM role to allow the kms, Encrypt, kms, Decrypt, kms, GenerateDataKey*, and kms, CreateGrant actions for the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. EBS volumes EC2 instances organization would be weaker with In the target AWS account, update the KMS key policy on the AWS managed key to explicitly allow the kms, Decrypt and kms, CreateGrant actions to, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. instances organization default managed key separates In the security team's AWS account, update the automation's IAM role to allow the kms, Encrypt, kms, Decrypt, and kms, CreateGrant actions for the AWS managed and In the security team's AWS account, update the automation code to take EBS snapshots and to use the AWS managed key, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. managed key automation consists Lambda points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 19:

  A security engineer is designing security controls for a fleet of Amazon EC2 instances that run sensitive workloads in a VPC. The security engineer needs to implement a solution to detect and mitigate software vulnerabilities on the EC2 instances.

  Which solution will meet this requirement?

  A. Scan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager.
  B. Install host-based firewall and antivirus software on each EC2 instance. Use AWS Systems Manager Run Command to update the firewall and antivirus software.
  C. Install the Amazon CloudWatch agent on the EC2 instances. Enable detailed logging. Use Amazon EventBridge to review the software logs for anomalies.
  D. Scan the EC2 instances by using Amazon GuardDuty Malware Protection. Apply security patches and updates by using AWS Systems Manager Patch Manager.
  A. Scan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager.

  ---

  Explanation

  designing controls fleet EC2 instances makes Scan the EC2 instances by using Amazon Inspector, Apply security patches and updates by using AWS Systems Manager Patch Manager, the strongest match, because EC2 instances run sensitive workloads asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. EC2 instances run sensitive workloads depends on Scan the EC2 instances by using Amazon Inspector, Apply security patches and updates by using AWS Systems Manager Patch Manager, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. sensitive workloads VPC implement detect is reinforced by A security engineer is designing security controls for a fleet of Amazon EC2 instances, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  implement detect mitigate software vulnerabilities also supports Scan the EC2 instances by using Amazon Inspector, Apply security patches and updates by using AWS Systems Manager Patch Manager,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. software vulnerabilities EC2 instances requirement would be weaker with Install host-based firewall and antivirus software on each EC2 instance, Use AWS Systems Manager Run Command to update the firewall and antivirus software,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. instances requirement Scan EC2 Inspector separates Install the Amazon CloudWatch agent on the EC2 instances, Enable detailed logging, Use Amazon EventBridge to review the software logs for anomalies, and Scan the EC2 instances by using Amazon GuardDuty Malware Protection, Apply security patches and updates by using AWS Systems Manager Patch Manager, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. EC2 instances Inspector Apply patches points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 20:

  A security engineer for a company needs to design an incident response plan that addresses compromised IAM user account credentials. The company uses an organization in AWS Organizations and AWS IAM Identity Center to manage user access. The company uses a delegated administrator account to implement AWS Security Hub. The delegated administrator account contains an organizational trail in AWS CloudTrail that logs all events to an Amazon S3 bucket. The company has also configured an organizational event data store that captures all events from the trail.

  The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident. The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.

  Which solution will meet these requirements?

  A. Disable the compromised IAM user in the organization management account. Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.
  B. Remove all IAM policies that are attached to the IAM user in the organization management account. Use AWS Security Hub to query the CloudTrail logs for actions that the IAM user performed in the previous 7 days.
  C. Remove any permission sets that are assigned to the IAM user in IAM Identity Center. Use Amazon CloudWatch Logs Insights to query the CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.
  D. Disable the IAM user's access in IAM Identity Center. Use AWS CloudTrail to query the organizational event data store for actions that the IAM user performed in the previous 7 days.
  A. Disable the compromised IAM user in the organization management account. Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.

  ---

  Explanation

  design incident response plan addresses makes Disable the IAM user's access in IAM Identity Center, Use AWS CloudTrail to query the organizational event data store for actions that the IAM user performed the strongest match, because plan addresses compromised IAM user asks for a managed AWS capability and the design remains easier to govern across the environment. plan addresses compromised IAM user depends on Disable the IAM user's access in IAM Identity Center, Use AWS CloudTrail to query the organizational event data store for actions that the IAM user performed to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. IAM user credentials organization Organizations is reinforced by A security engineer for a company needs to design an incident response plan that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  organization Organizations IAM Identity Center also supports Disable the IAM user's access in IAM Identity Center, Use AWS CloudTrail to query the organizational event data store for actions that the IAM user performed, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. Identity Center manage user access would be weaker with Disable the compromised IAM user in the organization management account, Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. user access delegated administrator implement separates Remove all IAM policies that are attached to the IAM user in the organization management account, Use AWS Security Hub to query the CloudTrail logs for and Remove any permission sets that are assigned to the IAM user in IAM Identity Center, Use Amazon CloudWatch Logs Insights to query the CloudTrail logs in from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. administrator implement Hub delegated contains points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.